The Surveillance Ratchet

Originally published October 18, 2026.

How a Crime-Fighting Camera Network Becomes Political Intelligence Infrastructure

The camera on the pole is the least important part of the story.

Automated license-plate readers entered American communities through an uncomplicated pitch: a camera reads a passing plate and alerts police when the vehicle is stolen, wanted or connected to an investigation.

Viewed narrowly, this appears to automate something police officers could already do on a public road.

That description is increasingly incomplete.

Across different surveillance systems, stored plate observations can support travel-history searches, co-travel analysis and links to identity records. Video tools can search for people or vehicles matching written descriptions; separate wireless sensors can correlate nearby devices with vehicles.[1][2][3]

Flock Safety alone says its network includes more than 120,000 cameras across 49 states, generating roughly 20 billion plate scans each month.[4]

The operative question is no longer simply, is the stolen car passing this camera?

It is becoming, where does this person travel, who travels with them, and what people and devices appear around them?

This is not merely passive or automated observation.

It is automated investigation augmented by artificial intelligence.

And once such an infrastructure becomes ubiquitous, the central issue is not whether law enforcement, governments or vendors promise to use it responsibly.

It is what governments will be capable of doing with it.

The Database Precedes the Suspect

Scale fundamentally changes surveillance.

A police officer at an intersection sees whatever passes while on duty. A network records observations whether anyone is suspected of wrongdoing or not, preserving information so investigators can search backward later.

Traditional investigative logic generally proceeds as follows:

Crime identified → Evidence gathered → Suspect(s) identified → Surveillance

The emerging model permits:

Surveillance → Stored Data → Pattern → Identity → Suspect → Crime

OS Investigate (originally called Nightshift) is Flock's experimental AI investigative platform. WIRED’s examination of Flock’s platform demonstrates how complete this inversion is becoming.[1]

The software can identify potential witnesses based on how frequently their vehicles enter an area, highlight vehicles repeatedly traveling together as possible “associates,” and combine plate observations with case files, 911 dispatch records and commercial databases containing names, addresses and relatives.[1]

Crucially, an investigator need not always begin with a plate number or known person. Some searches can begin with a location, time period and behavioral pattern.

Investigators can now begin with stored observations and behavioral patterns, identify potential subjects and then search for evidence connecting them to suspected criminal activity.

The geographic reach is no longer theoretical. WBTV reported in October 2026 that Houston police conducted more than 183,000 searches that included UNC Charlotte’s Flock network from March through May; the university’s own police conducted 229. Houston’s queries often included more than 6,000 networks. These figures count searches that included the university network, not confirmed sightings or searches specifically targeting the campus. They do not establish misuse. They demonstrate how routinely a department in Texas can query camera networks far beyond its jurisdiction.[5]

From Location to Association

Location history is revealing; association mapping creates additional risks to constitutional rights.

Leonardo’s ELSAG SignalTrace adds another layer by detecting wireless emissions from mobile phones, smartwatches, Bluetooth devices, RFID tags and electronics within vehicles.[2]

Leonardo’s SignalTrace product can identify groups of devices traveling in proximity and create an “electronic fingerprint” that can be correlated with ALPR observations and analysis.[2]

The captured wireless identifiers do not necessarily reveal a person’s identity. Correlating recurring device and vehicle observations with locations, records and other investigative information may help investigators infer the identities of people associated with a device or vehicle. That is an investigative inference, not a demonstrated automatic identity-resolution capability of SignalTrace. Its reliability depends on the data, the analytical method and independent corroboration.[2]

For example, identifying travelers is facilitated when a recurring cluster of devices appears with one vehicle, near a residence at night and a workplace during the day.

This creates a critical analytical trap: correlation can be mistaken for culpability.

Two vehicles traveling together may indeed belong to bad actors and conspirators, or they may also belong to journalists and their sources; attorneys and clients; political campaign workers; investigators and their clients/witnesses or subjects; peaceful protesters or voters carpooling to a rally.

At sufficient scale, this becomes more than vehicle tracking. It creates the technical foundation for constructing social networks, identifying associations and potentially supporting systems that classify individuals according to their activities, relationships or perceived risks.

Essentially, technology establishes correlation and government assigns meaning to it.

