Where Flock has failed
Benicia's own records show how this system works locally. This is the documented record of where it has gone wrong elsewhere — the misuse, the security failures, and the growing list of cities that have switched it off.
Everything else on this site rests on documents the City of Benicia produced. This page does not. It is a record of what has been established elsewhere — by state audits, court filings, city councils and investigative reporting — because the questions Benicia’s records raise are not unique to Benicia.
Every claim below links to its source. Where reporting and official findings disagree, or where a number depends on who is counting, this page says so.
The national lookup, and who was using it
Flock’s value to a police department is not its own cameras. It is everyone else’s. A department that joins the network can search cameras far outside its jurisdiction — and, for a period, so could agencies the host city had never approved.
In June 2025, 404 Media reported that local police had run lookups “on behalf of ICE”, and that a Texas officer had searched cameras nationwide for a woman who had self-administered an abortion. Flock subsequently stopped agencies from searching cameras inside California, Illinois and Virginia through its national lookup.
Illinois then audited it. On 25 August 2025 Secretary of State Alexi Giannoulias announced (NBC Chicago’s report) that a sample audit of twelve law-enforcement agencies found Flock had allowed U.S. Customs and Border Protection to access license plate cameras on Illinois roads, which his office concluded violated Illinois law restricting ALPR sharing for immigration enforcement or for lawful reproductive healthcare. The audit found 262 immigration-related searches through cameras in Mount Prospect alone. Giannoulias ordered the access shut off; Flock paused its CBP pilot nationwide and ended blanket national and statewide searching by federal agencies. A second audit finding followed on 5 September 2025 against the Forest Park Police Department.
On 8 August 2025, two members of Congress opened an investigation, demanding Flock produce details of all searches of its national network concerning ICE, CBP and abortions. Rep. Raja Krishnamoorthi’s office described the inquiry as concerning Flock’s “role in enabling invasive surveillance practices that threaten the privacy, safety, and civil liberties of women, immigrants, and other vulnerable Americans.”
This is the mechanism, not a metaphor. The reason a Benicia camera matters to someone in another state is that the network is designed to make it reachable. Finding 12 shows how that reach expands here: by vendor email, with an “Accept All” button.
The search that was called a missing-person case
In May 2025, Johnson County, Texas sheriff’s deputies ran two ALPR searches through Flock. The first queried 1,295 networks — 17,684 cameras. The second expanded to 6,809 networks and 83,345 cameras, across a month of data.
Sheriff Adam King said the woman was “being searched for as a missing person” and that “it was all about her safety.” Flock publicly called the coverage “misleading” and “clickbait”, asserting she was sought “as a missing person, not as a suspect.”
Court documents later obtained by the Electronic Frontier Foundation showed the matter was formally classified as a death investigation of a “non-viable fetus”. The detective’s sworn affidavit recorded that he consulted prosecutors about charging her for “taking the pill to cause the abortion.” No charges could be filed. Investigators had collected medication packaging and reviewed her text messages about the abortion.
Why it belongs on a Benicia site: nothing about that search required Johnson County to have a camera anywhere near the woman. It required only that other agencies had joined the same network.
Cities discovering searches they never approved
The most direct parallel to Benicia’s records is Mountain View — a Bay Area city roughly Benicia’s size in camera count.
On 24 February 2026 its City Council voted unanimously to terminate its Flock contract. Police Chief Mike Canfield disclosed that more than 250 unapproved agencies had run roughly 600,000 searches against the city’s 30 cameras between December 2024 and December 2025 — undetected for about a year. His statement to the council:
“To be very clear, we did not know this was going on. We had not set it up, and we were surprised to learn of it.”
The cameras were switched off on 2 February 2026, three weeks before the formal vote.
That is the question Benicia’s own Network Audit export would answer, and it is the record the City has not produced. See what is still outstanding.
The security record
Everything above concerns who is allowed to search. This section is about something prior to that: whether the system can be kept closed at all. Unlike the rest of this page, Benicia’s own records carry four moments of this story, and they are linked below.
2021 — a resident asks, and the vendor answers with a penetration test
In March 2021, before the cameras were installed, a Benicia resident who identified himself as an information security professional emailed the Mayor and Council, citing that week’s breach of the camera company Verkada.
Two months later Flock’s territory manager sent the City its security materials — a CJIS compliance document, a data-security overview, an internet security policy, and “the results of our most recent Penetration Test.”
That test is in the archive. It was run by
Cobalt Labs between 23 November and 7 December 2020 against seven Flock subdomains, including
admin., search., hotlist. and camera-management.flocksafety.com. Its Summary of Findings
records nine vulnerabilities — 7 low, 2 medium, 0 high — grouped as business logic, server
security misconfiguration, authentication and sessions, insufficient security configurability, and
server-side injection.
What the twelve-page report does not contain is any description of a single one of them. The contents run Scope of Work → Methodology → Terms. The findings appear only as counts in a bar chart and as nine numbered dots on a risk-matrix graph.
