A private company's cameras quietly became a de-facto national surveillance grid. Now the backlash has started
Flock Safety's license-plate readers scan billions of cars a month into one searchable database used by thousands of police departments. In 2026 it emerged that federal immigration agents were tapping it without a contract or, critics say, a warrant. Here is how the network works, and why cities are now revolting against it.
Flock Safety runs a network of automated license-plate readers (ALPRs) used by thousands of US police departments, scanning billions of vehicles a month into a shared, searchable database that can reconstruct where a car has been. In 2026, audits and reporting revealed that federal immigration agents were reaching that data indirectly, by asking local police to run searches on their behalf, without a direct contract and, civil-liberties groups say, often without a warrant. A Columbus audit flagged more than 15,000 searches as possibly immigration-related, and cities are now moving to cut off statewide data-sharing. It is a case study in how private surveillance infrastructure becomes government surveillance infrastructure, quietly.
Most people have never heard of Flock Safety, but if you drive in the United States, its cameras have very likely photographed your car, logged your plate, and filed the record in a database that thousands of police departments can search. That system was sold as a tool to catch stolen cars and solve crimes. In 2026 it became something bigger and more contested: a near-nationwide vehicle-tracking grid, built by a private company, that federal agencies can tap without ever signing a contract. Here is how it works and why the pushback has suddenly gone national.
What is Flock, and how big is it?
Flock Safety is a private company that sells automated license-plate readers, cameras mounted on poles and police cars that photograph every passing vehicle, read its plate with software, and record the time and location. Individually, that is unremarkable. At scale, it is a surveillance system.
And the scale is the point. Flock's cameras are used by more than 5,000 law-enforcement agencies across roughly 6,000 communities, and the network scans on the order of 20 billion vehicles a month into a shared, searchable database. Because departments can search one another's data, a single query can trace a specific plate across many jurisdictions, effectively reconstructing a car's movements over time. What looks like a local crime-fighting tool is, in aggregate, a map of where Americans drive.
How the data reaches federal agents without a contract
The 2026 controversy is about who gets to search that map. Reporting and local audits found that federal immigration agents were accessing Flock data indirectly. Immigration and Customs Enforcement (ICE) has no direct contract with Flock, but according to civil-liberties groups it did not need one: it could ask "friendly" local police departments to run searches on its behalf and pass back the results.
The concern, voiced most sharply by the American Civil Liberties Union, is that many of these searches happened without a warrant. The ACLU's Chad Marlow has described the arrangement as a way for a federal agency to obtain bulk location data while sidestepping the usual legal checks. In Columbus, Ohio, an audit of Flock searches flagged more than 15,000 as possibly tied to immigration enforcement, and the city moved to disable statewide data-sharing in July 2026 after a federal operation in the area drew scrutiny. Whether every flagged search was truly immigration-related is disputed, but the audit is what turned an abstract worry into a documented pattern.
Why this is a privacy problem even if you have nothing to hide
The instinctive response is that license plates are already public, so photographing them cannot be a privacy violation. That misses what changes at scale. A single officer noting a plate is ordinary policing. A permanent, searchable, cross-jurisdiction record of every car's movements is something new: it lets anyone with access answer questions like where a given vehicle goes, who it visits, and what pattern its owner's life follows, all retroactively, without ever having suspected that person of anything.
That is the civil-liberties objection in a nutshell. Mass location data does not just catch wrongdoers; it captures everyone, and it sits waiting to be queried for purposes the driver never anticipated and never consented to. The immigration story is one example of "mission creep," a system built for stolen cars now reportedly used for something its buyers never intended, and it is the kind of risk privacy advocates warned about when these networks were installed.
The backlash
What makes 2026 different is that the pushback has become organized and local. The ACLU launched a campaign, bluntly titled "Get the Flock Out," urging communities to audit or drop the cameras, and city councils have taken up the fight in public hearings. Columbus disabled its statewide data-sharing; other cities are auditing how their Flock data has been searched and by whom. The through-line is a demand for transparency and limits: who can query the database, for what, and with what legal authority.
Flock, for its part, disputes the framing. It says it does not give federal immigration agents direct access to its system, that it provides audit logs and access controls, and that individual agencies set their own sharing policies. It also points to a real record: the network is credited with helping police solve crimes, recover stolen cars and find missing people, which is why so many departments adopted it in the first place. That public-safety value is genuine, and it is what makes this a real tradeoff rather than an easy call. The counterpoint is just as real: a powerful surveillance system whose safeguards depend on the discipline of thousands of separate agencies is only as private as the least careful one.
Why it matters
The Flock story is bigger than any single city or agency. It is a clear illustration of how modern surveillance actually spreads: not through a grand government program announced to the public, but through a private company selling convenient tools to thousands of local departments, whose data then quietly pools into something none of them built alone, and which other agencies can reach through the back door. The privacy question it raises is not "are you a criminal?" but "who gets to watch where everyone drives, and who is checking that they follow the rules?" In 2026, the answer turned out to be less reassuring than most drivers assumed, and that, more than any single search, is why the backlash has arrived. For more, see the Privacy section and our explainer on what a VPN actually hides, which, notably, does nothing to hide your license plate from a camera.
Flock's surveillance network, at a glance
| What it is | Private automated license-plate-reader (ALPR) network |
| Scale | 5,000+ police agencies, ~6,000 communities |
| Volume | ~20 billion vehicle scans per month, shared and searchable |
| The 2026 issue | Federal immigration agents accessing data via local police, no direct contract |
| The Columbus audit | 15,000+ searches flagged as possibly immigration-related (Jul 2026) |
| The legal worry | Searches often without a warrant (per the ACLU) |
| The backlash | ACLU "Get the Flock Out"; Columbus disabled statewide sharing (Jul 2026) |
The EU's plan to scan your private messages isn't dead. It's heading for a September showdown
'Chat Control,' the EU push to scan private messages for child-abuse material, comes in two versions. A voluntary one survived a July vote; a far-reaching mandatory one now returns for a decisive autumn negotiation. At its heart is a question with no easy answer: can you scan everyone's messages without breaking the encryption that protects them? Here is the honest state of play.
Apple is fighting the UK's secret order to break iCloud encryption, again
For a year and a half the British government has been trying to force its way into end-to-end-encrypted iCloud data. Apple is now challenging a second, quieter version of that order, and UK users have already lost their strongest protection in the process. Here is the honest state of the most important encryption fight in the world.
Google just started using your IP address to track you for ads, a technique it once called 'wrong'
From 3 August 2026, Google began using the IP addresses of users in the UK, the European Economic Area and Switzerland to identify their devices for ad targeting and measurement. It is a quiet but significant reversal: the same company once said this kind of tracking was wrong precisely because, unlike a cookie, you cannot clear it. Here is what changed and what you can do.