Questions and answers from the ALPR/Flock Community Conversation May 20, 2026

What is Flock’s policy on data breaches?

• Flock Safety policy and contracts state that police agencies—not Flock—own their data.
• Flock is required to store data in a highly secure cloud environment and is required to notify agencies of any security incident.
• The CIO of the City of Albany would work with Flock to ensure data security.
• Their published policies emphasize encryption, access controls, and strict auditing of who accesses data.

Has Flock ever been hacked?

• As of this document, there are no publicly confirmed incidents involving unauthorized theft of customer ALPR data from Flock’s production systems.
• Independent researchers have tested for vulnerabilities, but no confirmed unauthorized access to real customer data has been documented.

Can the network Flock cameras connect to be hacked?

• Flock cameras do not connect to Albany Police networks or city infrastructure.
• They transmit data through secure connections directly to their cloud environment, which is stored on an Amazon GovCloud server.
• Agencies control operational use and data access policies. Vendor administrative access for maintenance or support functions is governed by contract terms, audit logging, and CJIS-related security controls.

Have Flock cameras ever been hacked and used by criminals?

• There are no known or publicly reported cases of Flock cameras being taken over by criminals, used to feed false data, or used for illicit tracking.

How can we be sure that Flock data are secure?

There are several layers of protection:

• Agencies own the data and decide who can access it.
• Every search is logged and auditable.
• Data are encrypted during transmission and while stored.
• Default retention is 30 days, after which data are automatically deleted. This is also covered in state law.
• Agencies can set strict policies on who can query the data and for what purposes.

The Albany Police Department also requires:

• Regular audits
• Two-factor authentication
• Documentation of any external data sharing
• Vendor compliance reviews

Does Flock use end‑to‑end encryption that blocks the company itself from accessing data?

• Flock encrypts data in transit and at rest using industry‑standard methods.
• As the data belong to the police agency, any Flock employee access is tightly restricted to technical support functions and is logged.

Has Flock’s secure data center ever been breached?

• There are no known or confirmed public reports of data breaches affecting Flock’s secure cloud environment.

If a data breach occurred, what consequences would Flock face?

Penalties would depend on state law and the terms of the contract with the city, but could include:

• State-level civil penalties under Oregon’s data-protection laws
• Required customer notification
• Possible financial liability for breach-related costs
• Contract termination
• Legal action for failure to comply with state ALPR statutes such as Oregon’s Sanctuary Promise law and SB 1516

How is this not a violation of the Fourth Amendment?

• License plates on public roads carry no expectation of privacy; photography and database storage do not constitute unconstitutional searches. Courts have consistently ruled in support of this principle.

Can you morally justify tracking everyone’s movements constantly using a private company?

• The ALPR solution does not “track everyone’s movement constantly.” It takes notice of a license plate as it passes a reader.

• • License plates are visible in public and public information.
  • LPR’s purpose is crime‑specific (e.g., stolen vehicles, abductions).
  • Data retention is limited (legally required at 30 days).
• Moral acceptability in law enforcement hinges on clear, enforced policies and laws—like warrant requirements, retention policies, and access oversight. SB-1516 brings that balance while keeping an important public safety tool.

Is Flock turning us into a surveillance state and violating civil liberties like the Patriot Act?

• Oregon's ALPR law directly confronts concerns about turning into a “surveillance state.” By controlling data retention, establishing vendor restrictions, enforcing oversight, and enabling legal recourse, the state balances public safety benefits with strong civil liberties protections.

“We’re leveraging this tech for public safety.” How can we protect our data from a private company?

• Data ownership

• • The Albany Police Department retains full ownership and control over all ALPR data.

• Retention limits

• • Oregon law requires that all license plate reads be deleted in 30 days unless they are connected to an active criminal case.

• Access restrictions

• • Access is limited by role-based permissions.
  • Contracts prohibit sharing with ICE or other unauthorized agencies.

• Encryption and audit logs

• • Data are protected with industry‑standard encryption both in transit and at rest.
  • All system searches and accesses are logged for accountability.

• Community oversight

• • Contracts and state law include transparency requirements.
  • Public records access and independent reviews ensure ongoing oversight.

Can Albany’s ALPR data be connected to other databases outside of Albany? Where does the data live, and whose servers host it?

• Data are stored on cloud servers (AWS GovCloud) under Flock Safety with required security for data.
• Despite vendor hosting, Albany Police Department (APD) retains full ownership and control under Oregon’s SB 1516 .
• Data may only be shared with other Oregon law enforcement agencies under clearly defined, lawful purposes—off-limits to out-of-state or federal agencies without a court order

Under what circumstances can data be shared with immigration enforcement?

