What the Flock is Going On, Anyway?

What does privacy look like in the 21st century? What expectation of privacy do we have once we step outside our doors? Who can be trusted with the massive amounts of information generated by the devices upon which we’ve come to rely?

Those questions lie at the heart of the debate over Flock cameras and other automated license plate readers (ALPRs), which have suddenly become part of daily life in American cities. Before going further, it’s worth understanding how these systems actually work. Retired Microsoft engineer Dave Plummer made a great video explaining the system and laying out both pros and cons, and I strongly suggest you watch it before reading the rest of this article:

Our Founding Fathers ratified the Fourth Amendment as part of the original Bill of Rights because they were concerned about governments engaging in overbearing police powers. The text of the amendment recognizes that all people have the right “to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures…” If a law enforcement officer wishes to examine those things against your will, he must swear before a judge that he not only has probable cause to suspect you of a crime, but describe to the judge what he plans to search and what he expects to find. That’s the basis for what we call a search warrant today.

In 1789, that was straightforward enough, but it has grown murky by 2026. Are the photos stored on your mobile phone considered to be your “papers and effects”? What if they are backed up to iCloud or Google Photos, requiring data to be transmitted between your device and a data center potentially located in a different state? Is there a difference between unlocking your phone via passcode and unlocking it via biometrics, such as fingerprint or facial scan? What about otherwise public knowledge, such as the fact that you drove to the grocery store on Monday after work? After all, you weren’t likely in disguise—anyone could see you.

That last question lies at the heart of the ALPR debate. If a policeman stands on a street corner and watches cars go by, keeping an eye out for a specific make and model with a specific plate number that was reported as stolen, I doubt many would take issue. What if he makes a list of every plate number that passes by? Some might start having concerns. Yet what if there is a camera on that street corner recording every make, model, and plate that passes by, 24/7/365, storing it in a database that law enforcement could query at will?

Many on both sides of the aisle would say that has now crossed a line and constitutes an unconstitutional invasion of privacy. But where exactly was that line crossed?

The first question that must be answered is how much of an expectation of privacy do we have when out and about in public? FischerKing, one of the most insightful anonymous posters on X, had an interesting take on the Shilo Hendrix case last week. As you might be aware, Hendrix is a white mother who was with her son at a Minnesota playground when a Somali boy allegedly began rifling through her bag. She reacted by allegedly calling him the so-called “n-word” which attracted the attention of a Somali man who whipped out his cell phone and began recording her, demanding she call him the “n-word” to his face. After multiple attempts to extricate herself from the situation, Hendrix finally snapped in anger and gave him the content he was baiting her for. He uploaded the video, which went viral, and resulted in her conviction by a Minnesota jury for disorderly conduct.

FischerKing asked a pointed question: do we have any expectation of privacy when a stranger points a mobile phone video camera in our face?

Some people even brought up the Fourth Amendment in some comments on my other posts about this. In the US, privacy is attached to the home. What you do inside your home is private, but when you are in a public space you are basically fair game. So some journalist can approach you, stick a microphone in your face and ask you all sorts of questions. Or some jerk in a public park can try to goad you into saying a nasty word, and then spread it all over the web. Because you are “out in public” – you don’t have any expectation of privacy, and no Fourth Amendment protection.

I’ve done posts about this in the past – but this is different in continental Euro countries like France and Germany. There you can film just random scenes on the street of crowds of people, but you cannot single someone out, film them up close, ask them questions – and then just post it all over the internet. You have some privacy protections that attach to you as a person, and in how your image is used. So this guy who harassed Shilo wouldn’t just be in the clear like he is in the USA, where privacy protections don’t really extend beyond your home.

It seems like there should be some laws passed that provide a little protection from this kind of harassment. They would run up against First Amendment “freedom of the press” issues, but there should be a way to find some balance there.

Should we maintain different rules with regard to our personal privacy for law enforcement, members of the media, and strangers? Or should there be one consistent threshold for all? The argument to constrict law enforcement further than journalists or private citizens is that police and prosecutors have the power to put you in jail based on what they find. However, in the 21st century, a viral video could ruin your life just as much. That’s why most social media platforms have rules against doxing—sharing personal information such as home addresses—and why Idaho and other states have had to pass laws against swatting—calling police to your home under false pretenses.

