The case against
Flock Safety

Who Pays for Flock?

Flock leases each camera for roughly $3,000 per year. The math doesn't add up. The company is valued at $8.4 billion. That gap is the entire story.

Oklahoma City pays Flock approximately $3,000 per camera per year for hardware, mounting, batteries, cell service, solar panels, and maintenance.^[1] Across Flock's claimed deployment of more than 40,000 cameras serving over 5,000 agencies,^[2] that works out to roughly $120-150 million in annual camera-leasing revenue.

In April 2026, the company was valued at $8.4 billion.^[3]

The investor profile confirms the framing. Flock's lead investor is Andreessen Horowitz, which has put nearly $1 billion into the company.^[4] A16Z's portfolio is dominated by data infrastructure and AI plays - Databricks, Snowflake, Scale AI, Palantir-adjacent ventures. They are not known for investing in security camera leasing companies. They invest in data platforms.

So either A16Z is wildly overpaying (unlikely - they have a long track record), or camera leasing fees are a loss leader for a much larger data business that has not been disclosed to the cities being surveilled.

The data fusion product

The clearest evidence of where Flock is actually headed is their newer product, Flock Nova. In April 2025, 404 Media reported that Flock Nova was being built to combine ALPR data with third-party data, including data obtained from large-scale hacks and security breaches.^[5] After the story ran, Flock announced it would stop using illegally obtained data.^[6] The architecture of the product - a fusion platform joining ALPR data with external sources - remains.

Flock markets Nova as "one click, one case solved", querying:

• ALPR camera images and metadata
• Computer-aided dispatch (CAD) records
• Criminal records databases
• Video surveillance feeds (their own and third-party)
• "Third-party data acquired by Flock Safety"

That last category - "third-party data acquired by Flock Safety" - is the business model. The cameras generate the raw input. The data fusion platform is what gets sold.

Who is actually buying?

Flock does not publish a list of its data customers. Based on documented incidents and industry patterns, the candidates include:

Federal agencies. In Mountain View, California, the ATF, Air Force, and GSA Inspector General accessed local Flock data for 17 months without local police knowledge or approval.^[7] Flock data has been queried for immigration-related searches over a thousand times in Denver alone.^[8] The platform is designed to integrate with federal law enforcement systems.

Insurance companies. Vehicle location patterns are directly convertible into auto and home insurance risk pricing. Major insurers already buy vehicle telematics data; ALPR data is the next layer.

Other data brokers. Movement data joined with shopping data, employment data, and credit data produces extremely precise individual profiles. Data brokers are Flock's investor profile's primary business.

Retailers and HOAs. Companies and homeowners associations that host Flock cameras on private property are themselves customers of analytics derived from those cameras.

What this means for Oklahoma City

Oklahoma City pays Flock roughly $270,000 a year for 90 cameras.^[9] That money buys the surveillance. It does not buy any visibility into who else is accessing the resulting data, what it is being used for, or who is paying Flock the difference between $270,000 and the share of an $8.4 billion valuation that OKC's data contributes.

Before the next contract renewal vote, the question Oklahoma City Council must answer is not just "is this system effective?", but also "do we know who else is buying the data we're paying to generate?"

The Company Behind the Cameras

When the same company gets caught lying in council chambers, lying in marketing materials, lying about security, and lying about who can access the data - the pattern stops being a series of unfortunate incidents and starts being a business strategy.

The public debate around Flock often starts with "is the technology good or bad?" That's the wrong question. The right question is whether the company building, selling, and operating this technology has earned the trust required to do so. The evidence is now substantial that it has not.

The Oshkosh moment

In April 2026, Oshkosh, Wisconsin's city council approved a Flock contract on a Tuesday and rescinded it less than 24 hours later after the Police Chief discovered that Flock representatives had given the council false information during the deliberation.^[1]

A council member specifically asked whether the system creates "a pattern or heat map of an individual's movement." The Flock representative answered "no." That answer was demonstrably false. Flock's own platform contains a feature literally called a "heat map" that displays where a vehicle has been detected over a 30-day retention window. Flock's later "clarification" was that they don't track individuals, they track vehicles - as though the people inside those vehicles are not the point of the surveillance.^[2]

Oshkosh Police Chief Dean Smith's response was unambiguous:

A council member added: "I don't know how I can discern what's right if you lie to me."^[1]

The CEO's response to scrutiny

In December 2025, Flock CEO Garrett Langley sent an unsolicited email to law enforcement agencies nationwide. Its opening line:

Langley went on to characterize independent journalism and public records requests as weapons used "against you and against us."^[3]