Stated fairly: a summary-only report is an ordinary thing for a vendor to hand a prospective customer, and detailed findings would themselves be sensitive to circulate. Not claimed here: that anything was concealed, or that the underlying test was inadequate. What the record shows is narrower — the security assurance in the City’s file, offered in answer to a resident’s question, is a 2020 summary with the substance omitted.
November 2025 — a white paper, and CVEs
On 5 November 2025 an independent security researcher published a paper compiling previously disclosed findings about Flock hardware and software. Flock responded the next day, confirming it had “registered the vulnerabilities with the National Vulnerability CVE database via Mitre” and that the researcher “has been in contact with Flock Safety throughout the course of their work.” It disputed the significance, saying exploitation “would not only require physical access to a device, but also require intimate knowledge of internal device hardware.”
Two weeks later the question reached Benicia’s council. On 18 November 2025 Council Member Terry Scott asked the Police Chief about “the concerns related to the vulnerability and security of our systems from hacking.” The email was forwarded to staff, who wrote to Flock:
“Please be prepared to speak to the vulnerability of the system to hacking”
The City’s answer to its own council member’s security question was to ask the vendor to prepare it. That is the pattern documented in finding 7.
Both quotations in this subsection are from an image-only scan that was OCR’d, and the OCR ran
the words together — the source document reads Pleasebepreparedtospeaktothevulnerabilityofthe systemtohacking and thevulnerability and security of our systems fromhacking. Word spacing has
been restored here and nothing else changed; the linked page shows the text exactly as extracted.
December 2025 — cameras streaming to the open internet
In late December 2025, researchers Benn Jordan and Jon “GainSec” Gaines found Flock Condor cameras exposed on the public internet. 404 Media reported at least 60 Condor PTZ cameras live-streaming to the open internet, and verified the exposure itself — by locating a camera and watching its live feed of the reporters. The Independent Institute and WABE also covered the findings.
On 23 December 2025, Flock emailed Benicia about it. That email is in the archive, and it is the vendor’s own account:
“The debug interface on a small number of Condor units was temporarily accessible on the internet without password protection.”
Flock’s framing was that no LPR devices, audio devices or trailers were affected, that the interface allows no manipulation of the camera and no access to the Flock cloud, and that the only content visible was “live or recorded video comparable to what could be observed from a public roadway.” It added that “a website and a sensationalized YouTube channel inaccurately portrayed the extent of this access,” and closed by encouraging the City to forward the message “to others in your department or to councilmembers so they can be prepared for any potential questions.”
Important limit on this finding: the email does not say Benicia’s own cameras were among those exposed. It states that affected customers were contacted directly the previous day and that this was a broader update to everyone else. Nothing in the archive establishes that a Benicia camera was reachable from the internet, and this page does not claim it.
What the record does establish is the shape of the thing: an exposure found by outside researchers rather than disclosed by the vendor, characterised to the City in the same message that advised it how to handle councillors’ questions.
What the courts have said
The leading case is Schmidt v. City of Norfolk, brought in October 2024 by two Norfolk residents represented by the Institute for Justice, challenging the city’s ALPR network under the Fourth Amendment.
On 27 January 2026, Judge Mark Davis of the Eastern District of Virginia ruled for the city — Norfolk’s 176 cameras were not, on that record, an unconstitutional search. He added a warning:
“as the number and capabilities of ALPR cameras expand, the constitutional balancing could conceivably tip the other way.”
Five months later the Supreme Court decided Chatrie v. United States. On 29 June 2026 it held 6–3, in an opinion by Justice Kagan, that accessing stored location data is a Fourth Amendment search requiring a warrant (CNN, NBC News, Congressional Research Service). The plaintiffs in Norfolk are appealing.
Stated fairly: Chatrie concerned cellphone location history held by Google, not licence plate cameras, and it does not by itself make ALPR networks unlawful. Whether its reasoning reaches plate readers is exactly what the Norfolk appeal will test. No court has yet held that a Flock network is unconstitutional.
The argument stopped being partisan
For most of its history the case against ALPR networks was made by civil-liberties groups — the ACLU, EFF, the Institute for Justice. That is no longer where the argument lives.
In July 2026 Tucker Carlson devoted an episode to it, “Whistleblower Reveals the Largest Mass Surveillance Operation in History and the Coming Slave State”. What makes the episode worth recording here is not its rhetoric but its guest list: Flock’s own chief executive, Garrett Langley, appeared alongside his critics, including Benn Jordan — the researcher whose Condor findings are described above — and a former Rhode Island police officer.
Why this belongs on a Benicia site. Nothing about a podcast establishes a fact. But the composition of opposition is itself a fact with consequences for a city council, and it has changed: the objection is now being made simultaneously to civil-liberties lawyers, to Silicon Valley city councils, and to a large conservative audience. A council that expects this argument to arrive from one direction, and to be answerable in those terms, will be surprised.
The officer who objected
Noel Pichardo served with the Pawtucket, Rhode Island police department and began raising concerns after the city adopted Flock in 2021. He told NBC 10 (WJAR) the technology “creates a mass surveillance system” that could be used to “track romantic partners” or “for political means”, and argued citizens should keep “the freedom to be able to move freely in your community without your government tracking you.” He received multiple suspensions and resigned in July 2025.
