Watched Without a Vote

Start with an ordinary morning. You leave your driveway, and a plate reader on the corner logs your car, its color, its direction, the time. You pass a second and a third; each one adds a point to a line that traces where you have been. A camera on a pole captures your face as you stop for coffee. If an alert fires on a car like yours, a drone can be dispatched to your location. Your phone leaves its own trail, and there is software that maps it. Somewhere downtown, those feeds — plates, faces, video, phone data — can be pulled onto a single screen in a room called a real-time crime center.

None of that is science fiction, and almost none of it required a public vote. Each piece arrived on its own: a grant here, a renewal there, a line item in a budget most residents never read. Taken one at a time, each looks like a tool. Taken together, they are something else — the working parts of a system that can reconstruct where an ordinary person went, and when — often with no case-specific warrant for the initial capture, and little routine oversight from anyone outside the agency that runs it. This is how a surveillance infrastructure gets built in a democracy: not by decision, but by accumulation.

We spend our days documenting these systems in North Carolina, agency by agency and record by record. Here is what the pieces are, and what they add up to.

1. Where you drive

The foundation is the automated license plate reader, or ALPR. The dominant vendor, Flock Safety, has cameras in hundreds of North Carolina jurisdictions, connected through a platform that lets participating agencies share and search one another’s data across jurisdictions. The scale is not theoretical. In New Hanover County, the Sheriff’s Office network generated a search audit of 2,980,082 records; App State’s campus cameras were searched 1.5 million times in three months by 3,487 agencies, 84% of them from outside North Carolina; UNC Charlotte’s were searched more than a million times a month. Roughly nine in ten of the logged searches, in the audit records we’ve obtained, came from out-of-state agencies — Texas, California, agencies most residents have never heard of — because every Flock camera is a node on one shared grid.

The reads are supposed to be for law enforcement, but the audits show the softer uses creep in: in Pender County, 13.7% of the Sheriff’s own searches were coded “Traffic Infraction,” a purpose North Carolina law expressly forbids. And the system is only as trustworthy as the people using it — a point the state made concrete when the SBI criminally charged a Charlotte-Mecklenburg officer for misusing Flock. Plate readers are the layer that maps your movements. Everything else is built on top of them.

And the plate reader is only the foundation the vendor is building on. Flock now markets Nova, a platform that pulls plate hits together with police records, jail data, public records, and open-source intelligence to build a profile of a person and map their associates; it is also testing an AI tool, OS Investigate (formerly “Nightshift”), whose code WIRED obtained — it can begin a search with nothing but a location and a time window, no plate at all, and reach Social Security numbers, dates of birth, and lists of relatives. To be clear: New Hanover’s Flock contract does not list Nova or OS Investigate, and we have no record the county runs either. The point is the trajectory. The company that sold this county its plate readers is moving quickly from reading plates to profiling people — and today’s contract is not tomorrow’s product.

2. Who you are

The next layer identifies the person, not just the car. When New Hanover County leaders asked their Sheriff about facial recognition, he answered that the Flock cameras don’t use it — which is true. But facial recognition was never a plate-reader feature; it is separate, downstream software. And the county’s own records show the Sheriff’s Office bought it: Clearview AI, on a purchase order the county itself titled “NHCSO Facial Recognition Software,” held since 2023. Down the road, Carolina Beach holds an active Clearview license, and Fayetteville police records show 3,013 Clearview facial-recognition searches already run. The Sheriff told the truth — but not the whole truth.

Why does a plate network and a face database matter together? Because the images can move between them. In December 2025, a security researcher demonstrated, in reporting by 404 Media, how imagery from Flock’s system could be exported and run through facial recognition. Once an agency owns cameras that capture faces and the software that identifies them, the wall between “we read plates” and “we identify people” is a policy choice, not a technical limit.

Here we are careful, because precision is the point. We have no evidence that New Hanover’s Flock system is wired to Clearview through an automated feed, and none that any specific image has been run through it. What the records establish is not just possession but capability: one office holds both the cameras that capture faces and the software that identifies them, and moving an image from one to the other — by a deputy’s manual export or a software integration — is a matter of policy, not technical impossibility. Make it concrete. The Sheriff’s Condor cameras already create a live video feed of children playing soccer at Veterans Park in New Hanover County. A still of any face in that crowd — a child on the field — is exactly the kind of image Clearview is built to match against its billions of scraped photos and attach a name to. In other words, the child on that soccer field can be identified by software this office already owns. Nothing but the office’s own policy stands between the camera that films her and the tool that could name her. Whether that has ever been done is what the usage logs would show — and those logs are exactly what our pending records request seeks.

