Flock accidentally exposed training materials and a panel which tracked what its AI annotators were working on. It showed that Flock, which has cameras in thousands of U.S. communities, is using workers in the Philippines to review and classify footage.#Flock
Flock Uses Overseas Gig Workers to Build its Surveillance AI
This article was produced with support from WIRED.Flock, the automatic license plate reader (ALPR) and AI-powered camera company, uses overseas workers from Upwork to train its machine learning algorithms, with training material telling workers how to review and categorize footage including images people and vehicles in the U.S., according to material reviewed by 404 Media that was accidentally exposed by the company.
The findings bring up questions about who exactly has access to footage collected by Flock surveillance cameras and where people reviewing the footage may be based. Flock has become a pervasive technology in the U.S., with its cameras present in thousands of communities that cops use everyday to investigate things like car jackings. Local police have also performed numerous lookups for ICE in the system.
Companies that use AI or machine learning regularly turn to overseas workers to train their algorithms, often because the labor is cheaper than hiring domestically. But the nature of Flock’s business—creating a surveillance system that constantly monitors U.S. residents’ movements—means that footage might be more sensitive than other AI training jobs.
💡
Do you work at Flock or know more about the company? I would love to hear from you. Using a non-work device, you can message me securely on Signal at joseph.404 or send me an email at joseph@404media.co.Flock’s cameras continuously scan the license plate, color, brand, and model of all vehicles that drive by. Law enforcement are then able to search cameras nationwide to see where else a vehicle has driven. Authorities typically dig through this data without a warrant, leading the American Civil Liberties Union (ACLU) and Electronic Frontier Foundation (EFF) to recently sue a city blanketed in nearly 500 Flock cameras.
Broadly, Flock uses AI or machine learning to automatically detect license plates, vehicles, and people, including what clothes they are wearing, from camera footage. A Flock patent also mentions cameras detecting “race.”
Screenshots from the exposed material. Redactions by 404 Media.
Multiple tipsters pointed 404 Media to an exposed online panel which showed various metrics associated with Flock’s AI training.
This post is for subscribers only
Become a member to get access to all content
Subscribe now
A massive cache of Flock lookups collated by the Electronic Frontier Foundation (EFF) shows as many as 50 federal, state, and local agencies used Flock during protests over the last year.#Flock #borderpatrol #FOIA
Cops Used Flock to Monitor No Kings Protests Around the Country
Police departments and officials from Border Patrol used Flock’s automatic license plate reader (ALPR) cameras to monitor protests hundreds of times around the country during the last year, including No Kings protests in June and October, according to data obtained by the Electronic Frontier Foundation (EFF).The data provides the clearest picture yet of how cops widely use Flock to monitor protesters. In June, 404 Media reported cops in California used Flock to track what it described as an “immigration protest.” The new data shows more than 50 federal, state, and local law enforcement ran hundreds of searches in connection with protest activity, according to the EFF.
This post is for subscribers only
Become a member to get access to all content
Subscribe now
“Most drivers are unaware that San Jose’s Police Department is tracking their locations and do not know all that their saved location data can reveal about their private lives and activities."#Flock
ACLU and EFF Sue a City Blanketed With Flock Surveillance Cameras
Lawyers from the American Civil Liberties Union (ACLU) and Electronic Frontier Foundation (EFF) sued the city of San Jose, California over its deployment of Flock’s license plate-reading surveillance cameras, claiming that the city’s nearly 500 cameras create a pervasive database of residents movements in a surveillance network that is essentially impossible to avoid.The lawsuit was filed on behalf of the Services, Immigrant Rights & Education Network and Council on American-Islamic Relations, California, and claims that the surveillance is a violation of California’s constitution and its privacy laws. The lawsuit seeks to require police to get a warrant in order to search Flock’s license plate system. The lawsuit is one of the highest profile cases challenging Flock; a similar lawsuit in Norfolk, Virginia seeks to get Flock’s network shut down in that city altogether.
“San Jose’s ALPR [automatic license plate reader] program stands apart in its invasiveness,” ACLU of Northern California and EFF lawyers wrote in the lawsuit. “While many California agencies run ALPR systems, few retain the locations of drivers for an entire year like San Jose. Further, it is difficult for most residents of San Jose to get to work, pick up their kids, or obtain medical care without driving, and the City has blanketed its roads with nearly 500 ALPRs.”
The lawsuit argues that San Jose’s Flock cameras “are an invasive mass surveillance technology” that “collect[s] driver locations en masse.”
