Flock Cameras Can Surveil Cars Without License Plates

This is from a 2024 company presentation:

Officers can also tap into data showing a car’s decals, bumper stickers, back and top racks—along with temporary and unique state tags.

Flock calls it a “Vehicle Fingerprint” and it’s touted as a way for law enforcement officials to get more information “even when you don’t have full plate information,” the company’s presentation shows.

The company gives police officers the ability to search that data as well, to “build stronger cases with less information upfront.” That includes being able to locate multiple vehicles law enforcement officials believe are moving together and what Flock calls a “multi geo search.”

This kind of thing is older than AI; I wrote about it in my 2014 book Beyond Fear. Edward Snowden revealed that the NSA was using cell phone location data to track phones that were habitually near each other.

As bad as Flock is, remember that anyone with broad access to cell phone location data can do the same thing.

Tags: cameras, cars, cell phones, geolocation, identification, privacy, surveillance

Posted on July 3, 2026 at 7:15 AM • 14 Comments

Comments

Clive Robinson • July 3, 2026 9:18 AM

@ Bruce, ALL,

With regards,

“remember that anyone with broad access to cell phone location data can do the same thing.”

It’s not just “cell phone location data”

Use a laptop, netbook, or tablet etc only on WiFi, and you are still being tracked.

Then there are all those “wearables” to consider and in some cases implanted medical electronics.

Oh and in some cases payment card info, public transport cards and even RFID devices in your possessions.

All can be crosslinked in software that started becoming noticed at the turn of the century

I consulted for a company that linked up with AT&T Wireless to use SS7 and other cell network information to compile “traffic census” reports.

Whilst we tried to anonymize user mobile device and network numbers it was clear that others were not.

One thing that became clear was that you could do a couple of things,

1, pull out new numbers in an area.
2, pull out numbers breaking habit.

Both of which are valuable to not just investigators but prosecutors.

As it was shortly after 9/11 there was “pressure” to remove the anonymizing from the data…

Rontea • July 3, 2026 10:46 AM

Fascinating to see Flock pushing “Vehicle Fingerprints” with decals, racks, and temporary tags as identifiers. This is a classic case where the tech outpaces the public understanding of surveillance. Even without a license plate, the metadata is enough to track patterns and associations—think bumper stickers as beacons. Reminds me of the lessons from SIGINT: once you can correlate movement across time and space, you’re effectively mapping networks. Law enforcement will tout “multi-geo searches” as efficiency, but it’s really about persistent tracking without the traditional anchor points. Old tools, new polish.

KC • July 3, 2026 6:21 PM

Just reading that there’s a big wave of Flock-inspired class action lawsuits being filed under California’s ALPR Privacy Act.

https://www.rainintelligence.com/blog/flock-alpr-class-action-california

Specific compliance failures against customers include: the lack of a stand-alone ALPR policy, missing audit records, unauthorized or undisclosed data sharing, and so on. Penalties could include $2,500 in damages for every plate captured.

Beyond this, there are emerging civil tort claims due to AI camera errors (eg, a “0” being mistaken “O”) leading to wrongful LE encounters, including gunpoint stops and wrongful arrests.

https://ij.org/dozens-of-innocent-motorists-have-been-pulled-over-detained-at-gunpoint-or-jailed-due-to-ai-license-plate-camera-errors/

And there have been constitutional challenges over warrantless surveillance.

50 cities and counties have cancelled Flock contracts or deactivated cameras since early last year. Still, it’s being reported that cameras are in more than 6,000 communities. It would be great to see Flock’s sensitivity to civil liberties and legal statutes evolve along with their technical capabilities.

cls • July 4, 2026 5:37 AM

@KC, thanks for posting the two links. Glad to learn that people are tracking all the stories about failures of Flock and other cameras.

Often it comes down to human error with LEOs not doing their jobs to verify the reports and use discretion about the citizens they detain.

… I am glad lawyers are getting involved to help chase the $2500 per incident fines. But I have mixed feelings, because these are class action firms and they smell easy pickings.

Here’s another recent story: Alameda county (California) doubled down on the usual dubious BS to justify extending their $2.4 million contract with Flock for another year.

https://www.mercurynews.com/2026/07/01/alameda-county-extends-flock-safety-contract-amid-worries-over-surveillance-network/

Archived copy with no extra links

https://archive.is/20260702173947/https://www.mercurynews.com/2026/07/01/alameda-county-extends-flock-safety-contract-amid-worries-over-surveillance-network/

r • July 4, 2026 10:22 AM

china was doing this with identiably worn paint and rust spots 10? years ago.

east germany, you have the freedom to associate with heavens gate but lord help you when the drone strikes.

dead or locked up == disenfranchised.

it’s not a matter of opinion.

i just read something two? weeks ago where the legal opinion was as loose as “potentially dangerous”.

that applies to everyone considering the 11yo who just ran down some monks.

dbCooper • July 4, 2026 12:16 PM

The US Supremes recently placed restrictions upon the use of geofence warrants. One would expect the data collection/sharing practices by Flock to be reviewed by the top court at some point. This ruling gives optimism for citizens retaining their personal privacy rights.

https://www.eff.org/deeplinks/2026/06/victory-supreme-court-says-constitution-protects-peoples-location-data

DBA • July 4, 2026 1:17 PM

I remember my first encounter with a license plate camera, I had just parked at a shopping center in El Paso, Texas, and I noticed a police car doing a slow crawl up and down the parking lot. And on both sides of its light bar was a camera.