If a private company sets up an automatic license plate reader on a public right-of-way and sells access to law enforcement agencies, is that inherently unconstitutional? If not, is it still morally and ethically wrong? The Supreme Court has yet to rule on ALPRs directly, but it has established a pattern of defending individual privacy under the Fourth Amendment, increasingly recognizing that technology capable of creating comprehensive records of innocent people’s movements raises constitutional questions that did not exist in the Founding era.

One of the first Supreme Court cases to consider the extension of personal surveillance into the realm of technology was United States v. Knotts in 1983. The Court held unanimously that police were justified in using a short-range electronic transmitter to follow a man named Leroy Knotts suspected of manufacturing methamphetamine. Justice William Rehnquist’s opinion for the Court held that since the transmitter was short range, it did not reveal information that was unavailable to law enforcement engaged in visual surveillance, and also that people did not have an expectation of privacy while driving in public.

The following year, however, the Supreme Court decided in the other direction in United States v. Karo. Justice Byron White’s majority opinion held that a similar transmitter that was tracked into a private residence constituted an unreasonable search and seizure contrary to the Fourth Amendment.

Technology evolved quickly, and the law struggled to catch up. By 2001, the Supreme Court considered whether the use of thermal imaging devices to monitor heat from a private home was legally justified, even without a search warrant. Justice Antonin Scalia wrote a majority opinion in Kyllo v. United States holding that using such devices constituted a search and seizure, and therefore required a search warrant.

Just a few years later, DC law enforcement received a warrant to place a GPS tracking device on a vehicle belonging to Antoine Jones, who they suspected of drug trafficking. However, police left the tracker on for longer than the warrant allowed, and used it to track the vehicle for weeks across multiple states. Justice Scalia once again wrote for the majority that, despite any questions about expectations of privacy, installing a tracking device required an intrusion into a subject’s personal property, and was therefore a “search and seizure” under the Fourth Amendment.

Justice Samuel Alito concurred with the outcome of the case, but disagreed with Scalia’s reasoning. He argued instead that 24/7 monitoring of a subject’s vehicle constituted an invasion of his constitutional right to privacy.

The outcome of United States v. Jones brought new attention to a concept called the mosaic theory of privacy. This theory describes how combining multiple individual sources of information can reveal something beyond what can be discovered by examining each source in isolation. A snapshot of your car passing a certain intersection at a certain time of day reveals little of its own accord, but combine that with data linking you to that vehicle and license plate, combined with data showing when you purchased your home, how you vote, what websites you browse, when you’re on your mobile phone, when you’re on your mobile phone, etc. and you have a very comprehensive profile of your private life. Suddenly, modern technology has created the ability to learn more about an individual from discrete public sources than the framers of the Bill of Rights ever imagined.

In 2014, Chief Justice John Roberts wrote the majority opinion in Riley v. California that police officers need a warrant to search a suspect’s mobile phone, even during the process of arrest. Justice Alito concurred in the judgment but questioned how courts should distinguish between digital information stored on a phone and physical objects such as paper documents. He urged Congress to establish clearer statutory rules rather than leaving the issue entirely to the courts.

Mobile phones changed everything. In order to function at all, cell phones send data back and forth to physical towers located throughout a region. As an individual traverses an area, his or her phone must establish connections to new towers to maintain connectivity. That means that cell phone companies can easily build a profile on each individual cell phone owner that includes fairly detailed data about where and when they travel. In 2018, the Supreme Court ruled in Carpenter v. United States that law enforcement cannot simply access this location data without a search warrant. Chief Justice Roberts held that specific cell phone location data was akin to the GPS data previously proscribed under Jones. This contradicted a 1979 decision that allowed law enforcement to request lists of phone numbers dialed by a suspect without a warrant, a case which established the so-called third-party doctrine.

