Now You See Accountability. Now You Don’t.

What the new policy gets right

General Order E-07 has now been revised three times in 2026: a February 25 version that required no audit at all, a September 1 version that added a bare 30-day audit the day the Sheriff disclosed the misuse, and this October 16 version, approved by Sheriff Brian Chism, that rebuilds the document from the ground up. On internal governance it is a real step. It names twelve expressly prohibited uses — among them “personal or curiosity searches,” searches about “family members, friends, acquaintances,” “bias searches,” “political or other non-law-enforcement purposes,” using an ALPR alert “as the sole basis for enforcement action,” and, pointedly, “circumventing audit controls” and “altering or deleting audit records.” It requires a search justification, a case number, and verification before any deputy acts on a hit. It sets discipline up to termination and reminds users that misuse is a crime under Article 3D. Read against the February version, it is the policy the county should have had from the start.

And it says, in its own Section X, that the 30-day audit “shall include, as appropriate, user activity, search justification, case-number use, excessive or repeated searches, searches involving employees or acquaintances, … searches outside assigned duties or work hours, large-volume searches, external-network searches, hot-list activity, data sharing,” and more. That is a strong list. Every item on it describes something the Sheriff can see: the activity of his own people. When a Brunswick deputy runs a search that reaches out across the national network, that search is logged to the deputy, and the Sheriff can pull it, read the stated reason, and discipline the deputy if it was improper. For the inside of the house, the policy now works.

The question the policy can’t answer

Here is what it cannot do. Once Brunswick’s eight cameras join Flock’s shared network, agencies all over the country can search them — not by asking Brunswick, but automatically, as part of broad queries that sweep thousands of camera networks at once. The policy’s sharing section (§ VIII) describes a careful, paper-based world:

Captured plate data may be disclosed “only to a criminal justice officer … pursuant to a written request” that “shall identify the requesting agency and official, the legitimate law enforcement purpose, the case or investigation when applicable.”

That is a sound rule for the rare manual request — one agency emails another for a specific record, and a supervisor signs off (§ VIII.B even requires that every such request “be reviewed by the Sheriff or designee”). It is not the world the network actually runs in. Once Brunswick turns sharing on, an outside agency’s search is the request: an electronic query that reaches Brunswick’s cameras automatically, with no one at the Sheriff’s Office reviewing it, approving it, or even seeing it until — maybe — it surfaces later in an audit log. The review step in § VIII governs the door almost no one uses. The self-service network search is the door everyone uses, and for it there is no supervisory review by Brunswick of the outside agency at all. Turning sharing on is the whole decision; after that, the requests review themselves.

We know this because it is already documented, over and over, in the region’s own records. We have obtained the inbound Network Audit — the log of who searched the cameras — from roughly ten law-enforcement agencies across southeastern North Carolina, and they all show the same shape. Whiteville, in Columbus County right next to Brunswick. Carolina Beach and Kure Beach, just up the coast. And Pender County, whose audit is the starkest: in a single three-month window it logged 2,101,548 searches by 3,591 agencies, about 94% of them out of state. Those are not two million written requests to Pender. They are automatic network sweeps. Every one of these agencies runs the same Flock product Brunswick runs, and when Brunswick finally produces its own inbound audit, there is no reason to expect a different shape. The policy’s written-request regime governs a door almost no one uses; the network search is a window that is always open.

