Full Report
Alpharetta, Georgia, cops share data with thousands of Flock users, ranging from federal agencies to a fish and wildlife commission. The reasons why show how vast—and invasive—the network has become.
Analysis Summary
# Incident Report: Massive Inter-Agency Data Sharing via Flock Safety Network
## Executive Summary
This report details an investigation into the extensive surveillance data-sharing network facilitated by Flock Safety, centered on the city of Alpharetta, Georgia. The investigation revealed that Alpharetta police share license plate reader (LPR) data with over 2,000 external organizations, including federal, state, and local agencies, creating a vast and potentially invasive surveillance apparatus without clear geographic or jurisdictional boundaries. The impact is a significant erosion of privacy for residents whose movements are tracked and distributed across a nationwide database accessible by agencies ranging from Medicare fraud investigators to fish and wildlife commissions.
## Incident Details
- **Discovery Date:** August 28, 2026 (Date of publication)
- **Incident Date:** Ongoing / Continuous
- **Affected Organization:** Residents of Alpharetta, Georgia, and travelers through the region.
- **Sector:** Public Sector / Law Enforcement / Private Surveillance
- **Geography:** Alpharetta, Georgia, USA (with nationwide data distribution)
## Timeline of Events
### Initial Access
- **Date/Time:** Continuous / Real-time
- **Vector:** Deployment of Flock Safety Automatic License Plate Recognition (ALPR) cameras.
- **Details:** Local police installed several dozen Flock cameras throughout the suburb to capture vehicle data, including license plate numbers, make, model, and color.
### Lateral Movement
- **Details:** Data captured locally is uploaded to the Flock Safety "OS" cloud platform. Through the platform's "Talit" feature, Alpharetta police authorized the sharing of this data with a massive web of 2,000+ external entities.
### Data Exfiltration/Impact
- **Details:** Personal mobility data (location, time, vehicle ID) is exfiltrated from the local jurisdiction and shared with entities such as Morehouse College, Florida’s Fish and Wildlife Commission, Illinois Medicare fraud investigators, and federal inspectors general.
### Detection & Response
- **How it was discovered:** Public records requests filed by investigative journalists (WIRED).
- **Response actions taken:** Advocacy groups and privacy experts have raised concerns regarding the lack of oversight and the "invasive" nature of the network.
## Attack Methodology (Surveillance Perspective)
- **Initial Access:** Physical installation of ALPR hardware in public right-of-ways.
- **Persistence:** Continuous 24/7 monitoring and cloud-based data storage.
- **Privilege Escalation:** Not applicable in a traditional sense, but functional escalation occurs when local data is granted "National" or "Multi-Agency" access status.
- **Defense Evasion:** Use of "public safety" justifications to bypass traditional Fourth Amendment warrant requirements for location tracking.
- **Discovery:** Systemic reconnaissance of vehicle movements across city lines.
- **Collection:** Automated capture of every vehicle passing a sensor, regardless of suspicion of a crime.
- **Exfiltration:** Cloud synchronization to a central database accessible by third-party agencies.
- **Impact:** Systemic surveillance and potential for "chilling effects" on freedom of movement and association.
## Impact Assessment
- **Financial:** Funded by taxpayer dollars via police department budgets and high-value signing bonuses for officers to manage these systems.
- **Data Breach:** While not a "hack," the widespread dissemination of sensitive location data to 2,000+ organizations constitutes a massive privacy breach by design.
- **Operational:** Law enforcement operations are now heavily reliant on third-party private databases.
- **Reputational:** Significant public outcry regarding the "invasive" nature of the network and the lack of transparency in inter-agency agreements.
## Indicators of Compromise
- **Behavioral indicators:** Sudden increase in inter-agency investigative requests originating from distant jurisdictions based on local vehicle sightings.
- **Network indicators:** Data traffic flowing from local sensors to `flocksafety[.]com` domains.
## Response Actions
- **Containment:** None currently reported by the agency; the network remains active.
- **Eradication:** Privacy advocates are calling for legislative limits on how long data can be stored and with whom it can be shared.
- **Recovery:** Public transparency via records requests is the primary method of exposing the scope of the compromise.
## Lessons Learned
- **Lack of Perimeter:** Surveillance data does not stay within the city that collects it; it effectively becomes part of a global, searchable mesh.
- **Scope Creep:** Systems designed for "stolen cars" are being used by agencies unrelated to violent crime (e.g., Fish and Wildlife, Medicare Fraud).
- **Transparency Gap:** The scale of these networks is often hidden from the public until revealed by third-party investigations.
## Recommendations
- **Geofencing Data:** Implement strict policies limiting data sharing to immediate neighboring jurisdictions or agencies with a demonstrated, active case file.
- **Audit Logs:** Require mandatory, public-facing audits of which agencies are accessing local data and for what purpose.
- **Data Minimization:** Reduce retention periods for non-hit data (vehicles not associated with a crime) to the minimum time required for immediate operational needs.