The Camera That Convicts Killers And Stalks Ex-Girlfriends: The Flock Dilemma No One Can Resolve

In February 2026, a Flock Safety camera in Sherwood, Arkansas, misread a single digit on a license plate. Police treated the alert as a stolen vehicle hit and conducted a high-risk stop. An innocent couple was ordered out of their car at gunpoint while their six-week-old baby sat in the back seat. Five months earlier and 500 miles away, a Hays County, Texas, jury sentenced Omar Galvan-Ochoa to life in prison for shooting a man three times in the back at a Buda gas station. The surveillance video of the murder was too grainy to reveal the killer’s plate. Flock images identified the truck. A local witness confirmed it. A murderer is behind bars because those cameras existed.

Both of these things are true. Both happened because of the same technology, operating exactly as designed. And studying the record, I cannot tell you whether Flock is a net good or a net evil. I genuinely do not know. What I can do is arm you with both sides of the ledger, because your city council, your sheriff, your state legislature, and eventually Congress are going to have to decide, and they should decide with eyes open. Let me warn you, no matter where you stand on the Flock issue, you’re not going to be happy with this op-ed.

Start with what the cameras accomplish, because the case is stronger than critics admit. Flock operates more than 120,000 cameras across 49 states, generating an estimated 20 billion scans per month. The company’s 2025 Impact Census, drawn from nearly 700 agencies in 43 states, reported that its systems supported more than 1 million investigations and assisted in roughly 20% of solved cases in customer jurisdictions. Approximately 10,000 missing persons were located, about 27 per day. Those are company figures and deserve appropriate skepticism, but independent research points the same direction. A randomized National Institute of Justice experiment in Mesa, Arizona found that license plate readers checked 8 to 10 times as many plates as manual methods, produced nearly three times as many stolen-vehicle hits, and doubled recoveries. That is the definition of a force multiplier.

The prosecutorial record is concrete. In July 2026, a robber hit the First Convenience Bank on Houston’s Eastex Freeway and fled in a gray sedan. Bank surveillance captured the plate. Flock located the car. Deputies found the suspect still wearing the same clothing, still holding the handwritten demand note and the bank’s money. In Norfolk, Virginia, a detective searching a two-hour window on two cameras turned a vague description of a white BMW with black rims into a plate, a registration match, search warrants, recovered stolen property, and guilty pleas that survived appellate review. San Diego’s official 2025 surveillance report documents 361 cases advanced, 269 arrests, 12 firearms recovered, $3.1 million in stolen property returned, and assistance in nearly a third of the city’s homicide investigations. As Hays County prosecutor Elizabeth Schmidt put it after the Galvan-Ochoa verdict, bringing the killer to justice was a team effort. The camera was one member of the team. It did not convict anyone by itself. It gave human investigators a lead that would otherwise have evaporated, and ordinary warrants, witnesses, and juries did the rest.

Now the other ledger, and it is long. The Institute for Justice, a libertarian legal foundation not known for hostility to property rights or police, has documented at least 26 cases of officers using license plate readers to stalk romantic interests, most since 2024. These were not rookies who misunderstood policy. A Kansas police chief searched his former girlfriend’s vehicle 164 times and her new boyfriend’s 64 times. A Georgia deputy allegedly searched the plate of a woman he was having an affair with 1,639 times. Georgia alone has produced at least 19 public employees implicated in Flock or ALPR misuse, including a police chief charged with stalking, five Albany officers arrested in a single July 2026 sweep, and a dispatch supervisor arrested just this week. Critically, IJ found that only a few of these cases were caught by internal controls. Most surfaced because a victim complained. The audit log existed the whole time. Nobody was reading it.

The mission creep is worse than the stalking, because it is institutional rather than personal. A Johnson County, Texas investigator searched 83,345 cameras across 6,809 networks looking for a woman, reaching cameras in Illinois and Washington whose local governments never consented to that use. Ventura County, California, discovered more than 364,000 out-of-state queries of its data in roughly two months, without the county’s knowledge. An Illinois audit found federal Customs and Border Protection accessing state camera data in violation of state law. A DEA agent in Louisville used a local detective’s password without the detective’s knowledge. Flock’s own CEO, Garrett Langley, admitted the company “didn’t create distinct permissions and protocols” to ensure federal users followed local rules. The Electronic Frontier Foundation examined more than 12 million searches and found over 50 agencies running protest-related queries, including searches justified simply as “KINGS DAY PROTEST.” Whatever your politics, understand the symmetry: a network that can identify every vehicle near an anti-ICE march can identify every vehicle near a pro-life vigil or a gun rights rally. The infrastructure does not care which side you are on.

