Have You Been Flocked?

A handful of police departments that use Flock have unwittingly leaked details of millions of surveillance targets and a large number of active police investigations around the country because they have failed to redact license plates information in public records releases. Flock responded to this revelation by threatening a site that exposed it and by limiting the information the public can get via public records requests. 

Completely unredacted Flock audit logs have been released to the public by numerous police departments and in some cases include details on millions Flock license plate searches made by thousands of police departments from around the country. The data has been turned into a searchable tool on a website called HaveIBeenFlocked.com, which says it has data on more than 2.3 million license plates and tens of millions of Flock searches.  

The situation highlights one of the problems with taking a commercial surveillance product and turning it into a searchable, connected database of people’s movements and of the police activity of thousands of departments nationwide. It also highlights the risks associated with relying on each and every law enforcement customer to properly and fully redact identifiable information any time someone requests public records; in this case, single mistakes by individual police departments have exposed potentially sensitive information about surveillance targets and police investigations by other departments around the country.

Flock is aware of the exposure enabled by its own product design and has tried to do damage control with its law enforcement customers by blaming “increased public records act/FOIA activity seeking by the public,” according to an email Flock sent to police obtained via public record request. Flock has threatened Cris van Pelt, the creator of HaveIBeenFlocked, by going after his web hosts and claiming that he has violated their intellectual property rights and is posting information that “poses an immediate threat to public safety and exposes law enforcement officers to danger.” In recent weeks Flock severely limited the amount of information available on its audit logs, which are designed to be a transparency tool, raising questions about how much information journalists, regulators, and government agencies will be able to get about police use of Flock cameras in the future.

“I set up HaveIBeenFlocked to show how pervasive and prevalent this monitoring is, and to show just how many searches are getting done. That information, by itself, is shocking,” van Pelt told 404 Media. “To me, as a private citizen, that’s shocking, and I think that’s kind of what Flock is trying to hide or bury.” van Pelt added that he is committed to keeping the website online.

As 404 Media has reported before, Flock’s automated license plate reader cameras are connected to local, state, and/or national “networks” of cameras. When a police officer runs a search seeking the locations of a specific license plate, they are usually not just searching cameras owned by their own jurisdiction, they are usually searching all Flock cameras in that state or in the country. Each individual search creates a record of that search on as many as 80,000 different cameras around the country. 

As a compliance and transparency measure, these search records can be obtained through a “search audit,” which are essentially huge spreadsheets of specific Flock searches that contain not just the searches of local police but of all police who have ever searched that camera. Using this data, we have previously been able to report that local police are regularly giving Immigrations and Customs Enforcement side-door access to Flock cameras, and we also reported that Texas searched tens of thousands of cameras nationwide for a woman who self-administered an abortion. Flock search audits have also been used to catch police who have allegedly illegally stalked people or otherwise abused the system.

Because these search audits are important tools for police transparency and accountability, they have become a popular type of public record to request for journalists, concerned citizens, privacy experts, city councils, and government regulators. In the vast majority of cases, the police departments releasing the search audit files redact the surveillance target’s license plate number. But in recent months, at least four police departments have released full Flock search audits without redacting anything at all, revealing information about a mix of more than a million individual surveillance targets, suspects, and crime victims. This means that any individual Flock customer could accidentally leak the specific search targets for millions of Flock searches nationwide; any single failure point anywhere in the country could dox the police activity and surveillance targets of other police departments elsewhere.

With the license plate information, you can determine not just what police are using Flock for, but who they are using it against. An unredacted search log file obtained by 404 Media shows more than 700,000 individual searches from June 2025 alone, performed by hundreds of law enforcement agencies nationwide, including hundreds of searches performed by US Border Patrol agents. They show the specific date and time of a search, the name of the officer who did the search, sometimes show the specific case number of a search, the police-stated “reason” of a search, as well as the number of Flock cameras searched. Crucially, they also show the license plate, allowing someone to connect a specific license plate and therefore person to reasons like “drug trafficking,” “fugitive,” “narc,” immigration enforcement, “homicide,” “oil and gas theft,” etc. As the Electronic Frontier Foundation found, they also expose the victims of a host of biased policing tactics and dubious searches, including hundreds of searches of “No Kings” protesters, audit log reasons that included “possible gypsy,” and the search for a woman who had a self-administered abortion.

“EFF has had this [unredacted] information but we’ve chosen not to publish it or share it because of concerns about doxing people—our policy is not to release data of surveillance victims,” Cara Gagliano, a senior staff attorney at the EFF, told me.

04 Media has also had unredacted versions of some of these files for months but has not published any of them. At first, just one or two police departments failed to do redactions. In recent weeks, however, it has become clear that many police departments are not redacting license plates; this led van Pelt to create HaveIBeenFlocked.com, a website that collates many of these search audit logs and allows people to search individual license plates to determine if they have been run through the Flock system, and if so, where and when. The number of police departments who have now released fully unredacted logs has become so numerous that it can no longer be ignored, and the releases have caused Flock to drastically reduce the amount of information that can be obtained from a search audit. 

Rather than simply making sure that search audits exported for public records requests do not include license plates or are redacted by default, Flock has totally overhauled how the search logs work; in a December email to police customers obtained by 404 Media, Flock said that “to protect officer safety and active investigations, Network Audit Logs will no longer include: officer names, specific plates searched, vehicle fingerprint information.”

To be clear, Flock is not turning on license plate redaction by default: It is fully withholding officer names and license plate information from the police departments themselves. 

“Flock is doing their best to have it both ways where they have no responsibility and also no accountability to the communities where their cameras are placed,” Chris Gilliard, privacy expert and author of the forthcoming Luxury Surveillance, told 404 Media. “Shoddy data hygiene by law enforcement is not seen as a threat or danger but accountability and transparency are.”