Audit / oversight

On September 23, 2026, Marion County Prosecutor Ryan Mears announced charges against five Indianapolis Metropolitan Police Department officers for allegedly using Flock license-plate cameras to conduct thousands of impermissible searches, primarily to track ex-partners and acquaintances. Officer Jonathan Schultz faces 26 counts, including fraud and stalking. IMPD Chief Tanya Terry stated the department will retain its 301 leased Flock cameras and has tightened access requirements, including mandatory case numbers and new policy acknowledgments. The department discovered the misuse after an officer self-reported, leading to an internal audit.

Former Fort Pierce police officer Josepher Crutchfield was arrested on September 8, 2026 on four felony counts of unauthorized computer access. Investigators said he accessed Flock license-plate reader databases 382 times between October 2025 and July 2026 to search a license plate registered to his ex-girlfriend, without a legitimate law enforcement purpose. He also searched other databases including FCIC, NCIC, DAVID and TLO. Crutchfield had resigned from the department on August 18, 2026. Chief David Smith said, “The conduct alleged in this case is unacceptable.”

On September 3, 2026, a Boston Police Department drone crashed onto a parked Mazda 3 in Brighton, damaging its rear windshield and trunk and leaving the aircraft in pieces on private property. The crash occurred less than a week after the department began operating its Drone as First Responder program, which it had announced on August 28 in partnership with Motorola Solutions and BRINC. BRINC collected the wreckage. The car’s registered owner, a 42-year-old Brighton man, was not home at the time. Under 14 CFR § 107.9, the FAA requires remote drone pilots to report any accident causing more than $500 in property damage within 10 days. The program began operating in the final weekend of August.

On August 10, 2026, three Bibb County sheriff’s deputies were arrested in Macon, Georgia, for misusing the department’s access to Flock license-plate readers. The deputies, two men and one woman, were charged with stalking, prohibited use of a traffic control device, and violation of their oaths of office. They used the system for personal purposes to monitor people they knew. All three resigned. The arrests followed an audit of the license-plate reading system.

In August 2026, Business Insider reported that Flock Safety cameras generated 1,427 alerts to the Roseville, California, police department in 2023 and 2024 for vehicles flagged as stolen or tied to felonies, and that a department analysis found 71% of those alerts came from the software misreading the plate. Records showed a 9 read as an 8, and the department reported bad reads to the company dozens of times over four years. Flock said its cameras read more than 96% of characters correctly in optimal conditions and blamed Roseville’s older hardware, higher camera mounting and rear-only capture. No alert led to a stop or arrest because officers must verify plates before acting. The city has spent roughly $450,000 on Flock products since 2020 and continues the contract.

Flock Safety’s license-plate readers sent 1,427 alerts to Roseville, California police in 2023 and 2024 flagging vehicles as stolen or used in a felony. A police department analysis found that in 71% of those alerts, Flock’s software incorrectly read the license plates. The city has used Flock cameras since 2021 and has spent around $450,000 on Flock products since 2020. Roseville police said none of the incorrect alerts resulted in a traffic stop or arrest because officers verify plates before stopping.

The Los Angeles Police Department’s Office of Inspector General audited two months of Flock Safety stolen-vehicle hot-list alerts from August and September 2025. Of 498 alerts, 161 were false positives: vehicles the system flagged as stolen were not stolen. The remaining 337 alerts led to recovered vehicles, about one in three alerts wrong. The audit attributed the errors to hot-list data, not plate reads: recovered vehicles not cleared from lists, outdated theft reports and uncorrected data-entry mistakes. The OIG recommended suspending new ALPR camera deployments and contracts pending public input and a broader reassessment of vendors and data practices. LAPD’s three-year 2023 agreement for 138 pole-mounted cameras expired July 11, 2026 and was not renewed, with the department citing privacy and data-ownership concerns. At the July 15 Police Commission meeting, officials said they were negotiating a new contract giving the city ownership of all plate data.

An audit released July 11, 2026 by the LAPD Office of the Inspector General found that during a two-month review period (August 1 to September 30, 2025) officers acknowledged 161 automated license-plate-reader ‘hot list’ alerts as accurate stolen-vehicle matches that were in fact wrong, generally because outdated data was never cleared after a vehicle was recovered. LAPD policy requires verification before stopping, but the audit found this frequently did not happen, and false hits triggered high-risk stops. Following the audit, LAPD let its data-sharing contract with Flock Safety expire.

The Los Angeles Police Commission’s Inspector General publicly released a review of the LAPD’s automatic license plate reader (ALPR) system. During a two-month review period ending September 30, 2025, cameras captured 210,568,103 license plate reads. Officers confirmed 161 ALPR alerts as accurate matches to scanned plates, but subsequent investigation determined the vehicles were not stolen. The report also found 337 alerts led to stolen vehicle recoveries, 68 alerts led to 74 arrests, and nine alerts resulted in pursuits. The OIG recommended suspending new ALPR camera deployments and new contracts pending public input and formal agreements with all vendors covering data security, privacy, access controls, retention, and auditing.