The "coordinated attack" he was describing consisted of:

• Security researchers publishing documented vulnerabilities (numerous CVEs in NIST's National Vulnerability Database)^[4]
• Journalists at 404 Media, the EFF, NPR, and elsewhere reporting on the company's products and behavior
• Citizens filing public records requests through standard legal channels
• Independent investigators publishing findings on YouTube

The Staunton, Virginia Police Chief, Jim Williams, wrote back. After noting that his constituents were raising legitimate concerns about whether the system was being used to surveil private citizens for "nefarious purposes," he closed with:

Staunton terminated its Flock contract.^[5]

The opacity playbook

When confronted with public scrutiny, Flock's documented responses include:

Sending cease-and-desist letters to community researchers. Flock sent a C&D to DeFlock.me, a community-run mapping project, claiming trademark dilution. EFF and the project's creator publicly refused the demand. The map remains online.^[6]

Blocking the Internet Archive. Flock's master terms of service block the Wayback Machine from archiving the page, making it impossible for cities to track contract changes over time. We know this because the February 2026 contract update was caught only by third-party analysis - not by archived comparison.^[7]

Rewriting contracts quietly. In February 2026, Flock made 147 changes to their standard master agreement. The most consequential: they deleted the clause stating "Flock does not own and shall not sell Customer Data" and replaced it with a "perpetual, irrevocable, worldwide, royalty-free" data license that survives contract termination.^[7]

Public denial despite published evidence. The CEO has repeatedly claimed on LinkedIn and in press statements that Flock has never been hacked and that their security is best-in-class. Independent researchers have demonstrated cameras can be compromised in 30 seconds. 67 cameras were found streaming live video to the open internet without any authentication - including one pointed at a children's playground.^[8]

What Flock employees actually do with the system

In Dunwoody, Georgia, public records requests by independent researcher Jason Hunar revealed that Flock's own employees, including the company's VP of Business Development, were logging into customer Flock systems and running searches.

One Flock employee searched a city's database 63 times in a single year - despite not being a police officer or city employee. Multiple Flock employees were documented accessing cameras inside a community gym, including the pool, fitness studios, and preschool daycare areas.^[9]

This is a vendor whose contract claims to restrict access to authorized law enforcement personnel. The audit logs say otherwise.

The vendor's own standard

Here is what makes the pattern particularly indefensible: Flock's own CEO has publicly stated that every city using Flock should have published use policies and should conduct regular audits to ensure compliance.^[10]

Oklahoma City has neither. OKC is not meeting the standard set by the company selling us the product - and the company has not raised an objection, because the absence of oversight is what keeps the data flowing.

What this means for Oklahoma City

Before any renewal vote, the question is not whether Flock could behave better. The question is whether a company with a documented multi-year pattern of misrepresenting its product, its security, its data practices, and its critics is a company Oklahoma City should continue paying with public funds.

The evidence on that question is now public. The decision is the council's.

The Technology

Oklahoma City voted on a license plate reader. Three years later, the same hardware is part of a platform that follows people on foot, listens for human voices, and connects to drones - all without a single new council vote.

The 2023 contract Oklahoma City signed was framed as a tool for finding stolen vehicles and wanted plates. The marketing focused on Falcon cameras - fixed-position units that photograph passing license plates. That part is accurate. It is also a small fraction of what Flock now sells, and the contract grants Flock the unilateral right to activate new features on existing hardware without returning to council.^[1]

What the cameras started as

The original Falcon camera does roughly what its name suggests:

• Photographs the rear of every vehicle that passes within range
• Runs OCR (optical character recognition) on visible license plates
• Classifies vehicle make, model, color, and cosmetic damage from the image
• Uploads images and metadata to Flock's cloud servers in Atlanta
• Cross-references each plate against a customer-defined "hot list" and Flock's nationwide network

That alone is a substantial surveillance system - one that captures every vehicle, every time, with no warrant requirement. But it is no longer the product Flock is selling.

What the cameras have become

Flock now markets a suite of products that share the same pole-mounted hardware OKC already has installed. The feature set has expanded dramatically:

Vehicle Fingerprint. Flock's own marketing describes a system that can search for vehicles by make, model, color, bumper stickers, and damage without ever capturing a license plate.^[2] The plate is no longer the identifier. The car itself is.