“Most drivers are unaware that San Jose’s Police Department is tracking their locations and do not know all that their saved location data can reveal about their private lives and activities,” it adds. The city of San Jose currently has at least 474 ALPR cameras, up from 149 at the end of 2023; according to data from the city, more than 2.6 million vehicles were tracked using Flock in the month of October alone. The lawsuit states that Flock ALPRs are stationed all over the city, including “around highly sensitive locations including clinics, immigration centers, and places of worship. For example, three ALPR cameras are positioned on the roads directly outside an immigration law firm.”
Andrew Crocker, surveillance litigation director for the EFF, told 404 Media in a phone call that “it’s fair to say that anyone driving in San Jose is likely to have their license plates captured many times a day. That pervasiveness is important.”
DeFlock's map of San Jose's ALPRs
A zoomed in look at San Jose
A search of DeFlock, a crowdsourced map of ALPR deployments around the country, shows hundreds of cameras in San Jose spaced essentially every few blocks around the city. The map is not exhaustive.The lawsuit argues that warrantless searches of these cameras are illegal under the California constitution’s search and seizure clause, which Crocker said “has been interpreted to be even stronger than the Fourth Amendment,” as well as other California privacy laws. The case is part of a broader backlash against Flock as it expands around the United States. 404 Media’s reporting has shown that the company collects millions of records from around the country, and that it has made its national database of car locations available to local cops who have in turn worked with ICE. Some of those searches have violated California and Illinois law, and have led to reforms from the company. Crocker said that many of these problems will be solved if police simply need to get a warrant to search the system.
“Our legal theory and the remedy we’re seeking is quite simple. We think they need a warrant to search these databases,” he said. “The warrant requirement is massive and should help in terms of preventing these searches because they will have to be approved by a judge.” The case in Norfolk is ongoing. San Jose Police Department and Flock did not immediately respond to a request for comment.
Flock Removes States From National Lookup Tool After ICE and Abortion Searches Revealed
Following 404 Media’s reporting and in light of new legislation, automatic license plate reader (ALPR) company Flock has stopped agencies reaching into cameras in California, Illinois, and Virginia.Joseph Cox (404 Media)
A Washington judge said images taken by Flock cameras are "not exempt from disclosure" in public record requests.#Flock
Judge Rules Flock Surveillance Images Are Public Records That Can Be Requested By Anyone
A judge in Washington has ruled that police images taken by Flock’s AI license plate-scanning cameras are public records that can be requested as part of normal public records requests. The decision highlights the sheer volume of the technology-fueled surveillance state in the United States, and shows that at least in some cases, police cannot withhold the data collected by its surveillance systems.In a ruling last week, Judge Elizabeth Neidzwski ruled that “the Flock images generated by the Flock cameras located in Stanwood and Sedro-Wooley [Washington] are public records under the Washington State Public Records Act,” that they are “not exempt from disclosure,” and that “an agency does not have to possess a record for that record to be subject to the Public Records Act.”
She further found that “Flock camera images are created and used to further a governmental purpose” and that the images on them are public records because they were paid for by taxpayers. Despite this, the records that were requested as part of the case will not be released because the city automatically deleted them after 30 days. Local media in Washington first reported on the case; 404 Media bought Washington State court records to report the specifics of the case in more detail.
A screenshot from the judge's decision
Flock’s automated license plate reader (ALPR) cameras are used in thousands of communities around the United States. They passively take between six and 12 timestamped images of each car that passes by, allowing the company to make a detailed database of where certain cars (and by extension, people) are driving in those communities. 404 Media has reported extensively on Flock, and has highlighted that its cameras have been accessed by the Department of Homeland Security and by local police working with DHS on immigration cases. Last month, cops in Colorado used data from Flock cameras to incorrectly accuse an innocent woman of theft based on her car’s movements.The case came in response to a public records request made by Jose Rodriguez, who in April sought all of the images taken by the city’s Flock cameras between the hours of 5 and 6 p.m. on March 30 (he later narrowed this request to only ask for images taken by a single camera in a half-hour period). The city argued that Rodriguez would have to request them directly from Flock, a private company not subject to public records laws. But Flock’s contracts with cities say that the city owns the images taken on their cameras. The city eventually took Rodriguez to court. In the court proceedings, the city made a series of arguments claiming that Flock images couldn’t be released; the judge’s decision rebuked all of these many arguments.