3. The eye overhead

Then there is the drone. Departments across the state are standing up Drone-as-First-Responder (DFR) programs, in which an aircraft is dispatched rapidly toward an incident — and, increasingly, in response to an automated alert, typically with a dispatcher or operator authorizing the flight. The federal record shows how far this has spread: an FAA roster of DFR and beyond-visual-line-of-sight approvals lists nine North Carolina agencies, including the New Hanover County Sheriff’s Office. Charlotte approved roughly $16 million over eight years for an Axon package that bundles in-car cameras, DFR drones, cloud storage, and a fusion platform. And in Burlington, the SBI’s own report describes police launching a drone to the location of a Flock alert — the plate-reader-to-aircraft loop, running in the field, operated out of a unit the city’s website never mentions.

To be precise about what that means: in a DFR program, an automated alert can be the trigger that puts an aircraft over you — typically still with a dispatcher or operator in the loop, not a fully autonomous launch. The concern is not that a robot flies itself; it is that the path from a plate-reader hit to an airborne camera now exists, and how much human judgment sits in the middle is set by policy, not by law — which is exactly what the SOPs and launch logs would show. We have filed public-records requests on these programs at sheriffs’ offices and police departments across the state, each with a legal demand to preserve the flight logs before they are automatically deleted, because this is the layer being built fastest and documented least.

4. One screen

The layer that turns a pile of tools into a surveillance system is the real-time crime center — usually built on a platform called Fusus (now Axon Fusus). Its job is to fuse feeds: plate readers, fixed cameras, private cameras enrolled through a registry, gunshot-detection sensors, and drone video, all onto one live dashboard. The New Hanover County Sheriff’s Office runs a Fusus network of roughly 2,147 cameras behind a real-time crime center. The City of Wilmington runs its own, the “STING” Center, pulling public and private feeds together. A fusion center is what lets an operator move from a plate to a face to a live camera to a drone in a few clicks — the difference between owning surveillance tools and running surveillance as a system.

Here we mark the line between what the records prove and what they don’t. The records establish that the Sheriff’s Office owns and operates these systems, and that the fusion platform is built to combine their feeds — that is capability, and it is documented. What the records do not yet show is how routinely an operator actually chains them together in a single investigation: the workflow, the SOPs, the query logs. That is not a hole in the argument; it is the next thing to obtain, and it is precisely what our pending records requests seek. Ownership and integration-by-design are on paper today. The usage logs would turn “can” into “does.”

5. Your car, your face, your phone

And it reaches past cameras. The same New Hanover records show the Sheriff’s Office also runs Pen-Link, software for analyzing phone records and real-time geolocation, paid for since 2021; and ShadowDragon, for social-media surveillance. Plate readers track your car; Pen-Link tracks your phone; Clearview identifies your face; ShadowDragon maps your online life. Four different kinds of tracking, one Sheriff’s Office — and, as with the rest, none of it put to a public vote before it was bought.

6. It doesn’t stop at the county line

North Carolina’s data does not stay in North Carolina. Because Flock’s network is national, the roughly 90% of searches that come from out of state reach into our residents’ movements from anywhere. And the sharing runs to the federal government by design: New Hanover County’s Sheriff has confirmed his office shares with six federal agencies, and agencies statewide have data-sharing arrangements touching ICE, CBP, the SBI, and the FBI. And the federal reach does not stop at police-to-police sharing: federal agencies including ICE have separately bought access to commercially aggregated location data from private data brokers — reported by 404 Media and the Electronic Frontier Foundation — a way to obtain movement information without a warrant and without any local agency’s cooperation at all. The protections North Carolina writes for its own residents do not follow a plate across a state line, or through a federal database.