FreeForm AI Search. A natural-language query interface that allows law enforcement to search the network with phrases like "white sedans near the abortion clinic" or "any vehicles seen at the gun show last weekend." The capability has been publicly demonstrated.^[3]

Condor cameras. A newer line of PTZ (pan-tilt-zoom) cameras with AI that automatically follows people on foot. Not vehicles. People. Independent investigator Benn Jordan documented Condor cameras zooming in on individuals jogging, arguing, taking phone calls, and in one case, watching unattended children at a playground - all streamed to the open internet without authentication.^[4]

Raven audio detection. Always-on microphones marketed as detecting "human voices in distress" and gunshots. The product converts public space into a continuously-recorded audio environment.^[5]

Aerodome (Drone-as-First-Responder). Autonomous drone deployment tied to ALPR hits and audio detection events. Flock acquired Aerodome in 2025 to integrate aerial response into the platform.^[6]

Flock Nova. The data fusion platform that joins all of the above with criminal records, dispatch data, and "third-party data acquired by Flock Safety." See Section 01 for the business model behind this.

The patent contradiction

Flock has publicly denied that its system performs facial recognition or classifies people by physical characteristics. The company holds a US patent that says otherwise.

US Patent 11416545B1, granted to Flock Safety in 2022, describes a system that classifies individuals by race, gender, height, weight, and clothing in searchable databases.^[7] The patent is publicly accessible on Google Patents. It is not a leaked document or insider source. It is a filing Flock itself submitted to the federal government.

The security record

Flock's CEO has repeatedly stated that the company's products meet the highest security standards. The documented record contradicts that claim at every level.

Numerous CVEs. Independent researcher Jon "GainSec" Gaines published a white paper documenting 51 security findings in Flock's device ecosystem, with multiple confirmed vulnerabilities now logged in NIST's National Vulnerability Database.^[8]

30-second compromise. Independent investigator Benn Jordan demonstrated on video that a Flock camera can be compromised in approximately 30 seconds, both with and without physical access, due to weaknesses in the Bluetooth and WPA2 implementations.^[4]

Unsupported operating system. Flock devices run Android 8, which has not received security patches from Google since 2021. New vulnerabilities in the OS itself cannot be remediated through software updates because no software updates exist.^[8]

67 cameras streaming to the open internet. Researchers found 67 Flock cameras - including a Condor camera pointed at a children's playground - broadcasting live video and 31 days of archived footage to the public internet with no authentication required. Anyone with a search engine could view live or scrub through a month of recordings.^[9]

Police credentials leaked publicly. Researchers found at least 35 sets of stolen police credentials for Flock systems being traded on hacking forums. Senators Wyden and Krishnamoorthi formally requested an FTC investigation into Flock's failure to enforce multi-factor authentication.^[10]

You can't opt out anymore

Oklahoma City pays for 90 cameras. The DeFlock.me community map currently documents 299 Flock cameras inside the OKC metro area. The difference is private deployment.

Flock sells the same hardware to homeowners associations, retail chains, apartment complexes, gated communities, business parks, and parking lot operators. Once a private camera is installed, the property owner often grants the local police department - or the entire Flock National Lookup network - access to its feed. The result is that even if a city cancels its public contract, the surveillance network continues operating on private property all around it.

This means:

• You cannot opt out by avoiding city streets - the cameras are also in private parking lots
• You cannot audit the cameras through public records law - private property cameras are not city assets
• The 90-camera number in the OKC contract is not the count of cameras tracking OKC residents - it is only the count of cameras the city pays for
• If a council decided tomorrow to terminate the city's contract, the private camera network would remain in place

The mission creep is the model

Every feature above was added to the platform after Oklahoma City signed its initial 2023 contract. None required council approval. None triggered public notice. None involved a new vote.

That is not an accident of contract drafting. It is by design. The original contract authorizes Flock to update the platform unilaterally and continue to invoice OKC for the same hardware.^[1] The cameras you voted on are not the cameras you have.

What this means for Oklahoma City

Before any renewal vote, Oklahoma City Council should know with specificity:

1. Which features are currently enabled on OKC's 90 city cameras
2. Which additional features Flock has the contractual right to enable without notice
3. How many additional Flock cameras have been deployed on private property within OKC city limits, and which of them feed data into law enforcement queries
4. Whether OKCPD has received any documented assurance that the security vulnerabilities described above have been remediated on OKC hardware specifically

If those questions cannot be answered, the renewal vote is being conducted in the dark.

The Law

The Supreme Court has already ruled that the government cannot track your movements without a warrant. Flock built a system that does exactly that - and sells access to it. The courts are now being asked whether the workaround is legal.

