The Senate Judiciary subcommittee hearing on Wednesday had a title that made its subject plain: Always Watching, Flock's Nationwide AI Surveillance Network. What it did not have was Flock. The company's chief executive, Garrett Langley, and the heads of Axon, Motorola and Verkada were invited to testify. None of them came.
Instead, Langley sent a letter. Subcommittee chair Josh Hawley, a Missouri Republican, read it aloud, and it contained the sentence that framed the rest of the afternoon. Flock, the letter said, does very little to oversee what its customers search, and instead "relies on its customers to police themselves." The company's position is that the agencies that buy the cameras own the data and set the retention rules.
That is a defensible description of a vendor relationship. It is also, as Senator Dick Durbin of Illinois, the panel's ranking Democrat, described the work ahead, a problem Congress has to solve by finding a way to balance privacy and security. The gap between those two statements is where the hearing lived.
Five witnesses and a seat the company left empty
The witnesses were chosen to establish that the risk is not hypothetical. Lindsey Isaacs, a Florida resident, described being accused in a fatal hit-and-run after a Flock camera recorded a vehicle matching hers two to three miles from the scene. She spent 13 days in jail, including time in solitary confinement, before the charges against her were dropped.
Benn Jordan, a cybersecurity engineer, testified that Flock's public claim that its system has never been hacked is inaccurate, citing cameras and interfaces left exposed, and argued for independent security testing and a federal privacy statute along the lines of Europe's data protection rules.
Chad Marlow of the American Civil Liberties Union went further and called for banning license plate readers outright, warning that the databases can be used for immigration enforcement and to track people traveling for reproductive care. Alasdair Whitney of the Institute for Justice pointed to a catalog of more than 200 documented incidents of misuse and proposed warrant requirements for historical location queries, retention limits, and conditions on federal funding for agencies that buy the systems.
Sheriff Ross Teeple of Pinal County, Arizona, sat in a different seat from the other four. He had a contract with Flock and ended it, telling the panel that the privacy concerns raised by his own community went unanswered and that the devices pose a risk to constitutional rights. A sheriff who cancelled the contract is harder to dismiss as an activist than a witness flown in to criticize the company.
The scale numbers put the whole thing in perspective. More than 120,000 cameras operate across 49 states, and roughly 140,000 law enforcement officers can search 30 days of vehicle location history. That is a national network. It is not governed by a national rule.
A national system administered through local contracts
This is the structural problem the hearing kept circling. Flock sells to cities, counties and police departments. Each sale is a contract. Each contract sets its own terms on retention, sharing and audit. The result is a system that functions nationally, because participating agencies can query each other's data across jurisdictional lines, while the rules that govern any given search depend on which agency is asking and which contract applies.
Accountability in that arrangement runs in the direction of the customer. A vendor that audits its customers would be auditing the people who pay it. Flock's letter to the subcommittee does not claim otherwise. It says the customers are responsible, which is a statement about how the market is built rather than a defense of how it performs.
That is why the abuse catalog matters. A single misuse is a personnel problem. Hundreds of documented incidents across many agencies is a design problem, because the design assumes that the entity with the least incentive to restrict access is also the entity responsible for restricting it.
What a query returns, and who can run one
The technical shape of the system is what turns a local contract into a national question. A license plate reader photographs passing vehicles and converts the image into a plate number, a timestamp and a location. Individually, that is a record of a car passing a fixed point, which is close to what a traffic camera captures.
The value comes from aggregation and from sharing. Flock's network lets participating agencies search each other's records, so a detective in one state who enters a plate can assemble a movement history from cameras operated by dozens of unrelated departments. The search does not require a warrant in most jurisdictions, and in many of them it does not require a supervisor's approval either.
That is the capability Isaacs described from the receiving end. A camera match put her near a crime scene, the match was treated as identification, and she spent close to two weeks in custody before the case against her collapsed. Plate readers do not identify people. They identify vehicles, and vehicles have drivers, passengers, borrowers and owners who are not the same person.
The scope of the search function is what worries the senators who want legislation. A query that would once have required an investigator to visit three police departments and fill out three forms now returns a month of movement history in seconds, run by any of the officers with access. Capability that becomes cheap gets used, which is the pattern the abuse catalog records.