Stated fairly: this is one side of an employment dispute, and the department disputes the substance. In the same report Detective Captain Kenneth Dolan defended the system — the “cameras are in public places, taking pictures of public vehicles on public roads” — and cited a shots-fired investigation in which Flock identified a suspect vehicle. Pawtucket also disclosed operational figures: 420 database searches in the preceding 30 days, a 30-day retention period, and no sharing with ICE. Not claimed here: that Pichardo’s account of why he left is established, or that anything comparable has happened in Benicia.
The vendor’s posture
In a 2025 interview with Forbes, Langley described the camera-mapping project DeFlock as a “terroristic organization.” In July 2026 he retracted it: “My comments were a mistake and I apologize.” He added that “there are groups today that have real valid criticisms of the business”, and that “what’s changed in the business in the last year is an acknowledgement that we don’t have all the answers.”
That is a notable admission from the vendor, and it is worth setting against the messaging pattern in Benicia’s own file — finding 7, and the December 2025 Condor email above, which told the City how to prepare councillors for questions about a security exposure the City had not been told it was affected by.
Cities that have dropped Flock
Counts vary by who is counting and what counts. The activist tracker Deflock put it at about 23 cities since January 2026 and roughly 98 since 2021; Newsweek’s tracker separates 47 cancelled contracts, 25 rejected proposals, 22 deactivations and one outright ban. The direction is consistent even where the totals are not.
| Place | Action | When | Stated reason |
|---|---|---|---|
| Mountain View, CA | Contract terminated, unanimous | 24 Feb 2026 | 250+ unapproved agencies ran ~600,000 searches, undetected a year |
| Santa Cruz, CA | Cancelled | Jan 2026 | Data accessed by out-of-state agencies and shared with ICE |
| El Cerrito, CA | Not renewed; cameras off 7 Jun 2026 | 2026 | Federal data access; changing state law |
| Los Altos Hills, CA | Ended | 2026 | Privacy and data security |
| Santa Clara County, CA | Voted against adopting | 2026 | Privacy concerns |
| Appleton, WI | Cancelled | May 2026 | “concerns about the integrity of Flock’s underlying system have eroded our trust” |
| Harrisonburg, VA | Agreement ended | 20 Jul 2026 | Fourth Amendment concerns; erosion of community trust |
| Elkton, VA | Ended | 2026 | Followed Harrisonburg |
| Menominee, MI | Cancelled, unanimous | May 2026 | Cameras activated without council approval |
| Ypsilanti, MI | ALPRs formally banned | 2026 | Ordinance |
| Bloomington, IN | Cancelled ($50,000) | 2026 | Community pushback |
| Tompkins County & Ithaca, NY | Cancelled | 2026 | Resident activism over surveillance |
| Saranac Lake, NY | Declined | 2026 | Privacy concerns |
| Framingham, MA | Declined contract | 2026 | Public opposition |
| Shoreline, WA | Rejected proposal | Apr 2026 | Public opposition |
| Salem, IL | Rejected | 2026 | Contract term changes |
| San Marcos, TX | Renewal declined | 2 Dec | Legal liability and privacy |
Flagstaff AZ, Cambridge MA, Eugene OR and Santa Cruz CA are also among localities that deactivated cameras or cancelled since the start of 2025. The Los Angeles Police Department has been reported as declining to renew — the largest such decision so far, and one worth watching for confirmation in the department’s own records.
Important limit on this table: these entries are drawn from news reporting, not from each city’s own minutes. Council actions get amended, delayed and reversed. Before citing any single row, check that city’s agenda packet. Where a date is given without a month it is because the source did not supply one.
Where this touches Benicia
Three agencies that appear in Benicia’s own records have since moved against Flock in their own cities:
- Mountain View PD holds a signed data-sharing acknowledgment letter in Benicia’s roster — and terminated its own Flock contract on 24 February 2026.
- El Cerrito PD requested access to Benicia’s cameras on 16 October 2025; El Cerrito switched its own cameras off on 7 June 2026.
- Santa Cruz PD requested access on 10 November 2025; Santa Cruz cancelled in January 2026.
Not claimed here: that any of these agencies searched Benicia’s cameras, that access was granted, or that data flowed after they ended their own contracts. The roster records a signed letter and two pending requests — nothing more. What it does show is that agencies enter this network and leave it independently, while the letters and requests behind them sit in a file. Benicia’s roster is a snapshot of who asked, not a live register of who is still participating.
See finding 6 on how that sharing is documented here, finding 14 on what residents were told about it, and the agencies list for the full roster.
What this page does not claim
It does not claim Flock’s technology fails to work as advertised, that ALPRs never solve crimes, or that every cancellation above was decided on the merits rather than politics. Several councils acted amid organised campaigns; that is how local government works, and it is not evidence either way about the underlying system.
The pattern this page does document is narrower and better supported: that access to these networks has repeatedly turned out to be broader than the host city believed, that this was discovered by audit and journalism rather than disclosed, and that a growing number of jurisdictions have concluded the trade is not worth it.