Washington spent the last week arguing over Flock Safety.
asserted
Washington → spend → Safety
On Sept. 23, a Senate Judiciary subcommittee hearing examined the company’s automated license plate reader network, privacy, misuse, and public-safety value.
asserted
hearing → examine → network
The next day, Rep. Greg Steube (R-FL) introduced the Facilitating Liberty and Accountability for Flock Observations Act, which would require federal agencies to obtain a warrant before accessing or sharing data from networked ALPR systems.
asserted
which → introduce → systems
Those legal and civil liberties questions matter.
asserted
questions → matter → ?
But they can obscure a narrower issue that does not require choosing between law enforcement and privacy: when a camera network stores searchable records of where vehicles were seen, can the agency using it prove exactly who can reach those records?
asserted
who → obscure → records
Flock says searches are tied to individual users and logged, access is role-based, and most communities use a seven-day retention period unless local rules require otherwise.
asserted
rules → say → period
It has also announced mandatory multi-factor authentication, required case codes for law enforcement searches by year-end, broader audit assistance, and proactive lockout for abnormal behavior.
asserted
It → announce → behavior
Its trust materials describe those controls.
asserted
materials → describe → controls
Security is now an access-control question
The public safety case should not be caricatured.
asserted
case → caricature → ?
At the Senate hearing, Pinal County, Arizona, Sheriff Ross Teeple, who had ended his county’s Flock contract, still described ALPRs as useful investigative tools.
asserted
who → end → tools
Sen. Katie Britt (R-AL) likewise argued that law enforcement values and safeguards can both matter.
asserted
values → argue → ?
Her office summarized that position after the hearing.
asserted
office → summarize → hearing
The cybersecurity question begins one layer later: do actual permissions, sharing relationships, and account behavior remain consistent with the written policy over time?
asserted
permissions → begin → time
Flock’s own recent security work shows what verifiable assurance can look like.
asserted
assurance → show → what
On Sept. 22, the company published a summary of an independent Bishop Fox penetration test covering its hardware, software, mobile applications, and cloud infrastructure.
asserted
company → publish → hardware
The test identified 36 issues of varying severity.
asserted
test → identify → severity
Flock says all critical and high-severity findings were fixed and independently verified, and that none resulted in outside access to customer data or systems.
asserted
none → say → data
The company published the remediation status here.
asserted
company → publish → status
That discipline should sound familiar: test a control, expose what fails, remediate it, then verify the fix.
asserted
what → sound → fix
Access governance can be judged the same way.
asserted
governance → judge → ?
A rule saying only approved partners may search data is weaker evidence than a record showing which partners could actually search it, when that permission changed, and what happened when use became unusual.
uncertain
use → say → it
California shows why configuration history matters
asserted
history → show → ?
In February, the Ventura, California, Police Department reported that a vendor-enabled nationwide query function had allowed two out-of-state agencies to query Ventura’s ALPR system during parts of 2025, even though the department believed access was restricted to state partners.
asserted
access → report → partners
Ventura said it had not authorized those queries.
asserted
it → say → queries
Because of limitations in the configuration and logging available at the time, it could not determine whether vehicle data had actually been provided.
uncertain
data → determine → time
Ventura published the incident and corrective actions.
asserted
Ventura → publish → incident
Flock separately acknowledged inadvertent out-of-state accessibility in some California networks and said it added safeguards.
asserted
it → acknowledge → safeguards
The lesson is not that every technically possible access became an improper search.
asserted
access → become → ?
It is that configuration history can matter as much as the written access policy.
asserted
history → matter → policy
The San Mateo County, California, Civil Grand Jury made a similar point in August.
asserted
Jury → make → August
Reviewing all 17 county law enforcement agencies operating ALPR systems, it found meaningful progress in eliminating out-of-state sharing while identifying remaining gaps in policy maintenance, audits, and oversight of in-state sharing relationships.
asserted
it → review → relationships
Its press advisory summarizes the findings.
asserted
advisory → summarize → findings
There is no public evidence that the People’s Republic of China-linked Salt Typhoon campaign accessed Flock systems.
asserted
campaign → be → systems
Conflating the two would turn a security argument into speculation.
asserted
Conflating → conflate → speculation
The FBI says PRC-affiliated actors compromised multiple U.S. telecommunications companies and stole call-data logs, a limited number of private communications, and selected information associated with court-ordered law-enforcement requests.
asserted
actors → say → requests
Verizon says some mobile internet records reached by the actor included cell-tower locations, times, device identifiers, and destination IP addresses.
asserted
records → say → locations
A later multinational Cybersecurity and Infrastructure Security Agency advisory described PRC state-sponsored actors using compromised network devices and trusted connections to move through victim environments.
asserted
actors → describe → environments
That does not establish a bridge to Flock.
asserted
That → establish → Flock
It establishes a security principle: valuable metadata and trusted relationships deserve scrutiny.
asserted
metadata → establish → scrutiny
Ask the questions that an incident would force us to answer
An access-assurance review can remain agnostic on the larger warrant debate.
asserted
review → ask → debate
…and 15 more, not listed.
The Aporia
