The reasons typed into Flock Safety’s search box were “info” and “37.” The car being searched, according to a federal class-action complaint filed Oct. 8 in Newnan, Ga., was a 2024 Toyota Camry XSE belonging to Tyler Murkerson, a Heard County man who at the time was suing Coweta County Sheriff Lenn Wood and two of his deputies over a 2023 arrest.
Murkerson’s new lawsuit names the county, the sheriff, two other deputies, three unidentified officers and Flock Group Inc., the Atlanta company that sells the cameras. The claim against Flock reaches past Coweta County to every driver in Georgia, because it goes after a design choice: for most of the period in question, the only thing standing between an officer and a nationwide lookup of your car was a text field that accepted any word at all.
Five searches during a pending civil rights case
I read the complaint, filed in the U.S. District Court for the Northern District of Georgia as case No. 3:26-cv-00223-LMM. These are Murkerson’s allegations, and none of them has been tested in court.
The backstory starts on Feb. 6, 2023, in a Newnan gas station parking lot. Murkerson says deputies took him to the ground, used a Taser on him and arrested him over an alleged seat belt violation. All four charges were dismissed on June 26, 2023. He filed a civil rights suit on Sept. 9, 2024, and that case was dismissed with prejudice around August 2026 after it was resolved, according to the new complaint.
While that first case was open, the complaint says, a Flock audit record showed his Camry under a 197-day surveillance period running from May 4 to Nov. 18, 2025. The record attributes five searches to the Coweta County Sheriff’s Office. Two list operator usernames, “r.fau” and “w.fau,” which the complaint ties to the two deputies it names. Each of those searches reached between 6,397 and 6,521 camera networks. Details of the other three have not been disclosed. Murkerson also alleges, on information and belief, that his car sat on a standing alert list that would ping users whenever it passed a camera.
The cost to him, he says, went beyond nerves. Murkerson had spent about six years servicing the vehicles of a neighboring police department. He dropped that work, and the income with it, because he no longer felt safe doing it while he was being watched. Flock and the sheriff’s office had not commented when CBS News Atlanta reported the suit on Oct. 15.
Georgia law requires a purpose. The software required a word.
Georgia has regulated plate readers since 2018. Under O.C.G.A. § 35-1-22, captured plate data may be accessed only for a “law enforcement purpose,” which the statute defines as the investigation of an offense or activity initiated by a law enforcement agency. Anyone who knowingly obtains that data under false pretenses or for any other purpose commits a misdemeanor of a high and aggravated nature, and the statute counts each violation as a separate offense. In Georgia, that grade of misdemeanor carries up to 12 months in jail and a fine of up to $5,000.
The law sets a purpose test. According to the complaint, the software never applied one. Flock required an operator to type something into a “reason” field before a search would run, but it did not require that the text identify an offense, a case, an incident or an investigation, and it did not check the entry against any agency record. “Info” passed. So did “37.”
Flock’s own timeline lines up with that account. In an Aug. 13, 2026 post, CEO Garrett Langley wrote that case codes had been optional since July 2025, which is the middle of Murkerson’s surveillance window, and that they will be required for all law enforcement searches by the end of this year, with emergency searches allowed but flagged for an administrator. The same post said multifactor authentication became mandatory for all logins at the start of August 2026, that the Audit Assistance tool for flagging abnormal activity will be mandatory by year’s end, and that the default retention for new customers drops to seven days from 30. Existing customers keep whatever retention they already have.
Most of those changes came after the searches in this case, and the one that arrived during them, the case-code field, was optional. The complaint’s list of alternatives Flock could have built earlier includes case-number validation, anomaly detection, rate limits, alerts that expire and automatic removal of users who leave an agency.
How a county search left tracks in other agencies’ records
The 6,000-plus figure explains how Murkerson found out. A Flock search can run across cameras owned by other agencies that share their networks, and each of those agencies keeps an audit log showing who searched its cameras and why. Georgia’s statute exempts captured plate data from the state Open Records Act, so Murkerson could not simply request the record of where his Camry had been. The search logs kept by other agencies are a different matter. The complaint says he learned of the searches through haveibeenflocked.com, a public site that compiles Flock audit logs obtained through public records requests.