Look at what an outside search actually leaves behind

Now take the policy at its word and try to audit those outside searches. The only record of them is the inbound Network Audit, and this is what one looks like — three real rows from Pender’s export, the same format Brunswick will produce:

That is everything the receiving county gets: an agency name, a reason the searcher picks from a drop-down menu — Flock replaced the old free-text box with a list of canned categories — a count of how many networks the one query swept, and — usually — no case number and no identifiable officer. A single search by a Florida sheriff’s office reached 1,281 networks at once; Brunswick would be one of them. So picture Sheriff Chism’s designee sitting down, as the new policy commands, to audit “external” activity on the inbound side. What can he actually do with “Alcohol Offenses (Non-DUI)” — a menu option an officer in Georgetown County, South Carolina selected? He cannot verify the reason is true. He cannot tell which officer ran it. He cannot confirm a real case exists. And he has no authority whatsoever to discipline an officer in South Carolina, Florida, or Kentucky. Even if he could name that officer, there would be nothing for him to punish: a deputy in another state searching the shared network under that state’s law is acting lawfully where he sits. E-07’s twelve “prohibited uses” are prohibitions on Brunswick’s deputies — they bind no one who never adopted them, and much of what North Carolina forbids is permitted somewhere else. The Sheriff cannot discipline a lawful act in another jurisdiction, and he cannot reach an unlawful one. Every enforcement tool the new E-07 builds — the prohibited-use list, the justification requirement, the threat of termination — reaches exactly one group of people: Brunswick’s own deputies. For the agencies doing most of the searching, the policy is a letter addressed to someone else’s employees.

The policy even seems to reach for the whole network. Its sharing section includes a line that, read quickly, sounds like it holds every search — wherever it comes from — to North Carolina’s standard:

“Accessing data obtained from an ALPR system not operated by this agency is subject to the same law enforcement-purpose, authorization, documentation, confidentiality, security, and audit requirements applicable to agency-held ALPR data.” — General Order E-07 § VIII.D, quoting N.C. Gen. Stat. § 20-183.31(a)(8)

Read it again, and the limit is obvious. The clause binds the only people a Brunswick general order can bind: Brunswick’s own personnel, when they reach into another agency’s cameras. It is a rule the Sheriff writes for his own deputies. It is not — and cannot be — a rule for the 3,591 outside agencies reaching into Brunswick’s cameras. There is no mechanism by which a county sheriff in North Carolina imposes North Carolina’s confidentiality, security, and audit requirements on a police department in Texas, Florida, or Kentucky: those agencies never adopted E-07, never agreed to it, and answer to their own states’ laws, not ours. The clause describes a two-way street and governs only the lane leaving town.

The purge and the no-sale rule stop at the state line too

Retention is the same trick. The policy is firm about it: captured plate data “shall not be preserved for more than 30 days after the date of capture,” and the systems “shall be configured to comply with the 30-day … retention period” (§ VII). That governs the copy Brunswick holds. It does nothing about the copies that have already left. Every time one of those thousands of outside agencies searches Brunswick’s cameras and saves the hit — into a case file, an export, its own real-time crime center — a copy crosses the state line and lives under that agency’s retention rules, or none. North Carolina’s 30-day limit binds North Carolina agencies; it does not reach a detection now sitting in a system in Texas or Kentucky. Brunswick can purge its own store on day 30 and still have no way to know how many copies of the same data remain, where, or for how long. The copy that leaves town is the copy that lasts.

The policy’s promise not to sell or hand off the data runs into the same wall. E-07 states that the agency “shall not sell captured plate data for any purpose” and “shall not disclose” it to non-law-enforcement persons or entities (§ VIII). That is a faithful restatement of North Carolina law — § 20-183.32 — and, like the rest of the statute, it binds North Carolina agencies. It does not bind the sheriff’s office in Texas or Florida that pulled the same detection through a network search. Once the data is in that agency’s hands, whether it may be kept, shared further, or sold is answered by that state’s law, not North Carolina’s — and some of those states impose far weaker limits, or none. We have already traced North Carolina plate data moving through a Texas vendor. A rule that says “we will not sell it” protects no one when the copy that matters is sitting in a state that will.