That was close to 20 years ago.

Now they’re all over my town, and now both Lowe’s Home Improvement and Home Depot have them on their parking lot entrances “to prevent theft”.

What a wonderful world.

KC • July 4, 2026 5:42 PM

@cls
Super interesting reading about Alameda County’s conflicted debate on Flock. In their future contract bidding process, I’m curious who else will be in the market.

Also, I think you’re right about some officers/depts not exercising proper diligence.

In San Diego, police used Flock to search for a red Alfa Romeo but pursued a hit on the wrong car. One of the arrested men spent a month behind bars – even though data from other cameras would have shown he was not involved. The men filed tort claims for $1.5m each. It does seem surprising the dept would not have at least checked the other cameras.

https://timesofsandiego.com/crime/2026/06/07/a-flock-license-plate-reader-linked-a-san-diego-man-to-a-violent-crime-he-was-five-miles-away/

KC • July 4, 2026 5:46 PM

@cls, also … regarding the wave of California ALPR class actions, I’m trying to see if I can find any more info.

It’s said that ‘Bartholomew v. Parking Concepts, Inc.’ really opened the door. And here in ‘Hellerman v. Flock Group‘ lawyers took a direct-liability approach by suing Flock itself.

Oof, quite a bit there.

I mean, just in basic hygiene, I don’t know why Flock didn’t require MFA. Predictably database login credentials were found for sale on the dark web.

Surprising, too, that Flock was notably hands-off in regards to operator legal compliance. They enabled both willful data sharing violations, and “turned others into violators of SB 34 whether they knew it or not.”

When Santa Cruz cancelled their contract earlier this year, a council member said “Flock has made too many mistakes and Flock’s leadership has too often dismissed real, valid concern instead of responding with transparency and accountability . . . We need a partner who can take criticism seriously and redirect course.”

Feels like a fair call.

Clive Robinson • July 5, 2026 2:55 AM

@ r,

With regards,

“applies to everyone considering the 11yo who just ran down some monks.”

Whilst what happened can not be undone and I feel sorrow for all those who have come to harm.

I would like to think on the tragedy as being “joyriding gone wrong” rather than a beliberate and planned attack carried out by an 11year old child.

Already there is disagreement in the MSM about how many monks were killed with some saying 8 and others 11. Apparently only some died at the scene of the tragedy and others died in hospital and others may still do so as their injuries are not just critical but horrific.

Further that the vehicle was the property of the childs parents, and that the child who has special needs had stayed at home rather than go to school.

Apparently the childs parents had reported the taking of the vehicle to the police some time before the tragedy occured.

Further one news report has said the police have been unable to question the child because of the mental state the child is in,

https://www.theguardian.com/world/2026/jul/02/monks-killed-thailand-mukdahan-crash-truck-procession

ResearcherZero • July 5, 2026 2:57 AM

Commercial data is commercially available to anyone who can to pay to access it. There are opportunities to avoid payment and gain access to the flow of information at the source.

The Pentagon and NATO lack polices to deal with data privacy and security.

‘https://www.lawfaremedia.org/article/nato’s-cyber-approach-needs-change

Commercially available data can be weaponized to threaten public safety and harm national security. DeepSeek used OpenAI’s API to extract large volumes of data, using a technique called distillation. Private data once obtained is used in the targeting of individuals.

The number of civilian casualties allowed for in targeting operations is large.

https://opendatanewswire.com/research-impact/2026/06/22/iran-war-shows-adversaries-can-exploit-big-data-too/

Supply chain attacks are already being employed to steal AI platform API keys.
https://www.stepsecurity.io/blog/jetbrains-malicious-plugins-ai-api-key-theft

ResearcherZero • July 5, 2026 3:31 AM

@r, Clive Robinson

It is very difficult to reach the clutch and the breaks as a child, because your legs are not long enough. I had to screw pieces of balsa wood to the soles of my boots, or glue together a bunch of cork soles and screw them on, so that I could drive our trucks.

I did avoid driving through town after sunrise and often just dropped of loads to the industrial area, or avoided built-up areas completely when moving cattle and sheep. That kid may have been working and his parents may not have told the police due to labor laws.

Given how many people have mobile phones, it is best to avoid driving without a license.

It would be easy for a young boy to take a wrong turn and suddenly find a procession of monks directly in front of the truck. He might have panicked and missed the clutch or breaks. Hit the accelerator by accident, or missed all three and continued on over the monks. If he did take the truck without asking, he could of been in a rush to get it back home before his parents tore shreds off him and doled out punishment for failing to complete the job on time.

Child exploitation is very common all over the world and many kids are forced to work. Parents do not admit that they use their children as unpaid or extremely cheap labor, to save face. The law is purely a secondary consideration for many families, despite what ever they might espouse.

r • July 5, 2026 5:52 AM

@clive, rz

thank you for being more reserved than me.

dan cooper • July 5, 2026 2:32 PM

Judges might use cell phones, but are scotus justices allowed to drive?

Schneier on Security

Flock Cameras Can Surveil Cars Without License Plates

Comments

Leave a comment Cancel reply