“I wanted the records to see if they would release them to me, in hopes that if they were public records it would raise awareness to all the communities that have the Flock cameras that they may be public record and could be used by stalkers, or burglars scoping out a house, or other ways someone with bad intentions may use them. My goal was to try getting these cameras taken down by the cities that put them up,” Rodriguez told 404 Media. “In order to show that the records were public records and that they don’t qualify as exempt under the Washington public records act we cited the contract, and I made requests to both cities requesting their exterior normal surveillance camera footage from their City Hall and police station that recorded the streets and parking lots with vehicles driving by and license plates viewable, which is what the Flock images also capture. Both cities provided me with the surveillance videos I requested without issue but denied the Flock images, so my attorney used that to show how they contradict themselves.”
"it is pretty abhorrent that the city tried to make all of these arguments in the first place"
The case highlights the lengths that police departments and cities are willing to go to in order to prevent the release of what they incorrectly perceive to be private information owned by their surveillance vendors (in this case, Flock). Stanwood’s attorneys first argued that the records were Flock’s, not the city’s, which is clearly contradicted in the contract, which states “customer [Stanwood] shall retain whatever legally cognizable right, title, and interest in Customer Generated Data … Flock does not own and shall not sell Customer Generated Data.” The attorneys then argued that images taken by Flock cameras do not become requestable data until it is directly accessed and downloaded by the police on Flock’s customer portal: “the data existing in the cloud system … does not exist anywhere in the City’s files as a record.” The city’s lawyers also argued that Flock footage is police “intelligence information” that should be exempt from public records requests, and that “there are privacy concerns with making ALPR data accessible to the public.”“Honestly, it is pretty abhorrent that the city tried to make all of these arguments in the first place, but it’s great that the court reaffirmed that these are public records,” Beryl Lipton, senior investigative researcher at the Electronic Frontier Foundation, told 404 Media in a phone interview. “So much of the surveillance law enforcement does is facilitated by third party vendors and that information is stored on their external servers. So for the court to start restricting access to the public because law enforcement has started using these types of systems would have been horribly detrimental to the public’s right to know.”
In affidavits filed with the court, police argued that “if the public could access the Flock Safety System by making Public Records Act requests, it would allow nefarious actors the ability to track private persons and undermine the effectiveness of the system.” The judge rejected every single one of these arguments.
Both Lipton and Timothy Hall, Rodriguez’s attorney, said that, to the contrary, Rodriguez’s request actually shows how pervasive mass surveillance systems are in society, and that sharing this information will help communities make better informed decisions about whether they want to use technology like Flock at all.
“We do think there should be redactions for certain privacy reasons, but we absolutely think that as a whole, these should be considered public records,” Lipton said. “This is part of the whole problem: These police departments and these companies are operating under the impression that everything that happens on the street is fair game, and that their systems are not a privacy violation. But then when it comes to the public wanting to know, they say ‘this is a privacy violation,’ and I think that’s them trying to have it both ways.”
Hall said that Rodriguez’s case, reporting by 404 Media, and a recent study by the University of Washington about Flock data being available to immigration enforcement officers, has started a conversation in the state about Flock in general.
“Now because of the Washington State Public Records Act, people can be aware of all the information these cameras are collecting. Now there’s a discussion going on: Do we even want these cameras? Well, they’re collecting way more information than we realized,” Hall told 404 Media in a phone call. “A lot of people are now realizing there’s a ton of information being collected here. This has now opened up a massive discussion which was ultimately the goal.”
A Flock spokesperson told 404 Media that the company believes that the court simply reaffirmed what the law already was. The city of Stanwood did not respond to a request for comment.
Rodriguez said that even after fighting this case, he is not going to get the images that he originally took, because the city automatically deleted it after 30 days, even though he filed his request. He can now file a new one for more recent images, however.
“I won’t be getting the records, even though I win the case (they could also appeal it and continue the case) no matter what I won’t get those records I requested because they no longer exist,” Rodriguez said. “The cities both allowed the records to be automatically deleted after I submitted my records requests and while they decided to have their legal council review my request. So they no longer have the records and can not provide them to me even though they were declared to be public records.”