The danger is not confined to erroneous camera readings. In her September 23 Senate testimony, Lindsey Isaacs described how a Flock camera recorded her Dodge Durango a few miles from a fatal Florida collision. That observation became part of an investigation that led to her arrest. She testified that she spent 13 days in jail before release on bond; prosecutors later declined to prosecute and charged another individual. Her account describes an accurate observation followed by a disastrous investigative inference, not a camera misidentifying her vehicle.[6]

This is the distinction between observation and inference. A camera can accurately record a vehicle and an algorithm can correctly identify a pattern, yet investigators may still reach the wrong conclusion. Automation bias—the tendency to give automated output undue weight—can turn a useful lead into apparent proof. Improving the technology’s accuracy does not necessarily improve the judgment applied to its results.

Politics Controls the Definition of Threat

Political weaponization is no longer entirely hypothetical.

Political-event surveillance predates today’s nationwide networks. During the 2008 presidential campaign, Virginia State Police used automated plate readers to record vehicles attending Barack Obama and Sarah Palin rallies and later President Obama’s inauguration. The attendees were not suspected of crimes; their presence at a political event was what made their vehicles worth recording. Police documents said the system could provide a record of attendees if a serious incident later occurred. The resulting scans were retained in a state database—some for as long as three years—until the practice was curtailed following a Virginia attorney general’s opinion.[7]

Government did not begin with suspects and determine where they went. It began with a political gathering and recorded attending vehicles.

Protest activity provides another example.

Public records have shown police using Flock in connection with an immigration protest, while a Flock law-enforcement training webinar demonstrated how its integrated surveillance platform could be used during demonstrations, including a No Kings protest.[8][9]

Government fusion centers have also monitored anti-Flock social-media activity and circulated intelligence surrounding planned protests and a nationwide anti-ALPR “Week of Action.” Some of that monitoring involved legitimate concerns about camera vandalism, but the intelligence also encompassed lawful political organizing and opposition to surveillance technology itself.[10]

The political implications become still clearer inside Flock’s software.

WIRED found that Flock’s AI search interface recognizes queries involving “political, social, and cultural expression” as sensitive—but does not necessarily block them. An officer can acknowledge a warning, provide an explanation and select: “Continue With Search Anyway.”[3]

Vendor access adds another dimension. In September 2026, 404 Media reported that internal Flock accounts, including “Flock City PD,” had queried live customer cameras during demonstrations. Logged prompts concerned political stickers, religious symbols, people holding signs and crowds. Some queries were blocked; others were allowed or triggered warnings. Flock said sensitive prompts tested safeguards and that the demo account was now isolated from real cameras. The records do not establish a political-intelligence operation.[11]

Flock’s own explanation acknowledges employee testing and demonstrations on live cameras with customer permission. The governance question therefore extends beyond police conduct: who authorizes vendor access, which searches are technically possible, and who independently verifies the limits?[11]

Consider what roadside cameras can see:

• A bumper sticker.
• A campaign sign.
• A protest placard.
• Repeated visits to campaign headquarters.
• Vehicles regularly appearing at the home of an activist, donor or political candidate.

Now add historical searches and association analysis.

A government interested in a political organization does not necessarily need access to its membership list.

1. It can begin with a location
2. Identify vehicles and devices
3. Identify which appear repeatedly
4. Map those traveling with them
5. Convert data to identities
6. Follow associations outward

The surveillance system can construct an alleged membership list.

Similar inferences could concern religious attendance or visits to gun ranges and shows.

The January 6 Geofence Dragnet

The January 6 investigation provides one of the clearest demonstrations of how location technology can identify people first and determine culpability afterward.

The FBI obtained a geofence warrant requiring Google to produce records of devices located within a defined area covering the U.S. Capitol and its immediate surroundings during the breach. Google’s Location History used GPS, Wi-Fi and Bluetooth signals to estimate device locations.[12]

The initial Google production encompassed approximately 5,700 devices. Investigators progressively narrowed that population, attempted to exclude devices belonging to people lawfully present, and ultimately obtained identifying information associated with devices believed to have been inside the Capitol. The resulting location evidence helped identify and prosecute numerous defendants.[12]

The significance is not whether people who unlawfully entered the Capitol should have been prosecuted. It is the investigative method:

Government began with a place and thousands of unidentified devices, searched a private company’s historical location database, and worked backward from location to identity.

