Letter to the Editor: Get the Flock out
Twentynine Palms under surveillance
By Elliott Balsley
In December 2024, the Twentynine Palms City Council approved a no-bid, sole-source contract with Flock Safety to install 31 surveillance cameras throughout the city, for an annual cost of $102,3001. These are officially known as Automatic License Plate Readers (ALPR), but that name is misleading because they capture much more than just license plates — they use AI to recognize vehicle characteristics and other personally identifying features. These images and tags are fed into a nationwide database that can be searched with no warrant and minimal oversight. In a recent software update, released after Twentynine Palms signed its contract, all Flock cameras were upgraded to stream live video and recorded clips as well.
While this may help to deter crime, it comes with outsized risks for privacy, public safety, and national security, which have led over 40 cities to terminate their Flock contracts. And Flock’s own “research study” showing their effectiveness has raised concerns about its methodology and potential bias. So far, the City of Twentynine Palms has installed 22 out of 31 cameras approved for “Phase 1.” There was no mention of what/when Phase 2 might entail, but Flock CEO Garrett Langley said that he wants the cameras on every street corner. In September, Yucca Valley approved plans to install 20 cameras of their own. We need to get rid of these cameras now, before it gets even worse.
A group of local residents has started a petition, asking the city to terminate their contract with Flock and remove the existing cameras.
Data Sharing—By Design and via Poor Security Practices
Sharing data between agencies is a core piece of Flock’s business model. That, combined with massive scale, is what makes them so much more powerful than their competitors. They advertise a national network with over 5,000 law enforcement agencies and 1,000 private entities. In California, sharing ALPR data with out-of-state or federal agencies is prohibited by SB 34. This law has been on the books for over a decade, but the Electronic Frontier Foundation discovered 71 California agencies sharing ALPR data illegally, including San Bernardino County Sheriff’s Department (SBCSD). Attorney General Rob Bonta is currently pursuing legal action against the city of El Cajon for this.
Public records from July show SBCSD shares ALPR data with over 270 other agencies in California, Arizona, and Nevada, as well as federal DEA, USPS, ATF, Veterans Affairs, and US Marshals. That data is specifically about Motorola ALPRs, but it seems likely that they would apply similar policies to their newer Flock cameras.
In June, Flock said they disabled their national sharing feature for California to comply with SB 34, but as of January 2026, their website still shows a green dot on this state. And just last month, SBCSD told the Desert Trumpet in a statement, “Any entity who has bought the FLOCK program has access to the system.”
In August, Flock admits federal immigration agents have direct access to tracking data, despite previous claims
Another California law, SB 54, prohibits using state/local resources for immigration enforcement purposes, which includes sharing non-public personal information about individuals with immigration authorities. And yet public records show thousands of Flock searches being performed for immigration-related reasons, including data from states like Illinois, which specifically bans the use of ALPR data for immigration enforcement. In some cases, this is an informal arrangement where ICE agents ask a local cop to run a search for them. Several cops have been found sharing their Flock account passwords with ICE and DEA agents to make this easier. This account sharing violates Flock’s terms of service, and probably the law, but Flock does nothing to prevent it. In fact they help to facilitate it by not requiring multi-factor authentication (MFA). MFA is one of the most basic, common sense requirements for any modern computer system, that helps avoid phishing by requiring an additional code after you enter your password.
In one case, Texas cops used Flock’s national search to investigate a woman who had an abortion. Flock issued a statement denying this, citing Sheriff Adam King who said it was false, but the story remains highly suspicious. King has since been arrested and indicted on felony counts for sexual harassment and whistleblower retaliation, and charged with aggravated perjury for allegedly lying to a grand jury.
Flock also sells their products to HOAs and businesses. Flock claims data collected by law enforcement agencies is not shared with private customers, but nothing in their terms of service actually prevents this.
Thanks to our new paid subscribers, we are at $8865 in subscriptions, just $1,135 short of our $10,000 goal. Upgrade your subscription from free to paid today for just $50 per year or $5 per month.
Are you able to give more than $100? Donate via Paypal!
Contractual loopholes
Flock’s data sharing features are reciprocal, meaning that if the customer (SBCSD) chooses not to share data with other agencies, they also cannot access other agencies’ data. This sharing is a major selling point for cops, so they have a strong incentive to opt in. Even if they opt out, the contract contains several loopholes allowing Flock to share data anyway:
Customer hereby grants to Flock a limited, non-exclusive, royalty-free, irrevocable, worldwide license to use the Customer Data and perform all acts as may be necessary for Flock to provide the Flock Services to Customer.
