Capture
Each camera unit runs computer vision models that go beyond optical character recognition of the plate string itself. The system extracts a full "Vehicle Fingerprint" — make, model, body type, color, and distinguishing features like roof racks, bumper stickers, or damage — and stores that alongside the plate read. This is what allows a natural-language search like "blue pickup truck with a roof rack" to return matches even without a plate number. Confirmed
Upload & Storage
Captured images and metadata upload automatically over cellular LTE to Flock's cloud platform, hosted on Amazon Web Services' GovCloud — a cloud environment built to meet Criminal Justice Information Services (CJIS) security standards for government data. Confirmed
Retention
The default retention period is 30 days, after which data is automatically and irreversibly deleted via AWS S3 lifecycle policies — no manual human action required. Confirmed This default shifts based on local law: Maine requires a 21-day purge, Minnesota allows up to 60 days. If an officer flags a specific scan as evidence in an active case, it can be exported to separate, secure storage and retained indefinitely for the life of that case. Confirmed
Access Controls
Access is restricted to verified, trained law enforcement personnel through role-based permissions — in theory, no anonymous or open-ended searching is allowed. Every query is supposed to require a standardized offense code, an active case number, and a written justification, which creates the audit trail that has made most of the misuse documented on this site discoverable in the first place. Confirmed
In practice, that justification field has frequently been filled with vague placeholders, generic traffic-stop codes, or — as documented in our misuse section — the literal name of a protest or a private personal motive.
Hot Lists
Real-time alerts are driven by "Hot Lists" that automatically ingest daily updates from federal databases like the FBI's National Crime Information Center and state systems like LEADS, covering stolen vehicles, active warrants, and missing persons. Agencies can also build custom local hotlists, which are configured to auto-expire after 30 days to prevent them from becoming permanent, informal tracking lists. Confirmed
The National Lookup Tool
This is the feature that turns thousands of individually small, local camera networks into one searchable national system. When an agency enables it, their officers' searches reach camera data from any other participating agency or private network across the country — not just their own jurisdiction. ConfirmedSeveral of the worst documented incidents on this site happened specifically because this setting was enabled — sometimes by Flock itself, without the local agency's knowledge — letting a single search reach far beyond where anyone expected it to.
Private Cameras, Public Network
Roughly 40% of Flock's cameras are owned by HOAs and private businesses, not government agencies. When a private owner opts into sharing, their camera's feed becomes part of the same searchable law enforcement network as a city-purchased camera — despite never going through any public procurement process or council vote. Confirmed
Security Track Record
Flock states its centralized cloud platform has never had a successful breach. Self-Reported by Flock Independent researchers have nonetheless found real vulnerabilities outside that central platform: leaked law enforcement credentials appearing on cybercrime forums, and a carrier misconfiguration that briefly exposed some camera diagnostic interfaces to the open internet. ConfirmedThe distinction matters — "the core platform has never been breached" and "this system has no security weaknesses" are not the same claim.