Flock, the automatic license plate reader (ALPR) company whose cameras are installed in more than 5,000 communities in the U.S., is building a product that will use people lookup tools, data brokers, and data breaches to “jump from LPR [license plate reader] to person,” allowing police to much more easily identify and track the movements of specific people around the country without a warrant or court order, according to internal Flock presentation slides, Slack chats, and meeting audio obtained by 404 Media.
The news turns Flock, already a controversial technology, into a much more invasive tool, potentially able to link a vehicle passing by a camera to its owner and then more people connected to them, through marriage or other association. The new product development has also led to Flock employees questioning the ethics of using hacked data as part of their surveillance product, according to the Slack chats. Flock told 404 Media the tool is already being used by some law enforcement agencies in an early access program.
Flock’s new product, called Nova, will supplement license plate data with a wealth of personal information sourced from other companies and the wider web, according to the material obtained by 404 Media. “You’re going to be able to access data and jump from LPR to person and understand what that context is, link to other people that are related to that person […] marriage or through gang affiliation, et cetera,” a Flock employee said during an internal company meeting, according to an audio recording. “There’s very powerful linking.” One Slack message said that Nova supports 20 different data sources that agencies can toggle on or off.
Flock sells its ALPR cameras to communities, homeowners associations, schools, and businesses with the promise of solving crime and deterring criminals. Communities can then opt to share their cameras’ data with law enforcement, and law enforcement agencies purchase their own Flock cameras too. The cameras continuously record the plates, color, and make of vehicles passing in front of them, and store a timestamp of when, and where, each vehicle was spotted. Flock has also expanded into drones and gunshot detection. Nova will make the product even more invasive, experts say.
“Flock has hundreds of customers, both law enforcement and private residents. This development will certainly help to bring expanded surveillance powers to police departments of all sizes that never needed this much information on any random person who happens to drive by,” Beryl Lipton, senior investigative researcher at activist organization the Electronic Frontier Foundation, told 404 Media in an email.
In the meeting audio obtained by 404 Media, the Flock employee described the sorts of information the company will supplement ALPR data with. The first is data breaches. One example the employee pointed to was a 2021 data breach impacting users of Park Mobile, an app that allows users to pay for parking without physically going to the parking meter or in some lots where meters no longer exist. That data included license plate numbers with their owners’ associated email addresses, phone numbers, and in some cases mailing addresses. With regards to Flock, “Nova ingests that and is able to use that to contextualize the data. So we’re now able to make that cognitive leap from LPR to person,” the employee said.
“You’re going to be able to access data and jump from LPR to person.”
Over the last several years more surveillance and technology companies have packaged stolen or hacked data and then sold access to that information to law enforcement. The practice raises questions around the ethics of re-using such data for surveillance purposes; the legality of doing so; and the chain of custody of that information if it was ever used as part of a criminal investigation.
The second was “commercially available data,” with the employee explicitly naming credit bureaus Equifax and TransUnion. As 404 Media has reported, when people open a credit card their personal information is sent to the credit bureaus in their role as monitoring peoples’ credit. Some bureaus then repackage and sell this information to law enforcement or other data brokers. TransUnion has a data product called TLOxp. That tool can include addresses, social media data, and vehicle ownership information. Equifax did not respond to a request for comment. A TransUnion spokesperson told 404 Media “We cannot comment on individual business relationships.”
The third is public records such as marriage licenses, property records, and campaign finance records, the employee said. The slides say that Nova will also pull data from law enforcement Records Management Systems (RMS), which are typically databases for storing information on cases, and Computer Aided Dispatch (CAD) systems, which manage responses to 911 calls.
At the moment a police officer might take a result from an ALPR database—a vehicle with this plate was at this location at this time—then use more data from other sources, such as a DMV, to find who owns that vehicle. Then, they might perform open source intelligence, or OSINT, to find out more about that person or where they live by digging through public records. “Law enforcement use these tools every day, just in a very fragmented basis. And what we’re doing is bringing them under one roof” with Nova, the employee said in the meeting.