Leaving the Door Wide Open: Flock Surveillance Systems Expose Washington Data to Immigration Enforcement - Center for Human Rights
Summary Flock Safety automated license plate reader (ALPR) networks have become increasingly common in Washington state.Andrea Marcos (Center for Human Rights)
Lawmakers say AI-camera company Flock is violating federal law by not enforcing multi-factor authentication. 404 Media previously found Flock credentials included in infostealer infections.#Flock #News
Flock Logins Exposed In Malware Infections, Senator Asks FTC to Investigate the Company
Lawmakers have called on the Federal Trade Commission (FTC) to investigate Flock for allegedly violating federal law by not enforcing multi-factor authentication (MFA), according to a letter shared with 404 Media. The demand comes as a security researcher found Flock accounts for sale on a Russian cybercrime forum, and 404 Media found multiple instances of Flock-related credentials for government users in infostealer infections, potentially providing hackers or other third parties with access to at least parts of Flock’s surveillance network.This post is for subscribers only
Become a member to get access to all content
Subscribe now
Flock has built a nationwide surveillance network of AI-powered cameras and given many more federal agencies access. Senator Ron Wyden told Flock “abuses of your product are not only likely but inevitable” and Flock “is unable and uninterested in preventing them.”#News #Flock
ICE, Secret Service, Navy All Had Access to Flock's Nationwide Network of Cameras
A division of ICE, the Secret Service, and the Navy’s criminal investigation division all had access to Flock’s nationwide network of tens of thousands of AI-enabled cameras that constantly track the movements of vehicles, and by extension people, according to a letter sent by Senator Ron Wyden and shared with 404 Media. Homeland Security Investigations (HSI), the section of ICE that had access and which has reassigned more than ten thousand employees to work on the agency’s mass deportation campaign, performed nearly two hundred searches in the system, the letter says.In the letter Senator Wyden says he believes Flock is uninterested in fixing the room for abuse baked into its platform, and says local officials can best protect their constituents from such abuses by removing the cameras entirely.
The letter shows that many more federal agencies had access to the network than previously known. We previously found, following local media reports, that Customs and Border Protection (CBP) had access to 80,000 cameras around the country. It is now clear that Flock’s work with federal agencies, which the company described as a pilot, was much larger in scope.
This post is for subscribers only
Become a member to get access to all content
Subscribe now
Court records show that the narrative Flock and a Texas Sheriff's Office has told the public isn't the whole story, and that police were conducting a 'death investigation' into the abortion.
Court records show that the narrative Flock and a Texas Sheriffx27;s Office has told the public isnx27;t the whole story, and that police were conducting a x27;death investigationx27; into the abortion.#Flock #Abortion
Flock said it has "paused all federal pilots" after police departments said they didn't realize they were sharing access with Customs and Border Patrol.
Flock said it has "paused all federal pilots" after police departments said they didnx27;t realize they were sharing access with Customs and Border Patrol.#Flock
A DEA agent used a local cop's password "for federal investigations in late January 2025 without [the cop's] knowledge of said use."
A DEA agent used a local copx27;s password "for federal investigations in late January 2025 without [the copx27;s] knowledge of said use."#Flock
Feds Used Local Cop's Password to Do Immigration Surveillance With Flock Cameras
A Drug Enforcement Administration agent used a local police officer’s password to the Flock automated license plate reader system to search for someone suspected of an “immigration violation.” That DEA agent did this “without [the local police officer’s] knowledge,” and the password to the Flock account, which belonged to the Palos Heights PD, has since been changed. Using license plate readers for immigration enforcement is illegal in Illinois, and casual password sharing between local police and federal law enforcement for access to surveillance systems is, at the very least, against Flock’s terms of service.The details of the search were first reported by the investigative news outlet Unraveled, which obtained group chats about the search using a public records request. More details about the search were obtained and shared with 404 Media by Shawn, a 404 Media reader who filed a public records request with Palos Heights after attending one of our FOIA Forums.
DEA agent used Illinois cop’s Flock license plate reader password for immigration enforcement searches
A federal Drug Enforcement Administration agent on a Chicago area task force used Palos Heights Detective Todd Hutchinson’s login credentials to perform unauthorized searches this past January. Group chat screenshots obtained via public records request show the detective and the feds discussing the incident.Unraveled Press
Flock makes automated license plate reader (ALPR) cameras, which passively collect the time, plates, and model of cars that drive past them and enter them into a network that can then be searched by police. Our investigation in May showed that federal agents were gaining side-door access into this system by asking local police to perform immigration enforcement searches for them; the new documents show that in some cases, local police have simply given federal agents their passwords.The documents obtained by Unraveled show details of an internal investigation done by the Palos Heights, Illinois police department in response to a series of questions that I asked them for an article we published in May that appeared to show a Todd Hutchinson, a police officer in Palos Heights, performing a series of Flock searches in January as part of their research into an “immigration violation.”
At the time, Palos Heights police chief Mike Yott told me that Hutchinson was a member of a DEA task force “that does not work immigration cases.”
“None of our officers that work with federal agencies have cross designation as immigration officers, and therefore have no immigration authority, and we and our partner agencies are very sensitive to the fact that we and the State of Illinois do not pursue immigration issues,” Yott said. “Based on the limited information on the report, the coding/wording may be poor and the use of Flock may be part of a narcotics investigation or a fugitive status warrant, which does on occasion involve people with various immigration statuses.”
