You can find out who can see your area’s licence plate camera data by checking whether police use the cameras and reading their access policy. If they will not publish it, use a public records request to get the sharing settings and audit logs.
What you need before you start
The case behind this guide shows how sharing can happen without any formal agreement. The Verge reports that a Savannah police officer was dismissed in August after an internal investigation found she had given her login for the Flock camera system to her husband, who works for US Immigration and Customs Enforcement. According to the report, the Savannah Police Department does not share its Flock data with ICE. It said that passing on access to the system broke its security protocols. How the access was used, if it was used at all, is not set out in the material available here.
The lesson for residents is that a policy on paper is only part of the picture. You also need to know who holds accounts, how logins are protected and whether searches are recorded and checked. Before you begin, gather the following:
- The name of your city, county and any nearby agencies, such as sheriff’s offices or university police, that might run cameras.
- An email address you are happy to use for official correspondence.
- A basic understanding of your state’s public records law. Every US state has one, but deadlines, fees and exemptions differ.
- Time. Replies to records requests can take weeks, and you may have to follow up.
- A simple log, such as a spreadsheet or notebook, to track what you asked for, when you asked and what came back.
Confirm whether your area uses plate-reading cameras
Start by establishing whether automated licence plate readers are in use at all. Search your city council and county commission agendas and minutes for terms such as “licence plate reader”, “ALPR”, “LPR” or the names of vendors. Contracts for these systems are often approved at public meetings, so the purchase may appear in the minutes or in budget documents.
Check local news coverage and the police department’s own website, which may have a press release or a frequently asked questions page. Keep in mind that homeowners’ associations, shopping centres and private businesses sometimes buy cameras and then choose to share footage or alerts with police. Write down every agency and private operator you find, because each may have separate rules.
Find the agency’s written access policy
Once you know which agency runs the cameras, look for its written policy on plate-reader data. Many departments publish a general orders manual or a policy library online. The relevant document usually covers:
- Who is allowed to hold an account, and how accounts are approved.
- Whether each user must have their own login, and whether multi-factor authentication is required.
- What reason a user must enter before running a search.
- How long data is kept before it is deleted.
- Which outside agencies, if any, can search the data, and under what agreements.
- What happens when someone breaks the rules.
Read the section on credential sharing closely. A policy that clearly bans sharing logins, and says what the penalties are, is stronger than one that does not mention it.
Look for a published transparency portal or audit summary
Some agencies publish a transparency page for their plate-reader system. It may list the number of cameras, the retention period, the agencies the data is shared with and summary search statistics. Check whether your agency has one and how recently it was updated.
Do not treat a portal as proof that the controls work. A portal shows the settings the agency has chosen to describe. It does not show whether someone used another person’s login. Use the portal as a starting point for questions, not as an answer.
Submit a public records request for access and audit logs
If the information is not published, or you want to check it, file a written request under your state’s public records law. Keep the request specific, because broad requests are more likely to be delayed or refused. Useful items to ask for include:
- The current policy and any earlier versions.
- The contract with the vendor, including any data-sharing terms.
- A list of external agencies that have access to the data or can search it.
- Audit logs of searches for a defined, short period, showing the user, time and stated reason.
- Records of any internal investigations into misuse of the system, subject to whatever redactions the law allows.
- Records of training given to staff on using the system.
Send the request in writing, keep a copy and note the date. Agencies may claim exemptions for active investigations or personnel matters. If they do, ask which exemption applies and request the remaining material with redactions.
Read the records for warning signs
When documents arrive, read them for gaps rather than headlines. Signs that controls may be weak include:
- Shared or generic accounts, such as a single login for a whole unit.
- No record of multi-factor authentication.
- Search reasons that are blank, vague or repeated word for word.
- Searches at unusual hours or in large volumes by one user.
- Sharing arrangements that are broader than the published policy suggests.
- No evidence that anyone reviews the audit logs regularly.
A log that exists but is never checked offers little protection. The Savannah case, as reported, came to light through a department investigation, which suggests that some form of review took place there. What triggered that review is not known from the material available.
Raise what you find with local oversight
Take your findings to the people who can change the rules. That may be a city council member, a police oversight board, a county commission or a state legislator. Share the documents along with a short summary of your concerns. Specific requests are more likely to get a response. Examples include mandatory individual logins with multi-factor authentication, routine audits with published results, and clear limits on which outside agencies may search the data.
Local journalists and civil liberties organisations may also be interested, especially if the records show a gap between policy and practice.
Mistakes people commonly make
- Assuming one policy covers everything. Neighbouring agencies, private camera owners and statewide networks may follow different rules.
- Asking for “all data”. Requests that are too broad are slow, expensive or refused. Ask for named documents and short date ranges.
- Confusing formal sharing with access. An agency can truthfully say it does not share data with a particular body while a single user’s credentials are still misused.
- Ignoring deadlines. Many records laws set response times, and missing your own appeal window can end the process.
- Publishing personal details from logs. Audit records may contain information about people who have done nothing wrong. Handle them with care.
- Drawing conclusions from one record. An odd search may have an innocent explanation. Look for patterns before you raise concerns.
When this approach is the wrong choice
This process suits residents, researchers and journalists who want to understand how a system is governed. It is the wrong tool in several situations:
- If you think you have personally been tracked or targeted, speak to a lawyer first. Records requests are public, and a lawyer can advise on remedies such as complaints or litigation.
- If you are a police employee who has seen misuse, internal reporting channels or whistleblower protections may be more appropriate than a public request.
- If you live outside the United States, the laws are different. In the UK, for example, data protection law gives individuals a right to request their own personal data, which works differently from US open records laws.
- If you need an answer urgently, a records request is unlikely to be quick enough.
Frequently asked questions
How do I find out if my police department uses Flock cameras?
Search your city council and county commission meeting minutes, budget papers and contract approvals for terms such as licence plate reader or ALPR, along with vendor names. Check the police department’s website for policies or transparency pages. If nothing is published, you can send a short written public records request asking whether the agency uses automated licence plate readers and, if so, which vendor supplies them.
Can police share licence plate reader data with ICE?
Whether a police agency shares plate-reader data with federal immigration authorities depends on its own policy, its contracts and state law, all of which vary. Some agencies say they do not share data with ICE. Formal sharing is not the only risk, though. Access can also pass outside approved channels when logins are shared, as the reported Savannah case shows.
What should I ask for in a public records request about ALPR data?
Ask for the current access policy, the vendor contract, a list of outside agencies with access, audit logs of searches for a short and specific period, training records and records of any internal investigations into misuse. Requests that name specific documents and date ranges are usually handled faster than general requests for all data, and they are less likely to be refused.
Why does sharing a login matter if the user is trusted?
Audit logs record searches against an account, not against the person actually at the keyboard. When a login is shared, the records no longer show who ran each search. This makes misuse harder to detect and harder to prove. It can also let someone outside the agency get around the agency’s rules on which bodies may see the data.
Sources and further reading
- The Verge: reporting on the dismissal of a Savannah police officer over shared access to the Flock system.
- Municipal council and county commission records: agendas, minutes and contract approvals for surveillance technology.
- State public records statutes: the legal basis for requesting police policies, contracts and audit logs.
- Civil liberties organisations: general guidance on the governance of automated licence plate readers.
Surfaced from the rss:verge signal “police surveillance login misuse”. AI-assisted draft, editorially reviewed.
