What Happened Inside Brunswick County’s Flock System Before the Public Was Told?

This is a story told in dates. Each one comes from a document — a contract, a state report, a personnel record, or the Sheriff’s own system logs. Put in order, they raise a simple question of transparency: when a surveillance system runs for years with no written policy in the records, and 145 Audit Assistance review items are archived on a single day, how is the public supposed to know what happened?

Years of cameras. No earlier policy located in the records.

Brunswick County Sheriff’s Office’s presence in the Flock system can be traced to February 7, 2023 — the start of the agency’s data range on the public Have I Been Flocked dataset, matched to the day by a role identifier in the Sheriff’s own event log. That establishes presence in the system, not necessarily that cameras were collecting data that day. The paid contract we have a copy of for eight cameras did not take effect until January 18, 2024 — roughly eleven months later — so the gap is unexplained. For most of that first year, the governing agreement is not something we can identify in the record at all.

More striking: when the North Carolina SBI reported to the Legislature on the ALPR pilot in April 2026, it attached the written ALPR policies of the participating agencies. Sixteen agencies’ policies are in that appendix. Brunswick County’s is not. Omission from the appendix is not itself proof that no policy existed — one could have gone unsubmitted, been filed elsewhere, or fallen outside the pilot’s scope — but, together with E-07 naming no predecessor, it leaves the question for BCSO to resolve by producing any earlier policy.

📄 Read the NC SBI ALPR Pilot Program Report to the Legislature (Apr 7, 2026) — see the participating-agency list and the policy appendix; Brunswick County’s policy is absent. (Internet Archive)

What state law requires.

North Carolina’s ALPR statute is explicit: an agency must adopt a written policy governing use before the system is operational, and that policy must address supervisory oversight and annual (or more frequent) auditing and reporting (N.C. Gen. Stat. § 20-183.31(a)). The law puts the policy first — before the searching, not after it. The statute requires those audits and reports to go to the head of the agency operating the system; it does not itself require them to be made public. The open question is whether BCSO performed the required reviews, what they found, and what records can lawfully be disclosed. (N.C. Gen. Stat. § 20-183.31)

The vendor’s audit tool switches on — and flags appear.

The most serious finding concerns these 145 searches that Flock’s own audit system marked “Needs Review.” A flag generally means a search looked like it might not meet the rules. Flock describes Audit Assistance as a tool that surfaces atypical search patterns for administrators to review, and the system requires a case number and offense type for every search (Flock Safety; TechCrunch, Aug. 2026). A copy of the tool’s output released by another agency — the Dunwoody, Georgia Police Department, through a public-records request — shows the categories it flags, among them “Single-User Plate Searches,” “Searches Beyond 30 Day Timeframe,” and “Repeated Narrow Timeframes”: the pattern of one user repeatedly searching, or tracking, a single plate. Flock’s own interface cautions that these items are “for administrators’ informational purposes and do not reflect any findings or conclusions by Flock or your agency.” Flock told TechCrunch the same — it is a rules-based “data tool,” not AI, and “a flag does not mean that it is definitely abuse — it only means it warrants further investigation” (TechCrunch, Aug. 13, 2026). Each flag is supposed to be checked by a supervisor, who decides whether the search was proper. That supervisory review is exactly the oversight state law requires the policy to provide (N.C. Gen. Stat. § 20-183.31(a)).

Yet the records show this audit function was off for almost the entire period they cover. The event log runs from January 1 through August 31, 2026, and within it Flock’s “Audit Assistance” is switched from Disabled to Enabled only once — on August 18, 2026. Flock had made the tool available months earlier: it launched Audit Assistance in April 2026 (announced April 14) and offered it to every agency at no cost, with more than a third of agencies adopting it voluntarily (Flock Safety; TechCrunch, Aug. 13, 2026). Brunswick County left it switched off until August 18, nearly four months later. So, at least as far as the system is concerned, no automated audits were being run until August 18. Once on, the tool flagged 145 “Needs Review” items in thirteen days, across 17 different Sheriff’s Office employees (one account alone drew 65).

