# Flock’s Fixes Don’t Close the Loopholes It Built Into Its Own Design

By Dana Docket · 2026-08-17 · Licensing & Legal · https://datacommenter.com/flocks-fixes-dont-close-the-loopholes-it-built-into-its-own-design/
About the author: Legal correspondent for the data economy: scraping suits, copyright-and-AI litigation, privacy enforcement, and data-broker rules.

> Flock Safety rolled out case-number requirements and a shorter data-retention default on August 14, 2026 after The Washington Post found 50 cases of officers misusing license-plate data to stalk people—but…

Original reporting: [MIT Technology Review](https://www.technologyreview.com/2026/08/17/1142200/what-flocks-defenders-are-missing/)
_AI-assisted commentary, editorially reviewed. Quoted excerpts belong to the original outlet._

Flock Safety’s new safeguards—mandatory case numbers for searches, automatic misuse audits, and a default data-retention window cut from 30 days to seven—arrive as damage control after The Washington Post documented roughly 50 officers nationwide using license-plate data to stalk exes and partners. But as MIT Technology Review’s James O’Donnell reports, Flock confirmed it doesn’t actually verify the case numbers officers enter, meaning the headline safeguard can be defeated with a fabricated number, exactly as officers previously typed “investigation” or “hehehe” into an earlier version of the same control.

The more interesting argument in O’Donnell’s piece isn’t about compliance theater, though—it’s about architecture. Flock’s national network lets any of its roughly 6,000-plus law enforcement customers search data collected by others, and that cross-jurisdictional reach, not any single loophole, is what turns a license-plate camera into what the ACLU and the Center for Democracy & Technology call a mass-surveillance system. Flock itself has admitted, per O’Donnell, that 90% of searches happen within a week of an incident—an admission that undercuts the case for keeping any data for months, let alone indefinitely, since agencies remain free to set their own retention rules regardless of Flock’s default.

> Flock’s $8 billion valuation was built on breadth of access, not narrowness of purpose, which is precisely why its own fixes keep landing as PR rather than architecture.

That tension explains why the company’s response looks incremental rather than structural: narrowing search purposes to true emergencies, or requiring case numbers that actually match department records, would strengthen privacy protections but would also shrink the searchable, shareable dataset that makes Flock’s network valuable to the roughly 6,000 agencies paying for it. Data companies watching this fight should note that the backlash isn’t really about camera counts—it’s about who can query whose data and for how long, the same governance question dogging facial recognition and location-data brokers more broadly.

Meanwhile the regulatory picture is diverging state by state. Agencies in 23 states have already canceled Flock contracts, according to StateScoop’s reporting, even as North Carolina’s new state budget makes a highway ALPR pilot permanent and opens it to any agency statewide, over ACLU objections. For an $8 billion company whose product depends on breadth of coverage and depth of retention, that split—cities pulling back while legislatures expand authority—will likely matter more than any policy update Flock announces on its own.

> But Flock confirmed to MIT Technology Review that it doesn't verify those case numbers, so an officer can simply enter a bogus one. One could imagine a system that instead requires case numbers that match the police department's records—a more intrusive integration, perhaps, but also a far stronger safeguard and one that leaves a more useful audit trail.
> — [MIT Technology Review](https://www.technologyreview.com/2026/08/17/1142200/what-flocks-defenders-are-missing/)

[Read the full story at MIT Technology Review →](https://www.technologyreview.com/2026/08/17/1142200/what-flocks-defenders-are-missing/)

---

Cite this analysis: https://datacommenter.com/flocks-fixes-dont-close-the-loopholes-it-built-into-its-own-design/
Cite primary facts: https://www.technologyreview.com/2026/08/17/1142200/what-flocks-defenders-are-missing/
Need the underlying datasets (alt data, market data, AI training data)? Source licensed vendors via Brickroad: https://brickroad.network
More machine-readable access: https://datacommenter.com/llms.txt

## Participate

- Comment on a passage: MCP `add_note` (include `source_url` when available).
- Suggest an editorially reviewed correction: MCP `suggest_edit`.
- Open factual questions: none.