Software Settings Are Not Rights

Flock has responded to criticism by announcing stronger safeguards: a recommended seven-day default retention period, case-code requirements, automated misuse detection, account lockouts and multifactor authentication.[13]

These measures may discourage some unauthorized activity.

These safeguards leave retention periods subject to policy choices.

System users may adopt data-retention periods that suit their needs, and Flock’s ‘Evidence Mode’ allows selected records to be preserved longer for investigations.[13]

Even an agency’s written restrictions may not settle how a surveillance network operates. Flock says customers control access and sharing, while acknowledging authorized testing on live cameras. Agencies need independently verifiable restrictions on external sharing, employee access and demonstrations. A contractual prohibition is not the same as a technical impossibility; control over the service also depends on enforceable suspension, termination and deletion rights.[11][13]

The distinction is fundamental: a right protected only by a software setting or contractual promise remains dependent upon whoever controls that setting or interprets that contract.

Policies are set to whatever is justified.

Consider this hypothetical test.

A child is kidnapped.

Police later identify a suspect vehicle that crossed several cameras nine days earlier, but the seven-day retention period erased the records.

Perhaps those records would have shown where the kidnapper traveled.

Now place the grieving parent before television cameras asking why potentially lifesaving evidence was deliberately destroyed.

How long will seven days survive? Thirty days suddenly sounds reasonable.

Soon a murder investigation demonstrates the usefulness of six months.

And a terrorism case demonstrates the usefulness of years.

Every expansion has a compelling justification.

Every exception has a victim.

That is the surveillance ratchet.

Expansion need not arrive through sudden and dramatic suspension of liberty.

It occurs one ‘reasonable’ exception at a time.

The Limits of Auditing

Procedural safeguards have similar limitations.

Prosecutors in Indiana allege that former Jackson County deputy Skylar Thompson searched the same license plate 2,055 times over approximately seven months while repeatedly entering “City Planning/Traffic Analysis” as the justification, despite having no such assigned duties.[14]

An audit eventually exposed the alleged activity—but only after thousands of searches had already occurred.

That illustrates the limitation of auditing: it may document abuse after the fact, but it does not necessarily stop the surveillance from taking place.

The vendor-access disclosures show why oversight must extend beyond sworn officers. Vendor employees and civilian technical personnel may hold credentials without conducting a police investigation. Effective oversight must establish who can search, whether each purpose is authorized and independently checked, and whether a prohibited search should have been technically possible. A log alone cannot answer all those questions.[11]

More importantly, rogue users may be the easier problem to solve.

The greater danger arises when the surveillance is authorized.

A police chief approves the search. A prosecutor opens the investigation. An intelligence unit classifies a political organization as a security concern.

Every user authenticates properly. Every query carries a case number. Every search is logged. Nothing in the system has malfunctioned.

Surveillance can be completely policy-compliant and still represent an abuse of governmental power.

Audit trails and internal controls are designed to catch people who violate the rules. They offer little protection when the institution itself decides the surveillance is permissible. And they provide no meaningful safeguard when the institution’s rules fail to account for everyone who can access the system—including the vendor itself.

The Legislative Imperative

Personal countermeasures cannot solve an infrastructure problem.

Turning off Bluetooth or placing a phone in airplane mode may reduce some electronic emissions. It does nothing about the license plate mounted to the vehicle, roadside cameras recording it, passengers carrying other devices, or increasingly connected electronics built into modern automobiles.

Citizens should not have to practice counter-surveillance tradecraft merely to attend a political meeting or visit a political rally or a gun range without creating a searchable record.

The solution must occur upstream.

Courts are beginning to confront the distinction between observing a vehicle in public and reconstructing its movements from stored observations.

On October 1, 2026, Judge Sara E. Hill of the Northern District of Oklahoma granted suppression in United States v. Kyle. A deputy used Flock and VehicleManager to examine historical vehicle movements; the ALPR search yielded more than 50 sightings across multiple states over a month. The court held that this warrantless search, unsupported by probable cause, violated the Fourth Amendment. It separately found that the traffic stop had been unlawfully extended.[15]

The decision concerns that record; it does not establish a nationwide prohibition on warrantless ALPR searches. Other courts have reached different conclusions. The constitutional question remains central to the surveillance ratchet: when does the aggregation of individually public observations become a search requiring judicial authorization?[15]

Legislative action should address capabilities rather than vendor promises:

