What happened
Two bills introduced in Congress in the space of three days show how quickly automated license plate recognition has moved from a local procurement question into national politics. On Wednesday, Senator Josh Hawley introduced the Stop Flock Abuse Act, which would strengthen safeguards for AI-enabled cameras and, in his words, protect people's constitutional rights.
On Friday, Senators Bernie Sanders and Jeff Merkley, with Representative Alexandria Ocasio-Cortez, introduced a broader bill. It would block the federal government from using license plate readers, prevent states that deploy them from receiving federal funding, and let Americans sue the federal government if their rights are violated by a deployment. The proposals would apply to all license plate reader companies, not only Flock Safety, including Motorola and Axon.
The political energy behind the bills is not coming from one party. Grassroots campaigns in both red and blue states have highlighted cases of officers using the cameras to track people they knew, and of innocent drivers stopped because their plate or car model matched a suspect's. At a hearing last week, a Florida woman described being jailed for 13 days, including more than three days in solitary confinement, after an AI-powered camera misread her vehicle.
Questions about how these networks are built have added to the pressure. In late September a security researcher published a map showing roughly 300,000 connected devices and more than 170,000 cameras, while the company has consistently said it operates about 120,000. The same researcher has said he found an access token exposed on the company's website that allowed queries without logging in. A Washington Post report also described a Florida county discovering 14 cameras it had not permitted. The bills' path is uncertain, with congressional leaders unlikely to prioritise votes in the lame-duck session, but the issue looks set to return.
Why this is a GRC story
Vendor assurances are not evidence. When a supplier's public camera count differs from an independent researcher's map, the gap is a due diligence problem. Buyers should be able to reconcile what they were told with what is actually deployed and permitted in their jurisdiction.
Access control is the whole control. A plate network is only as safe as the query log behind it. If officers can search for personal contacts without triggering review, the abuse is a logging and monitoring failure before it is a technology failure.
Exposure outside the dashboard matters too. A token that permits queries without a login is a governance failure of the ordinary kind, the sort a basic external attack surface review is meant to catch. It is also a reminder that a supplier's security posture is part of your own risk picture once you connect.
What to watch
Watch whether federal funding conditions change procurement behaviour before any bill passes. Councils and police departments that review their contracts now will be better placed than those that wait for a vote.
The practical move for any public body running these cameras is to produce two lists: every camera it authorised, and every camera actually reporting to the vendor. The distance between those two lists is the finding, and it is usually quicker to produce than people expect.
Attribution: Analysis based on The Record's reporting and related public reporting. This article is original commentary, not a repost of the source material.