City closes WPD transparency gaps but fundamentally unfixable issues remain
Policy cannot fix the problems with Flock Safety
We want to applaud Roscoe Stelford and the city manager’s office. They heard from the community that the lack of any usage policies is a huge problem and they moved to close that gap by creating this general order document. They also posted it to the city’s social media channels yesterday, though I’m not sure what they expected the response would be.
When we contacted them last week regarding a suggestion of adding monthly audits to the usage policy, they responded that they are kicking around the idea of cross-jurisdiction audit review, which is a great idea. When we spotted some confusing usage patterns based on openly available records and organization audit log data, they committed to shoring up usage practices that will increase accountability and transparency in how WPD uses the Flock system.
We spoke and they listened, which is what is supposed to happen in a democracy. Even though we’ve never suspected any different of the Woodstock Police Department, we’re are confident that our police officers will continue to work in the best interests of its citizens.
Still, there are fundamental issues with Flock Safety that cannot be solved with policy.
Poor access and security controls
Flock Safety has still not allowed for an independent security audit of their software or hardware. There are huge security issues with the older Flock Falcon vehicle tracking cameras that cannot be resolved in any way short of replacing the hardware. This non-technical explainer by Benn Jordan is an informative and entertaining watch.
The very idea of centrally aggregating nationwide tracking data and trusting it to a private company leaves a security hole big enough to drive a dump truck through. Consider:
You cannot expect that a government that is historically well-known for subterfuge throughout the world, including against its own citizens will now magically behave. So far, they haven’t.
We can’t go two months without getting a new data breach notification, can you? And we’re expecting Flock Safety of all companies, the one that is perpetually holding images, video, metadata and location data, can be securely hardened enough to resist serious and state-sponsored hackers? Xi Jinping may not give a shit about my POS family sedan or where my Tuesday yoga class is, but what about the whereabouts of government officials, whistleblowers, activists, or troop movements? When the national guardsmen out of Woodstock are on the move, what kind of advantage does their location data give our enemies?
Credentials can and have been shared with the wrong people. Stolen credentials are available for sale on the dark web.
Your location data is their product
They claim that they do not sell your data. How can you claim to not sell data and yet offer products and services that do not include and sensor capturing equipment. If you aren’t buying a camera from Flock, exactly what are you getting?
Flock Safety’s AI cameras fail 71% of the time
In one California town, Flock misread license plates in 71% of the alerts it sent to police:
Flock sent 1,427 alerts to Roseville police, flagging vehicles as stolen or used in a felony after they passed one of the city's Flock cameras. An analysis by the police department found that in 71% of those alerts, Flock's machine-learning software incorrectly read the license plates.
Besides just being an objectively unreliable and awful product that fails at its task 71% of the time, these errors have the very real effect of causing innocent citizens to be harassed, pulled over, arrested and jailed in error:
Family of Black girls handcuffed by Colorado police, held at gunpoint reach $1.9 million settlement
How a Bad AI Camera Hit Put the Wrong Man in a San Diego Jail Cell
My god, the stalking
When tens of thousands of people have access to a trove of nationwide tracking data, you cannot expect everyone to behave.
While we trust the officers of the WPD, we do not trust all of the officers and users of the 466 other jurisdictions/Flock customers in Illinois that WPD shares data with. Four police officers have been fired or charged with felonies for stalking and misconduct including:
Tyler C. Bryan, Winnebago County Sheriff/Cherry Valley PD
Flock and their supporters like to call these people “rogue actors” as if it’s some rare occurrence or only happens in big cities or far off lands. That is not the case. Abusers have been charged all over the country as well as right here in our own backyard:
Flock Safety’s sales people like to get in on the action too. Here’s a story about them using live children’s gymnastics room feed as a sales pitch demo:
Flock Safety Employees Watched Kids’ Gymnastics Room to Pitch Surveillance Tech
Our fourth amendment rights are fundamentally violated by the government having access to people’s historical location data without a warrant
Flock proponents says you have no right to privacy in public. This may be true, but explain how being in public should open you up to having 30 days of your location history tracked and searchable by any police officer in the state of Illinois.