Justice Neil Gorsuch dissented, writing that the Fourth Amendment itself had lost its original meaning in a world of mass surveillance. He recommended that the third-party doctrine be overturned entirely, arguing that specific data points such as cell phone location information rightly belong to the user, not to the cell phone company.

This brings us back to the question of ALPRs such as Flock cameras. Does the collection and storage of data points such as your car’s make, model, and license plate number violate a driver’s Fourth Amendment right to privacy? ALPRs bring up a host of other questions, including but not limited to:

• Is there a material difference between ALPRs that are owned and operated by private companies, including Flock, who have contracts with law enforcement agencies, and those owned by agencies directly?
• In the case of contracts, who owns the data? Does it belong to law enforcement agencies that contract with Flock or other ALPR manufacturers, or does it belong to the company?
• Who can access the data? Is it just for the agency contracting with Flock, or can it be accessed by neighboring jurisdictions, or even the federal government?
• How long should data be retained? A system retaining data for 24 hours is a very different conversation from one retaining it for months or even years.
• Who is allowed to search ALPR data? Any law enforcement officer, or only those working on a specific case? Should every search of the database require a warrant?
• What’s to stop ALPR systems from growing beyond their current purview? Will they one day combine with red light or speeding cameras, and allow law enforcement agencies to issue traffic tickets? What about consolidation with other national databases?

Idaho lawmakers have already attempted to tackle the ALPR issue with Senate Bill 1180 during the 2025 legislative session. The bill was sponsored by Sen. Doug Okuniewicz, chairman of the Senate Transportation Committee, and Rep. Joe Palmer, chairman of the House Transportation and Defense Committee, and sought to clarify when ALPRs could be used while prohibiting their use for non-law enforcement purposes. It limits ALPRs to investigations of felony and misdemeanor crimes, traffic accidents, and missing or endangered persons. It prohibits their use for routine traffic enforcement except in connection with an accident. It also restricts access to authorized personnel, requires agencies to log every search, mandates semiannual audits, requires privacy and ethics training for users, and makes misuse of the data subject to discipline or criminal prosecution.

Those are significant safeguards, but they do not answer every question raised by this technology. The statute says relatively little about data ownership, data retention, or data sharing. If a city contracts with a private vendor such as Flock, who ultimately owns the database? How long may the information be retained? Under what circumstances may it be shared with agencies outside Idaho? Those are among the questions lawmakers are likely to revisit.

Post Falls Mayor Randy Westlund recently explained why his city uses a different approach:

We do not and will not use Flock camera systems in Post Falls. I am firmly opposed to unconstitutional mass surveillance and the construction of large national databases which track the movement of citizens.

We do have a limited and tightly controlled use of Motorola cameras that read license plates and check against the NCIC wanted list. We use these in cases like stolen vehicles, abducted children, and vehicles associated with active warrants. We do collaborate with federal law enforcement, including ICE. We own the cameras and the data, which is never shared commercially. Every use is connected to an active case and access is regularly audited to prevent abuse. We do not and will not track movement of law-abiding residents; the system is configured for real-time notification against active wanted lists only.

Idaho state law currently requires all cities to keep these images for a minimum of two years and some jurisdictions keep them forever. I believe this is wrong, and opens the door to myriad privacy concerns. I call on our state legislators to amend state law to prevent the construction of tracking databases by requiring this data to be deleted within 90 days.

Sen. Tammy Nichols has written several Substack newsletters on the subject of ALPRs, including this from earlier this month:

These cameras do more than take a picture of a license plate. They capture plate numbers, vehicle information, time, date, and location. That means a person’s movements can be searched later and pieced together into a pattern of life: where they worship, where they work, what doctor they visit, what political meeting they attend, and who they spend time with.

This is not a faraway issue. Right now, Caldwell, Nampa, and Meridian pop up as having ALPR/Flock-style cameras installed in their areas, and residents can verify locations through the public map at DeFlock.org, an open-source project mapping ALPR cameras across the country. Caldwell has installed a little over 40 cameras, and Meridian has been adding dozens of license plate reader cameras citywide.