There is a further channel, and here we separate what is documented in general from what is not yet documented locally. The country runs on a network of fusion centers — state-owned intelligence hubs designed to move locally generated information up to the federal government. This is not a theory: federal law (6 U.S.C. § 124h) directs the Department of Homeland Security to review and incorporate information gathered by state and regional fusion centers; DHS describes the network as a two-way hub between local agencies and Washington; and the Government Accountability Office has found DHS intelligence officers embedded inside the centers, wired to federal systems like the Homeland Security Information Network. North Carolina’s hub is the SBI-run North Carolina Information Sharing and Analysis Center (NCISAAC), one of roughly eighty DHS-recognized fusion centers. The pipeline from local police data to DHS is, in other words, built, funded, staffed, and authorized by statute — as a matter of national design.

What we cannot yet show with documents is the specific local link: whether New Hanover’s Fusus real-time crime center feeds NCISAAC, and what of its camera, plate, and analytic data flows onward from there. The architecture makes that flow possible, and in many places routine; proving it here means obtaining the data-sharing agreements, the Fusus/Axon sharing configuration, and the NCISAAC participation records — which is what our pending requests seek. We flag the channel because it is the line between a county surveillance program and a node in a national one. We do not claim, on the record we have today, that New Hanover’s specific feeds reach Homeland Security. We claim that the public is entitled to know whether they do.

7. Nobody was asked — not locally, and not in Raleigh

Here is the thread that ties the whole build-out together: at no point was the public actually asked. In New Hanover County, no elected body ever held a noticed public hearing and cast a recorded vote to put the Sheriff’s cameras on the roads. The office signed a contract, and the cameras appeared. The same is true of the three beach towns that run their own networks — Carolina Beach, Kure Beach, and Wrightsville Beach. No notice. No public discussion. No opportunity for a resident to stand up and be heard before the surveillance went live. It was procured, not decided — which is why most people learn their town runs plate readers, or their county runs a real-time crime center, only when someone files for the records.

And the pattern repeats one level up, in Raleigh. In July 2026, North Carolina authorized the State Bureau of Investigation to place plate readers on any state-maintained road — a permanent, statewide driver-tracking program, with the SBI stating a goal of “covering all entrances and exits to North Carolina.” But it did not arrive as a standalone public-safety bill with its own committee hearings and a clean up-or-down vote. It was a provision tucked into the roughly $30-billion state budget (WRAL). That routing was not an accident. When the surveillance question was put up on its own, it could not survive the daylight: a 2019 plan to authorize cameras on state roads was killed by a bipartisan coalition of libertarian-leaning Republicans and Democrats, and a 2026 standalone bill to make the program permanent (HB 206) was stripped out in June. So the policy moved through the budget instead — a must-pass bill no member could vote on line by line, and no hearing was devoted to the surveillance question. Legislative leaders defended it only after the budget passed. The skeptics who had fought for years to keep the cameras off state roads, as WRAL put it, “lost that fight.”

So ask the plain question — did the public get notice, a hearing, a chance to be heard? — and the answer is the same at both levels: no. Locally, the decision was administrative and invisible. At the state level it was legislative, but buried in a budget rather than debated on its own. At neither point were the people being tracked — the drivers, the residents — invited to weigh in on whether to be tracked at all. Officials will answer, fairly, that voters elect the commissioners and legislators who made these calls. True — but representative government is not a substitute for the specific, noticed decision these programs never got. The provable claim is narrow and damning enough on its own: no dedicated public hearing and recorded vote preceded the deployment of the county’s camera network, and the statewide expansion was enacted as a budget line rather than a standalone bill debated on its face. The one thing a mass-surveillance program has never had to survive in North Carolina is a clean, standalone, public vote. And it is no accident which hands made those calls: at nearly every link, the people who run North Carolina’s surveillance are the people who authorize it — the same profession requesting, deploying, lobbying for, sponsoring, and funding it, with no one outside the building to say no.

And there is a second failure stacked on the first: the companies building this often aren’t even licensed to. North Carolina’s Chapter 74D security-systems licensing statute — the same law a court used to halt Flock in 2023 — requires the vendors that install and service these camera and analytic systems to hold a state license. This is not a novel theory: the Board’s own records, which we obtained, show it issued Flock a cease-and-desist on January 5, 2022 for “engaging in the alarm services profession in North Carolina without having been properly licensed,” and that when Flock came into compliance it did so by routing its work through a licensed North Carolina intermediary — a path the newer vendors have not shown they took. We have filed complaints documenting that several major ALPR vendors operate here without one. By its own terms, Chapter 74D provides that security-systems work performed without the required license is void and unenforceable. Whether that reasoning voids these particular vendors’ North Carolina contracts is not yet decided — our complaints are pending before the state licensing board, and no court has ruled on them. But the question now sits squarely on the record, where a public body will have to answer it.