Under Surveillance: Constitutional Concerns Surrounding Flock Cameras
Flock Safety are still fucking liars
In 2025, the ACLU reported on Flock Safety sales teams were falsely claiming to have worked with them on privacy policy. You may recognize the person in the video making the claim was none other than Flock Safety regional sales rep Dan Murdock, who is also in charge of Woodstock Police Department’s account. We’ll hear from him again later.
In 2025 the ACLU reported that Flock Safety was lying when they said they do not work with ICE. Later, Flock Safety was forced to cop to the fact that they indeed were lying:
Last year, reports revealed that, even in the absence of federal contracts, cooperating police officers and departments were regularly sharing Flock ALPR data and search results with immigration agencies like U.S. Immigration and Customs Enforcement (ICE) and CBP. The company responded to the reports with a disingenuous blog entitled “Does Flock Share Data With ICE? No. Flock Does Not Work With ICE.” In its blog, the company pushed back by asserting that “ICE does not have direct access to Flock cameras, systems, or data” and that license data is “owned and controlled by the customer.”
Flock knew that, despite not being a customer, ICE had indirect access to Flock’s data and system through the company’s state and local law enforcement customers. The issue was never about having direct access to Flock’s data, it was about having any access to the data. But rather than address these data security and control issues on their merits, Flock released a misleading blog which reads as an attempt to confuse the public and create a false sense of security among its potential government customers. Ultimately, Flock was forced to accept that its denials were simply not credible. The CEO admitted Flock was used for immigration enforcement but argued that such matters were not Flock’s problem.
In the city council video stream from the February 3rd city council meeting at the timestamp 2:56:13, Dan Murdock makes the false claim that all data is scrubbed after 30 days.
The truth is that while “customer data” becomes inaccessible to the customer after 30 days, the underlying raw data belongs to Flock Safety, forever. From the contract:
1.3 “Customer Data” means the images, audio and/or video segments made available to Customer through the Web Interface in connection with the Flock Services, together with the metadata associated with that Customer’s use of the Flock Services (e.g., license plate number, timestamp of capture, and geospatial coordinates). For clarity, Customer Data does not include the underlying raw Footage captured by the Flock Hardware or any Flock IP (as defined in Section 1.9).
4.4 Data Distribution. Customer may, upon request, choose to integrate Flock Services with a third party to either distribute Integration Data or Customer Data (such third party, “Recipient”). Only upon such request (in writing from the Chief of Police), Customer hereby grants to Flock a non-exclusive, non-transferable, royalty-free, perpetual license to access, share, view, record, duplicate, store, save, reproduce, modify, display, and distribute Customer Data and/or Integration Data, as required by the requested distribution. Customer acknowledges that such data may be viewed, recorded, duplicated, stored, saved, reproduced, modified, displayed, distributed, and retained by Recipient for a period longer than Flock’s standard retention period and hereby provides consent to such retention period. Unless authorized in writing by Customer, Flock shall not share, use, duplicate, disseminate, reproduce or in any way distribute Customer Data or the underlying raw Footage captured by the Flock hardware or any Flock IP (as defined in Section 1.9). Any unauthorized use, distribution or dissemination of Customer Data or underlying raw footage captured by the Flock hardware or any Flock IP shall be a breach of this Agreement
On the same city council stream at 2:53:24 Dan Murdock tells city council that you can only search “clothing and things like that, not physical descriptions of people”.
This Flock Safety patent for a “System and method for object based query of video content captured by a dynamic surveillance network” describes their capabilities differently:
For example, if the object class of the identified object is that of a human being, then the object detection module 154 may further analyze the image 501 using a neural network module 507B configured to identify different classes of people (male, female, race, etc.). Subsequently, with aspects of the person identified, the object detection module 154 may leverage other, more detailed neural networks 507, 509 to further identify aspects of the person such as, but not limited to, a neural network 509D for identifying clothing types (jacket, pants, shorts, hat, etc.) and a neural network 509ZZ for gauging height and weight.
Can we give the Woodstock Police Department the tools to keep us safe while avoiding all of these issues?
Yes! If the city disables the Flock Safety cameras and finds a closed-circuit option with a reputable vendor where data is stored locally and only accessible to WPD.
We want them to have the tools to protect us, but these are not the right tools.
We tell the mayor and city council that we don’t want Flock Safety in our town (again) on Tuesday, August 18th. You should join us. Read more about it in this Northwest Herald article published on Friday.