The legal status of Flock's surveillance model is not settled. It is actively being challenged in federal court, contested in state legislatures, and openly questioned by police chiefs, civil libertarians, and lawmakers on both sides of the political aisle. That alone should give a city pause before signing another year of contract.

The constitutional question

In 2018, the United States Supreme Court ruled in Carpenter v. United States that the government cannot acquire historical cell-site location information from a person's phone without a warrant. The Court's reasoning is directly applicable to ALPRs:

Flock's system creates exactly that record - except instead of pulling data from a person's phone, it builds the record by photographing every vehicle that passes thousands of fixed-position cameras. The 30-day retention window in OKC's current configuration captures roughly the same time period the Supreme Court found constitutionally significant.^[1]

The Supreme Court has not yet ruled on whether warrantless ALPR mass surveillance specifically violates the Fourth Amendment. That question is now being litigated in federal court in at least two active cases.

The active federal lawsuits

Schmidt v. City of Norfolk (2025). The Institute for Justice filed a federal Fourth Amendment lawsuit on behalf of Norfolk, Virginia residents whose movements were tracked by the city's 176 Flock cameras. The lead plaintiff's vehicle was logged 526 times in four months - roughly four times per day - without any criminal investigation, warrant, or probable cause.^[2]

Tan v. City of San Jose (April 2026). The Institute for Justice filed a second federal class action in the Northern District of California challenging San Jose's 474-camera Flock deployment. The complaint cites 360 million images captured in a single year - of which only 0.25% matched any law enforcement hotlist - and argues the system "creates an unconstitutional mass surveillance regime."^[3]

Lead plaintiff Tony Tan stated publicly: "I know what an authoritarian surveillance state looks like, and I worry about the proliferation of similar mass surveillance technologies."

If either case succeeds, the legal foundation for Flock's nationwide deployment model collapses. Oklahoma City is currently a participant in a model whose constitutionality is actively under challenge.

What Oklahoma law actually allows

Oklahoma statute 47 O.S. §7-606.1 is the only state law specifically governing ALPR use. Its text is narrow and explicit. ALPR systems may be used:

• For enforcement of the Compulsory Insurance Law (verifying that vehicles on Oklahoma roads carry valid insurance)
• For criminal investigations - but only with a warrant, subpoena, or court order

Data collected by ALPR systems is required to be deleted or destroyed once an investigation or enforcement action ends, or once the data has served its limited authorized purpose.^[4]

The Flock Master Agreement Oklahoma City signed in 2023 lists the system's "Permitted Purpose" as "crime awareness, prevention, and prosecution" - a phrase that does not appear anywhere in Oklahoma statute, and which is plainly broader than insurance enforcement or warrant-backed investigations.^[5]

OKCPD's own published policy

The Oklahoma City Police Department Operations Manual contains one section governing ALPR use: Section 5-118, in the 6th Edition dated February 5, 2026.^[6]

Section 5-118 is the policy OKCPD pointed to when responding to three separate open records requests asking for Flock-specific governance. It contains the following clauses, quoted directly:

• "ALPR data will not be shared as part of a law enforcement information database."
• "ALPR data will be used only by members of the Oklahoma City Police Department who have been properly trained in the use of ALPR for a legitimate law enforcement purpose."
• "Data will be purged from the system once the maximum retention period of sixty (60) days has been reached."

Each of those provisions is directly contradicted by how Flock's platform operates:

• Flock's National Lookup network is a shared law enforcement information database, used by more than 5,000 agencies
• Flock's own employees have been documented accessing customer databases (see Section 02)
• Flock's February 2026 contract update added a "perpetual, irrevocable, worldwide, royalty-free" data license that survives contract termination - effectively making the 60-day retention rule applicable only to local OKCPD copies, not to the underlying data on Flock's servers

The full text of Section 5-118 is available on okc.gov and is also analyzed in detail on our Documents page.

OKCPD knows how to write a real surveillance policy. They did - just not for Flock.

The defense that OKCPD "couldn't" produce Flock policies because that kind of governance work is hard does not survive contact with their own Operations Manual. Sections immediately adjacent to 5-118 cover two other surveillance technologies the department uses - and both come with detailed policies the Flock system entirely lacks.

