← The GA Files · Do Better
We Can Do It Better / Surveillance

Watching the Watchers

How Georgia built America's biggest surveillance-camera company — and how Georgians can keep it from becoming a dragnet

A research report from the "We Can Do It Better" project · July 2026 · Research foundation complete; all load-bearing and disputed claims checked to primary or official sources

The short version

An Atlanta company you may never have heard of now runs the largest automated surveillance-camera network in the United States — more than 100,000 cameras that photograph your car, log where and when, and store it in a nationwide database that roughly 4,800 police agencies can search. Most of the time, that database helps solve real crimes. The problem is what happens the rest of the time: it has been used to help federal agents, to hunt a woman who had an abortion, and by police officers to stalk their exes — and in Georgia, five officers in one city were arrested in a single week for misusing it. None of this required breaking the technology. It required only using it with no real limits. This report lays out what has gone wrong, why it’s a rights problem and not just a privacy annoyance, and a framework — usable tonight by a city council and this session by the legislature — that keeps the public-safety benefit while closing the door on the abuse.

Every factual claim below is labeled. Verified survived independent, adversarial fact-checking against primary sources. Documented is credibly reported. Company claim is Flock’s own assertion. Debunked was investigated and disproven.

Why this matters, and why now

License-plate cameras are not new, and this report does not ask Georgia to rip them all out. Used narrowly — find a stolen car, locate an Amber Alert vehicle, follow a lead in a specific violent crime — an automated license plate reader is a legitimate and useful tool, and police who use it that way solve cases with it.

What’s new is the scale and the architecture. Flock Safety, headquartered in Atlanta and founded in 2017, has turned a single camera into a nationwide, searchable, always-on database — over 100,000 cameras, roughly 5,000 communities, about 4,800 law-enforcement agencies, more than 20 billion vehicle scans a month, most recently valued at $8.4 billion. (Verified.) By the ACLU’s count, fewer than 1% of the vehicles scanned are connected to any crime — the other 99% are ordinary people whose movements are recorded and kept. (Documented.)

That is the shift that should concern a Georgian of any political stripe: a system built to catch the rare criminal now, by design, tracks everyone in order to do it. The camera on the corner is not the danger. The database behind it is — because a record of everywhere your car has been, held long enough and shared widely enough, is a record of your life: where you worship, who you visit, which clinic or lawyer or gun shop or protest you drove to. The Supreme Court said as much about phone-location data in June 2026. The same logic is now coming for the cameras.

We looked hard at where this has already gone wrong, with Georgia in the foreground — because the company is ours, the abuse is happening here, and Georgia is unusually well-positioned to lead on the fix.

Part I — What has actually gone wrong

The database gets shared with people it was never promised to

The core betrayal in the Flock story is that data collected by your local police for local policing has repeatedly ended up in federal and out-of-state hands — often automatically, sometimes without the local agency even knowing.

Only after national reporting did Flock remove states and federal agencies from its Lookup tool. (Verified.) The guardrail existed only once someone was watching.

Police use it to track people they personally want to track

Strip out immigration and politics entirely, and a plainer abuse remains: officers using the system on people in their own lives.

And in Georgia, this is not abstract

Georgia is where the company lives — and lately, where the misuse keeps surfacing:

Every one of these Georgia cases has the same tell: it was caught by an audit of the system’s own logs. The technology records who searched and why. The abuse happened anyway — because nobody was required to look until after the damage was done.

It isn’t even secure

In Cobb County, a researcher showed that Flock cameras could be reached over the open internet — letting an outsider watch live feeds and pull 30 days of stored footage, and even delete it. (Verified — WABE.) Separately, two members of Congress told the FTC that stolen police logins were exposing Flock’s cameras to hackers; Flock acknowledged that roughly 3% of its law-enforcement customers had not turned on basic multi-factor authentication, which it does not require. (Verified — TechCrunch.) A nationwide tracking database is also a nationwide target.

(One myth to retire: the viral story of a woman mailed a “$1,251 ticket” for a phone on her lap is not Flock and not Georgia — it happened in Queensland, Australia, with a state phone-detection camera and Australian dollars. Debunked. It’s worth correcting, because one false example can sink a true argument.)

Part II — Why this is a rights problem, not just a privacy one

It’s tempting to answer all of this with “if you’re not doing anything wrong, who cares?” Here is why that answer fails, in terms that hold across the political spectrum.

Your movements reveal you. The Supreme Court, in Carpenter v. United States (2018), recognized that a detailed log of where you go exposes “a wealth of detail about [your] familial, political, professional, religious, and sexual associations.” (Verified.) A single photo of your plate on a public street is trivial. A searchable four-month record showing your car photographed hundreds of times — as one Norfolk driver’s was, 475 times — is a portrait of your life. (Verified.) The harm isn’t any one snapshot; it’s the mosaic.

