A roadside camera misreads a "7" as a "2." Minutes later, a driver is pulled over at gunpoint. That is not a thought experiment. It is what happened in Toledo, Ohio, when a Flock Safety automated license plate reader flagged Brandon Upchurch's plate.
Now scale that failure mode across a private network that records roughly 20 billion plate scans per month, and you start to see why cities are ripping contracts out while police lean on the same cameras harder than ever.
I build voice agents and CRM automations for clients. I do not build surveillance stacks. But Flock is a useful case study for anyone shipping AI in production: the model is only one layer. Access control, audit trails, and error budgets matter just as much as accuracy benchmarks.
What Flock actually built
Flock Safety sells automated license plate readers (ALPRs): small rectangular boxes on roadside poles, often solar-powered, angled at traffic lanes. When a car passes, the camera captures an image and runs machine learning to extract the plate, vehicle color, make, model, and other metadata.
CEO Garrett Langley founded the company in 2017 after a police major told him that more than 70% of crime involves a vehicle, but most of those crimes go unsolved because police rarely have the plate. Langley's fix was engineering: build a system to find the plate at scale.
The business model is subscription fees per camera. Customers include police departments, cities, businesses, schools, and homeowner associations. Flock was recently valued at $8.4 billion and claims deployments in 49 states.
Flock says its readers do not use facial recognition and that vehicle records delete after 30 days by default (customers can configure longer retention where law allows). The company's pitch is narrow: focus on the vehicle involved in an incident, not the person inside it.
That pitch breaks down the moment you network thousands of fixed cameras and give broad search access to thousands of users.
The misuse numbers are not edge cases
A Washington Post investigation found at least 50 U.S. police officers charged with or accused of using license plate readers for unauthorized purposes, including stalking ex-partners. 46 of those cases involved Flock's network.
Flock's defense is statistical: misuse is rare against the volume of legitimate investigations. At 20 billion scans a month, "rare" still means real harm to real people.
The Electronic Frontier Foundation calls this mass surveillance because cameras photograph every passing vehicle, not just suspects. Networked records can reveal when someone visited a clinic, a protest, a mosque, or an ex-partner's neighborhood, even if each camera only captures a single point in time.
| Risk | What happened |
|---|---|
| Officer misuse | At least 50 officers accused of unauthorized ALPR queries, mostly on Flock |
| Misreads | Armed stops, dog attacks, wrongful jail time when plates are wrong |
| Data sharing | EFF and ACLU documented immigration-enforcement searches on Flock data |
| Political chilling | Broad travel logs can expose First Amendment activity |
Six cities have cut or suspended Flock contracts. Activists map camera locations through open-source DeFlock campaigns.
When 71% of alerts are wrong
Roseville, California has used Flock cameras since 2021. A Business Insider investigation audited 1,427 stolen-vehicle and felony alerts issued in 2023 and 2024.
Flock incorrectly read the plate in 71% of those alerts.
That is not a rounding error. That is a system where the majority of high-stakes notifications are based on bad OCR. Officers are supposed to verify before action, but in practice misreads have led to armed traffic stops and arrests.
If you ship computer vision in production, ask yourself: what happens when your model is wrong 7 times out of 10 on the alert that triggers human escalation? Flock's cameras are not a demo. They are infrastructure with guns attached.
Lessons for applied AI builders
I am not arguing that ALPRs should never exist. I am arguing that the deployment pattern matters more than the pitch deck.
Treat search access like root credentials. Every officer with query access is a potential insider threat. Role-based access, query logging, anomaly detection on lookup patterns (repeated searches on one plate, off-hours queries), and mandatory review for sensitive searches should be table stakes, not nice-to-haves.
Measure error rates on the alert path, not just the model path. Aggregate accuracy across 20 billion scans hides the failure mode that matters: what percentage of alerts that trigger human action are wrong? Roseville's 71% number is the metric that should have killed the deployment.
Network effects invert privacy assumptions. A single camera on a public road is legally defensible in many jurisdictions. Ten thousand cameras with federated search is a movement diary. Your architecture needs to assume adversarial composition: what can someone learn if they stitch your logs together?
"Rare misuse" is the wrong frame at scale. Flock says misuse is statistically small against cases solved. Civil liberties groups counter that rare times billions still equals a lot of people, and that the unresolved question is whether a private camera network that maps where anyone has been is ordinary police gear or something courts must treat differently.
Flock published a November 2025 white paper arguing fixed point-in-time observations are constitutionally distinct from seamless tracking. The ACLU and EFF disagree: networked ALPRs collectively create searchable travel histories.
What I would audit before shipping similar systems
If a client asked me to wire AI into a high-stakes ops workflow (fraud alerts, eviction notices, medical triage flags), I would steal this checklist from the Flock backlash:
- Who can trigger an action? Minimize the population with query or override rights.
- What is the false-positive rate on escalations? Not overall accuracy. Escalation accuracy.
- Is there a human verification step with teeth? "Officers should verify" is not a control if KPIs reward speed.
- Can logs be audited retroactively? Stalking cases only surfaced because someone looked.
- What happens when a city pulls the contract? Data retention, migration, and citizen notification need answers upfront.
Flock is not failing because the technology is impossible. It is under pressure because scale turned a neighborhood crime tool into a national movement graph, and the governance layer did not keep up.
If you are building AI that touches real people (and you probably are), treat access control and alert quality as product features, not compliance footnotes.
Book a free discovery call if you want help auditing an AI workflow before it goes live in production.