• SB 1516 explicitly prohibits sharing ALPR data with federal immigration agencies like ICE or CBP or any entity for the purpose of immigration enforcement.
• Oregon’s sanctuary laws reinforce this, requiring a court order before any assistance to immigration enforcement is permitted.

If Flock data are part of the public record, could activities of citizens—including their movements—be accessed by anyone, including ICE or the vendor CEO?

• Raw ALPR plate-read data are exempt from public disclosure under SB 1516 .

• Only aggregate statistics, policies, and audit results are required to be publicly released
• Individual trip data remain private, not available to the public, for immigration authorities, or employees of Flock not authorized by the owner, Albany Police.

Can private companies access APD’s Flock data?

• No – there is no private access
• SB 1516 prohibits ALPR vendors from accessing, selling, or disclosing captured plate data outside of agreements with APD.
• Access is strictly limited to authorized law enforcement purposes as outlined in formal contracts approved by APD and Oregon state law

Are data stored locally or in the cloud, and where do they reside?

• ALPR data—including still images, plate numbers, vehicle make, and color—are stored in a cloud-based database, typically on CJIS-compliant AWS GovCloud servers managed by Flock
• Even though it’s cloud-hosted, APD retains full ownership and control, as mandated by Oregon’s SB 1516

Can these data be connected to databases outside of Albany?

• Data sharing is strictly limited under SB 1516: data may only be shared with Oregon-based law enforcement agencies for active investigations.
• Sharing with out-of-state or federal agencies, such as ICE, is prohibited unless a court order authorizes it

Under what circumstances could this data be shared with immigration enforcement?

• SB 1516 explicitly prohibits data sharing with federal immigration authorities like ICE or CBP or other entities engaged in immigration enforcement.
• Oregon’s sanctuary laws reinforce this, allowing ALPR data release only with a court order

Are Flock employees able to access Albany’s ALPR data?

• SB 1516 prohibits ALPR vendors (such as Flock) from accessing, selling, or disclosing plate data captured by local agencies
• Contracts must be CJIS-aligned, logging all access and enforcing strict vendor access restrictions, making unauthorized access by company staff illegal

Are the cloud servers located within Oregon or the U.S., and does the Patriot Act apply?

• Data are stored in CJIS-certified U.S. data centers, typically within AWS GovCloud servers. While not necessarily within Oregon, they are U.S.-based
• While the U.S. government has broad authority under the Patriot Act, Oregon law and vendor contracts impose strict restrictions on data use and access, ensuring oversight even when legally compelled.

How does the Albany PD protect data from cloud vulnerabilities or misuse?

• Data are encrypted in transit and at rest under industry and CJIS standards
• Detailed audit logs track all access, searches, and administrative activity.
• SB 1516 mandates standards-aligned contracts, enforcing incident notification obligations, ban on vendor data access, and civil penalties for violations

What guarantees exist that this network won't be expanded?

• State law (SB 1516) requires clear camera-use policies and specifies authorized locations.
• Any expansion would require a new contract that must be approved through public policy updates and City Council action.

How were searches conducted between April 22–May 20 despite Flock being suspended?

• The only camera in place was suspended and provided no data to the server. The APD still has limited access to search the Oregon database while not adding any additional data to the overall database.

Why were cameras accessed on the morning of April 22 before the council vote?

• See the answer above

What does “Devices” mean in the audit log?

• “Devices” refers to the number of cameras (or endpoints) involved in the search.
• It shows how many units contributed to the data pool involved in the query.

If the Oregon State Police (OSP) audits city ALPR use, who audits OSP’s use?

• The Oregon Secretary of State’s Audit Division reviews OSP’s compliance with state policies although OSP does not have access to the Flock database.
• OSP also follows internal CJIS-aligned protocols and conducts audits into the use of systems used by law enforcement to ensure CJIS protocols and policies are followed.

Who verifies that data aren’t shared outside Oregon improperly?

• SB 1516 prohibits sharing with out-of-state or federal agencies without a court order.
• Monthly audits and public transparency portals track all sharing activity and will be inspected by a command-level officer to check for compliance.
• Internal and third-party reviews verify compliance with sharing restrictions. Audits will be available to the public on a monthly or as-needed basis.
• The APD can remove other Oregon law enforcement who don’t follow SB1516 or misuse the technology.

What safeguards exist against misuse, leakage, or unauthorized requests?

