Flock sells a nationwide automatic license plate reader network. Its cameras photograph cars, log where and when they passed, and let police search those movements across thousands of jurisdictions. In May 2026 the NoCo Privacy Coalition, a privacy group in Northern Colorado, found something Flock never meant anyone to see. The internal records of police searches, including the reasons officers typed in to justify running a plate, were sitting in public search results on DuckDuckGo and Bing. 404 Media reported the exposure on June 11.
Read that again. The justification a cop wrote down before pulling up your driving history was indexed by a search engine. Anyone who knew how to look could read what police were searching for and why. A system marketed as a controlled, audited, law-enforcement-only tool spilled its audit trail onto the open internet.
This is what surveillance infrastructure actually is once it exists. Flock did not just build cameras. It built a giant searchable database of human movement and then bolted a search interface onto it for tens of thousands of officers. Every one of those searches generates a record. Every record is data that has to be stored somewhere, secured by someone, and trusted not to leak. Everyone argued about the cameras. The database behind them is what just failed.
Flock has form here. 404 Media previously caught the company exposing live camera feeds to the open internet, streams that anyone could pull up without a login. Police across the country were promised the cameras would not be used to ticket ordinary drivers, and that promise did not survive contact with reality. We have written about Flock treating ordinary people as livestock to be tracked, about Flock exposing children, and about Ring walking away from a Flock partnership after the backlash. This is the seventh time Flock has earned its own post on this blog, and that is before counting the twenty-odd other articles where the company shows up as a supporting villain. At this point the Blackout newsroom should send a fruit basket. No company works harder to prove our argument for us.
The argument is simple. Data that gets collected gets leaked. It does not matter how serious the operator claims to be. The more a system knows, the more there is to expose when the operator is careless, and operators are always careless eventually. Flock holds billions of vehicle sightings and the search history of an entire law enforcement customer base. A database that size is not a question of whether it leaks. It is a question of when, and how much, and whether you ever find out.
The cruel detail is who gets exposed in this particular leak. Cops are loud about protecting their own operational privacy. They redact officer names, fight body camera releases, and treat their internal systems as sacred. Flock handed those internal systems to a search crawler. The people most insistent that surveillance only points outward just watched it point straight back at them. Police do not deserve it, but that misses what happened. Nobody controls a database once it is big enough and connected enough, not even the people it was built to serve.
This connects directly to the wider license plate reader dragnet we have covered. The pitch is always the same. Narrow purpose, tight controls, serious crimes only, trust us with the data. Then the purpose widens, the controls slip, and the data ends up somewhere it was never supposed to be. Flock did not get hacked by a foreign government. It leaked to Bing. The most ordinary failure in computing just exposed the guts of one of the most invasive surveillance networks in the country.
You cannot opt out of Flock. The cameras photograph your plate whether you consent or not, and the database keeps the record for as long as the operator decides. The only exposure you actually control is your own. Reduce what can be linked back to you, encrypt what you can, and assume any centralized system holding your data will eventually spill it. Flock just gave you a live demonstration of why.
Blackout VPN exists because privacy is a right. Your first name is too much information for us.
Keep learning
FAQ
What did Flock actually leak?
Internal records of police license plate searches, including the reasons officers gave for running a plate, were indexed by DuckDuckGo and Bing and visible in public search results.
Who found the exposure?
The NoCo Privacy Coalition, a privacy group in Northern Colorado, found the indexed search records in May 2026 and shared them with 404 Media, which reported the story on June 11.
Has Flock leaked data before?
Yes. 404 Media previously reported that Flock exposed live camera feeds to the open internet that anyone could view without logging in.
Can I opt out of Flock cameras?
No. Flock cameras photograph your plate in public regardless of consent, and the data is retained according to the operator's policy, not yours.
What can I actually do about license plate tracking?
You cannot stop the cameras, but you can reduce the rest of your exposure by minimizing what links back to you online and assuming any centralized database holding your data will eventually leak.