The law is catching up — carefully. In Chatrie v. United States (June 29, 2026), the Supreme Court held 6–3 that pulling a person’s phone-location history with a geofence warrant is a Fourth Amendment search. (Verified.) That case is about phones, not plates, and it did not ban anything — but its reasoning about mass, aggregated location tracking is exactly the argument now aimed at camera networks. And in the leading camera case, Schmidt v. City of Norfolk, a federal judge upheld the current system in January 2026 — but warned that as cameras multiply, “the constitutional balancing could conceivably tip the other way.” (Verified.) The plaintiffs are appealing. The courts are telling us, in effect: density and permanence are what turn lawful cameras into an unlawful dragnet — so cap them before we have to.

This is a left-right issue, and that’s its strength. The people worried about Flock include immigrant-rights groups and gun owners who don’t want a log of every visit to the range; abortion-rights advocates and conservatives who remember that surveillance powers outlive the administration that built them; the ACLU and the libertarian Institute for Justice, which is litigating the marquee case. (Verified.) A record that can find a woman who had an abortion can find a pastor, a protester, a journalist’s source, or a political opponent. The tool doesn’t care who’s in charge — which is exactly why the rules can’t depend on who is.

And there’s a Georgia-sized irony. The most surveilled-by-Flock state’s own company is headquartered here, its arbitration clauses are written under Georgia law, and Georgia already makes misuse a crime — yet Georgians have less practical protection than residents of Virginia, California, or New Hampshire, because our law sets a 30-month retention window and requires no routine audits. (Verified.) We are the natural place to get this right, and we’re behind.

Part III — The better way: a framework for public safety without a surveillance state

Here is the core argument: almost nothing that makes Flock dangerous is necessary to catch the stolen car or the Amber Alert vehicle. Police get the legitimate benefit from a short-lived, locally-controlled, audited tool. The danger comes entirely from the four things layered on top — long retention, frictionless national sharing, unaudited access, and no democratic control. Cut those four, keep the tool.

The framework below is built to work at two levels at once: as a local ordinance a city or county can adopt now, and as a Georgia statute that raises the floor statewide. Each plank cites a real precedent already in force somewhere in the country, so none of this is theoretical.

1. Democratic control before deployment (local ordinance; state enabling)

No surveillance system should be bought or switched on by a purchase order. Adopt the CCOPS model (Community Control Over Police Surveillance), already used in ~20 cities: city-council approval after a public hearing, a published use policy, a civil-rights impact assessment, and cost disclosure — with no grandfathering of systems already installed. (Model: ACLU CCOPS.) At the state level, require every agency operating ALPRs to adopt and post a written policy as a condition of using the data, mirroring California SB 34.

2. Retention measured in days, not years

This is the single highest-leverage change. Georgia currently allows 30 months. New Hampshire deletes non-hit data in 3 minutes; Maine and Virginia in 21 days. (Verified.) Set a hard retention cap of no more than 30 days for data not tied to a specific, documented investigation — as a local policy floor and a statewide maximum. A shorter memory is the difference between a lookup tool and a life-logging machine. (Model: NH; Maine; Virginia HB 2724.)

3. A warrant to track a person

Reading a plate is one thing; assembling a person’s movement history is another. Require a warrant based on probable cause before anyone can query the system to reconstruct where a specific individual or vehicle has traveled over time — the standard Minnesota already uses, and the direction Carpenter and Chatrie point. (Model: Minnesota; reinforced by the Supreme Court.) Routine “is this stolen car here right now” hits don’t need a warrant; retrospective tracking of a named person does.

4. A firewall against federal, ICE, and out-of-state sharing

This is where the worst abuses live, and the fix is proven. Prohibit selling, sharing, or transferring ALPR data to out-of-state or federal agencies (including ICE and CBP) absent a judicial warrant — the exact rule California adopted under SB 34 and enforced through its Attorney General’s 2023 bulletin. (Model: California.) Turn “National Lookup”-style default sharing off, permanently, and make any cross-jurisdiction access an affirmative, logged, warranted exception — not a toggle that ships switched on.

5. Mandatory, independent audits and public transparency reports

Georgia’s own cases prove audits work — they’re what caught the Albany five and the Braselton chief. So make them compulsory instead of optional. Require access logging (who searched, when, and why) on every query; independent audits on a fixed schedule; and an annual public report listing camera locations, number of searches, how many led to a stop, and every outside agency granted access. (Model: Minnesota audits; Virginia’s annual query/stop reporting; Colorado access logs.) Sunlight is the cheapest guardrail there is, and the one Flock’s own product already makes possible.