• Vendors are legally barred from selling, disclosing, or accessing data outside contract terms.
• There are no known incidents of Flock data being leaked, sold, or shared improperly.
• If misuse occurs:
  • Citizens or the customer entity may file civil suits under state law.
  • Contracts allow for termination, penalties, and restitution mechanisms.
  • Formal audits and public complaints trigger enforcement and corrective action.
  • Some actions could result in criminal prosecution of law enforcement for misusing any CJIS system.

Why did Albany choose Flock instead of other systems with fewer ICE‑related concerns?

• Oregon SB 1516 sets strict, statewide rules that apply to any ALPR vendor, including retention limits, sharing limits, vendor access restrictions, and mandatory audits.
• Albany selected a system that could meet Oregon’s compliance requirements at the time, provide audit transparency, and integrate with existing investigative workflows—not solely based on cost.
• We are required to take the lowest cost bid unless otherwise permitted, however Flock has better audit tools, gave more customer control and operated solely in the United States.

Flock’s updated terms mention “perpetual rights” to customer data. How is Albany preventing misuse?

• Oregon SB 1516 overrides vendor boilerplate by legally prohibiting any vendor from accessing, selling, or disclosing ALPR data.
• Albany’s contracts and policies specify that all captured data belong exclusively to APD and must be deleted after 30 days unless tied to an active investigation.
• We also conduct audit reviews on a monthly basis, not yearly, as required by law.

Would the City Council support a sunset clause requiring periodic reauthorization?

• A sunset clause could be implemented at the city level through local policy or contract terms. SB 1516 allows for local renewal requirements and periodic re‑approval.

What does it cost to replace or repair equipment?

• ALPR systems operate on subscription models that include hardware, software, and maintenance. Actual replacement or repair costs depend on local contracts and the number of cameras deployed.
• Replacement, repair and other maintenance are covered by our existing contract and there is no additional financial liability to the city unless we are negligent in the use of the devices.

Is Flock less expensive because it uses collected data to train AI?

• No.
• Flock Safety utilizes a closed-loop AI ecosystem where image data captured by their network of cameras are fed back into their cloud-based algorithms to continuously train and refine object-recognition and behavioral models.
• The ALPR camera network captures vehicle details (make, model, color), processing them into searchable, vehicle-linked learning models.

Why should the community trust a for‑profit company?

• For non-profits and for-profits alike, trust is based on law, oversight, and transparency—not on goodwill. State law enforces retention limits, bans unauthorized vendor access, requires audits, limits data sharing, and creates civil penalties for violations.
• All current ALPR companies are “for profit” technology companies (including Axon and Motorola).

Crime in Albany is low and declining. Why implement this system now?

• Historically, crime in Albany has risen and fallen. As the city grows, technology can make criminal investigations more efficient and expeditious.
• Even if crime levels are low, there is no specific level below which laws wouldn’t be enforced and crimes wouldn’t need to be solved.
• The system supports investigations into thefts, stolen vehicles, missing persons, and serious crimes. It is a tool to keep crime low and solve existing crimes more efficiently.
• ALPR does not track people, issue citations, or serve as general surveillance—it captures only license plates and vehicle demographics on public roads, and auto‑deletes after 30 days.

Technology relies on community trust—how do you reconcile that with skepticism of the vendor?

• Albany’s ALPR use is governed by public policy, audits, retention limits, role‑based access, and transparent reporting.
• Community and APD oversight, not vendor assurances, are the core trust mechanism.
• Albany Police created an additional information page for the community beyond the Flock Safety Transparency Page.
• We have proactively released documentation about its use and are open about camera placement.

Does the system help with trafficking cases?

• ALPR can help identify vehicles associated with missing or endangered individuals and support investigations related to trafficking when tied to case information.
• As Albany is a city situated on a major highway, we see human trafficking occur via our truck stops, ingress and egress to the city.
• ALPR is also a valuable tool to stem the flow of illicit drugs into the city like fentanyl. It helps us identify dealer vehicles.

Does this stop drug activity or theft?

• ALPR does provide investigative leads by identifying vehicles linked to criminal cases, theft rings, or drug investigations.
• We have seen good success on both property and serious persons crime, including the death of a two-year-old boy.

Could captured images be used later with facial‑recognition software?

• No – the cameras do not use facial recognition and are not standard security cameras. They take still photos of vehicles. APD and other city staff continue to try to clarify this issue and eliminate confusion about this issue.
• Albany’s ALPR is not authorized for facial recognition and are designed to capture the license plate and vehicle details, not occupant details.
• Albany specific cameras will capture images (no video) of the rear of the vehicle.
• Policies and state law restrict use to license‑plate and vehicle‑related investigations.
• Any attempt to use captured data for facial recognition would violate department policy and state law, which has additional privacy protection in this area.

Do cameras capture more than plates?