Section 5-119 (Facial Comparison Program), adopted October 2025. Eight pages of policy governing OKCPD's facial recognition program, including:^[a]

• Audit logs retained for a minimum of three years, including the requester, the approving supervisor, the authorized examiner, the justification for access, and whether any leads were verified
• Monthly audits conducted by the Special Operations Division commander
• Mandatory training including "intelligence gathering limitations, constitutional rights to privacy, records retention requirements"
• Supervisor review and approval required for every request
• Independent peer review of every candidate match
• Explicit prohibition on Live Facial Recognition in live video feeds
• Explicit prohibition on "monitoring daily activities of individuals or groups"
• Explicit prohibition on retaining information based on race, religion, political views, or "social views or activities"

Section 7-208 (Small Unmanned Aircraft Systems - drones), revised October 2025. Detailed policy governing OKCPD drone use, including:^[a]

• Mandatory FAA Part 107 certification for pilots
• Fourth Amendment compliance requirement: "absent exigent circumstances or the consent of the property owner, a warrant shall be obtained"
• Personal sUAS prohibited - only department-approved equipment
• Visual Observer required for all flights
• Selection process with documented qualifications
• Incident reporting documented in the first line of the officer's narrative

The full Police Operations Manual sections covering ALPRs, Facial Recognition, and Drones are available on this site for direct comparison.

Federal access without authorization

The clearest documented evidence that Flock's platform circumvents normal legal channels comes from Mountain View, California. In 2026, the city's Police Chief publicly recommended terminating the Flock contract after discovering that the ATF, the Air Force, and the GSA Inspector General had been accessing the city's Flock data for 17 months without local police knowledge or approval.^[7]

Federal access of that kind would normally require a subpoena, warrant, or formal data-sharing agreement signed by the local jurisdiction. Through Flock's National Lookup feature, none of that was needed. The setting had been silently enabled on Mountain View's account.

Oklahoma has no state law prohibiting outside agencies from querying OKC's Flock data. Whether the same kind of unauthorized federal access has occurred here is an open question - and one OKCPD's own memo confirms it has no audit procedure to answer.^[8]

State-level violations elsewhere

California. A class-action lawsuit filed in February 2026 (amended April 2026) alleges Flock allowed out-of-state agencies to search the San Francisco Police Department's Flock database 1.6 million times in seven months - in direct violation of California state law, which explicitly prohibits sharing ALPR data outside the state.^[9]

Texas. The Texas Department of Public Safety issued a cease-and-desist to Flock Safety for installing cameras at private homes and businesses without state authorization.^[10]

These are not isolated edge cases. They are the documented pattern of a vendor whose technology and business model routinely operate outside the bounds of state-level legal frameworks.

What this means for Oklahoma City

The legal questions facing Oklahoma City Council before any renewal vote are:

1. Does the Flock contract's "Permitted Purpose" exceed the authorization granted by 47 O.S. §7-606.1? If so, the contract may be unenforceable as a matter of state law.
2. Has OKCPD's data been queried by federal agencies through Flock's National Lookup without local authorization, as occurred in Mountain View? The department has confirmed it has no audit procedure capable of answering this.
3. If Carpenter is extended to ALPRs by the federal courts, does Oklahoma City have legal exposure for having operated a warrantless mass surveillance system on its residents?
4. Why is the city's own published policy (Section 5-118) so plainly inconsistent with how the Flock system actually operates?

None of these questions can be answered with "Flock told us it's fine." Each requires independent legal analysis, and that analysis should happen before public funds are committed to another year of operation.

The Track Record

Every case below has been documented through court filings, public records requests, official government statements, or original investigative journalism. None of it is hypothetical. All of it has already happened.

The most common defense of Flock - "the system would only ever be misused in theory" - has not been true for some time. The system has been misused in practice, by named individuals, with documented consequences, in jurisdictions all over the country. The harms below are not abstract risks. They are receipts.

Officers using Flock to stalk people they know

Milwaukee, Wisconsin. Former Milwaukee Police Officer Josue Ayala was charged with misconduct in public office for using Flock to track his girlfriend and her ex-boyfriend. Audit logs showed Ayala searched his girlfriend's plate 124 times and her ex's plate 55 times over a roughly two-month period. The justification he entered for every single search was one word: "investigation." He resigned hours before his first court appearance.^[1]

Menasha, Wisconsin. A Menasha police officer was charged with a Class I felony for using Flock to track his ex-girlfriend's vehicle and her brother's vehicle while off duty. He conducted seven searches in a single week. He pleaded not guilty and was bound over for trial.^[2]

Kenosha County, Wisconsin. Sheriff's Deputy Frank McGrath was found to have used Flock and the Polaris squad-car tracking system to surveil a fellow deputy he was dating. An internal investigation concluded the misuse was "repeated, knowing, and not truthful when confronted." McGrath resigned under a negotiated separation agreement before formal discipline was imposed. No criminal charges were ultimately filed.^[3]

