Every claim on this page is sourced from government documents, court filings, the federal cybersecurity database, vendor patents, or named investigative reporting. No anonymous sources. No speculation. Click any source link to verify for yourself.
Before examining specific failures, understand what Flock Safety actually is — because the business model explains everything else.
Flock Safety's valuation — a Georgia startup with $950 million in venture capital funding
What El Paso paid per camera per year — 150 cameras, $702,500 total grant, 24/7 surveillance of a major city
Ask the question any Texan should ask: how does a company justify a $7.5 billion valuation by charging less than $5,000 per camera per year? The hardware is not the product. The network is. Every city Flock enters adds to a massive, interconnected database of vehicle movements across America. That database — your routes, your patterns, your life — is what investors are valuing at $7.5 billion.
El Paso didn't buy a public safety tool. El Paso gave a private company free access to photograph every vehicle in our city, 24 hours a day, in exchange for hardware that costs less than a used car per year. That price only makes sense if the data has far greater value than what the city is paying for it.
In February 2026, Flock Safety rewrote its Terms of Service with 147 documented changes. The most significant: deletion of the clause that previously stated "Flock does not own and shall not sell Customer Data." That language no longer exists in the current terms — the terms that any May 16 renewal would be signed under.
When a surveillance company quietly removes the promise not to sell your data from its contract, that is not an administrative update. That is a signal about business intent.
In May 2025, 404 Media reported that Flock was developing "Nova" — described internally as a "public safety data platform" that supplements ALPR data with commercial data sources to build profiles on and track specific individuals without a warrant. The Electronic Frontier Foundation called it a "dystopian panopticon." Nova was already in use by law enforcement in an Early Access program before the reporting surfaced.
Flock cameras are not simple cameras. They are networked computers mounted on public poles, running an operating system that will never receive another security update.
Flock Falcon cameras run Android 8.1 (Oreo) — an operating system Google discontinued in 2021. This is not a temporary gap. Android 8.1 will never receive another security update. Ever. The hundreds of known vulnerabilities in that operating system are permanent, unpatched attack surfaces.
This is not a camera with a software problem that can be fixed. It is a system built on a foundation that the manufacturer abandoned years ago. Every Flock camera in El Paso is running an operating system with permanently unpatched holes — photographing your vehicle, your passengers, and your movements 24 hours a day.
Security researchers demonstrated on video that Flock cameras can be fully compromised by anyone who can physically reach them. A specific button sequence on the back of the camera activates a Wi-Fi access point (SSID: "flock-54E823", password: "security"). Once connected, Android Debug Bridge is enabled by default — giving the attacker full root access without authentication.
"The longest part, actually, is waiting for the hotspot to turn on," said the researcher who discovered the vulnerability. Most Flock cameras are mounted on public utility poles at street level. Anyone can reach them.
Flock cameras store hard-coded Wi-Fi network names and transmit credentials in cleartext — meaning anyone who creates a Wi-Fi hotspot with the right name can intercept traffic from nearby cameras. The bootloader ships unlocked, allowing unrestricted firmware modification. Officer login credentials for Flock's system have been found for sale on dark web marketplaces.
The National Vulnerability Database (nvd.nist.gov) — the U.S. government's official registry of cybersecurity flaws — lists 22 confirmed CVEs specifically affecting Flock Safety hardware. These are not allegations or opinions. They are formally registered security flaws, acknowledged and entered into the federal database.
Senator Ron Wyden's federal investigation found Flock did not require multi-factor authentication for officer accounts. At least 35 customer account passwords were stolen by hackers. At one point, Flock cameras and admin dashboards could be accessed publicly without any login. Flock only began requiring MFA by default for new users in November 2024 — years after deploying cameras in thousands of cities.
Flock uses YOLO — a powerful neural network object detection system — to analyze every frame captured by its cameras. Here is the full documented list of what it detects and classifies, drawn from Flock's own patent and independent security research.
From the patent (US11416545B1) and independent forensic analysis of the camera hardware:
The ACLU of Oregon confirmed: "Even a pedestrian, bicyclist, or animal who happens to be caught in the frame of a Flock camera can be swept up in the vast and unregulated Flock surveillance network."
Flock Safety states publicly on their own website: "Flock's ALPR cameras do not use facial recognition. Flock's ALPR system cannot be used to search for human characteristics, like race or gender."
The patent explicitly describes the capability to "identify the face… query for any footage having a person with matching face recognition data points." It also describes classifying individuals by race, gender, height, weight, and clothing.
This is not a gray area. This is a company making a public claim that directly contradicts their own federal patent filing. Flock avoids the term "facial recognition" in their marketing to prevent backlash. The functionality is patented and documented in a public federal record.
El Paso residents should ask: which Flock capabilities are active in El Paso's deployment? Which are disabled? Is there anything in the contract that contractually prohibits these capabilities from being activated?
These are issues documented in El Paso's own public records and transparency portal. They deserve direct public answers before any contract renewal.
A community member has filed a public records request with the City of El Paso seeking detailed data on how El Paso's Flock system has been accessed, by whom, and for what purpose. We are awaiting the city's response. This page will be updated when records are received. Transparency is not a favor — it is a legal right.
El Paso PD's own Flock transparency portal — a public document — lists a Harris County Precinct 3 Commissioner's office as an entity with access to El Paso's camera data. A commissioner's office is not a law enforcement agency. No public explanation has been provided for why a political office in Harris County, hundreds of miles from El Paso, has access to our surveillance data.
We are not asserting wrongdoing. We are asserting that El Paso residents deserve a clear, public answer: why does this office have access, under what authority, and what data has it accessed?