An SFPD audit found that the Northern California Regional Intelligence Center (NCRIC) had queried SFPD’s Flock network on behalf of federal and out-of-state agencies. There were 299 improper inquiries over approximately one year, accounting for 0.005% of inquiries. SFPD Chief Derrick Lew turned off NCRIC access and initiated an internal review. The improper searches were conducted by analysts with the Western States Information Network. California law prohibits sharing ALPR data with out-of-state and federal agencies.

On September 8, 2025, The San Francisco Standard reported, based on records it obtained, that out-of-state law enforcement agencies had run more than 1.6 million searches of the San Francisco Police Department’s Flock license plate reader database, including at least 19 searches marked as related to U.S. Immigration and Customs Enforcement. California law bars sharing automated license plate reader data with out-of-state agencies for any purpose, and state sanctuary law bars assisting immigration enforcement. The Standard reported that SFPD gave out-of-state agencies direct access between at least August 2024 and February 2025, and that nearly 4,000 out-of-state agencies searched the data. EFF and the ACLU wrote to SFPD that month demanding it stop. A city audit reported in June 2026 found hundreds of additional illegal searches, including improper use by federal agencies.

On August 26, 2025, Evanston ordered Flock Safety to deactivate its 19 license plate reader cameras and issued a 30-day termination notice, effective September 26, after an Illinois Secretary of State audit found Flock had let U.S. Customs and Border Protection access Illinois camera data in violation of state law. Flock challenged the termination. In September the company reinstalled stationary cameras without city authorization, and the city covered the cameras pending removal. The five-year contract, approved January 8, 2024, at $48,500 per year, runs to January 29, 2029; the city paid the first two years and would owe $145,500 for the remaining three if the contract is upheld. As of March 2026 no lawsuit had been filed, the city had not paid its 2026 fee, and the final two cameras were removed after a RoundTable inquiry.

Flock Safety paused pilot programs with U.S. Customs and Border Protection and Homeland Security Investigations on August 25, 2025. Illinois Secretary of State Alexi Giannoulias said an audit found CBP had accessed Illinois data, calling it “a clear violation of the state law.” Flock CEO Garrett Langley said parameters were unclear. Flock added flag terms including “abortion,” “immigration” and “ICE” in late June. Federal agencies can no longer make blanket statewide searches.

On August 25, 2025, Illinois Secretary of State Alexi Giannoulias announced that an audit of 12 local law enforcement agencies found Flock Safety in violation of state law. The audit found the company lacked proper safeguards on data sharing and had been running a pilot program that gave U.S. Customs and Border Protection access to cameras on Illinois roads. An Illinois law passed two years ago prohibits sharing plate reader data for purposes including investigating immigration status or interfering with reproductive health care. Giannoulias ordered the federal agency’s access to Illinois cameras shut off, and Flock paused its pilot with CBP and other federal agencies nationwide. Flock’s CEO said the company “didn’t create distinct permissions and protocols in the Flock system to ensure local compliance for federal agency users.” A follow-up finding on September 5 named the Forest Park Police Department for sharing data with CBP.

On July 10, 2025 the Electronic Frontier Foundation published an investigation concluding that Axon’s Draft One, which drafts police reports from body-camera audio, is designed in a way that frustrates audits. Reviewing police reports, emails, procurement documents, department policies, software settings and Axon’s own manuals and marketing, EFF found it is often impossible to tell which parts of a report were generated by AI and which were written by an officer, because Draft One does not retain the initial AI-generated draft. Administrators cannot produce a list of all Draft One activity across a department; they can only inspect an individual officer’s audit log or a single evidence item. An Axon representative told one agency there is no filter for Draft One reports. The Palm Beach County Sheriff’s Office, which requires a disclosure on each report, isolated more than 3,000 Draft One reports generated between December 2024 and March 2025.

On June 11, 2025, the Illinois Secretary of State’s office notified the Mount Prospect Police Department that other law enforcement agencies had conducted 262 immigration-related searches of the village’s automated license plate reader data. The department said it had been unaware of the searches until notified. The village also learned that the Johnson County, Texas, sheriff’s office had used Flock Safety’s National Lookup feature, accessing Mount Prospect’s data without a data-sharing agreement. Illinois law prohibits using plate reader data to investigate immigration status. Mount Prospect said it has since disabled nationwide access and revoked access for all out-of-state agencies.

Chicago’s contract with SoundThinking for the ShotSpotter gunshot-detection network ended September 22, 2024, followed by a two-month transition period. The city entered a $33 million, three-year contract in 2018; WTTW reported the city paid more than $53 million since 2018. In February 2024 Mayor Brandon Johnson signed a nine-month extension reported by the Sun-Times at $8.6 million, more than the previous year’s cost. A 2021 Office of Inspector General review of 50,176 alerts from January 2020 to May 2021 found 9.1 percent produced evidence of a gun-related crime. The City Council voted 34-14 in May to require a council vote before removal from any ward, and later voted 33-14 to rebuke Johnson’s decision; the mayor vowed a veto.