Each of these cases was discovered only because someone went looking. In one case, the victim searched her own license plate on a public audit-log tool and recognized her ex's badge ID. In Oklahoma City, no such audit log is publicly available, and OKCPD has confirmed in writing that no internal audit procedure exists.^[4]

Politically targeted searches

Tulsa, Oklahoma. The Electronic Frontier Foundation obtained Flock search logs from 3,900+ agencies through public records requests. Tulsa PD was one of the most consistent users of Flock to investigate protest activity, logging at least 38 searches in which officers queried the network with terms like "protest" without specifying any underlying crime.^[5]

Johnson County, Texas (abortion investigation). Sheriff's deputies queried the Flock nationwide network for a vehicle, entering the search reason as: "had an abortion, search for female." The search crossed 83,345 cameras across 6,809 networks. Flock and the sheriff initially claimed the search was for a "missing person." EFF obtained the public records that contradicted that account. The sheriff was later indicted on unrelated felony charges including aggravated perjury.^[6]

Wrongful detentions based on Flock data

Aurora, Colorado. A mother and her young children were held at gunpoint after a Flock camera misread their license plate as belonging to a stolen vehicle. The family received a $1.9 million settlement from Aurora taxpayers. Flock's contractual liability provisions protected the company from any direct exposure.^[7]

Lakewood, Colorado. A woman was confronted by an officer who accused her of stealing a package off a porch - based entirely on a Flock camera record showing she drove through the neighborhood. She offered to show the officer her own vehicle's recorded video proving she never stopped. The officer refused to consider the contradictory evidence, citing the Flock data as definitive.^[8]

Both incidents illustrate the same pattern: Flock data is treated as conclusive in the field, even when contradicted by direct physical or video evidence. The Aurora case proved that the financial cost of those errors lands on local taxpayers, not on the vendor that supplied the data.

Unauthorized federal access

Mountain View, California. ATF, the Air Force, and the GSA Inspector General accessed Mountain View's Flock data for 17 months without local police knowledge or approval. Flock had silently enabled nationwide search on the city's account without notifying the customer. The Police Chief - not an activist, the Police Chief - publicly recommended terminating the contract.^[9]

Denver, Colorado. Public records obtained by EFF document that Flock data was accessed by outside agencies nearly 1,400 times in a single year, with multiple searches related to immigration enforcement. Oklahoma has no state law prohibiting equivalent access here.^[10]

San Francisco, California. A class-action lawsuit filed February 2026 (amended April 2026) alleges Flock allowed out-of-state agencies to search the San Francisco Police Department's Flock database 1.6 million times in seven months - in direct violation of California state law.^[11]

Vendor misconduct against customer cities

Cambridge, Massachusetts. Cambridge voted to deactivate and remove its Flock cameras. Shortly after, the city discovered that Flock had installed two new cameras without the city's knowledge or consent. The City Manager publicly called it a "breach of trust." The contract was terminated and all cameras removed.^[12]

Oshkosh, Wisconsin. Flock representatives gave the Oshkosh City Council false information during deliberations on a contract - specifically denying that the system creates a "heat map" of vehicle movements, when in fact Flock's own platform contains a feature called a heat map. The Police Chief recommended rescinding the contract within 24 hours of its approval. See Section 02 for details.^[13]

Texas (statewide). The Texas Department of Public Safety issued a cease-and-desist to Flock Safety for installing cameras at private homes and businesses without state authorization.^[14]

Flock employee misconduct

Dunwoody, Georgia. Public records audit logs revealed Flock's own VP of Business Development searched a customer city's Flock database 63 times in a single year - despite not being a police officer or city employee. Multiple Flock employees were documented accessing cameras inside a community gym, including the pool, fitness studios, and preschool daycare areas. See Section 02.^[15]

Security failures

67 cameras streaming live to the open internet. Researchers found Flock Condor cameras - including one pointed at a children's playground - broadcasting live video and 31 days of archived footage to the public internet with no authentication required.^[16]

Stolen police credentials traded online. Researchers found at least 35 sets of stolen police credentials for Flock systems on hacking forums. Senators Wyden and Krishnamoorthi formally requested an FTC investigation. See Section 03.^[17]

Norfolk: tracking a private citizen 526 times

The cleanest case of "ordinary person, no crime, tracked anyway" comes from Norfolk, Virginia. The city's 176 Flock cameras logged the location of a retired veteran 526 times in four months - approximately four times per day - without any underlying criminal investigation, warrant, or probable cause. The Institute for Justice filed a federal Fourth Amendment lawsuit on his behalf, which is currently pending.^[18]

Norfolk has 176 cameras. Oklahoma City has 90 city cameras and at least 299 total Flock cameras in the metro according to the community map. The math is not encouraging.