Then, on August 31, 2026 — the day before BCSO’s “Automated License Plate Readers” policy (E-07) took effect — every one of the 145 flags was marked “Archived” between 9:55 a.m. and 4:10 p.m. That is one flag closed, on average, every 2.6 minutes, for searches run by 17 different employees. What “Archived” means — each one individually reviewed and resolved, or simply closed in bulk — is not established by the records, which record no reviewer name, no written justification, and no “approved” or “resolved” outcome for any of the 145 — only the status change to “Archived.” The records also show only when each flag was closed — all on August 31 — not when it was raised. The flag-creation dates exist in Flock’s system; they have not been produced. Nor has BCSO produced its Audit Assistance report itself: when another agency released that report, each flagged item carried the type of anomaly, the number of searches involved, the date of the latest activity, and space for reviewer notes — none of which appear in the records Brunswick County produced.

We identify the operators below only by initials. Their full names were released by Sheriff Chism’s office in the publicly produced Flock event log; we have chosen not to republish them here. A review flag means “worth a look,” not wrongdoing — a high count can reflect legitimate, active casework. We draw no conclusion about any operator; we simply report what the County’s records and a public dataset show.

Independently, Have I Been Flocked — a public, open-source project that analyzes agencies’ ALPR audit and transparency data to surface unusual search patterns — catalogued the same agency’s activity (83,346 searches by 96 operators) and flagged a set of repeat-search patterns. Three of the operators it flagged — G.J., J.D., and C.S. — also appear in Brunswick County’s own Audit Assistance review list, with 65, 8, and 2 review items respectively. BCSO’s own event log and an outside project’s analysis of ALPR data name an overlapping set of accounts (the two analyses may draw in part on related underlying data).

Importantly, these 145 review items cannot be identified, from the records reviewed, as the “routine audit” the Sheriff said flagged the employee. Local reporting (Port City Daily, Sept. 1) stated the matter had been referred to the SBI in early August — weeks before the August 31 archiving — though we have not independently verified that referral date. The relationship, if any, between the 145 items and the employee investigation is unclear.

There is more that does not line up. At the Board of Commissioners’ meeting on September 21, 2026, it was stated that the misuse was caught by an audit and dealt with the next day — yet Lt. Daniel Little, the only employee who is publicly known to have left the agency in that timeframe, does not appear anywhere among the 17 flagged accounts. And the 145 “Needs Review” items that flagged those 17 employees were not resolved one at a time over the days that followed; all 145 were cleared on August 31 with the same “Archived” switch.

That raises questions the records cannot answer on their own: Were these 145 items given a genuine, individual review — or simply closed in bulk? Who reviewed them? And was the single separated employee really the only person who may have used Flock improperly, when Audit Assistance had just flagged 17?

Independent experts have raised exactly this concern about Audit Assistance. The ACLU’s Chad Marlow has written that without knowing how many officers are misusing the system, “we cannot conclude if Flock and its auditing tools are catching 95% of violators or 5%,” and that until the tool is independently evaluated “we don’t know if [it] is a real security measure or just window dressing.” The Electronic Frontier Foundation’s Cooper Quintin put the oversight problem plainly: if “whoever [the tool] reports to is the same police agency that is doing the abuse, it’s just a fig leaf” (TechCrunch, Aug. 13, 2026). In Brunswick County, the tool reported to the Sheriff’s Office — and the Sheriff’s Office closed all 145 flags itself.

An exit, an SBI referral, and no public detail.

On September 1, 2026, the Sheriff announced in a video statement that an employee had “resigned” amid an SBI investigation into Flock misuse — flagged, he said, by a “routine audit.” The Sheriff publicly described the employee as having resigned and did not name them. The Investigative Watchdog account first identified the officer as Lt. Daniel Little; the county roster corroborates his rank and tenure, and the Sheriff’s own event log shows his Flock account was deleted on August 18. His separation has been reported as a retirement effective September 1 — with a salary and a leave/longevity payout. The event log records the deletion but does not state the reason, or whether the account’s search history was preserved.