That trail is getting thinner. The complaint quotes a Flock announcement that its Network Audit reports would no longer include officer name, specific plates searched, vehicle fingerprint or the open-text search reason. If those fields had already been gone in 2025, the “info” and “37” entries at the center of this case would not have appeared in anyone else’s files.
Why a camera maker is sitting at the defense table
Georgia’s plate-reader statute punishes misuse as a crime, but it does not spell out a right for the person who was tracked to sue. The complaint gets around that with O.C.G.A. § 51-1-6, Georgia’s general rule that someone harmed by the breach of a legal duty can recover damages even when the law creating the duty doesn’t say so. It also leans on a clause in § 35-1-22 that makes a contractor holding plate data for an agency subject to the same penalty provision. If the judge accepts that route, the vendor’s design decisions become a negligence question, not only the officer’s.
The suit also invokes the federal Driver’s Privacy Protection Act, a 1994 law Congress passed after actress Rebecca Schaeffer was killed in 1989 by a stalker who obtained her home address from California motor vehicle records. The DPPA lets a person sue anyone who knowingly obtains or uses personal information from a motor vehicle record for an impermissible purpose, with liquidated damages of at least $2,500. The connection to plate readers is mechanical. A camera read is a string of characters and a location; it becomes a person when someone matches the plate to the registration file at the DMV. Whether Flock queries fall under a law written for DMV clerks and private investigators is a question the court will have to answer.
The class Murkerson proposes is broad: anyone whose plate was queried by a Georgia law enforcement agency where no case, incident, call for service or investigation supported the search, going back four years. A separate injunctive class covers searches logged with placeholder reasons like “info” and no case number. The relief he wants includes purging improperly obtained records, pulling identifiers off active alert lists and requiring Flock to validate search justifications in Georgia. If a judge certifies anything close to that class, discovery would run through the audit logs of agencies across the state. We’ve covered a similar fight in Colorado, where a Rivian owner sued after her plate was logged 20 times over a $25 porch theft, and an Oklahoma case in which a Tulsa deputy’s month of plate searches reached a Fourth Amendment ruling.
Plate-reader misuse cases in Braselton, Hall and Gwinnett
Murkerson’s suit lands after a string of Georgia cases built on the same failure. In November 2025, the GBI arrested former Braselton Police Chief Michael Steffman on stalking, harassment and multiple counts of misusing plate-reader systems; the agency said its investigation found he used the systems to harass and stalk multiple people, Atlanta News First reported. In August 2026, three Coweta sheriff’s employees resigned after routine audits flagged their Flock accounts, and the office asked the GBI to investigate, FOX 5 Atlanta reported. The sheriff’s office has not named them, and I found nothing in the public record tying them to the deputies Murkerson names.
On Aug. 25, the Hall County Sheriff’s Office fired two investigators after an internal audit found searches unrelated to police work. On Sept. 4, Gwinnett County police fired and charged three officers, two of them with misuse of license plate data. Gwinnett said it gained access to Flock’s new auditing system in June 2026, and it now requires officers to justify a search to a supervisor, who decides whether it runs. It also cut its retention from 30 days to 15. Our running record of reported plate-camera misuse has more.
The pattern in those cases runs one direction. Better audit tools found misuse that the search screen had allowed, and the agencies then added the gate by hand: a supervisor, a case number, a shorter memory. Gwinnett’s supervisor rule is the same check Murkerson wants a court to require statewide.
What Georgia drivers should watch
Your plate is read whether or not anyone suspects you of anything, so the protections that matter are how long the read is kept and who can pull it up. On the first, Georgia law allows an agency to keep plate data for up to 30 months unless it is tied to a toll violation or a law enforcement purpose. Flock’s new default is seven days, and a bill from Sen. Josh Hawley would cap it at 10. On the second, the answer through most of 2025 was any authorized user who could type a word.
Three things are worth tracking. Flock has promised mandatory case codes by Dec. 31, and a code field that accepts “info” would leave the problem in place. The GBI’s Coweta findings would typically go to the district attorney, which is where § 35-1-22’s criminal penalty gets tested. And the defendants’ responses in Newnan will show whether Flock argues that what an officer types into its box is the agency’s problem alone.
Should a plate-reader search refuse to run until an officer enters a case number that can be checked, even if that slows down a detective working a live lead?