Flock Safety Building People Lookup Tool Using License Plate Data

Figure 1: Visual representation of the BeyondTrust vulnerability chain

On May 14, 2025, 404 Media published an investigation based on internal Flock presentation slides, Slack chats, and meeting audio obtained by the publication. The materials revealed that Flock Safety is building Nova, a product designed to supplement license plate data with personal information from people lookup tools, data brokers, and data breaches.

According to the leaked audio, a Flock employee described the product during an internal company meeting: "You're going to be able to access data and jump from LPR to person and understand what that context is, link to other people that are related to that person through marriage or through gang affiliation, et cetera. There's very powerful linking."

Flock confirmed to 404 Media that the tool is already being used by some law enforcement agencies in an early access program. The company did not dispute the authenticity of the leaked materials.

The development comes as Flock has expanded rapidly across the United States. According to a company press release from October 2024, Flock cameras are installed in more than 5,000 communities nationwide.

The leaked materials make several specific claims about Nova's capabilities:

Data Source Integration: Internal Slack messages indicate that Nova supports 20 different data sources. Agencies using the system can toggle individual sources on or off based on their preferences or legal constraints.

Personal Information Linking: The system is designed to connect license plate detections to personal information about vehicle owners and their associates. According to the meeting audio, this includes relationships established through marriage records and alleged gang affiliations.

Early Access Deployment: Flock confirmed that some law enforcement agencies are already using Nova through an early access program, though the company did not specify which agencies or how many are participating.

Data Broker Integration: The product incorporates data from commercial people lookup services and data brokers, companies that aggregate personal information from public records, commercial transactions, and other sources.

The leaked materials also revealed internal discussions among Flock employees questioning the ethics of using hacked data as part of their surveillance product, according to 404 Media's reporting.

Figure 2: How the authentication bypass vulnerability works

Law enforcement agencies have argued that license plate reader technology assists in recovering stolen vehicles and locating missing persons. Proponents of expanded surveillance capabilities contend that linking vehicle data to personal information could accelerate investigations.

Flock has marketed its products as tools for solving crimes and improving public safety. The company's cameras capture license plates, vehicle characteristics, and timestamps that can be searched by law enforcement.

For agencies with limited investigative resources, automated systems that aggregate multiple data sources could reduce the manual work required to identify suspects or witnesses.

Civil liberties organizations have raised significant concerns about automated license plate reader technology and its expansion into personal data aggregation.

Mass Surveillance of Innocent People: The Electronic Frontier Foundation found that the overwhelming majority of license plate data collected involves people not connected to any crime. A 2021 EFF report analyzing data from 63 California law enforcement agencies found that only 0.05% of captured plates were relevant to a public safety interest at the time of collection.

Lack of Warrant Requirements: License plate readers operate without warrants or court orders. Adding personal lookup capabilities would extend this warrantless surveillance to identifying individuals and mapping their relationships.

Data Breach Concerns: The use of data from breaches raises ethical questions about law enforcement benefiting from criminal activity. Internal Flock communications revealed employee concerns about this practice.

Potential for Abuse: Law enforcement databases have been misused by individual officers. The EFF documented a 1998 case where a Washington, D.C. police officer pleaded guilty to extortion after using license plate data to identify and blackmail people near a gay bar. More recently, an officer in Kechi, Kansas was arrested on suspicion of accessing a Flock Safety database to stalk his estranged wife.

Targeting of Communities: Police in New York have used license plate readers to record plates near mosques. EFF analysis of Oakland Police Department data showed that ALPR-equipped vehicles were disproportionately deployed in low-income communities and communities of color.

Misidentification Risks: License plate readers sometimes misread plates, leading to wrongful stops. In 2009, San Francisco police handcuffed Denise Green at gunpoint after a reader error incorrectly identified her car as stolen.

Figure 3: Privilege escalation from user to SYSTEM level

Automated license plate readers are high-speed, computer-controlled camera systems typically mounted on street poles, streetlights, highway overpasses, mobile trailers, or police vehicles. The cameras automatically capture all license plate numbers that come into view, along with the location, date, and time. Photographs often include images of the vehicle, its driver and passengers, and the immediate surroundings.

The data is uploaded to central servers where it can be searched and analyzed. Law enforcement agencies can query historical data to track where a vehicle has been, identify patterns of movement, and discover vehicles that may be associated with each other.

Flock Safety operates one of the largest networks of these cameras in the United States. The company also facilitates data sharing between law enforcement agencies, allowing police in one jurisdiction to access plate data collected in others.

Nova appears to add a layer of personal information on top of this vehicle tracking infrastructure. By integrating data from people lookup services and data brokers, the system would allow users to identify the registered owner of a vehicle and then access additional information about that person and their associates.

Technical Context: Data brokers aggregate information from public records, commercial transactions, social media, and other sources. People lookup services compile this data into searchable profiles. The integration of such services with real-time location tracking creates a surveillance capability that civil liberties advocates have long warned about.

The development of Nova represents a convergence of two surveillance trends that privacy advocates have tracked separately: the expansion of automated license plate reader networks and the growth of commercial data broker services.

License plate readers have proliferated across the United States over the past decade. Private companies like Flock Safety and Vigilant Solutions have made the technology accessible to smaller police departments and even homeowners associations. The data collected by these disparate systems is increasingly shared through regional networks and commercial platforms.

Simultaneously, data brokers have assembled detailed profiles on most American adults, drawing from public records, commercial transactions, and online activity. Law enforcement agencies have purchased access to this data to circumvent warrant requirements that would apply to direct surveillance.

Nova appears to combine these capabilities into a single platform. The implications extend beyond Flock's customers to the broader question of how surveillance infrastructure is evolving in the United States.

The American Civil Liberties Union has documented how license plate readers can be used to target immigrant communities and people seeking reproductive health services. The addition of personal lookup capabilities would make such targeting more efficient.

Confirmed:

• Flock Safety is developing a product called Nova that integrates license plate reader data with personal information sources
• The system supports 20 different data sources that agencies can toggle on or off
• Some law enforcement agencies are already using Nova through an early access program
• Internal Flock employees have raised ethical concerns about using data from breaches
• Flock cameras are installed in more than 5,000 US communities

Unclear:

• Which specific law enforcement agencies are participating in the early access program
• The complete list of data sources integrated into Nova
• Whether the system uses data from specific known breaches
• What safeguards, if any, are in place to prevent misuse
• Whether any agencies have declined to participate due to legal or ethical concerns
• The pricing structure and contract terms for Nova

Several indicators will signal how this technology develops:

Legislative Response: State legislatures have previously enacted laws regulating license plate reader data retention and sharing. California's S.B. 34 requires public meetings before starting ALPR programs and prohibits selling data to non-public agencies. Similar legislation addressing personal data integration could emerge.

Legal Challenges: Civil liberties organizations have successfully challenged license plate reader practices in court. The ACLU and EFF have filed lawsuits over data sharing and retention policies. Nova's expanded capabilities could prompt new litigation.

Agency Adoption: The number of agencies joining the early access program and their public statements about the technology will indicate law enforcement appetite for these capabilities.

Audit Findings: California's State Auditor issued a critical report in 2020 about law enforcement compliance with license plate reader regulations. Similar audits could examine Nova's deployment.

Company Disclosures: Flock's public statements about Nova's capabilities, data sources, and safeguards will shape the public debate about the technology.

Sources for this article were published on or before May 18, 2025. The 404 Media investigation was published on May 14, 2025.