Our reporting set off an internal investigation into what these searches were for, and who did them, according to the documents obtained by Unraveled. According to a July 9 investigation report written by the Palos Heights Police Department, Hutchinson was the only task force member who had access to Flock. Information about what the search was actually for is redacted in the internal investigation, and neither the Palos Heights Police Department nor the DEA has said what it was for.
“Hutchinson advised that it was common that he allowed others to use his login to Flock during the course of their drug investigations. TFO Hutchinson spoke to his group and learned that one of the DEA agents completed these searches and used his login information,” the report says. The DEA agent (whose name is redacted in the report) “did in fact use Hutchinson’s login for federal investigations in late January 2025 without Hutchinson’s knowledge of said use.”
“When I had shared my account with the Special Agent, I believed it would only be used for DEA/narcotics related investigations,” Hutchinson wrote in an email to his bosses explaining why he shared his password. Hutchinson said in a series of text messages to task force officers, which were also obtained by Unraveled, that he had to change the password to lock other members of the task force out of the system.
“What’s the new password?,” a task force member wrote to Hutchinson.
“Sorry man. Keys had to be taken away,” he responded.
The task force member replied with a gif of a sad Chandler Bing from friends sitting in the rain.
“Hey guys I no longer have access to Flock cause Hutch took my access away,” another group text reads. “Apparently someone who has access to his account may have been running plates and may have placed the search bar ‘immigration’.. which maybe have brought undue attention to his account. Effective immediately Defer all flock inquiries to Toss Hutchinstein[sic].”“Dear Todd, I hope you don’t get in trouble cause of my mistake,” the DEA agent joked in the group chat. “U were so helpful in giving the group access but now that is gone, gone like dust,…..in the wind … Trust is broken / I don’t know if bridges can be mended … one day we might be back to normal but until then I will just have to sit by this window and pray things will return … Best Regards. Ps, can u flock a plate for me”
“Only time will tell my fate, I suppose,” Hutchinson responded. “What’s the plate? And confirming it is NOT for immigration purposes…”
“It was a test …… and u passed ….,” the DEA agent responds.
In response to a separate public records request filed by Shawn, the 404 Media reader, and shared with us, the Palos Heights Police Department said “Our investigation into this matter has revealed that while these inquiries appear to have been run as part of a taskforce assignment, no member of the Palos Heights Police Department ‘ran’ those queries. They were, apparently, run by another, non-Palos Heights, task force member who used a Palos Height's member's sign in and password information without his knowledge.”The Palos Heights Police Department said in its investigation files that “this incident has brought to light the need to review our own protocols of LPR use.” The police department said that it had decided to limit searches of its Flock system only to agencies within the state of Illinois, rather than to police departments around the country. The department also turned on two-factor authentication, which had not been previously enabled.
“Lastly, I believe there is a need to start a monthly review of our own flock searches to ensure our officers are working within standards and compliant with all policies and laws,” the report says.
Palos Heights’ casual sharing of passwords to a powerful surveillance system is a violation of Flock’s terms of service, which states “Authorized End Users shall not share their account username or password information and must protect the security of the username and password.”
More concerningly, it shows, as we have been reporting, that there are very few practical guardrails on how Flock is being used. The DEA does not have a contract with Flock, and police generally do not obtain a warrant to use Flock. We have repeatedly reported on police officers around the country who have offered to either run plates for their colleagues or to give them access to their logins, even when those agencies have not gone through proper acquisition channels.
The Palos Heights police department did not respond to a request for comment from 404 Media. The DEA told 404 Media “we respectfully refer you to the Palos Heights Police Department.” Flock also did not respond to a request for comment. The House Oversight Committee announced last week that it had launched an investigation into how Flock is being used to search for immigration violations.
ICE Taps into Nationwide AI-Enabled Camera Network, Data Shows
Flock's automatic license plate reader (ALPR) cameras are in more than 5,000 communities around the U.S. Local police are doing lookups in the nationwide system for ICE.Jason Koebler (404 Media)
Flock's automatic license plate reader (ALPR) cameras are in more than 5,000 communities around the U.S. Local police are doing lookups in the nationwide system for ICE.
Flockx27;s automatic license plate reader (ALPR) cameras are in more than 5,000 communities around the U.S. Local police are doing lookups in the nationwide system for ICE.#News #ICE #Surveillance #Flock
ICE Taps into Nationwide AI-Enabled Camera Network, Data Shows
Flock's automatic license plate reader (ALPR) cameras are in more than 5,000 communities around the U.S. Local police are doing lookups in the nationwide system for ICE.Jason Koebler (404 Media)