What this means for Oklahoma City

OKCPD has confirmed in writing that no audit procedures exist for Flock use. That means: if an officer searched a partner's license plate 124 times this year, OKC has no internal process to catch it. If a federal agency has been quietly accessing OKC's Flock data for 17 months, OKC has no record of it. If a private camera operator is sharing OKC residents' data with parties OKCPD has not vetted, there is no audit trail to review.

The absence of evidence here is not evidence of absence. It is the consequence of the city's own admission that it has not built a system capable of producing evidence either way.

Common Ground

The American Civil Liberties Union, the Institute for Justice, Republican state legislators, Democratic senators, libertarian property-rights advocates, police chiefs, federal agencies, and city councils across the political spectrum all agree on one thing: Flock's surveillance model is a problem.

This is unusual. The kind of issue that draws opposition from both the ACLU and the Institute for Justice - from both Senator Ron Wyden and Republican Oklahoma state legislators - from both police chiefs and the people who normally hold those chiefs accountable - is not a left-versus-right issue. It is a concentration-of-power issue, and the coalition opposed to it is broader than almost any other privacy fight in recent memory.

For Oklahoma City Council members weighing whether opposing Flock is a "political risk" - it isn't. It is one of the few positions in 2026 with documented public support from every direction.

Civil liberties organizations

ACLU National. Through Senior Policy Counsel Chad Marlow, ACLU has publicly stated: "Oklahomans have a right to know more about Oklahoma City's use of automatic license plate readers. Nearly 50 cities have terminated their relationships with Flock in the past year."^[1]

ACLU of Oklahoma. Organizing the May 27, 2026 community town hall on Flock surveillance in Oklahoma City. Working with state-level partners.^[2]

Electronic Frontier Foundation (EFF). Obtained 12+ million Flock search logs from over 3,900 law enforcement agencies through public records requests. Published more than a dozen investigative pieces in 2025 alone documenting protest surveillance, abortion investigation searches, and discriminatory targeting.^[3]

This is big government, wearing a corporate badge

Oklahoma is one of the most pro-limited-government states in the country. The case against Flock is not a left or right case - it is a concentration of power case. Flock has built infrastructure that the government itself would not be allowed to build directly:

• The government cannot warrantlessly track every vehicle in a city. Flock can - and then sells access back to government agencies.
• The government cannot run a nationwide database of citizens' movements without statutory authority. Flock's National Lookup operates one and the statute came after.
• The government is bound by public records law. Flock's data sits on private servers in Atlanta, beyond the reach of any FOIA request.
• The government is accountable through elections, oversight boards, and civilian review. Flock is accountable to its investors.

This is not a libertarian critique that civil libertarians have to bend to accept. It is the same critique. Both sides are looking at the same problem and identifying the same harm: a private corporation has been installed between residents and the agencies that surveil them - which removes accountability, not adds it.

Property rights and libertarian organizations

Institute for Justice. Libertarian-aligned public-interest law firm. Filed federal Fourth Amendment lawsuits against Flock-using cities in Norfolk, Virginia (2025) and San Jose, California (April 2026). The IJ frames Flock as a property-rights and individual-liberty violation. The ACLU frames it as a civil liberties violation. They are on the same side of the same lawsuits.^[4]

Texas Privacy Coalition. Right-leaning state-level privacy organization. Published patent analysis documenting Flock's person-tracking and classification capabilities. Active in opposing Flock contracts at Texas city council meetings.^[5]

Building Blocks for Liberty. Conservative civil-liberties outlet. Published critical coverage of Flock CEO Garrett Langley's "activist" email to police departments.^[6]

Federal lawmakers

Senator Ron Wyden (D-OR) and Representative Raja Krishnamoorthi (D-IL) formally requested an FTC investigation into Flock Safety in November 2025, citing the company's failure to enforce multi-factor authentication and its pattern of cybersecurity claims that did not hold up to independent review.^[7]

The FTC investigation request was filed alongside ongoing oversight inquiries into the broader surveillance technology industry. Flock's response to the inquiry has not addressed the substance of the senators' concerns.

