Flock Safety: Trust, Verify - and Read the Contract

I attended Tuesday's Nevada County Board of Supervisors meeting in person. I also spoke during public comment about the Nevada County Sheriff's Office's use of Flock Safety automated license plate readers.

If you care about this issue, I encourage you to watch the meeting yourself through the Nevada County Board of Supervisors video archive rather than relying exclusively on my interpretation - or anyone else's.

I also encourage readers to read Marianne Boll-See's reporting in The Union, “NCSO and reps from Flock address concerns of personal and global safety”. Her reporting is particularly useful because it places statements from the Sheriff's Office and Flock representatives alongside some very different claims made during public comment.

I walked away from the meeting understanding both sides better. 

I can understand why the Sheriff's Office considers this technology valuable. NCSO described an incident in which an ALPR alert identified a stolen vehicle entering Nevada County, ultimately contributing to the apprehension of five suspects. A tool capable of quickly identifying a stolen vehicle, locating a kidnapping suspect or helping find a missing person can unquestionably have legitimate law-enforcement value.

But understanding the value of a technology is different from blindly trusting everything we're told about it.

And that was my difficulty Tuesday.

We heard from the Sheriff's Office. We heard from two Flock representatives. We heard from more than a dozen citizens, some making extremely serious allegations.

Who should we believe?

My answer is: Don't blindly believe any of us. Verify it.

Start with what NCSO told us

NCSO Lieutenant Dennis Haack explained that the County's 25 Flock cameras identify vehicles and license plates at particular locations and times. He said they don't record audio and don't use facial recognition.

NCSO also said the data belongs to the Sheriff's Office, isn't sold to third parties, and that sharing with federal and out-of-state agencies was discontinued in November 2023.

Those are important representations.

But public commenters described something much more ominous: a nationwide surveillance infrastructure capable of tracking people's movements, sharing information across jurisdictions and potentially combining ALPR information with other technologies and artificial intelligence.

Some claims sounded alarming enough that my first reaction was skepticism.

So I started checking them.

Claim: “Flock owns all the data.”

This one is not accurate as stated.

Nevada County's agreement says in Section 4.1 that all right, title and interest in “Customer Data” belong to and are retained solely by the County. It further states that Flock does not own or sell Customer Data.

NCSO was correct about that.

But that's not where Section 4.1 ends.

The County simultaneously grants Flock a limited, non-exclusive, royalty-free, irrevocable, worldwide license to use Customer Data as necessary to provide Flock's services.

Then Section 4.3 becomes even more interesting.

It authorizes Flock to collect, analyze and anonymize Customer Data, including for training machine-learning algorithms. Nevada County grants Flock a worldwide, perpetual, royalty-free right to use and distribute that anonymized data for improving its services and other development purposes.

Section 5.3 also permits Flock, under specified circumstances, to access, use, preserve or disclose footage to law-enforcement authorities, government officials or third parties.

So “Who owns the data?” is a legitimate question - but an incomplete one.

The better questions are: Who possesses it? Who can access it? What rights does Flock have to use it? When can Flock disclose it? And what derivative uses can Flock make from it?

I encourage everyone to read the actual Nevada County-Flock agreement, Resolution 24-325/SR 24-0877, particularly Sections 4.1, 4.3 and 5.3.

Claim: Flock uses less than 1% of the data for machine-learning training.

This deserves clarification because a Flock representative discussed the figure during Tuesday's presentation.

Flock's own privacy policy says it may use a “small fraction (less than 1%)” of images captured through its services for machine-learning training. According to Flock, those images are stripped of metadata and identifying information, maintained separately, used internally to improve recognition of vehicles and objects, and aren't sold or shared with third parties.

So the representative's statement appears consistent with Flock's publicly stated policy.

But I went back to Nevada County's signed agreement looking for that same 1% limitation.

I couldn't find it.

Section 4.3 instead broadly authorizes Flock to collect, analyze and anonymize Customer Data and Customer Generated Data and expressly includes training machine-learning algorithms among the permitted uses.

I am not suggesting Flock is secretly using more than 1% of Nevada County's data. I have no evidence of that.

I am making a narrower distinction: a company's representation about its current practice isn't necessarily the same thing as a contractual limitation enforceable by Nevada County.

If less than 1% is an important safeguard being presented to the public, why isn't that limitation expressly written into the County's agreement?

Claim: Flock called its opponents “terrorists.”

I initially wondered whether that could possibly be accurate.

It substantially is.

Flock CEO Garrett Langley described DeFlock as a “terroristic organization.” He subsequently told Forbes he shouldn't have characterized nonviolent activists that way. Readers can examine the Forbes reporting on Langley and DeFlock themselves.

That doesn't prove anything about whether Flock's technology is good or bad. But the citizens raising this particular issue Tuesday weren't inventing the controversy.

Claim: ALPR information has been used in an abortion-related investigation.

There is factual support for this concern.

Illinois officials investigated after license-plate-reader information was shared with a Texas sheriff searching for a woman whose family reported concerns after she had undergone a self-administered abortion. Illinois law restricts ALPR information from being used for abortion and immigration investigations. Flock subsequently blocked access for dozens of outside agencies and implemented additional safeguards. Readers can examine the Associated Press investigation.

The distinction is important. This demonstrates the potential for misuse or prohibited sharing within a networked ALPR system. It does not demonstrate that Nevada County has used its cameras for abortion investigations.

Claim: Flock information has reached federal immigration authorities.

This concern isn't hypothetical either.

Associated Press reported that Customs and Border Protection had accessed Illinois license-plate data despite Illinois restrictions. Flock acknowledged pilot programs involving CBP and Homeland Security Investigations and later paused those programs while changing its access controls. Read the AP reporting on federal access.