The public was given a conclusion — one employee, handled — without the record behind it. A week later, on September 8, a sitting commissioner said on the record that she believed the misuse might involve more than one employee.

🔗 WECT: “Brunswick Co. Sheriff’s Office employee resigns amid investigation into Flock system misuse” (Sep 1, 2026) (wect.com)

The full sequence, in order.

Each entry is drawn from a primary source, named beneath it.

How two other NC agencies handled it.

Two other North Carolina agencies faced similar allegations in 2026. Here is what each disclosed.

These jurisdictions differed in the facts known, charges filed, camera ownership, and personnel-law constraints at the time each spoke. This compares what each agency chose to make public — not the merits of the underlying cases.

🔗 WRAL: “Franklin County detective fired for misuse of Flock Camera system” (Sep 25, 2026) (wral.com)

🔗 See the Mooresville case, with coverage, on our NC Flock Misuse Tracker (deflockilm.org)

The policy, dated the day of the announcement.

General Order E-07, BCSO’s written ALPR policy, carries a revision date of September 1, 2026 — the same day the Sheriff announced the investigation and the public portal launched — and names no prior policy it amends or rescinds. (The “Twenty-one days” box above lays out the full sequence of August changes.)

We have found no evidence, in the records reviewed for this report, of a BCSO plate-reader policy predating September 1, 2026: the SBI’s April report does not include a Brunswick policy among the participating-agency policies, and E-07 identifies no policy it amends or rescinds. That is not proof none existed. If an earlier policy did exist, Brunswick County can resolve the question by producing it.

Separately, Brunswick County’s Flock configuration grants live-video permissions to more than a hundred agencies outside North Carolina — even though the Sheriff’s Office says it does not use Flock’s live-video cameras. We examine that finding in a companion report: Brunswick County’s Flock network shares live-video access with agencies in more than 20 states.

Flock told agencies to be transparent. Brunswick County wasn’t.

In August 2026, a leaked Flock coaching guide — “How to Speak to City Councils About Public Safety Technology,” reported by 404 Media — urged agencies to get ahead of scrutiny: brief officials early, “share policies proactively,” and “demonstrate oversight rather than simply promising it.” Its chapter on accountability tells agencies to “show safeguards rather than simply describe them,” and says the ability to “demonstrate who searched what, when they searched it, and why they searched it allows agencies to answer those questions with facts rather than assurances.” The guide even holds up as a model an agency that found an audit configuration problem and “initiated a full review … and shared its findings directly with elected officials,” rather than waiting for the issue to surface publicly.

Brunswick County did close to the opposite. Its written ALPR policy bears the very date it announced the matter; it switched the audit tool on only the day the account at the center of the matter was deleted; and it has not produced the records that would show who reviewed the 145 flags, when, or why — the same “who searched what, when, and why” Flock says an accountable agency should be able to demonstrate. DeFlockILM’s public-records requests — including a request for the unredacted network audit and a request for the Sheriff’s Office’s written ALPR policy, filed before BCSO issued E-07 on September 1 — remain unanswered.

Questions the Commissioners could ask.

Nothing here accuses any individual of a crime. These are the questions the records leave open — the ones the Brunswick County Commissioners are well placed to put to the Sheriff’s Office:

An invitation to correct the record.

This report is built entirely on public records and public datasets, each cited below. If Brunswick County, the Sheriff’s Office, or its counsel believes any fact stated here is inaccurate or incomplete, we invite them to tell us — we will correct the record promptly and publish their response in full. The questions raised here — among them the August 31 archiving of the 145 review items, the absence of a written policy before September 2026, and the out-of-state video sharing — remain open, and we welcome answers. Reporters and readers who want to authenticate the underlying records can download the full source set, with integrity hashes, at the Internet Archive.

Acknowledgment.

The Investigative Watchdog account first surfaced the identification of Lt. Daniel Little and several of the lines of inquiry this report develops. We independently verified each factual claim here against the underlying public records before publishing.