The editorial reframes the issue away from Fourth Amendment abstractions and toward concrete system design: Flock's 'reason' field is honor-system free text, the privilege check happens at login rather than at query time, and audit logs after the fact don't deter misuse. The structural flaw is identical to any internal admin tool shipping with is_admin=true and an unvalidated justification field.
The IPVM report frames the documented stalking cases as evidence that internal department policy and Flock's own audit logging are structurally insufficient. Their thesis is that querying a nationwide vehicle-movement database should require a warrant, because only external judicial review can constrain officers who already have legitimate credentials.
Notes that Flock's two statements — that misuse is rare and that domestic stalking is the most common abuse pattern — are technically compatible but together undermine the marketing claim that audit logs deter abuse. If the deterrent worked, the dominant abuse type wouldn't be cops tracking women they're personally entangled with.
IPVM, the surveillance-industry trade publication, published a report documenting multiple cases of U.S. police chiefs using Flock Safety's automated license plate reader (ALPR) network to track women they were romantically involved with — current girlfriends, ex-girlfriends, and in at least one case a woman who had ended contact. The story hit 506 on Hacker News and pulled the predictable practitioner reaction: this is not a policy failure, it is an access control failure.
Flock operates roughly 40,000 cameras across more than 5,000 U.S. communities, feeding a queryable nationwide database of vehicle movements. Any officer with credentials at a subscribing department can query that database. The system logs queries and asks officers to enter a reason — a free-text field that is not validated, not gated, and not reviewed before the query returns results. The 'reason' field is honor-system input on a database of where tens of millions of Americans drove yesterday.
Flock's public response, as quoted in the IPVM report, characterizes this misuse as rare while simultaneously identifying domestic stalking as the most common abuse pattern the company sees. As one HN commenter pointed out, those statements aren't contradictory — abuse can be rare in absolute terms and still dominate the abuse mix — but they collapse the marketing claim that audit logs deter misuse. If your most common abuse pattern is a cop stalking his ex, the deterrent isn't working.
The surveillance debate usually gets framed as civil liberties vs. public safety, which is exactly the framing that lets the actual engineering problem walk past undefended. This isn't a Fourth Amendment debate. It's an IAM debate. The Flock architecture has the same structural flaw as every internal admin tool that ships with `is_admin = true` and a free-text justification field: the privilege check happens at login, not at query time, and the constraint on what an authenticated user can do is social, not technical.
Compare to how a competent backend team would build this if the threat model were taken seriously. Mandatory two-party approval for any cross-jurisdiction query. Cryptographically signed warrant attestations bound to the query payload, expiring on a short clock. Differential privacy noise on aggregate queries. Rate limits that catch a single officer running 40 plate queries on one person across three weeks. Anomaly detection that flags repeated queries on the same plate from the same operator with no associated case number. None of this is exotic — it's the same playbook any fintech uses to keep their own employees out of customer accounts.
The community discussion landed on a sharper point: enforcement requires friction. Audit logs without consequences are decorative; the abuser knows the log exists and queries anyway because nothing happens. Stripe doesn't deter employee snooping with logs alone — it deters it by making the queries expensive, slow, and visible to a security team in real time. Flock has the logging primitive. It declined to build the enforcement primitive, and now it's surprised that authenticated users with no friction in their workflow are doing what authenticated users with no friction always do.
There's a second-order point that matters for anyone building B2G (business-to-government) software. The buyer — a police chief — is also the worst-case insider threat in the documented cases. When the person signing the procurement contract is the same person who would misuse the product, 'admin can do anything' is not a feature, it's a liability the vendor inherits. Flock's revenue model depends on chiefs not being told 'no' by their own software, which is why the product doesn't tell them 'no.' This is the same pattern that produced every CRM with a 'mass delete customer PII' button — vendor optimizing for buyer convenience over end-user safety.
If you build or operate any system that exposes PII to authenticated internal users — and most enterprise apps do — the Flock story is a checklist, not a news item.
First, treat the 'reason' field as fiction. Any free-text justification on a sensitive query is unaudited until someone audits it, and nobody audits 40,000 cameras worth of query logs. Replace it with structured input bound to a case ID, ticket number, or signed approval token. If a query can succeed without a verifiable upstream artifact, you don't have access control — you have access theater.
Second, rate-limit by subject, not just by operator. Most internal-tool abuse looks like normal volume from the operator's side (a cop runs lots of plate queries) but anomalous concentration on the subject side (one plate, queried 40 times by one officer over six weeks, on dates that correlate with that officer's days off). The cheap detection is per-subject query density per operator. The cheap mitigation is a soft block after threshold N requiring a second-party signoff.
Third, log the *result*, not just the query. Flock logs that an officer queried plate ABC123. It does not log that the officer then drove to the address where ABC123 was last seen. The reason this matters for your stack: if you're only logging API calls, you're missing the action chain. Pair query logs with downstream action logs and surface the join to a security team that doesn't report to the user being audited.
Fourth, two-party approval for high-blast-radius queries is no longer a paranoia control — it's table stakes. The same companies that require two engineers to merge a production deploy let a single support agent pull a celebrity's address. Fix the asymmetry.
The regulatory pressure on ALPR networks is coming regardless — multiple state legislatures already have bills in committee — but the technical fix doesn't require legislation. Any vendor whose product can be misused by a single authenticated user without triggering a second human in the loop is shipping a known defect; the only question is whether they patch it before the lawsuits or after. Flock will likely add warrant-attestation tooling within 12 months, because the alternative is being named in the next civil suit. The interesting question for the rest of us is whether we audit our own internal tools with the same skepticism IPVM brought to Flock, or whether we wait for our own version of this report.
Remember that scene from "Men in Black" where K watches surveillance video feed of his ex? In the movie it was meant to be wistful and cute, I guess. Now that such systems are getting closer to reality, you realize the potential for abuse in enormous.
This shouldn't be hard to understand. Don't talk to the police, without your attorney present, under any circumstances whatsoever.Dating the police is just such an astoundingly egregious violation of this principle that I can only wonder what, if anything, those people are thinking.Anyway,
Scott Adams' had a great line:"Whenever people have the opportunity to commit fraud and there is no monitoring, you can assume they are committing fraud."
Ultimately, there’s a sort of homeostasis in people’s tolerance for crime. If you need video evidence for prosecution, those who want it prosecuted will produce video cameras. If you make warrants impossible to produce in a timely manner, the camera search will be warrant exempted.Attempts to damage
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
No, it shows that we have a destructive, trust undermining security industry that sells abusive surveillance software that by spirit of the law would be clearly illegal in any country that pretends to be a free and open society and has a constitution in the direction.