Five Cameras. Three Million Searches.

Carolina Beach operates five license plate readers. Two Falcon, one Falcon Flex, and two Solar units added last December. The town has roughly 6,400 residents and pays $13,696 a year.

Between March 1 and May 31, outside agencies searched those five cameras approximately three million times.

That is not a typo, and it is worth sitting with. New Hanover County’s entire network — the whole county — logged 2,980,082 searches over sixteen months. Carolina Beach appears to have matched that in one quarter, with five cameras, in a town you can drive across in six minutes.

We know this because we asked. On June 30 we sent the Town the same nine-item records request we have sent agencies across North Carolina. Here is what came back — and here is every page of it, unaltered, at the Internet Archive. We host none of it ourselves, on purpose. Check our work.

The Town answered, and answered fast

We should say this first, because it is true and because most agencies do not earn it.

Captain Scott Hettinger acknowledged the request on July 6 and had the production ready on July 15 — fifteen days, among the fastest turnarounds we have received from any agency in the state. He copied it to a drive; we picked it up. Then, the next day, he wrote to say he had realized on his own that the event logs were left off, and asked if he could email them. He did, unprompted, within hours.

That is a records officer doing the job properly. Nothing below is about Captain Hettinger’s diligence. It is about what the records say, and about four categories that came back empty.

Three million searches of five cameras

The network audits — the logs of searches run by outside agencies against Carolina Beach’s cameras — run to roughly 951,000 rows in March, 1,045,000 in April, and 1,000,000 in May.

Before that number gets misused, here is the honest version. Those are not three million investigations of Carolina Beach residents. They are not three million searches by Carolina Beach officers. It is a network audit: it counts every query, run anywhere in the country, that reached into this town’s cameras. One broad search typed in another state can touch thousands of participating networks at once, and Carolina Beach is one of them. One search there, one row here.

Which is the point. Almost none of it was theirs. A town of 6,400 bought five cameras, and those cameras now answer millions of questions asked by people who do not live there, do not answer to anyone there, and whose identity the Town has blacked out.

The Town’s own officers ran 1,358 searches in the same three months. The median one reached 1,168 separate camera networks. The largest reached 6,323. And that reach nearly tripled over the quarter — a median of 427 in March, 1,168 in April, 1,180 in May. Five cameras on a barrier island, reaching a thousand networks at a time, and growing.

Forty-one searches for traffic

North Carolina law is not ambiguous. N.C. Gen. Stat. § 20-183.31(b): ALPR data “shall not be used for the enforcement of traffic violations.”

Carolina Beach’s own Policy 425.4(g) says the same thing, and cites the same statute: “ALPR data shall not be used for the enforcement of traffic violations (N.C.G.S. § 20-183.31).”

In the three months of logs the Town produced, 41 searches are labeled “Traffic Infraction.” Fifteen more are labeled “City Planning/Traffic Analysis.” Fifty-six in all.

We are not inferring anything. That is a dropdown menu on the Department’s own system, chosen by the Department’s own officers, on the Department’s own searches.

And we will be fair about the scale: 56 out of 1,358 is 4.1%. Down the road in Kure Beach, the same code accounted for 33.5% of all searches, and 62.9% of them in May alone. Carolina Beach is not Kure Beach. But it is not zero either, and the statute does not have a threshold.

The policy and the system describe different towns

Policy 425.7 is one sentence, and it is the most interesting document in the production:

“ALPR data shall only be shared with another law enforcement agency or prosecutor upon a written request, which may be made electronically.”

Now hold that against a million outside-agency searches a month.

If each of those searches was preceded by a written request, the Town of Carolina Beach should be holding roughly three million written requests from the last quarter alone. We asked for data-sharing agreements. That category came back empty.

So either the requests exist and were not produced, or the policy describes a system the Town is not running. We have asked the Town which. It is a fair question and it has a real answer.

There is a second problem with Policy 425: it carries no adoption date. No effective date, no revision date. Its only date is a Lexipol copyright line reading 2026/06/26. The statute requires a written policy before the system is operational, and the Town has been billed for Flock since November 3, 2022. We are not saying the policy was written in response to our request, and we do not assume it was. We are saying that, as produced, it cannot show compliance — and only the Town can fix that.