Scott Herndon, former (and likely future) state senator, wrote about ALPRs on Facebook recently:

In Caldwell, police used a network of license plate cameras to identify an armed robbery suspect’s vehicle within about ten minutes. Twin Falls police credit the same kind of technology with rescuing a kidnapped child who was being driven through their town. These systems, automated license plate readers, catch real criminals, and they are spreading fast across Idaho.

That is the side of this you do not hear enough. Now here is the side that should give every Idahoan pause.

Some of these systems do not just check your plate against a wanted list and move on. They store it. Every plate, every pass, building a searchable record of where law-abiding people drive. And that raises a question almost no one is asking: who owns that record? With the most common system, Flock, the answer is a private company in another state. Your city pays to collect data about its own residents, but the company owns it, hosts it, decides who may search it, and wires it into a national network.

This is not hypothetical.

Herndon concluded his statement by saying he was not sure where the line should be drawn and welcomed input from constituents. He followed up with a comment indicating that the more he learned about these systems, the greater his concerns. Because S1180 was silent on the issue of data retention, Herndon and Mayor Westlund both argue that ALPR data falls under Idaho’s existing public records framework, which may require retention periods of at least two years depending on how the records are classified.

The conversation is not just theoretical. In Idaho Falls, the city’s use of Flock cameras has become the subject of a dispute over how ALPR data may be used. According to reporting from the Post Register, Flock Safety operates 13 cameras for the Idaho Falls Police Department and nine more for the Bonneville County Sheriff’s Office. Law enforcement officials argue that the system is a routine and regulated tool for solving crimes, while critics contend that Flock’s contract allows the company to use captured images to train its artificial intelligence systems, raising concerns about privacy and data ownership. Former legislative candidate Brian McKellar has threatened to file tort claims against the city for every image taken if the cameras are not deactivated by July 29. Idaho Falls officials maintain that the system complies with state law, but the city attorney later announced that the city intends to modify its contract with Flock.

The dispute in Idaho Falls illustrates some of the questions left unanswered by S1180 and demonstrates how the line between legitimate law enforcement tools and individual privacy protections has become increasingly complicated in the age of rapidly advancing technology. Post Register reporter Allen Thayer noted in his article that state law requires images to be purged after 30 days, but Herndon and Mayor Westlund both contend there is no specific provision in Idaho Code. Lawmakers should probably clarify this issue.

After reading the arguments from both sides, I believe ALPRs can be a legitimate tool to help police enforce the law and catch the bad guys. I suspect people’s views of these systems depend in part on where they live. Urban dwellers, existing in a high crime and low trust environment, might look at this tool and say “of course police should use whatever they can to keep us safe” while Idahoans in a low crime and high trust environment might look at the same tool and say “it’s outrageous and offensive that anyone would be recording me out in public.”

Nevertheless, there are serious privacy concerns with regard to these systems. I believe the central issue is not the cameras themselves, but the data they create. After all, technology is always marching on. Today it’s ALPRs, tomorrow it will be something else. The overriding question of the 21st century is “who controls your data?” If law enforcement agencies in Idaho will continue using data-gathering technology such as ALPRs, then I believe the Legislature must impose strict controls regarding the use of that data.

Additionally, any tool is only as useful as its operator. Many conservatives on social media have raised concerns that, despite their promise to crack down on crime, ALPRs could potentially be used against right-wing dissidents in a totalitarian future. The same overriding system that allowed BLM and Antifa rioters to run amok in 2020 also sought to punish you and I for leaving our homes without masks. The same overriding system that currently seeks to punish ICE agents for carrying out the law also cracked down hard on anyone in the vicinity of the Capitol on January 6, 2021. Can we trust that tools of mass surveillance won’t be used for political purposes should the wrong crowd gain political power?

What do you think? Where should we draw the line between legitimate law enforcement activity and an invasion of our privacy? Is there room for ALPRs among the tools available to Idaho law enforcement agencies? If so, what additional regulations would you like to see on their use? This debate will only intensify once the Legislature returns in January, so now is the time to have this conversation.

Feature image courtesy of Flock Safety.