Flock Safety’s cameras do not need to read your license plate to know it’s your car. They can do it from the dent in your bumper, the roof rack you never removed, or the faded parking sticker from a job you quit two years ago. That single fact, buried in the company’s own marketing copy, matters more than anything in the letter Senator Josh Hawley sent Flock’s CEO this week.
On August 26, Hawley, who chairs the Senate Judiciary Subcommittee on Crime and Counterterrorism, opened a formal investigation into Flock Safety and gave the company until September 8 to hand over records explaining who can see, search, and sell the data its cameras collect. His letter puts real numbers on a system most drivers have never heard of: more than 120,000 cameras spread across 49 states, running more than 20 billion vehicle scans every month, feeding a searchable national database that Congress never authorized and that most of the people captured in it never did anything wrong.
Here is the detail almost nobody outside the industry understood until now. Flock does not just read plates. Its Vehicle Signature and FreeForm search tools are built to recognize thousands of unique vehicle characteristics: paint color, body damage, roof racks, bumper stickers, wheel style, a missing hubcap. Type a description like dark green pickup, ladder rack, cracked taillight into the system, and it can generate a lead without a plate number at all. That is a fundamentally different technology than the plate scanner a state trooper used in the 1990s. It means the parts of your car that make it uniquely yours are exactly the parts that make it easiest to track. A wrap job, a set of aftermarket wheels, a distinctive decal: to this software, that is not self-expression. It is a fingerprint that does not wash off at the car wash and cannot be swapped out like a plate.
Flock is not even the only company running a network like this. A rival built on repurposed tow trucks has already scanned nine billion plates in California alone, and a state court recently decided that arrangement is perfectly legal.
The letter’s most alarming numbers are not about privacy in the abstract. They are about what happens when the system is wrong. Hawley cites one California police department where 71 percent of Flock alerts turned out to be false. The LAPD dropped its contract after officers wrongly stopped 161 vehicles flagged as stolen in a two-month span. A Florida woman spent 13 days in jail facing eight felony counts, including three counts of vehicular homicide, after investigators matched her car through a vehicle description search that turned out to be wrong. Prosecutors dropped the charges seven months later. We have already covered this exact failure mode: a single misplaced digit on a press-fleet Range Rover’s paperwork was enough to get it logged as stolen.
For everyday drivers, that is the part worth sitting with. If you have ever bought a used car and driven around for a few weeks on a paper temporary tag, or if you drive something common in an uncommon color, you are exactly the kind of false positive these systems produce. A stolen-vehicle hit does not get you a polite phone call. It gets you pulled over at gunpoint, and increasingly, it can happen even when your plate never comes up wrong at all.
The abuse does not require a technical failure, either, just a bored or vindictive person with a login. Hawley points to a Milwaukee police officer criminally charged with searching his girlfriend’s plate 124 times and her ex-boyfriend’s plate 55 times, and he was only caught because the ex-boyfriend looked up his own plate on a public lookup tool and noticed the pattern himself. A civilian employee in St. Charles County, Missouri got the county’s entire Flock contract canceled by running searches that had nothing to do with police work. Savannah, Georgia benched six employees for the same kind of misuse just weeks before Hawley’s letter went out.
Then there is the timing. On August 18, eight days before Hawley’s letter, Flock published a policy update cutting its default data retention from 30 days to seven. The company frames this as continuous improvement. It is also exactly the kind of move a company makes when it can see a subpoena coming. Hawley’s letter zeroes in on the real tension underneath all of it: Flock is a private company valued at 8.3 billion dollars, and that valuation depends on the network getting bigger and the data getting more useful, not less. Every driver scanned by a Flock camera is, functionally, unpaid inventory for a business with every incentive to find new customers for that data. Automakers already learned a version of this lesson the hard way when regulators caught some of them quietly funneling driving-behavior data from connected cars to insurance-linked data brokers. Flock’s cameras collect a similar kind of behavioral record, just from outside the car instead of inside it, and nobody had to buy a new vehicle or sign a telematics agreement to end up in it.
It is also worth remembering who is buying these cameras. Flock’s customer base is not limited to police departments. Homeowners associations, apartment complexes, churches, and retail parking lots all run the same network, which means a car can be logged the moment it turns into a subdivision, not just when it crosses a police jurisdiction’s boundary. The national surveillance network Hawley describes is not a government program. It is a patchwork of private contracts that happens to function like one.
Congress has decades of case law about when police need a warrant to search a car. It has essentially no law governing a privately built, nationwide, AI-searchable record of everywhere that same car has been. Hawley’s letter will not close that gap by September 8, and it will not be the last investigation into this industry, either. But it does put a fine point on something every driver should understand now: the plate on your bumper was never really the technology doing the identifying. Your car was already doing that job by itself.