The case for the cameras, stated fairly

None of this means the tools do nothing. Law enforcement’s rationale is real and worth stating plainly: in its report to the legislature, the SBI credited plate readers with helping find missing and endangered people — including drivers with dementia who wander — recover stolen vehicles, intercept drug shipments, and, in at least one case, clear an innocent person by confirming an alibi. Sheriffs and police chiefs point to closed cases and rescues, and House leaders defending the statewide expansion argued that anyone driving a public road is already visible to anyone who happens to see them. These are not throwaway arguments, and we do not pretend otherwise. A resident can believe every one of them and still ask the question this piece is about.

8. The real problem: no one is allowed to check

The benefits are real. The unresolved question is whether the scope, the sharing, the retention, and the oversight are anywhere near proportionate to them — and it is on the absence of a check that the whole build-out falls short. Any one of these tools would be less troubling with oversight. The defining feature of the whole build-out is that there is almost none. The audits that might catch misuse are run internally, by the same office that would answer for it — the design flaw we walk through in What If Sheriff Hoover Had Flock Cameras?. And even when an agency does audit itself, the internal fix can stop well short of accountability: Raleigh Police Department’s own audits found 416 active Flock accounts against 700-plus sworn officers — more than half of them dormant, and, in the department’s own words, “several” belonging to people no longer employed there — after which the department quietly purged the accounts, with no discipline and no charges. That gap is baked into the statewide framework, too: North Carolina law requires each agency merely to have an ALPR policy, but leaves the contents — in WRAL’s words — “entirely up to individual agencies to make as strict or as lax as they desire,” with no rules an agency must follow to catch abuse. When WRAL reviewed the 32 agencies in the state’s pilot program, only two — Asheville and Raleigh — had any policy restraining the surveillance of protests or protected groups. The other 30 had none. The public-facing “transparency portals” hide the locations, undercount the cameras, and cannot show who is searching. When one agency — Durham — was asked for its Flock audit logs, it denied the request outright as “exempt,” citing no statute, even as peer agencies across the state produced the very same records.

Notice this is not incidental — it is the last move in the same play: build it, deny it, hide it. New Hanover County produced its plate-reader audit — all 2,980,082 rows — and then redacted the one field that says who searched, blacking out the searching agency in every single row; that lone field is now the subject of a pre-litigation mediation. Durham went further: asked by a citizen for the same class of Flock audit logs, it refused outright — “exempt,” no statute named — a flat denial that more than one North Carolina agency has now given, no reason offered. A system watched only from the inside becomes airtight the moment the records that would let an outsider check are handed over with the key field blacked out — or not handed over at all. The surveillance is built to be seen only by the people running it.

This is not to say there are no rules at all. Under public pressure, New Hanover County cut its Flock retention from 90 days to 30, moved from an annual to a monthly internal audit, and published a transparency portal. Those are real changes, and we have credited them. But every one of them is administrative — adopted by the agency, revocable by the agency, and audited by the agency — which is exactly the problem. A safeguard the watched cannot see and the public cannot enforce is a courtesy, not a check; the next administration can undo it with a memo. The structural flaw is the one we keep returning to: an internal-only audit is only as trustworthy as the person holding the office — a system built for the best official, when the law should be designed for the worst.

Set the capability beside the secrecy and the picture is troubling. The public is told “no facial recognition” while an office holds a facial-recognition contract; the movement data is called protected while nine in ten searches come from strangers out of state; the drone program that launches on an automated alert is run out of a unit that appears on no website. It is not any single tool that should worry a resident. It is the combination — sweeping capability, assembled quietly, checked by no one outside the building.

And the next layers are already arriving

This is not a finished system; it is a growing one, and two more layers are close. The first is in your pocket. In December 2026, North Carolina plans to launch a digital driver’s license in its NC Wallet app — convenient, and built on a standard that can protect privacy, but rolled out without the bright-line safeguard other states wrote in — that showing a digital ID is not consent to search the rest of the phone. We wrote that one up on its own, with a simple rule attached: keep carrying the plastic license.