What a federal statute would have to contain
The witnesses who brought proposals were specific about the shape a law could take. Whitney, from the Institute for Justice, proposed warrant requirements for historical location queries, retention limits that a vendor could not extend by contract, and conditions attached to federal funding for agencies that buy the systems. Jordan, the security researcher, called for independent testing of the systems and for a privacy statute modeled on European data protection law, which sets a legal framework rather than a list of vendor practices.
Those ideas address different layers. A warrant requirement governs the officer running a search. A retention limit governs the data holder. A funding condition governs the city deciding whether to buy in the first place. A security testing requirement governs the product itself. A law that adopted all four would be comprehensive in a way that nothing currently on the books is.
The counterargument, which the empty seats made for the companies, is that a national statute is a heavy instrument for a technology that cities can regulate by choosing not to buy it. The 200-plus cancellations since January are evidence for that view. The opposing evidence is that a city which cancels leaves its neighbors' cameras running, and nobody crossing a municipal boundary is told which rules just changed.
The pressure is not coming from one party. Katie Britt of Alabama and Raphael Warnock of Georgia entered into the record a letter asking the Justice Department to set federal guardrails for the technology, and Warnock noted that 20 Georgia law enforcement officers have been arrested for misusing it. Hawley, who chairs the subcommittee, spent the hearing asking witnesses what a federal statute should require rather than whether one should exist. That question is the difference between a hearing that produces a bill and one that produces a press release.
The retention cut is a concession, not a rule
Flock has reportedly pledged to reduce its default retention window from 30 days to seven and to require users to justify database searches, including through a dropdown menu and a case number field. Both changes move in the direction the witnesses wanted.
Neither is a rule. Both are company policy, announced under congressional pressure, and changeable without a hearing. The distinction is not a small one. A retention limit enforced by statute binds every vendor and gives an agency that exceeds it something to answer for. A retention limit enforced by a contract binds one customer at a time, and a retention limit announced by a company binds the company until it decides otherwise.
The seven-day figure also raises a question nobody at the hearing resolved: what happens to data already held under 30-day terms, and whether the shorter window applies retroactively to footage a city already collected. Vendors that shrink a retention window are usually describing the default for new data rather than deleting history.
The lever the Senate holds
The remedies discussed on Wednesday were procurement remedies, and that is not a coincidence. Congress cannot directly regulate how a county police department configures a camera network. It can attach conditions to the federal grants those departments rely on. It can hold hearings that make the costs of a contract visible to the city councils that sign them. It can pass a statute, if it can find the votes.
There is a softer version of the same lever. The Justice Department can issue guidance on how federal grant money should be spent, and a letter from two senators is the first step in asking for it. Guidance is not a statute, and it can be withdrawn by the next administration, but it arrives faster and it shapes what local agencies feel safe doing in the meantime.
The market has been moving in parallel. More than 200 cities have ended contracts with Flock and other license plate reader companies since the beginning of 2026, a number that reflects local political pressure as much as any change in the technology. That is the mechanism the hearing was built to accelerate: make the costs of a contract visible to the officials who sign it, and let them absorb the consequences.
Whether that is enough is the open question. A city that cancels its contract leaves the cameras in the neighboring city running, and a driver crossing a county line does not choose which rules apply. The witnesses who want a statute are making that point. So, in a different way, is Flock, whose letter describes a system of national reach administered by thousands of local decisions that no single authority coordinates.
What Congress does next will be measured against the record it built this week: a company that says its customers police themselves, a catalog of cases where that did not happen, and an industry that has begun trimming its own practices while the legislation sits unwritten. The subcommittee did not vote on anything. It did something less formal and, for a first hearing, arguably more useful: it made the oversight gap part of the public record.
Primary sources
- Senator Dick Durbin, statement at the Judiciary subcommittee hearing on Flock cameras, for the scope of the hearing and the balance the chair and ranking member described.
- Nextgov, Flock camera systems receive bipartisan scrutiny from senators, for the witness testimony and the company's letter.
- American Civil Liberties Union, ACLU privacy expert to testify at bipartisan Senate hearing on Flock and other automatic license plate readers, for the ACLU's position and the hearing details.
- Oregon Capital Chronicle, Flock surveillance cameras raise constitutional questions, bipartisan US senators say, for the network's scale and the senators' statements.