Lipton said “For police, the definition of what is considered ‘open source’ has really expanded to include information to which no one should ever have had access. Our health data, our financial records, or any of our other digital data is hacked and ends up on the Internet, companies scrap it up and add it to their package of information for police. Law enforcement would have otherwise needed to have a valid reason and warrant to access such stuff but now can just buy that access.”
Chad Marlow, senior policy counsel at the American Civil Liberties Union (ACLU), told 404 Media in an email “It is quite troubling that Flock ALPRs are designed to produce a massive overload of surveillance data by gathering and sharing ALPR data nationwide, and now they are marketing a product to help the police deal with the data overload they created.”
Flock said in a statement that “Nova is a public safety data platform that helps investigators analyze and connect data they already have access to, surfacing insights to uncover leads and close cases faster. The software is completely customizable—customers choose what data inputs they want in Nova and what permissions each user has access to. In other words, Nova is a software product and the data sources are chosen by the customer.”
The company said all actions within the Nova platform are permanently recorded in an audit trail. “While officers may have access to similar information through other means, centralizing it within Nova adds a crucial layer of transparency and accountability, so our democratically-elected governing bodies can ensure it is used in accordance with the law,” the statement added.
“Nova is currently being used by select law enforcement in an Early Access program. It has already helped a detective investigating Internet Crimes Against Children (ICAC) cases identify leads and confirm suspects (who were sentenced to 80 years in jail), amongst other successes,” it continued.
Flock declined to answer specific questions about its data sources, instead saying that some of the questions pertain to proprietary data. The company said that while Nova is in early access, it will be announcing general availability to the tool in June.
According to the leaked slides, Flock sees its main competitors to Nova as similar tools from Peregrine and Auror.
In October, 404 Media reported on a lawsuit which argued that warrantless use of Flock’s technology is unconstitutional. “It is functionally impossible for people to drive anywhere without having their movements tracked, photographed, and stored in an AI-assisted database that enables the warrantless surveillance of their every move. This civil rights lawsuit seeks to end this dragnet surveillance program,” the lawsuit, filed by the Institute for Justice, a civil liberties organization. In February a judge said that lawsuit could proceed, and the Institute for Justice told 404 Media the case is currently in discovery.
Typically police officers do not obtain a warrant before using Flock’s or other companies’ ALPR systems. That is part of the attraction to law enforcement: private companies install ALPR cameras around the country, or build historical ALPR databases, and police departments and federal agencies can simply pay for or request access.
“The Supreme Court has said that the Fourth Amendment’s overarching goal is to prevent ‘too permeating police surveillance.’ Yet, Flock is working to do just that,” Michael Soyfer, an attorney with the Institute for Justice, said in an emailed statement. “Backed by billions of dollars in capital, it’s working with police departments across the country to build out a massive database of people’s movements and locations. All an officer or another government employee needs to do to access that database is type in a search, provide some generic reason, and hit enter.”
“Flock’s constant announcements of new and more invasive features just reinforces the need for a warrant requirement,” he added.
Inside Flock, employees have voiced concern about the Nova product, according to the Slack messages. One pointed to the use of hacked data like the Park Mobile Breach. “I was pretty horrified to hear we use stolen data in our system. In addition to being attained illegally, it seems like that could create really perverse incentives for more data to be leaked and stolen,” they wrote. “What if data was stolen from Flock? Should that then become standard data in everyone else’s system?”
One Slack message said that Flock’s philosophy is “We live in a western democracy governed by the rule of law, set by democratically elected representatives. Nova will always operate within those boundaries.”
Jay Stanley, senior policy analyst at the ACLU’s Speech, Privacy, and Technology Project, said at “this moment in history, of all times, you especially don’t want to be building authoritarian spying structures for law enforcement.”
“People are being literally put behind bars for writing an op-ed,” he added, referring to Tufts student Rümeysa Öztürk. Öztürk was released earlier this month after spending six weeks in detention.
Civil rights groups are increasingly worried that ICE, for example, could turn to similar surveillance technology as part of its mass deportation efforts. That’s because the agency has had access to ALPR data from local police departments, including in sanctuary cities, The Guardian reported in March. That involved a different ALPR company called Rekor, the report said.