1. Require judicial authorization for historical and association searches. Pattern-based searches of movement histories, co-travel relationships or geographic activity should ordinarily require a probable-cause warrant tied to an identified investigation.
2. Set retention limits by statute, not software preference. Agencies and vendors should not be permitted to extend retention simply by changing an administrative setting. Preservation beyond the statutory period should require judicial authorization tied to a particular investigation.
3. Protect political and other constitutionally sensitive activity. Lawful political expression, protest participation, journalism, religious activity and similar protected conduct should not by themselves constitute grounds for historical or association surveillance.
4. Regulate aggregation, not merely cameras. Restrictions must apply when ALPR records are combined with wireless-device identifiers, commercial databases, AI analysis and information obtained through other agencies.
5. Create enforceable consequences. Independent auditing, public reporting and a statutory private right of action are necessary when agencies or vendors violate surveillance restrictions. Internal discipline is inadequate when misuse is institutional rather than individual.
6. Establish enforceable controls over vendor access and network sharing. Surveillance vendors should not possess unrestricted authority to search customer data, use operational cameras for demonstrations or expand access beyond the purchasing agency’s authorization. Contracts should require independently verifiable access restrictions, immutable audit records, immediate suspension authority, independent security testing and enforceable data-deletion obligations. Cross-jurisdictional sharing should require explicit authorization and be subject to the same legal restrictions as searches conducted by the originating agency.

The urgency is not theoretical.

In September, Florida began revoking permits for ALPR cameras located on state highway rights-of-way, citing the rapid growth of the systems, privacy concerns and reports of misuse.[16] The controversy has also reached Congress. On September 23, 2026, a Senate Judiciary subcommittee held a hearing on nationwide ALPR surveillance, investigative uses and constitutional protections. Witnesses included law-enforcement, civil-liberties and cybersecurity representatives and Isaacs. According to Chairman Josh Hawley’s office, the CEOs of Flock, Axon, Motorola Solutions and Verkada declined invitations to testify; Flock submitted a written response.[17]

The opportunity to impose durable limits is greatest before agencies become dependent upon it.

The Surveillance Ratchet

The danger is what those individually defensible expansions create in combination. A system built to reconstruct criminal networks can just as readily reconstruct political networks.

The difference between a crime-fighting network and a political intelligence system will depend on who holds power—and whom they decide to investigate.

The time to impose limits is before the surveillance infrastructure becomes embedded.

Endnotes

[1] Dhruv Mehrotra and Dell Cameron, “Flock Has a Powerful New AI Tool for Police. We Got Its Code,” WIRED, August 19, 2026.

[2] Leonardo US Cyber and Security Solutions, “ELSAG SignalTrace: Investigative Evidence Beyond Plate Reads,” product documentation, and Nate Maloney, “Beyond License Plates: How SignalTrace Expands Operational Awareness Through Electronic Signature Detection,” July 29, 2026, accessed October 18, 2026. The company describes device/vehicle correlation; it does not demonstrate automatic personal identification. https://www.leonardocompany-us.com/lpr/elsag-signaltrace ; https://www.leonardocompany-us.com/lpr/blog/beyond-license-plates-how-signaltrace-expands-operational-awareness-through-electronic-signature-detection . Also Nicole M. Bennett, “New Surveillance Tech Links Your Phone to Your License Plate,” Ars Technica, August 11, 2026.

[3] Dell Cameron and Dhruv Mehrotra, “This Is Flock’s AI Search Tool for Cops,” WIRED, September 3, 2026.

[4] Drew Harwell, Douglas MacMillan and Aaron Schaffer, “How Rogue Officers Turned a Nationwide Camera Network Into a Tool for Stalking,” The Washington Post, August 2, 2026.

[5] David Hodges, “Houston Police Searched UNC Charlotte Camera Network More Than 183,000 Times in Three Months,” WBTV, October 14, 2026, reporting on university search records for March–May 2026. Counts are queries including the network, not vehicle detections. https://www.wbtv.com/2026/10/14/houston-police-searched-unc-charlotte-camera-network-more-than-183000-times-three-months/ . Primary-record collection: UNC Charlotte PRR #26-206, mirrored by DeFlockILM, https://archive.org/details/deflockilm-unc-charlotte-alpr-2026 .

