When a cop leaves a department, there’s a checklist. Hand in the sidearm, the badge, the keys to the cruiser. What apparently wasn’t on the checklist in Effingham County, Georgia, was the one thing that let a former employee keep watching where cars went.
In July, the Georgia Bureau of Investigation arrested Andrae Wright, 44, of Statesboro, charging him with misuse of a license plate reader system, stalking, computer invasion of privacy, and violation of oath of office. At the time, Wright worked as an investigator for the Ogeechee Circuit District Attorney’s Office. The catch is whose camera network he allegedly used. The Effingham County Sheriff’s Office asked the GBI to step in after an internal audit of its Flock Safety account. Wright was a former sheriff’s office employee who still had access to that account, and investigators say he logged in more than 60 times between June 15 and July 5, 2026, for non-law enforcement purposes.
Sixty-plus searches in three weeks. That’s not a slip of the mouse. Charges are allegations, and the GBI says the case file will go to the Prosecuting Attorneys’ Council for review. But the mechanical failure here is already plain: a credential outlived the job it was issued for.
What a Flock camera actually knows about your car
Flock’s shoebox cameras aren’t just reading digits. Each time a vehicle passes, the system records plate information, vehicle characteristics, and when and where it was seen, per a Senate letter to the FTC. Your aftermarket wheels, roof rack, and that dented rear quarter panel you keep meaning to fix all become part of a searchable fingerprint. You can swap plates on a project car; you can’t easily swap its silhouette.
Related Articles
- Avis Billed a Renter for 28,933 km in a Week, a 107-MPH Average Around the Clock. His iPhone Logged 1,400
- Chicago Seized His Car Over $524 in Tickets, Sold It to Its Tow Contractor for $273 and Credited Him Nothing. Two Justices Noticed
Georgia law sets the ground rules. Under HB 79, agencies may collect plate data, but it must not be accessed except for a law enforcement purpose and must be destroyed within 30 months unless tied to a toll violation or investigation. Anyone who knowingly obtains that data for any other purpose commits a misdemeanor of a high and aggravated nature for each offense. Georgia’s attorney general even designated it a fingerprintable offense back in 2018.
Here’s the part that should bother owners: captured plate data held by police is exempt from Georgia’s open records law. Thirty months of where your car has been, and you generally can’t request it yourself. The people who can see it are the people with logins, which is exactly why stale logins matter.
Two-factor wasn’t the fix
Flock has spent 2026 tightening the screws. The company says it made multi-factor authentication mandatory for every user at the start of August, alongside required Audit Assistance, proactive lockouts, and required case codes for searches. That’s a reversal from its earlier position. Flock’s own fact sheet says it made MFA the default in November 2024, while federal lawmakers complained Flock offered MFA but didn’t require it.
Good. But think about how two-factor actually works. It proves the person typing the password also holds the phone tied to the account. A departed employee who still has his own phone sails right through. MFA stops strangers; it does nothing about an insider whose access nobody bothered to revoke.
The real fix is boring IT hygiene: offboarding. When someone leaves, their account dies the same day, ideally automatically through single sign-on tied to the department’s HR records. It’s the digital equivalent of re-keying the shop after a mechanic quits. Flock’s newer anomaly tools may help too. The company says proactive lockout is meant to help administrators spot and respond to atypical activity. A dormant account suddenly running dozens of searches is about as atypical as it gets. Whether those alerts get read by a busy sergeant is another question.
Related Articles
- The Dealership Boom Is Cracking: $120 Million Gone in One Quarter, and Buyers May Pay for It in the Finance Office
- California’s DMV Hounded a Widower for Fees on the SUV a Big Rig Destroyed. The Trucker Kept His License
Flock’s public line is unambiguous: “Abuse of Flock technology, at any level, is unacceptable.” The trouble is that account management sits largely with the agencies buying the cameras, and a vendor can’t deactivate an employee it doesn’t know left.
Your car is the fingerprint
Plate readers are now part of the driving environment, like speed cameras and toll gantries. They help recover stolen cars, which matters if you own something desirable. But every searchable database of vehicle movements is only as trustworthy as its weakest login.
- Your car is the tracker. Plate readers log appearance, not just numbers, so distinctive builds are easier to follow.
- Georgia data can live 30 months. That’s long enough to reconstruct routines: commutes, gym times, a partner’s address.
- Misuse is a crime here. If you believe someone used police access to track you, Georgia law gives prosecutors a specific charge to work with, and the GBI has shown it will use it.
- Ask your local officials. City councils sign these contracts. Asking how fast former employees lose access is a fair, specific question for your next public meeting.
The cameras didn’t fail in Effingham County. The offboarding did. Does anyone on your city council know how fast a departing officer loses plate-reader access?