ABC57 INVESTIGATES: Flock camera security concerns

SOUTH BEND, Ind. -- From our streets and neighborhoods to national headlines, Flock camera license plate readers are everywhere. They are one of the most prominent types of Automatic License Plate Readers (ALPRs).

They're a hot topic at city council meetings, courtrooms, and right here in Michiana. The worry many lawmakers and everyday citizens have are cybersecurity and privacy concerns.

ABC57's Brianna Clark spoke to security experts who say, ultimately, we do not have rights when it comes to personal data and these cameras.

Public records from Plymouth Police show the department has five Flock cameras up around the city. One is in the front yard of Sara Lopez. She tells ABC57 that she's constantly aware she's on camera.

"I go to school, I go to work, I come home and I see a Flock camera," says Lopez.

According to Flock, in Indiana alone, its cameras have helped track down stolen vehicles, rescue kidnapped kids, and locate murder suspects. It can also send instant alerts when a sex offender drives by, if a vehicle has expired tags, or if the driver has a suspended license.

Indianapolis-based privacy attorney Neal Eggeson says what concerns him about Flock are the "unintended consequences."

"It's not just one snapshot at one corner," says Eggeson. "It's your pattern. It's where you sleep, it's where you work, it's where you keep going, and when you come back, and how often. Flock wins its contract with each of these municipalities selling, 'Well, it's just a plate reader.' But the reality is that with this database, Flock is sitting on a moving map of your entire life."

There are zero laws regulating ALPRs in Michigan. There is one very narrow law in Indiana that says Homeowners Associations can't access the data - but they can use the cameras if they're operated by law enforcement.

Local municipalities like police departments, sheriff's offices, and county prosecutors can choose to share data with other agencies and businesses. In Berrien County, more than 2,000 other agencies across the county have access to Flock data from the sheriff's office.

Indiana University professor Scott Shackelford says this could pose significant cybersecurity dangers.

"So, if, you know, a group, you know, a criminal organization, or you name it, was able to get access, you know, to that system and lateral across these networks, well, all of a sudden, you can have eyes on a huge cross section of the country, right?" says Shackelford.

He says new tools might be able to exploit vulnerabilities in Flock's systems.

"Flock can put out all the PSAs they would like, but without a better view of what those current, you know, set of vulnerabilities look like and how new tools, including, you know, autonomous agents and generative AI, can exploit those tools at a scale and a pace that we really haven't seen before, well, I'm not going to sleep very easy there, right?" says Shackelford.

Flock does not make information about how many Flock cameras or where they are public. Some websites, like DeFlock, use crowdsourcing to locate them.

According to the website, there are more than 143,000 ALPRs in the U.S. - the majority of them being Flock.

DeFlock's website shows nearly 180 cameras in South Bend. By clicking on the "network" tab, you can view agencies with transparency portals that show they're sharing camera data with the South Bend Police Department.

ABC57 filed a public records request with the department several weeks ago for information on who SBPD shares that data with. We have not heard back.

ABC57 also asked the St. Joseph County Police Department the same question - along with where its cameras are located - but the department declined to do so, citing public safety concerns.

ABC57 reached out to Indiana State Police for an interview, but they declined, saying they are not allowed to talk to Flock because it's a third-party vendor.

ABC57 also contacted the Elkhart County Sheriff's Office, asking for audit logs, a list of agencies they share data with, and their privacy policy. Captain Michael Culp denied our request, because he said Flock data is part of criminal investigations.

Out of the dozens of police and sheriff departments in Michiana, ABC57 only found two online Flock Safety Transparency Portals: Michigan City Police Department's and Bremen Police Department's. The two have varying degrees of information.

Michigan City's has a list of the thousands of agencies that have access to their Flock database, while Bremen does not. According to DeFlock, at least 64 agencies say they share their camera database with Bremen P.D.

"When you have a database that contains that kind of detailed information about people, it risks exposure to unauthorized users, to third parties, to bad actors," says Eggeson.

In two separate cases this year, a Michigan City Police officer and a Chesterton Police officer resigned after violating their departments' Flock-related policies.

Down in Indianapolis, four police officers are facing charges of fraud and official misconduct -- and one former officer is accused of using the Flock system to stalk several women, including his ex-wife.

"The best thing we can do at this point is to try to mitigate the harm," says Eggeson. "And the best way to do that is we pass laws that would set guardrails, such as transparency so that everyone can see who's accessing this database; maybe audit requirements."

Eggeson also says that, when it comes to where cameras are located, private property isn't off the table.

Public records show the City of Plymouth treated the installation of its Flock cameras as a right-of-way project, which doesn't necessarily require a property owner's permission.

Starke and Kosciusko County both ended Flock contracts. Leaders in Michigan City recently voted to withdraw additional funding to add more Flock cameras to its current fleet.