• Yes—vehicle color, type, make, and visible distinguishing features like toolboxes and roof racks.
• They are not designed to capture identifying details of pedestrians or cyclists.
• As stationary cameras, they do not pan or move to follow objects.

How does the system protect privacy for pedestrians or cyclists near cameras?

• Cameras are aimed at vehicles and mounted to capture the rear of passing traffic.
• The software is trained to focus on vehicles.
• Policies and law prohibit using ALPR data to determine protected characteristics like race, gender, or appearance.

Does Flock allow API data connections? Could federal or state agencies ingest Albany’s data?

• API connections require explicit authorization from Albany and must comply with Oregon law. We do not have any APIs in place with Flock to any other CJIS system other than the Oregon Law Enforcement Data System (LEDS), which connects to NCIC for Hotlist entries like stolen vehicles, missing persons, and wanted persons.
• Data sharing is limited to Oregon agencies and cannot be shared with federal systems unless mandated by court order.

How accurate is ALPR? Are there misreads?

• Misreads can occur, which is why officers must visually confirm information before taking action.
• Each search requires a documented investigative reason, and audits review proper use.

What level of justification is needed to search the ALPR database?

• A search must be tied to a legitimate law‑enforcement purpose, and the reason must be entered into the system (example – stolen vehicle, missing person, wanted vehicle) and requires specific case identifiers like a case or incident number.
• Every search is logged, user‑identified, and subject to audit. This information does not auto delete and is kept permanently.

Do Albany patrol cars have mobile ALPR units? How many arrests were made solely due to ALPR?

• Albany uses fixed cameras and has one ALPR enabled traffic safety trailer. There are no ALPRs mounted on vehicles.
• ALPR generally provides leads rather than serving as the sole basis for arrests. Arrest metrics vary by investigative need.

If access is turned off, can it be turned back on?

• Yes, but only through authorized policy or council action in compliance with Oregon law.
• For specific users, we have two system administrators who can remove access for specific users.
• We can also remove access to data for other police departments.

What is “organized retail crime”?

• Coordinated theft groups targeting stores and supply chains, often using getaway vehicles. Retailers are common targets along major highways.
• Costco, Lowe’s, Home Depot, Walmart, Target, Winco, Kohl’s are frequent targets in Albany.
• ALPR can support such investigations when a license plate is known to law enforcement and entered into the system, looking for leads.

Will cameras generate revenue for Albany?

• No. Albany’s ALPR system is not used for traffic enforcement or fines.

What happens if Flock is hacked? How would the city compensate victims?

• SB 1516 authorizes civil actions and contractual remedies.
• Albany’s contracts include breach notification and response obligations.

If the vendor violates Oregon law, who receives compensation?

• Individuals or agencies harmed by misuse may pursue civil remedies under SB 1516 and contract law.

What happens to the data if Flock goes bankrupt?

• Data ownership remains with Albany.
• State law requires deletion after 30 days unless tied to a case, and prohibits vendor retention or sale of data.

Has the federal government ever accessed ALPR data by court order?

• Albany has never been contacted to turn over our data for a court order. It is unknown if any other ALPR customer has.
• Oregon law otherwise prohibits voluntary sharing with immigration enforcement or for people seeking reproductive care.

Can the federal government obtain all data under a future administration?

• Only through valid court orders (subpoena or warrant).
• Retention limits, in our case, 30 days and audit requirements reduce the risk of mass collection.

Does ALPR help find missing people?

• Yes—ALPR is frequently used to locate vehicles associated with missing or endangered persons. Every Amber Alert or Silver alert where a vehicle is involved will be entered in the NCIC / LEDS hotlist which communicates with ALPR services.
• There are a number of cases in Washington, Oregon and California where Amber Alerts have been resolved via an ALPR locate hit.

Could ALPR help identify drug traffickers on the I‑5 corridor?

• Yes—if a suspect vehicle is tied to a case or hotlist, ALPR can help identify movement patterns of a specific vehicle with identified license.

Why not use ALPR to protect law‑abiding citizens, as seen in incidents like the one in Austin, Texas?

• That was a recent case this past weekend where there was a series of shootings. The vehicle was entered on a hotlist and picked up on a neighboring city’s ALPR system (Flock). Arrests were made.
• ALPR has assisted in identifying suspect vehicles in serious incidents nationwide.

How is stalking (misuse) prevented?

• ALPR access is role‑based, logged, audited, and tied to documented investigative reasons.
• Misuse triggers are built in and will result in policy violations, discipline, civil penalties, and contract termination.
• A law enforcement officer could face criminal charges and decertification by the state of Oregon.