The Texas Department of Public Safety launched an investigation into whether Flock Safety holds the private security license required to legally operate surveillance systems in Texas. Operating without that license raises questions about the legal standing of El Paso's existing contract and any renewal. The status of that investigation has not been publicly resolved.
Texas has no state law governing how license plate reader data must be stored, who can access it, or how long it can be retained. Multiple bills have been introduced in Austin — all died in committee. El Paso residents' only protection is the contract itself — the same contract Flock rewrote with 147 changes in February 2026, including removing the data-sale prohibition.
For a border city with a large immigrant community, operating in a legal vacuum with a vendor that has repeatedly enabled unauthorized federal access in other jurisdictions, this gap is not theoretical. It is an active risk.
DHS/ICE/PIA-039 — ICE's own Privacy Impact Assessment — requires vendors to maintain audit logs of all ALPR queries. Those logs are available to "ICE personnel charged with ensuring proper use." They are not required to be shared with the local police departments whose camera networks are being queried, or with the cities those departments serve.
This means El Paso PD cannot independently verify who has searched El Paso's Flock data. When EPPD says "ICE does not have access," they are relying on the vendor's word — not on an audit log they can see. The audit log that would prove or disprove it goes to ICE, not to El Paso.
Documented cases where Flock Safety cameras intersected with federal immigration enforcement against U.S. citizens.
Marimar Martinez, a 30-year-old Chicago teacher and U.S. citizen, was shot five times by a Customs and Border Protection agent in October 2025. Federal charges against her were later dismissed after the government's case fell apart.
When Martinez's attorneys sought to release evidence from the case, federal prosecutors specifically sought to block the release of Flock Safety camera footage — described in court documents as cameras that "log details including license plate, make, model and other information about cars into a database accessible to law enforcement agencies, prosecutors and private companies."
A federal judge ruled against the government and ordered the evidence released. Flock cameras had been tracking Martinez's vehicle. That footage became evidence in a federal shooting case involving a U.S. citizen — and the government tried to suppress it.
404 Media documented that ICE agents asked state and local police to run searches through Flock cameras on their behalf — giving federal immigration enforcement "side-door access" to a tool they had no formal contract for. More than 4,000 lookups were conducted for immigration purposes, logged with reasons including "ICE," "immigration," and "deportee."
This is the mechanism. ICE doesn't need to contract directly with Flock. They ask a local officer to run the search. The local officer's name goes on the log. ICE gets the data. El Paso is part of this network.
Alvin ISD in Texas — a district south of Houston — had its Flock cameras searched 733,000 times in a single month. Thirty law enforcement agencies from other states, including Florida, Georgia, Indiana, and Tennessee, searched those school cameras for immigration purposes. Civil immigration searches outnumbered criminal immigration searches two to one.
Cameras at a school in Texas were being used by law enforcement in Tennessee to search for undocumented immigrants. El Paso has schools. El Paso is in Texas. El Paso is on the border.
El Paso city officials have cited Flock's assurances in council testimony. Here is how those assurances compare to the documented record.
| The claim | What the record shows | Status |
|---|---|---|
| "Data will not be shared with federal agencies" | ICE gained side-door access through local officers in multiple cities without formal contracts. In other cities, Flock enabled federal access for months without local police knowledge. El Paso PD cannot independently verify access — the audit log goes to ICE, not to EPPD. | ⚠ Disputed by record |
| "Cameras only capture the back of vehicles and license plates" | Flock's own patent describes classifying pedestrians, bicyclists, and animals. It describes face recognition query capability. It describes classifying people by race, gender, height, weight, and clothing. Independent forensic analysis confirmed YOLO object detection running on the hardware. | ⚠ Contradicted by patent |
| "We do not use facial recognition" | US Patent 11416545B1 explicitly describes the capability to "identify the face… query for any footage having a person with matching face recognition data points." Flock avoids the term in marketing — the functionality is patented. | ⚠ Contradicted by patent |
| "We have 30-day data retention" | 30-day retention is a dashboard setting — not a contractual guarantee written into the agreement by ordinance. Settings can be changed by the vendor. The contract and the dashboard setting are two different things. | ⚠ Not contractually guaranteed |
| "Multi-factor authentication protects the system" | Flock did not require MFA system-wide until November 2024. EPPD states MFA is in use. Independent verification of El Paso's specific configuration has not been made public. Officer credentials have been found for sale on dark web markets. | ⏳ Unverified independently |
| "Customer data is never sold" | The clause "Flock does not own and shall not sell Customer Data" was deleted in the February 2026 Terms rewrite. Any renewal would be signed under terms that no longer contain this protection. | ⚠ Protection removed from contract |
We are calling for the contract to be canceled and not renewed. We oppose this vendor and any similar private, venture-backed surveillance company that profits from the data of El Paso residents. If the city insists on renewing despite public opposition, these are the minimum conditions we demand — and we will be watching.
Every claim on this page is independently verifiable. See our full resources page for annotated descriptions of each source.
US Patent 11416545B1 — Flock's object detection and facial recognition capability
patents.google.com →El Paso Matters — March 3 council vote, contract details, Rep. Limón quotes
elpasomatters.org →El Paso PD Flock Transparency Portal — data sharing, usage statistics
transparency.flocksafety.com →Capitol News Illinois — Marimar Martinez case, Flock footage suppression attempt
capitolnewsillinois.com →404 Media — ICE side-door access, 4,000+ immigration lookups through Flock
404media.co →DeflockYourCity — sourced research, legal analysis, council briefing templates
github.com/DeflockYourCity →