The one misuse case we know of was an inside job — caught by a vendor, not the policy

It is fair to say: fine, but the real danger is a rogue local deputy, and the policy does reach those. Partly true — and the history is still not comforting. The only Brunswick misuse case we know of is former Lieutenant Daniel Little, indicted on eighteen counts for allegedly querying Flock on six vehicles “without a legitimate law enforcement purpose” from February through August 2026. That was an inside search — exactly the kind the new policy governs. Yet it was not the policy that caught it. The February policy in force at the time required no audit at all; what surfaced the problem was a Flock vendor feature, “Audit Assistance,” switched on August 18 — which promptly flagged 145 searches as “needs review” across about 17 employee accounts, all of them archived in a single afternoon on August 31, the day before the Sheriff went public. The lesson of Brunswick’s own scandal is that a written audit duty is only as good as the human who performs it. The new policy improves the duty. It still relies on the Sheriff’s office to audit the Sheriff’s office.

And no one outside that office can check the work

Which brings the two halves together. For inside searches, the new audit is real but self-administered — § 20-183.31(a)(7) requires reporting only to “the head of the agency,” so no commissioner and no member of the public is entitled to see it. For outside searches — about nine in ten of the total — there is no meaningful audit possible at all, because the record names an agency and a self-declared reason and nothing a county can verify or act on. And Brunswick has still not produced its own inbound Network Audit: it has been outstanding on our June 29 records request since the summer. So the county has now written itself a formal duty to audit “external-network searches” while continuing to withhold from the public the very log that records them.

None of this is an argument that Brunswick wrote a bad policy. It wrote a much better one. It is an argument about the limits of policy itself. You cannot govern a nationwide search network one county ordinance at a time. The searches that matter most — the millions run from a thousand miles away, on reasons no one here can check, by officers no one here can discipline — sit permanently outside the reach of the best policy a sheriff could write. The honest response to that is not a fourth revision of E-07. It is to stop feeding a small county’s cameras into a national network in the first place. North Carolina law already forbids selling this data and bars its use for traffic enforcement; the one guardrail it does not provide is a way to make three thousand out-of-state agencies answer to Brunswick County. There is exactly one control that does — and the Sheriff holds it in his own hand. He can turn off network sharing. Every limit E-07 promises — the 30-day purge, the no-sale rule, the confidentiality duty, the audit — becomes real the moment Brunswick’s cameras stop answering searches run from a thousand miles away, because then the only searches left are the ones the Sheriff actually governs. That is the single move that makes the rest of the policy true. Short of it, a better policy is still just a policy — and no policy, however well drafted, can pull that rabbit out of the hat.

Sources

• Brunswick County Sheriff’s Office General Order E-07, “Automated License Plate Readers,” rev. October 16, 2026 (approved by Sheriff Brian Chism) — the quoted prohibited-use list (§ III), data-retention limit (§ VII), interagency-sharing rules (§ VIII), and 30-day audit scope (§ X). Compare the earlier Feb. 25, 2026 and Sept. 1, 2026 revisions. (The Oct. 16 revision: read it in full; also in our Brunswick archive.)
• Inbound “Network Audit” format and figures: Pender County Sheriff’s Office Flock Network Audit, June 1–Aug. 26, 2026 — 2,101,548 searches by 3,591 agencies, ~94% out of state (our full analysis; file at the Internet Archive). The three sample rows are drawn verbatim from that export.
• N.C. Gen. Stat. § 20-183.31 — required contents of an ALPR policy, including § (a)(7) (auditing reported only to the head of the agency) and § (b) (no traffic-enforcement use).
• The Little indictment, the 145 flagged records, and the August timeline: our investigation · the North Carolina Flock Misuse Tracker. The February policy’s missing audit: here.

General information for public discussion, not legal advice. Quotations are from Brunswick County General Order E-07 (rev. Oct. 16, 2026) and N.C. Gen. Stat. § 20-183.31. The sample search rows are reproduced from the Pender County Network Audit, which uses the same Flock export format; individual plate numbers and names in that file are redacted at the source. An indictment is an accusation, not a conviction. Corrections: mark@deflockilm.org. First published October 17, 2026.