Surveillance technology company Flock is implementing new safeguards after investigations revealed that police officers in several states had used its license-plate tracking system to stalk romantic partners and conduct unauthorized searches. Garrett Langley, the company's CEO, acknowledged the failure and said he has changed his view about how much responsibility Flock bears for the actions of law enforcement.

Over the coming weeks, Flock will require all participating agencies to enable a feature called Audit Assistance, which detects abnormal search patterns and locks out suspicious users until an administrator reviews their activity. Previously, this feature was optional, and only about one-third of the agencies working with Flock had activated it. The company said that among those agencies, identification of misconduct increased sharply. Now, Langley said, making it a requirement was an obvious move. "I said, 'Fine. You know what? I think that's right, and we got this one wrong. We should make it a requirement.'"

In addition to mandatory audits, Flock will require officers to enter a case code for every search they run. The intention is to reduce the number of queries conducted for personal reasons or other non-official purposes. An administrator can override the requirement in an emergency, such as a missing-child case, but any such override will be automatically flagged for review.

The company is also shortening the default retention period for data collected by its automatic license plate readers from 30 days to seven days. That moves Flock closer to the data-protection limits long recommended by civil liberties groups such as the American Civil Liberties Union. However, individual police departments will still be able to choose a longer retention period if they wish. A new feature called Evidence Mode will preserve searches tied to a specific case number, allowing law enforcement to keep the data needed for an investigation without storing everything else.

Another significant change involves data sharing among agencies. Previously, a police department could choose to share its Flock data with other agencies on an all-or-nothing basis. Under the new policy, localities can set granular restrictions, for example allowing another department to search for a homicide suspect while prohibiting access for immigration enforcement.

Langley's public apology and the policy overhaul come after a string of alarming incidents. In Braselton, Georgia, a police chief was accused of searching his ex-girlfriend's license plate more than 500 times over seven months, according to reporting in national outlets. In California, prosecutors alleged that a former Riverside County Sheriff's Office deputy used Flock data to stalk his ex-girlfriend, including looking up license plate information about men she was dating. Those cases, and others, were covered by local outlets and national news organizations.

The changes also follow years of criticism from privacy advocates who say Flock and similar ALPR companies have downplayed the risks of their technology. The Electronic Frontier Foundation and the ACLU have repeatedly warned that license plate readers can be used to track people seeking reproductive health care, monitor political protesters, and build vast databases of innocent people's movements.

After Flock announced its updates, the ACLU issued an analysis that was measured but skeptical. The organization said the changes appear "more focused on addressing a perceived PR problem than the significant harms its products create." It called the shorter retention period a potential "step in the right direction" but said the real effect would depend on how Evidence Mode is implemented. The ACLU also called for independent evaluation of Flock's auditing and case-code tools to verify they actually work as described.

Langley, who previously took a combative stance toward critics, has shifted his tone. He had said that local policymakers should be the ones to decide what guardrails are needed for policing tools, and that Flock should not be held responsible if officers misuse the technology. That position drew fierce backlash, particularly after a magazine interview in which Langley described DeFlock, a website that tracks Flock installations across the country, as a "terroristic" group. He later apologized and called that characterization a mistake.

In the latest interview, Langley said his thinking has evolved through conversations with communities around the country, including at city council meetings. He acknowledged that many critics will not instantly trust his intentions. "All I guess I'm asking for is a fair shot," he said. He added that he would still prefer legislators to make the ultimate decisions about how policing tools should be used, but he now understands that the legislative process moves slowly and that the company has a role to play.

Langley also pointed to the benefits of Flock's technology, saying that in the month of July alone, the system helped locate almost a thousand missing people and more than 22,000 stolen vehicles. "It took me maybe longer than it should have to realize the sheer impact of the company," he said. "I'm still surprised. ... I got our July update a week ago, and we helped find almost a thousand missing people, over 22,000 stolen cars — in July. That's crazy. That's such a big impact on the world. And what I came to realize over time was that the responsibility that bears with it is an obligation to make sure that it's creating a society that we both, you and I, and everyone around us, want to raise their kids in."

The issue of police access to surveillance data is not limited to Flock. Automatic license plate readers have become common across the United States, mounted on street poles, patrol cars, and even tow trucks. Many police departments use them to locate stolen vehicles and wanted suspects, but the same data can also be used to build detailed records of where a person goes, with whom they meet, and at what times. The technology, privacy advocates say, functions as a form of mass location tracking that is largely unregulated.

Several cities have moved to restrict their use. Some have passed ordinances requiring warrants before ALPR data can be accessed, while others have banned the technology outright. At the state level, a growing number of legislatures have debated bills that would impose data retention limits and auditing requirements on law enforcement agencies. Few of those measures have been enacted, however, in part because of resistance from police unions and the surveillance industry.

Flock's decision to impose its own limits, even if imperfect, signals a shift in the industry's approach. The company is under pressure not only from civil liberties groups but also from its own customers. Some police departments have suspended their use of Flock systems after the recent abuse reports. One of the most notable suspensions came from the Los Angeles Police Department, which halted its use of Flock's readers while it reviewed its policies.

Langley says the new measures will make it easier for departments to identify bad actors. In the past, an agency looking for abuse would have to manually comb through thousands of lines of log data. With Audit Assistance enabled, the system will flag suspicious behavior automatically, such as an officer searching the same plate dozens of times in one week or running queries outside of work hours. "You are going to see more officers fired and more officers arrested for abusing police power," Langley predicted.

But watchdogs remain concerned. They point out that Audit Assistance is only effective if administrators actually review the alerts. If a department chooses not to take action, the system's warnings will do little to stop abuse. Similarly, requiring case codes can be circumvented if departments allow broad categories or if supervisors approve requests without asking questions. The ACLU has urged independent researchers to test Flock's systems and publish their findings.

The debate also raises questions about the role of companies that build surveillance tools. Flock has often argued that it is merely providing a technology that police use legally. Langley has repeated that argument for years, pushing back against proposals that would make the company responsible for misconduct. But the recent flurry of abuse cases has made that position difficult to maintain. In his mea culpa, Langley admitted that the company has a responsibility to design its products in a way that makes misuse harder.

Flock's changes are not just about public relations; they may also help the company deflect potential regulation. By voluntarily implementing safeguards, Flock can claim that it is taking proactive steps, even if those steps fall short of what critics want. At the same time, Langley has suggested that he would welcome legislation that levels the playing field, requiring competitors to adopt similar safeguards. "This is such an obvious way to curb abuse," he said of the mandatory audit feature. "And when I saw how slowly the regulatory process can move, I said, 'Fine. You know what? I think that's right, and we got this one wrong.'"

The company's changes come in phases, with some features rolling out immediately and others arriving over the coming weeks. The full effect on law enforcement practices will not be known for some time. But the incident has already reshaped the conversation around ALPRs, reminding both the public and the industry that surveillance tools can easily be turned against the very people they are meant to protect.

Source:The Verge News