Share with your CISO
Flock Safety, facing cancellations from at least 30 cities and political pressure from across the spectrum, is converting several optional governance controls into mandatory ones across its license plate reader network used by roughly 5,000 agencies. Officers must now enter a criminal case number before searching, and an automated auditing system flags suspicious search patterns to administrators. Data retention recommendations drop from 30 days to 7. Cross-agency search permissions can now be scoped by stated purpose, such as allowing kidnapping investigations while blocking immigration enforcement queries.
What this means for your business
Any enterprise deploying AI-driven surveillance tools, whether for physical security, access control, or operational monitoring, is looking at the same governance cliff Flock is now falling off. The tell isn’t the technology failing; it’s that Flock’s controls were optional first, mandatory only after the backlash hit critical mass. If your security stack includes vendors who treat audit logging or access justification as a premium feature rather than a default, you’re one investigative news cycle away from the same dynamic. The question worth asking your vendors now is whether their accountability controls are on by default or by invoice.
The ACLU’s finding that officers entered “hehehe” 20 times to satisfy a search-reason prompt is a clean proof point for what I’d call compliance theater decay, where a procedural safeguard exists on paper but erodes into ritual because no one verifies the inputs. Flock’s new automated auditing system is meant to catch that, but the company hasn’t released accuracy data or allowed independent evaluation. For any CISO evaluating a vendor’s internal compliance tooling, that combination of mandatory enforcement plus unverified detection accuracy is actually a worse posture than acknowledged absence of controls, because it creates liability the vendor can’t substantiate.
Competitors Axon and Motorola are quietly picking up Flock defections, and that matters less than the regulatory trajectory it signals. Several states are moving to ban license plate readers outright. The smarter read for enterprise security buyers isn’t which vendor wins the municipal contract flow; it’s that AI surveillance tools without auditable, independently verifiable governance are becoming uninsurable political risk. I’d revise that view if Flock opens its auditing system to third-party evaluation and publishes false-negative rates, but until then, “we now require case numbers” is a press release, not a control.
Based on reporting from Flock is tightening its rules in response to a growing surveillance backlash, originally published 2026-08-13 09:41:00.