The second layer is inside the car itself. Under Section 24220 of the 2021 federal Infrastructure Investment and Jobs Act, the National Highway Traffic Safety Administration is directed to require “advanced impaired-driving prevention technology” in all new passenger vehicles — which, as the agency’s own rulemaking contemplates, means inward-facing cameras and sensors that watch the driver, tracking eye movement, head position, and attention. The stated purpose is safety, and the details are unsettled: NHTSA missed its 2024 statutory deadline, has not finalized a standard, has not mandated a camera specifically, and has told Congress the systems are not yet accurate or reliable enough. Camera-based driver monitoring is, however, the leading approach — so the plausible near future is a new car that watches the person behind the wheel, most likely through an inward-facing camera. The boundary matters: the mandate is a federal safety rule, not a law-enforcement program, and the impairment-detection data is designed to be handled inside the vehicle. But privacy advocates warn — and the record gives them reason to — that the wall between “safety sensor” and “police feed” is thinner than it sounds. Connected-car location and telematics data is already reachable by law enforcement through subpoenas and warrants, and automakers are actively designing vehicles to report to police: in a patent application filed in 2023 and published in 2024, Ford described a system for onboard cameras to detect speeding and transmit the images, speed, time, and location to police — a capability the company said was intended for law-enforcement vehicles. A driver-monitoring camera in every new car does not have to be wired to a police server today to become one tomorrow. Whether it ever does turns entirely on rules — what it records, how long it is kept, and who may reach it — that no one has written. A plate reader records that your car passed a corner. A driver-facing camera is aimed at you — and those rules should be settled before it is standard equipment, not after.

None of this is unique to North Carolina

The pattern — infrastructure sold for one purpose, quietly repurposed for surveillance, with oversight arriving only after the public finds out — is documented elsewhere, and it is worth knowing this is not paranoia peculiar to one county. San Diego installed thousands of “smart streetlights” pitched for traffic and energy data; its police used the built-in cameras for investigations until public backlash forced a moratorium and one of the country’s first surveillance-oversight ordinances. The lesson North Carolina should take is that the check has to come before the network is built, not after. Once the cameras are on the poles, the contracts are signed, and the habits are formed, a surveillance system is very hard to unwind — which is why the quiet, piece-by-piece way it is being assembled here is not a detail. It is how the cumulative effect arrives — through decentralized procurement, with or without any single coordinated plan.

What we’re doing about it

We document it, in the open, so that it cannot be built in the dark. In a single day this month we filed public-records requests to sheriffs’ offices and police departments across North Carolina — on their drone programs, their ALPR systems, their facial-recognition contracts, and their fusion centers — each carrying a legal demand to preserve the records before they are purged. Every request, and every response, is posted to our public records hub; the full local surveillance inventory is there too. We have filed licensing complaints against the vendors, a mediation action over the redacted New Hanover audit, and we keep a running record of who is searching North Carolina’s cameras.

The remedy is not complicated, and it starts local. Surveillance systems should be adopted the way other serious government powers are — at a noticed public hearing, with a recorded vote, and with independent oversight of how they are used. In New Hanover County, the body that holds that power takes the Flock program up again on Monday, September 21. The infrastructure is being assembled quietly. The answer is to make the decisions loud — in public, on the record, where they belong.

Sources: New Hanover County and City of Wilmington public-records productions (Flock contract and audit, Clearview and Pen-Link contracts, Fusus/STING records); Appalachian State, UNC Charlotte, and Pender County Flock audit productions; the FAA Drone-as-First-Responder / BVLOS waiver roster obtained by EFF FOIA; the N.C. SBI report on ALPR use and its April 2026 report to the General Assembly; WRAL, “Mass surveillance authorized on NC highways, all other state roads” (July 17, 2026), on the statewide ALPR expansion enacted through the state budget; Durham public-records Request #26-1183; 404 Media / IPVM reporting on Flock image export (Dec. 2025); N.C. Gen. Stat. Chapters 132, 74D, and § 20-183.30 et seq.; and DeFlockILM’s own statewide records requests. Figures are drawn from the underlying documents, all preserved on the Internet Archive and linked from our records hub. This page reports on public records; it does not allege that any specific search was unlawful.