Through an audit, Secretary Alexi Giannoulias’ office found that Flock Safety, a company that partners with more than 5,000 law enforcement agencies nationwide, allowed U.S. Customs and Border Protection (CBP) to access Illinois license plate cameras on Illinois roads and run surveillance on drivers.
“The reality is that we are dealing with powerful surveillance technology and it has been abused, which is extremely troubling, especially as it violates the law,” said Giannoulias in a video statement.
Watch that statement, as well as Flock Safety's response in the video below.
The discovery came after Giannoulias’ office launched a sample audit in June, reviewing data from a dozen local law enforcement agencies. The audit found that Flock did not have the proper safeguards in place for data sharing, a flaw compounded by the fact that the company was running a pilot program with CBP.
The violation breaks a state law passed two years ago, which created strict rules for automatic license plate reader (ALPR) use, Giannoulias said in the statement.
The law explicitly prohibits any company from sharing data for purposes such as investigating a person's immigration status or interfering with their reproductive health care. The law gives the Secretary of State's Office the power to enforce these rules by defining a private company like Flock as a legally accountable “ALPR user,” subject to the same rules as law enforcement once it begins sharing data.
“I take my responsibility as Secretary of State seriously,” said Giannoulias. “It’s why we spearheaded this legislation, which now gives us the tools needed to hold Flock accountable for its actions.”
According to the news release, Flock was ordered to shut off data access, and has since paused its pilot with CBP and other federal agencies, not only in Illinois, but nationwide.
In an interview with Government Technology, Joshua Thomas, Flock Safety's chief communications officer, said the state's accusation came as a “surprise” for the company, who had been working with the Secretary of State's Office since June to ensure agencies using Flock were complying with the law, but was not aware of any formal audit investigation.
“We're doing everything we can to help our customers stay in compliance with these local laws, because at the end of the day, our customers own the data, not Flock,” he said. “They decide with whom they want to share, not Flock. It is not Flock’s job to police the police. It is not our job as a private company to be the regulators of this industry. This is why we rely on our elected officials.”
Thomas pointed to Flock's internal audit tools that allow agencies to hold their employees accountable to local laws and values.
“There's a lot of times where law enforcement agencies are working to collaborate with other law enforcement agencies,” said Thomas. “These are all legal entities who want to work together to stop crime. I don't think any of them are questioning each other's missions, so I think, candidly, probably what occurred is people were just accepting these or they might have had a setting that just said, ‘I will accept anything from any law enforcement agency.’ So what we want to make sure is that the administrators understand that they have the opportunity to deselect, to refine their sharing options at any moment.”
In a statement published Aug. 25, Flock Safety confirmed its federal pilots were “paused.”
CEO Garrett Langley wrote in the blog post that the company had “engaged in limited pilots with the U.S. Customs and Border Protection (CBP) and Homeland Security Investigations (HSI), to assist those agencies in combatting human trafficking and fentanyl distribution,” elaborating that Flock will now provide distinct permissions and protocols to ensure compliance for departments working with federal agencies.
Langley announced several changes that will be led by Flock’s new chief legal officer, Dan Haley, in a companywide effort to ensure users are able to stay in compliance with local laws, regulations and community norms.
Flock’s promised fixes include a “robust investment” in training to support agencies on how to remain in compliance with local laws. Langley wrote that “moving forward, federal users will not be added to statewide or nationwide lookup” and that any sharing request, audit or display of these agencies will clearly delineate that an organization is federal.
The CEO ended his post by pointing to the positive impact the technology has had across the country, from “recovering missing children to solving homicides.”
