Sep 01: A new kind of camera system for reading license plates has expanded the potential for law enforcement to track vehicles and at the same time has raised concerns about violations of privacy. Common parlance refers to these devices as “Flock cameras,” but in fact Flock is a brand name, and Flock Safety is just one of several companies that sell and operate similar security systems.
Virginia Tech online privacy expert Donna Wertalik and cybersecurity expert Murat Kantarcioglu provided analysis of the technology and its implications.
Donna Wertalik on how the systems work and privacy concerns raised
“Think of it as a camera with a memory. It photographs every vehicle that passes by. AI reads the license plate and logs the time, location, and direction of travel. Unlike a typical security camera that stores footage someone has to review, the system turns those images into a searchable database. It also creates a ‘vehicle fingerprint’ that captures details like make, color, and unique features, allowing searches even when a license plate number is unknown,” Wertalik said.
“Privacy groups have raised four main concerns. First, in Virginia, police can search this data without a warrant. Many people don’t realize that. Second, misuse can happen. There have been cases around the country in which officers improperly accessed plate reader systems. Third, there’s what’s called ‘mission creep.’ Technology originally marketed to help find stolen cars and missing children can end up being used for much smaller offenses. And finally, there’s data retention. Virginia passed a law limiting how long this information can be kept, but state reviews found some agencies were not fully following those rules,” she said.
“Another reason people are concerned is that security researchers found some Flock cameras exposed on the open internet, allowing access to live video feeds and stored footage. Flock said the issue affected a limited number of cameras and was quickly fixed,” Wertalik said.
“A bigger concern is where the data is stored. This information isn’t kept by your local town. It’s stored by a private company in the cloud. That means residents are relying on a third party to keep location data secure. Flock has taken steps to improve security, including reducing how long data is typically stored and adding stronger auditing and monitoring tools. But for many people, questions remain. Who has access to the data? Where is it stored? How well is it protected?”
Murat Kantarcioglu on striking a balance to address security concerns
“I believe we can have a balance between the safety this technology brings to us and the need to protect privacy. I see the usefulness of these systems for law enforcement, especially for situations like crimes of passion or child abductions, situations where a suspect is not necessarily aware of the nature of these systems. A professional criminal, on the other hand, will likely take precautions that will make them more difficult to track,” Kantarcioglu said.
“At the same time, strong privacy and security protections need to be there. For example, there have been reports — not in the United States — of camera systems hacked by foreign intelligence to track important people to target them for assassination. Hypothetically, systems like these could be used to determine where a reporter might be meeting with a confidential source. There have been reports of law enforcement officials using them to stalk former romantic partners. These raise valid concerns of invasion of privacy. It’s important to put safeguards into the system to detect potential hacking attempts and prevent abuse,” he said.
“Limits could be placed on how long data is retained. In addition, an internal auditing process could analyze search logs to identify potentially anomalous or inappropriate use, such as an unusually high number of repeated searches by a single user or searches that deviate significantly from normal patterns. Appropriate information about how the system and its data are used could also be made publicly available to promote transparency while protecting individual privacy and sensitive operational details.”