[6] Lindsey Isaacs, statement before the Senate Judiciary Subcommittee on Crime and Counterterrorism, “Always Watching: Flock’s Nationwide AI Surveillance Network,” September 23, 2026, pp. 1–3, especially p. 3 (bond, 13-day detention and subsequent No Information). This is witness testimony, not a judicial finding concerning the cause of her arrest. https://www.judiciary.senate.gov/download/09/23/2026/2026-09-23-pm_testimony_isaacspdf .

[7] Rebecca Glenberg, “Virginia State Police Used License Plate Readers At Political Rallies, Built Huge Database,” American Civil Liberties Union, October 8, 2013; Benjamin Freed, “Virginia Authorities Recorded License Plates of Cars Headed to Obama’s Inauguration,” Washingtonian, August 21, 2013; Ángel Díaz and Rachel Levinson-Waldman, “Automatic License Plate Readers: Legal Status and Policy Recommendations for Law Enforcement Use,” Brennan Center for Justice, September 10, 2020.

[8] Joseph Cox, “California Cops Investigate ‘Immigration Protest’ With AI-Camera System,” 404 Media, June 17, 2025.

[9] Jason Koebler, “Flock Taught Cops How to Surveil No Kings Protesters,” 404 Media, September 3, 2026.

[10] Jason Koebler, “The Government Is Monitoring Anti-Flock TikTok and Instagram Accounts,” 404 Media, August 12, 2026.

[11] Jason Koebler, “‘Flock City PD:’ The Fake Flock-Owned ‘Police Department’ That Searched Real Cameras for Real People,” 404 Media, September 17, 2026 (audit-log reporting and company response). https://www.404media.co/flock-city-pd-the-fake-flock-owned-police-department-that-searched-real-cameras-for-real-people/ . Josh Thomas, “Understanding Flock’s Testing and Development Program,” Flock Safety, accessed October 18, 2026 (company account of authorized live-camera testing, moderation and demonstration practices). https://www.flocksafety.com/blog/understanding-flocks-testing-and-development-program .

[12] Mark Harris, “A Peek Inside the FBI’s Unprecedented January 6 Geofence Dragnet,” WIRED, November 28, 2022. https://www.wired.com/story/fbi-google-geofence-warrant-january-6/

[13] Garrett Langley, “Flock Updates Privacy, Accountability, Security, and Transparency Safeguards,” Flock Safety, August 13, 2026. https://www.flocksafety.com/blog/flock-guardrails-address-lpr-privacy-concerns-and-police-transparency .

[14] Kendall Pierson, “Ex-Deputy Accused of Searching for Same License Plate 2,055 Times on Flock,” WRTV Indianapolis, September 2026.

[15] United States v. Kyle, No. 26-CR-00189-SEH (N.D. Okla.), Opinion and Order, ECF No. 62, October 1, 2026, pp. 2–3, 25–29 and 34–38. The district court granted suppression on historical-ALPR-search and prolonged-stop grounds; its discussion at pp. 29–30 identifies contrary ALPR rulings. Filed order: https://storage.courtlistener.com/recap/gov.uscourts.oknd.76981/gov.uscourts.oknd.76981.62.0.pdf .

[16] Helen Coster, “Florida Bans Highway License-Plate Readers as Backlash Over Surveillance Spreads,” Reuters, September 3, 2026. Florida’s Department of Transportation said it would revoke existing permits and stop issuing new permits for ALPR cameras within its jurisdiction, citing rapid deployment, reported misuse, data-privacy concerns and “surveillance schemes.”

[17] U.S. Senate Committee on the Judiciary, “Always Watching: Flock’s Nationwide AI Surveillance Network,” hearing and written testimony, September 23, 2026. https://www.judiciary.senate.gov/committee-activity/hearings/always-watching-flocks-nationwide-ai-surveillance-network . Office of Senator Josh Hawley, “ICYMI: Hawley Chairs Subcommittee Hearing Exposing Flock Cameras, Calls for Accountability,” September 28, 2026 (CEO invitations declined; Flock written response). https://www.hawley.senate.gov/icymi-hawley-chairs-subcommittee-hearing-exposing-flock-cameras-calls-for-accountability/ .

Additional legal authority: Chatrie v. United States, No. 25-112, U.S. Supreme Court, June 29, 2026. https://www.supremecourt.gov/opinions/25pdf/25-112_0am4.pdf .