EFF Investigation Reveals Widespread Abuse of US License Plate Surveillance

Last updated: September 26, 2026

A civil liberties investigation has documented how officers across the United States are entering nonsensical text into the mandatory justification field of a widely deployed license plate recognition system, calling into question the adequacy of existing safeguards.

Research summarized by techradar.com draws on findings from the Electronic Frontier Foundation, which collected examples of absurd rationales submitted by law enforcement when running searches. In one instance, an officer in Lake County, Indiana queried over 19,000 cameras and recorded the official reason as "LMAO." Other entries included name-calling, profanity, and dismissive phrases like "Hehe," "WEIRD KID," and an unhinged note about a robbery where the officer admitted they could not recall the case number.

The Scope of the Surveillance Grid

The Flock platform operates within a much larger automated license plate reader network encompassing 82,413 cameras scattered throughout the country, according to the EFF report. Operators can run vehicle tracking searches against this grid without first securing a warrant, with only a plain text box prompting them to explain the purpose of each query.

Because that prompt accepts any input without validation, anything typed becomes the archived legal justification for the search. Privacy advocates contend that this setup converts the oversight field into a formality rather than a meaningful constraint on police authority.

Prior Controversies and the Recent Data Exposure

Before this latest probe, Flock had already faced scrutiny over revelations that its cameras tracked former romantic partners and individuals simply walking on public sidewalks. Separately, a security incident demonstrated how attackers managed to pull an encryption key from a Flock unit and leverage it to download roughly 27,000 video clips alongside 1.6 million still images captured across just three weeks by a single device.

The significance of that breach lies in the sheer volume of locational and visual data a single node can stockpile, and how easily that material becomes exposed once device-level secrets are compromised. The timing matters because several municipalities were already reconsidering their contracts with the vendor. Columbus, Ohio halted its program, while Florida and Texas have both reduced their reliance on Flock hardware.

The Thin Response from Law Enforcement

When the EFF brought the absurd justification entries to the attention of various police departments, accountability measures were minimal, the group found. Most officers received only informal guidance rather than formal discipline. One agency had already allowed its 90-day window for internal review to expire before the matter was even escalated.

In another instance, a cop submitted the word "blah" as the stated reason. The department's defense was not to reprimand the officer but to assert that its employee was simply frustrated because the tools were, in the department's own wording, "not keeping pace" with his workflow. This framing reframes a compliance failure as a technical inconvenience.

What It Means for You

For professionals operating in web hosting, WordPress management, or cPanel administration, this episode serves as a reminder that data exposure risk is not limited to servers and cloud infrastructure. Surveillance archives, vehicle logs, and device-level credentials all live on networked equipment whose reliability depends on vendors, insiders, and supply chains. If a single Flock node could yield millions of images in a breach, the same logic applies to any connected device on your premises, from network video recorders to remote backup systems.

Your customers may face similar exposure. Many small businesses deploy internet-connected cameras for physical security, and those products often follow the same philosophy of logging data first and justifying access later. Reviewing where footage is stored, how long it is kept, and which staff or third parties can retrieve it has become a standard hygiene task rather than a niche concern.

Practical Takeaways

• Treat any device holding encryption keys as essential infrastructure: rotate credentials, isolate those systems on separate network segments, and apply patches without delay.
• Push vendors who manage video or location data to publish clear retention schedules, access audit logs, and incident disclosure timelines.
• Monitor local ALPR and camera rollouts in your area, particularly if your office or data center sits near a covered route.

Key takeaways

• The EFF evidence shows that a single weak justification field effectively turns a nationwide camera grid into an almost warrantless vehicle tracking engine.
• One compromised camera exposed thousands of clips and millions of photos, demonstrating that hardware-level key management matters for every connected device you operate or recommend.
• For hosting resellers and site administrators, the lesson is to audit your own stack, from WordPress deployments to on-premises cameras, with the same scrutiny now being applied to police surveillance networks.

Source: techradar.com