More broadly, an AP investigation found that Border Patrol has used nationwide license-plate-reader information and predictive analysis to identify supposedly suspicious travel patterns. According to AP, Border Patrol had at one point obtained access through Flock to at least 1,600 readers across 22 states. Read that AP investigation.

That does not establish that federal immigration authorities presently have access to Nevada County's cameras. NCSO says they don't. But it does establish why asking exactly how interagency access works is reasonable.

Claim: Flock is connected to Axon.

This one is clearly grounded in fact.

Axon announced in 2020 that it entered a commercial partnership with Flock and made a minority, non-controlling investment in the company. Axon described itself as Flock's channel partner, integration partner and minority investor, with plans to integrate fixed and mobile ALPR capabilities. Read Axon's 2020 announcement.

The relationship later changed as the companies increasingly became competitors, so describing Flock and Axon today as one unified surveillance company would go beyond the evidence.

But saying they have had a documented financial, commercial and technological relationship is accurate.

Claim: Flock is “funded and partnered by Toka,” an Israeli cyber company.

This is where the Israel-related claims require considerably more precision.

Toka is a real Israeli cyber-intelligence company. But I have found no reliable evidence that Toka controls Flock, is a corporate partner of Flock, can access Flock cameras, or can access Nevada County's data.

There is, however, a genuine financial connection.

Flock's own 2025 financing announcement TechCrunch reporting on Toka's camera-access technology.

That makes scrutiny of Toka entirely reasonable.

But the missing link remains critical: I have not found evidence demonstrating that Toka has access to Flock's network or Nevada County's cameras.

A shared venture-capital investor doesn't establish technical access.

So the speaker appears to have identified a real and controversial Israeli surveillance company and a real financial connection, but went too far if the claim was that Toka itself is partnered with or controls Flock.

Claim: U.S. Homeland Security is “headquartered” in Israel.

Another speaker reportedly said U.S. homeland security is “headquartered” in Israel and gives American information to Israel.

I can find no evidence supporting the headquarters claim.

The Department of Homeland Security's consolidated headquarters is at St. Elizabeths in Washington, D.C. Readers can examine the federal government's own GSA description of the DHS headquarters project.

But there is another part of the speaker's broader argument that shouldn't simply be dismissed.

The United States and Israel do have formal homeland-security cooperation.

For example, DHS Science and Technology and Israel's Ministry of Public Security jointly funded the BIRD Homeland Security program to develop advanced homeland-security technologies through collaboration between U.S. and Israeli organizations. Read the DHS announcement.

DHS leadership has also signed formal cooperative arrangements with Israeli public-security officials. DHS media collection on U.S.-Israel security cooperation.

So the accurate conclusion isn't: “DHS is headquartered in Israel.” It is: DHS is headquartered in the United States, while the United States and Israel maintain significant formal homeland-security and technology cooperation. Those are very different statements.

Claim: “Israel is going to control these surveillance centers.”

This is another claim for which I have found no evidence establishing it as fact.

There are documented U.S.-Israeli intelligence, defense, cybersecurity and homeland-security relationships. There are Israeli surveillance-technology companies. And American venture-capital firms invest across both U.S. and Israeli security-technology companies.

Those facts justify scrutiny.

They don't, by themselves, demonstrate that Israel will control American data centers, Flock's network or Nevada County's information.

Likewise, I have not found evidence supporting the sweeping assertion reported from the meeting that the United States gives “all of our information” to Israel.

If evidence exists for those claims, proponents should produce it. Until then, they shouldn't be stated as an established fact.

The larger surveillance concern is harder to dismiss

Where some speakers may have gone too far in connecting individual corporations, investors or governments, their broader concern deserves serious consideration.

Nevada County's own Flock contract materials describe Community Network Access, State Network access, Nationwide Network access and Law Enforcement Network Access.

The materials describe searches involving license-plate location history, vehicle characteristics, time and location, and other identifying vehicle features across a much larger network.

That doesn't mean Nevada County currently permits every form of sharing technically available through the Flock platform. NCSO says it stopped federal and out-of-state sharing in 2023.

But this is exactly why capability, policy and contract are three different things.

A technology may be capable of something.

An agency may have a policy prohibiting that use.

And the underlying contract may provide broader rights or capabilities than the agency presently chooses to exercise.

All three matter.

Trust requires verification

Board Chair Lisa Swarthout said something Tuesday that I think gets to the heart of this:

“It's all about trust.”

I agree.

But trust in government should never mean blind faith. And skepticism of the government shouldn't mean blindly believing every alarming claim made from the public podium either.

The Sheriff's Office should be able to demonstrate what its system does, how it is configured, who can search it and who cannot.

Flock should be expected to explain its contractual rights and technological capabilities accurately.

Critics should be expected to substantiate their allegations.

And citizens should read the documents themselves.

The question isn't whether you are “pro-police” or “anti-Flock.”

The question is whether Nevada County can obtain the legitimate public-safety benefits of new technology while creating enforceable safeguards against uses citizens never authorized.

For me, that starts with several questions:

What did Nevada County actually contract for? What capabilities are currently enabled? Who can access the information? What contractual limits - not simply policies or current corporate practices - protect that information? What prevents those rules from changing tomorrow? And which changes would require approval from our elected Board of Supervisors rather than an administrative change in software settings?

The less-than-1% representation provides a perfect example.

If that is Flock's current practice, say so.

If it is contractually guaranteed, show us where.

If it isn't, perhaps Nevada County should consider putting that safeguard - along with other representations made publicly Tuesday - into the contract.

Those aren't anti-law-enforcement questions.

They are oversight questions.

Watch the meeting. Read the County's Flock agreement - especially Sections 4.1, 4.3 and 5.3.

Then decide for yourself.