Flock Safety, the company that provides license plate surveillance to thousands of police departments, accidentally exposed police searches to public search engines. According to 404 Media, the leak revealed what specific license plates officers were looking for and why—information that should never be publicly accessible.
Flock operates automatic license plate readers (ALPRs) that capture every car passing by, building massive databases of vehicle movements. Police departments query these databases to track suspects, investigate crimes, or just see where a particular car has been. It's surveillance infrastructure that operates largely without public oversight.
The leak happened because Flock's search interface was improperly configured, allowing search engines like DuckDuckGo and Bing to index police query pages. Those pages included license plate numbers, timestamps, and sometimes the investigation reason—"domestic violence suspect," "stolen vehicle," etc.
From a security perspective, this is Database 101 stuff. You put authentication in front of sensitive queries. You add robots.txt rules to prevent indexing. You don't let Google crawl law enforcement investigation details. The fact that this happened suggests Flock's security practices are shockingly inadequate given the sensitivity of data they handle.
But the bigger issue is what this reveals about the surveillance ecosystem. Flock now operates in thousands of jurisdictions, many of which adopted the technology without meaningful public debate. Residents often don't know these readers exist in their neighborhoods. And when they do, the oversight mechanisms are minimal.
The company's pitch is compelling: solve more crimes, find stolen vehicles, catch dangerous suspects. All true. ALPRs are effective investigative tools. But they also create comprehensive movement databases for everyone who drives, not just suspects. That's mass surveillance infrastructure, regardless of how it's marketed.
Flock has said the exposure affected a limited number of searches and has been fixed. They're characterizing it as a configuration error rather than a fundamental security failure. From my experience building secure systems, I'm not convinced that distinction matters. The configuration is part of the security model.
What worries me is the proliferation of private surveillance companies with law enforcement contracts but minimal accountability. Flock isn't subject to the same public records requirements as government agencies. When their systems fail, the public learns about it from journalists, not transparency reports.
The exposed searches included everyday queries—officers looking up vehicles in their neighborhoods, ex-partners' cars, probably some fully legitimate investigations. We can't tell which because there's no oversight. That's the problem with building surveillance infrastructure without accountability mechanisms.
Some jurisdictions have banned ALPRs or imposed strict usage policies. Others have embraced them enthusiastically, installing readers on every major road. The decision usually happens at city council meetings with minimal technical understanding of what's being authorized.
From a privacy perspective, comprehensive vehicle tracking is nearly equivalent to personal tracking. Your car's movements reveal where you live, work, worship, protest, seek medical care, and who you associate with. License plate databases capture all of that, indefinitely.
The technology is impressive—the readers work reliably in various weather and lighting conditions. The question is whether we want this level of surveillance infrastructure deployed by private companies with profit motives and apparently inadequate security practices.
Flock's response to this incident will be instructive. Do they undergo independent security audits? Implement better access controls? Face any regulatory consequences? Or does this become another data breach that gets a brief news cycle then forgotten?