6. Real penalties — and a door to the courthouse

Georgia already makes misuse a high-and-aggravated misdemeanor — a genuine strength worth keeping and publicizing. (Verified.) Add the piece it’s missing: a private right of action so a person tracked by a stalking officer, or whose data was shipped to an agency it never should have reached, can sue — with statutory damages and attorney’s fees, as California provides. (Model: California SB 34.) Accountability shouldn’t depend solely on whether a prosecutor decides to charge.

7. Security minimums

If the data is going to exist at all, protect it: require multi-factor authentication on every account (not the ~97% Flock reports voluntarily), bar cameras from being reachable on the open internet, and mandate breach notification to the public. (Responsive to the Cobb County and stolen-login findings.)

The vision, plainly stated

This is not a demand to blind the police, and it should never be sold as one. A city can keep every legitimate use of a license-plate camera — the stolen vehicle, the Amber Alert, the specific violent-crime lead — while giving up none of its citizens’ protection against being tracked, catalogued, and shared without cause. The two are not in tension. The only uses these rules eliminate are the ones a free state shouldn’t allow anyway: warrantless tracking of named people, quiet handoffs to federal agents, a permanent map of everyone’s movements sitting in a database that 4,800 agencies — and, apparently, the occasional hacker or jealous officer — can open.

A better system looks like this: cameras a community voted to install, running under a policy anyone can read, holding data for days instead of years, walled off from ICE and out-of-state fishing expeditions, queried for a specific person only with a warrant, audited on a clock, and backed by penalties with teeth and a courthouse door for the wronged. Georgia — the state that built Flock — is the natural place to prove that a company can sell public safety without selling a surveillance state.

We can do this better. And because it’s our company, our courts, and our law already halfway there, we’re better placed than anyone to show how.

A note on method and sourcing

Every factual claim in this report was drawn from a research file that passed multi-source adversarial fact-checking: independent reviewers tried to refute each load-bearing claim, and only those that survived are stated here as verified. Where a claim is a company or agency assertion, we say so. Corrections we made in the process are themselves instructive: Virginia’s retention limit is 21 days, not the 30 sometimes reported; its 2025 law has no explicit immigration ban (it works by listing permitted uses); the Supreme Court’s Chatrie ruling is a 6–3 phone-location case, not a license-plate ruling; the “53 cities canceled” figure is single-sourced (a firmer floor is “at least 30”); and the “$1,251 lap-phone ticket” is Australian and not Flock at all. Getting those right is the point — a movement’s credibility is only as strong as its least-checked claim.

Sources (clickable):

  1. 404 Media — ICE taps into nationwide AI camera network
  2. Bend Source — 279 federal queries in three weeks
  3. EFF — Texas cop used 83,000 cameras to track a woman who had an abortion
  4. Mission Local — SF audit: feds improperly accessed Flock data
  5. 404 Media — Flock removes states from National Lookup
  6. Institute for Justice — Officers used plate readers to stalk romantic interests (21 cases)
  7. Institute for Justice — Innocent motorists detained at gunpoint over ALPR errors (26 cases)
  8. GBI — Five former Albany officers arrested for ALPR misuse
  9. CBS Atlanta — Greene County deputy arrested for personal Flock use
  10. GBI — Braselton police chief arrested for stalking via ALPR
  11. ATL Press Collective — Atlanta police Flock immigration searches
  12. WABE — Cobb County researcher documents Flock camera vulnerabilities
  13. TechCrunch — Stolen police logins expose Flock cameras to hackers
  14. Supreme Court — Chatrie v. United States, No. 25-112 (June 29, 2026)
  15. Courthouse News — Judge holds Norfolk’s ALPR use constitutional (with warning)
  16. EPIC — Court: pervasive vehicle fingerprinting likely violates Fourth Amendment
  17. O.C.G.A. § 35-1-22 — Georgia’s ALPR statute (Justia)
  18. California SB 34 — ALPR data law (bill text) · CA AG Bulletin 2023-DLE-06 (PDF)
  19. Virginia — HB 2724 (2025) ALPR oversight law · State Crime Commission ALPR report (Jan 2026, PDF)
  20. Legislative Analysis Center — ALPR state-law survey (NH, Maine, Minnesota, Colorado)
  21. ACLU — Community Control Over Police Surveillance (CCOPS) model bill
  22. ACLU of Georgia — Opposition to Atlanta airport Flock contract

Full citation and verification detail lives in the project’s surveillance/flock-baseline.md research file.