Then there is error. IJ catalogs 27 mistaken stops from stationary plate readers since 2018, with 19 traced to Flock cameras, and in nearly two-thirds of them officers drew or pointed guns before discovering the mistake. Grandparents held at gunpoint in Tennessee because a camera read an O as a zero. A Toledo man jailed and bitten by a police dog over a misread 7. An innocent motorist in Volusia County who spent 13 days in jail. And the security picture is genuinely alarming: at least 35 sets of stolen customer credentials, some offered on a Russian-language cybercrime forum, more than 60 camera feeds sitting on the open internet with no password, and 15 published CVE vulnerabilities including hardcoded passwords and disabled secure boot. Douglas County’s Republican sheriff, Darren Weekly, canceled his contract after finding one of his own feeds exposed online. “Trust was lost,” he said. Even the vendor’s conduct raises questions. Flock employees accessed Dunwoody, Georgia’s cameras overlooking a children’s gymnastics facility, a playground, and a Jewish community center more than 480 times, some of it for sales demonstrations.

So which is it? Here is where honesty requires me to disappoint you. The tool that found the Buda murderer’s truck and the tool that let a chief stalk his ex are the same tool, and not accidentally. The very feature that makes Flock powerful for prosecution, the ability to reconstruct where a vehicle has been across time and across jurisdictions, is precisely the feature that makes it irresistible for abuse. You cannot have one without at least the standing temptation of the other. A single officer at one intersection seeing one plate is traditional policing. A searchable 30-day national history of a vehicle’s movements is something categorically different, and our law has not caught up to the difference.

Can regulation thread the needle? Perhaps. The reform menu is well developed: warrant requirements for historical movement searches, mandatory multifactor authentication, prohibition of shared credentials, monthly insider-threat audits, automatic flags when the same private vehicle is searched repeatedly, verification of plate and vehicle before any high-risk stop, criminal penalties for personal use, and public reporting of outside-agency access. Georgia’s cascade of arrests suggests audits work when someone actually performs them, which raises the uncomfortable question of what every non-auditing state would find if it looked. San Diego proves that detailed public reporting is practical. But the skeptic’s rejoinder deserves equal weight: nearly every abuse cataloged above occurred despite existing policies, existing logs, and existing rules. The Fort Bend County lieutenant who ran hundreds of personal searches received a two-day suspension. Rules that are not enforced are decorations, and a movement database may simply be too tempting for the roughly 800,000 sworn officers, countless civilian employees, federal agents, and vendor staff who can touch it. I find I cannot confidently predict whether the reform program tames the tool or merely papers over it, and anyone who claims certainty on this question is selling something.

What I am certain of is this: the decision belongs to you and your neighbors, not to a vendor’s marketing department and not to a privacy group’s press release. Oshkosh rescinded its contract in under 24 hours after learning the company misdescribed a heat map feature. Evanston pulled 19 cameras. Harris County renewed for $868,975. Each community weighed the same evidence and reached a different answer, which is federalism working as intended. Ask your police department for its search logs, its audit schedule, its error rate, and its outside-access list. Ask your prosecutor how many cases the cameras actually built. Then decide whether the murderer caught in Buda outweighs the infant at gunpoint in Sherwood, or the reverse. I have laid out both pans of the scale as fairly as I can. I do not know which way it tips. That judgment, in a free country, is yours.

If you enjoy my work, please subscribe https://twitter.com/amuse/creator-subscriptions/subscribe.

Sponsored by the John Milton Freedom Foundation, a nonprofit dedicated to helping independent journalists overcome formidable challenges in today’s media landscape and bring crucial stories to you.

READ NEXT: Secret Service Details Security For Trump’s WHCA Dinner