Somewhere in Los Angeles this past June, someone at a Jaguar Land Rover dealership misplaced a manufacturer license plate during a photo shoot, filed a report, and moved on. Whoever entered that report into the FBI’s National Crime Information Center dropped part of the plate number. That single clerical slip, made two time zones away, ended a few weeks later with four Plymouth, Minnesota, police cars boxing in a $155,000 Range Rover in a Kohl’s parking lot.
The driver hadn’t stolen anything. He’s an automotive journalist who was testing a manufacturer press loaner, and his wife was riding along. Officers had him out of the car with his hands raised before anyone worked out that the “stolen” plate belonged to a dealer fleet vehicle that had never been within a thousand miles of the original theft report.
Flock Safety, the Atlanta company whose nationwide license-plate camera network turned that clerical error into an armed response, tucked a version of this story into a blog post this week about sweeping new accountability changes for its law enforcement customers. The framing is that this was a rare misfire, quickly resolved, and that new guardrails will make its thousands of police department partners more careful about how they use the system.
That’s true, as far as it goes. It’s also not the interesting part.
The Announcement, And What It Actually Fixes
The headline changes, detailed by Flock and confirmed by the Associated Press, are real. The company is cutting its default data retention period from 30 days to seven, introducing an Evidence Mode that lets detectives preserve specific records for open cases, and requiring every law enforcement customer to adopt its misuse detection tool by the end of the year. Searches will need an attached case number. Cities can now decide which categories of crime outside agencies are allowed to search their cameras for. An outside security firm is auditing the whole platform, and multi-factor authentication is now mandatory for anyone logging in.
Every one of those changes answers a version of the same question: who is allowed to search the system, and can the company prove they had a legitimate reason to? That’s the question raised by the parade of Georgia officers caught running plates on ex-partners and family members, and by the police departments that have walked away from Flock’s network entirely rather than keep answering for how it gets used.
It is not the question raised by a Kohl’s parking lot in Plymouth. Nobody misused anything there. The system worked exactly as designed. That’s the problem.
A 1967 Database Just Got A Real-Time Broadcast Signal
The National Crime Information Center has operated in some form since 1967. It’s the master hotlist that dispatchers, DMV clerks, and patrol officers across the country check before doing much of anything, and it has always contained errors, because it has always depended on someone typing accurately. For most of its history, that didn’t matter far beyond the county line. A bad entry sat quietly in the system until an officer happened to run that exact plate, in whatever jurisdiction the mistake happened to land.
Flock changed the blast radius. Its cameras read essentially every plate that passes them, across 49 states, continuously, and check each one against that same imperfect federal hotlist in real time. A bad entry no longer waits around for one unlucky encounter. It gets pushed to every camera on the network the instant a matching plate drives past one, in whichever state that happens to be.
According to Plymouth’s police chief, that’s exactly what happened. The plate had been reported stolen out of California weeks earlier and was, in the chief’s own words, “improperly entered in the National Crime Information Center database with incomplete numbers,” according to CBS News Minnesota. Flock’s system took that flawed federal record and did precisely what it was built to do, flagging the Range Rover the moment it rolled past a camera in the Minneapolis suburbs.
Dealer Plates Are Exactly The Wrong Plates To Get This Wrong
Here’s the detail worth sitting with. The plate in question wasn’t an ordinary consumer tag. It was a New Jersey manufacturer plate, the type car companies issue to press fleets and dealerships rather than individual owners, with a small stacked digit nested between larger characters, a nonstandard format New Jersey uses specifically for that plate class. Flock’s own system, by the company’s account to local reporters, had the plate on file missing that smaller digit entirely.
Manufacturer and dealer plates don’t stay bolted to one car for its whole life the way a personal registration does. They rotate through dozens of loaner and press vehicles over the years, they’re standardized in format across an entire regional fleet, and states routinely give them nonstandard layouts that plate-reading software was never primarily designed around. A bad entry against a plate structure like that isn’t just a one-car problem. It’s a template. Anywhere a police department runs Flock cameras, any vehicle wearing a similarly formatted tag becomes a candidate for the same mistake.
That’s a new kind of exposure for the auto industry specifically, not just for one unlucky driver. Every automaker that loans cars to journalists, every dealership running a fleet of demonstrators, every rental company titling vehicles under commercial plates, is now operating in a world where one sloppy report, filed by someone they’ve never met and will never meet, can turn part of their inventory into probable cause.
The Math Flock Would Rather You Not Do
Flock says its safeguards have produced fewer than nine human-reported errors for every million alerts its system generates. Read alone, that sounds negligible. It stops sounding negligible once you apply it to the volume the company advertises in the same breath: over a million crimes it credits itself with helping solve annually, and more than 20,000 stolen cars flagged in a single month this summer. Run a system at that scale, even at a genuinely tiny per-alert error rate, and rare mistakes stop being rare. They become a predictable, recurring feature of the product, arriving in a new city every few weeks.
A Privacy Win That’s Also An Accountability Loss
There’s a real tension buried in the new default retention window. Cutting it from 30 days to seven is a legitimate privacy improvement, and Flock’s own numbers show most legitimate searches happen within that first week anyway. But a shorter window also shortens how long anyone has to reconstruct a mistake like Plymouth’s after the fact, unless a detective specifically flags it for the new Evidence Mode before the clock runs out. The fix that keeps the company from holding your data too long is the same fix that could make it harder to prove, weeks later, exactly how a bad plate report cascaded across a nationwide network. Compiling a running record of these errors, something worth doing case by case as they surface, is about to get harder, not easier.
What To Actually Remember Here
None of Flock’s new guardrails, welcome as they are, touch the vulnerability that produced this specific incident. Case codes, audit tools, and offense filtering all govern human behavior after an alert fires. None of them improve the accuracy of the record that triggers the alert in the first place. Flock’s own cameras have a well-documented history of misreading plates on their own, with no bad database entry involved at all, and the underlying record still comes from federal and state databases that have been quietly error-prone for decades, protected mainly by how slowly those errors used to travel.
Flock didn’t invent a surveillance state out of nothing. It took a paperwork problem that predates the moon landing and gave it a nationwide, real-time megaphone. The auto industry’s own press and dealer fleets, built on plates designed for bureaucratic convenience rather than individual identification, just happened to be the perfect way to find out.