On June 20, 2024, the New York City Comptroller’s office released an audit of NYPD’s ShotSpotter program. The audit found that in June 2023, officers responded to 940 alerts, of which 13% (122) were confirmed shootings. Fewer than 1 in 5 alerts result in a confirmed shooting. Since 2014, NYPD has spent over $45 million on ShotSpotter and committed an additional $9 million. In June 2023 alone, NYPD personnel spent almost 427 hours investigating unconfirmed alerts. The audit recommends declining to renew the contract when it expires in December 2024.

On December 5, 2023, the Dallas County District Attorney’s Office stated that Dallas police deleted body camera videos from 2016–2021 due to retention policies, potentially affecting thousands of cases. A March notification led to a review of 113 trial cases involving complainant deaths; 572 of nearly 9,000 video files had been deleted. A November 2022 review found about 52,000 digital files improperly categorized. DPD increased retention to a two-year minimum and added staff. The DA’s office said no deleted video had yet proven material.

Seattle’s Office of Inspector General published a surveillance technology usage review covering ALPR deployments in 2021 and 2022. The report found 976 misreads in 2021 and 948 in 2022, approximately one misread for every five unverified hits. It documented two erroneous vehicle stops caused by outdated or misleading hotlist information. In one, a stolen license plate had been swapped onto a similarly described vehicle, leading to a firearms-drawn stop of an innocent driver. In another, officers stopped a vehicle reported stolen but recovered earlier; the recovery had not been recorded. The OIG recommended that SPD develop a deployment strategy that accounts for disproportionality in data collection.

An independent investigation by Kirkland & Ellis LLP found that a backup technician’s errors during a server migration caused the permanent loss of approximately 20.68 terabytes of Dallas Police Department data. The data included family violence and FUSION records. Only 3.26 terabytes were recovered from other sources. The report states the data is unrecoverable in its original format. The technician deleted archived data from cloud storage after incorrectly copying placeholder files to on-premises servers.

Chicago’s Office of Inspector General reported that ShotSpotter alerts rarely lead to confirmed gun-related evidence. Analysing the alerts from January through May, the office found that of 50,176 notifications, only 9.1% indicated evidence of a gun-related offense and only 2.1% linked directly to investigatory stops. The report said alerts can change officers’ behavior in patrolling areas. Deputy Inspector General Deborah Witzburg said there is little data linking alerts to recovered evidence or stops. The report came amid the city’s extended $33 million contract with ShotSpotter for two years.

On January 23, 2020, the Chicago Office of Inspector General (OIG) released an advisory on the Chicago Police Department’s (CPD) predictive risk models, the Strategic Subject List and Crime and Victimization Risk Model. CPD received $3.8 million in federal grants and spent ten years developing the models, which scored individuals on likelihood of being a party to violence. The department decommissioned the program in November 2019 after grant funding ended. OIG raised concerns about unreliable risk scores, improperly trained personnel, and lack of access controls. Inspector General Joe Ferguson said, “We reiterate our hope that the Department will apply these lessons going forward.”

The Chicago Police Department decommissioned its ‘party to violence’ risk-model program — the Strategic Subject List and its successor, the Crime and Victimization Risk Model — on November 1, 2019, after telling the Office of Inspector General in August 2019 it intended to do so. On January 23, 2020 the OIG published an advisory reporting that CPD had received $3.8 million in federal grants and spent ten years developing the sequential models, which assigned scores predicting the likelihood a person would be the victim or offender in a shooting. The advisory’s areas of concern included the unreliability of risk scores and tiers, improperly trained sworn personnel, a lack of controls on internal and external access, and interventions that may have attached negative consequences to arrests that never produced convictions. The algorithm was built by the Illinois Institute of Technology under a Department of Justice Bureau of Justice Assistance grant. The databases held data on more than 300,000 people.

In June 2019, U.S. Customs and Border Protection subcontractor Perceptics was breached in what CBP called a malicious cyberattack. Images of travellers’ faces and license plates, contracting documents and other data were made publicly available on the internet. About 184,000 traveller images from CBP’s facial-recognition pilot were compromised, and at least 19 were posted to the dark web. The attackers also obtained contractual documents, program-management documents, emails, system configurations, schematics and implementation documentation related to CBP license-plate-reader programs. Perceptics had downloaded sensitive CBP data from an unencrypted device and transferred it to the company’s network, violating DHS security requirements. Perceptics was suspended from federal contracts, subcontracts, grants and loans in June 2019; the suspension was lifted in September 2019. A September 2020 DHS Inspector General report found CBP did not adequately safeguard the data, though no federal networks were compromised.

On March 8, 2019 the LAPD Office of the Inspector General released an audit of the department’s data-driven policing programs — PredPol, Operation LASER and the ELUCD survey platform — and presented it to the Police Commission on March 12. The audit found significant inconsistencies in how individuals were selected and retained in LASER’s chronic-offender program, found the programs lacked oversight and often strayed from stated goals, and concluded there was insufficient data to determine whether PredPol reduced crime; the department had used PredPol for roughly eight years. LAPD suspended its Chronic Offender program and database in August 2018 without announcing it. A memo dated April 15, 2020 said the department would discontinue PredPol immediately, citing the pandemic-driven freeze on new contracts.