Oklahoma voices

Representative Tom Gann (R) has convened multiple legislative interim studies on Oklahoma ALPR use, with testimony from constituents, academic experts, and civil liberties advocates. The studies have documented widespread use of Flock by more than 50 Oklahoma agencies and concerns that data is being accessed for purposes far beyond what state law authorizes.^[8]

Marven Goodman, an Oklahoma resident, successfully campaigned to remove Flock cameras from State Highway 33 and to push Guthrie, Oklahoma to terminate its contract with the company.^[9]

Councilman James Cooper (Ward 2), Councilwoman JoBeth Hamon (Ward 6), and Councilman Camal Pennington (Ward 7) have engaged publicly with this issue. All three attended the May 27, 2026 community town hall. Cooper publicly stated his preference is "the maximalist position" - full contract termination - rather than merely strengthening oversight. Pennington signaled active conversations are underway ahead of the July renewal vote. Hamon has been engaged with the records produced by our FOIA filings since April. Five OKC council members did not attend the town hall: Bradley Carter, Katrina Avers, Todd Stone, Matt Hinkle, and Mark Stonecipher.^[10]

Police chiefs and law enforcement leaders

The strongest counter to "if you oppose Flock, you must be anti-police" is that police chiefs themselves have terminated Flock contracts and publicly explained why.

Police Chief Andrew Mills, Mountain View, California. Publicly recommended terminating the city's Flock contract after discovering federal agencies had accessed local data for 17 months without his knowledge.^[11]

Police Chief Jim Williams, Staunton, Virginia. Wrote a public response to Flock CEO Garrett Langley's email rejecting the framing that critics were attacking law enforcement. Williams' words: "It is democracy in action." Staunton terminated its contract shortly after.^[12]

Police Chief Dean Smith, Oshkosh, Wisconsin. Recommended rescinding the city's Flock contract within 24 hours of approval after Flock representatives gave the council false information. His words: "I will not betray that trust."^[13]

The cities that have already said no

More than 30 cities and counties have terminated Flock contracts since January 2025. A partial list:

• Guthrie, Oklahoma - Terminated contract. The closest geographic precedent for OKC.
• Lynnwood, Washington - 7-0 unanimous vote to cancel after a University of Washington report.
• Tompkins County, New York - 12-1 vote calling Flock "untrustworthy and not aligned with the county's values."
• Mountain View, California - Terminated after federal agency access disclosure.
• Cambridge, Massachusetts - Terminated after Flock installed cameras without authorization.
• Staunton, Virginia - Terminated after CEO's "activist" email.
• Oshkosh, Wisconsin - Rescinded within 24 hours of approval over Flock misrepresentations.
• Austin, Texas. Flagstaff, Arizona. Eugene, Oregon. Evanston, Illinois. Coralville, Iowa. Denver, Colorado. Dane County, Wisconsin. And growing.

Each termination is a small data point. Together, they form a pattern.^[14]

The independent press and research community

Independent journalists and researchers have done the bulk of the substantive investigative work on Flock. The list of outlets that have published critical reporting includes:

404 Media (live camera exposure, Flock Nova data sources), EFF (12M+ search log analysis), NPR (national cancellation coverage), NBC News (Norfolk lawsuit), The Markup, Reason (San Jose lawsuit), Axios (valuation reporting), Mountain View Voice, Wisconsin Examiner, Urban Milwaukee, Kenosha County Eye, Cville Right Now, San (Straight Arrow News), and many more.

Locally: KOSU / NPR Oklahoma, Free Press OKC, KOCO 5, The Gayly, KGOU, News9, KFOR, and Hoodline have all covered the OKC story. The May 27 town hall produced same-week coverage from Free Press OKC and KOCO 5.

Independent researchers documented core findings: Benn Jordan (YouTube investigations, security demonstrations), Jon "GainSec" Gaines (CVE research and 51-finding white paper), Jason Hunar (audit log analysis, Have I Been Flocked? tool), and the DeflockYourCity Toolkit contributors (contract analysis, model legislation, talk tracks).

Even industry has pulled back

In February 2026, Amazon terminated its Ring-Flock data-sharing partnership, ending a major channel through which Flock had accessed residential security camera networks.^[15] When Amazon - a company not historically known for restraint on consumer surveillance - decides a partnership has become too reputationally risky, that signal is worth noticing.

What this means for Oklahoma City

For an Oklahoma City Council member, the question of whether to terminate or impose strict conditions on the Flock contract is not a political risk. It is one of the rare votes in 2026 where principled action is supported across the entire political spectrum - by civil rights groups, by libertarian property-rights organizations, by federal legislators of both parties, by Oklahoma's own state lawmakers, by police chiefs, by the broader media landscape, and by every neighboring city that has already made the same decision.

Oklahoma City is not being asked to be a leader on this. It is being asked to catch up.