Flock shall have the right to collect, analyze, and anonymize Customer Data and Customer Generated Data to the extent such anonymization renders the data non-identifiable to create Anonymized Data to use and perform the Services and related systems and technologies, including the training of machine learning algorithms. Customer hereby grants Flock a non exclusive, worldwide, perpetual, royalty-free right to use and distribute such Anonymized Data to improve and enhance the Services and for other development, diagnostic and corrective purposes, and other Flock offerings.
So far, there has not been a clear legal determination about whether license plate numbers are considered Personally Identifiable Information (PII). Thus, Flock might reasonably argue that they are “anonymized data”, and therefore can be used with no restrictions (“…other Flock offerings”).
Subject to and during the Retention Period, Flock may access, use, preserve and/or disclose the Footage to law enforcement authorities, government officials, and/or third parties, if legally required to do so or if Flock has a good faith belief that such access, use, preservation or disclosure is reasonably necessary to comply with a legal process, enforce this Agreement, or detect, prevent or otherwise address security, privacy, fraud or technical issues, or emergency situations.
What counts as an emergency situation? What counts as legal process? If President Trump or ICE orders Flock to share the footage, would they comply?
Even worse, in December, Flock updated their contract to redefine “customer data” as only the images they choose to share. “Customer Data does not include the underlying raw Footage captured by the Flock Hardware”. In other words, they can use that footage for anything at all.
The contract also absolves Flock of any liability should their system make a mistake. Anyone who uses AI knows that it makes mistakes quite often. When police in Aurora, Colorado, used ALPRs to incorrectly identify Brittney Gilliam as a carjacker, they handcuffed her at gunpoint in front of her children, which led to a $1.9 million legal settlement paid by the city. In cases like this, Flock takes no accountability nor liability. According to Flock: “it is not Flock’s job to police the police.”
Security vulnerabilities
According to CEO Garrett Langley, Flock started with the core concept of using low cost consumer technology to create affordable ALPR cameras. Predictably, this has led to a system riddled with security vulnerabilities, which are summarized in Benn Jordan’s excellent video here:
The cameras run an old version of Android OS, which has been discontinued and has not received security patches since 2021.
Last year, at least 60 cameras were accidentally exposed to the internet with no password, potentially allowing stalkers and child predators to spy on potential victims. Some of these cameras were aimed at playgrounds.
Customers are not required to use phishing-resistant MFA, making it easy for accounts to be shared or stolen. At least 35 Flock accounts have been stolen and found for sale on a Russian cybercrime forum.
Flock accidentally shared access to personal information 53 times in public-code, putting both residents and officers at risk.
Weak security on cameras allows hackers to commandeer the camera with a root shell and access hardcoded plaintext secrets.
US Senator Ron Wyden (D-Oregon) and Rep. Raja Krishnamoorthi (D-Illinois) are urging the FTC to investigate Flock for their negligent cybersecurity practices.
If a company whose entire business model is built on collecting and securing sensitive data can’t even secure its own code and API keys, how can we possibly trust them with a nationwide database of our movements?
Flock’s response to all these vulnerabilities has been mostly dismissive, pretending that it’s not a problem because the video is similar what you could see from a public sidewalk. But when you collect billions of images every month, with timestamps and GPS locations, it is very different because that data can paint a very clear picture of everyone’s whereabouts, a boon for hackers, stalkers, and Big Brother.
Elliot Balsley is a video engineer for Netflix, working on cybersecurity.
Note: The Twentynine Palms map originally posted and emailed showed cameras at Two Mile and Lear. The map was later updated to eliminate those cameras - there are not currently cameras located there.
Heading into the 2026 elections, Desert Trumpet has sustained a potential 50% cut in funding. Help us provide the coverage you’ve come to expect by becoming a paid subscriber or upgrading your paid subscription today!
Leave your thoughts in the comments below. Please note that we do not allow anonymous comments. Please be sure your first and last name is on your profile prior to commenting. Anonymous comments will be deleted.
Thanks for reading! This post is public so feel free to share it.
Pre the initial presentation in December 2024, all incurred costs would be paid through a Local Law Enforcement Supplemental Account (LLESA), so this project would have no net fiscal impact on the City.
How do I sign the petition?
Excellent. Thank you.