Four categories came back empty. One of them is proved by their own paper.

Of nine categories requested, four produced nothing at all, with no explanation: the contract, any data-sharing agreement, the network sharing configuration, and the camera count and locations.

The contract is the conspicuous one, because the Town’s own invoices prove it exists. Invoice INV-48693: “Co-Term: Year 2 of 60 Month Term, 2024-2025.” Invoice INV-82409: “Phase 2 (NEW): Year 1 of 36 Month Term.”

A five-year agreement and a three-year agreement, described on documents the Town chose to hand us, and neither one produced. A contract between a town and a vendor is the plainest public record there is.

And the sharing configuration — the one document that would explain three million searches — is the one document nobody produced.

Every redaction, and not one citation

Across six audit files and the event log, every field that could identify anyone reads “Redacted.” No legend. No exemption log. No statutory citation on any page of any file — though our request asked for one in writing.

The only gesture toward withholding in the entire correspondence is a single phrase: “All publicly available records have been copied to an external media drive.” That is not a legal basis. It is a conclusion.

Two of those redactions we think cannot be supported. The searching officer’s name — N.C. Gen. Stat. § 160A-168(b)(1) makes a municipal employee’s name expressly public, and an officer performing an official act is not “captured plate data.” And the outside agency’s name in the network audits, which is neither plate data nor a Carolina Beach personnel record. Blacking that one out removes the only thing a network audit exists to tell you.

One more, on format. We asked for the data as CSV, which is how Flock exports it and how other North Carolina agencies have sent it to us. The Town converted it to PDF instead. The April network audit alone is 18,346 pages and 254 megabytes. The stated reason the records could not be emailed was their size. The size is a consequence of the format.

We asked. Ten business days.

On July 17 we sent the Town a deficiency letter asking for the contract, the sharing configuration, the camera locations, native CSVs unredacted as to searching agency and officer, a statutory basis for any redaction the Town keeps, and the adoption date of Policy 425.

We also offered a phone call, and mediation under § 7A-38.3E before anything else. We would rather have the CSVs than an argument.

The Town wrote back the same night

We sent that letter at 4:03 in the afternoon. Captain Hettinger answered at 11:39 that night.

He sent Policy 427 — “the implemented Policy 427 located in our Policy records from September 2023.” The original production had given us Policy 425, the undated Lexipol template. Policy 427 existed the whole time, and we had not been given it.

Then he did something we did not expect. He conceded the premise of our hardest paragraph, unprompted:

“I can say there was a significant delay in installation regarding the November 2022 date, however I am searching for the actual operational date and will update when I am able to accurately provide that record that will be in 2023.”

Read what that is. We had said the Town was billed for Flock starting November 3, 2022, and that a policy with no adoption date cannot show compliance with a statute requiring the policy to come first. Rather than argue, he told us the cameras were not running in November 2022, that the real date is somewhere in 2023, that he does not yet know it, and that he is looking.

We note the record as it stands. Fifteen days to produce. The event logs volunteered when he noticed they were missing. A seven-hour turnaround on a deficiency letter. A document he did not have to send. A concession he did not have to make. Those are facts and we will report them.

We are not in the business of sorting police officers into good ones and bad ones, and we are not going to start. The same production that arrived in fifteen days arrived as PDF. That was not a technical limitation — the Flock platform exports CSV, and somebody converted a spreadsheet into an 18,346-page document. That was a choice, made by someone, and it is the choice that made the records unusable and then made them too large to email. Both things are true at once. We are describing conduct, not character.

And the question gets sharper, not softer. The statute requires the policy before the system is operational. If the cameras went live after September 2023, Policy 427 satisfies it — and we will say so on this page, in this paragraph, with the same prominence. If they went live before, it does not. The Town is looking for the date, and the Town is the one who brought it up.

Policy 427 is Policy 425

It is the same Lexipol policy, renumbered between manual versions. The text runs nearly identical, clause for clause. And it bears a date: “Copyright Lexipol, LLC 2023/09/18.” Captain Hettinger’s account checks out.

It is also a perfectly lawful policy on its face. It purges plate data at 90 days, as the statute requires. It orders annual audits reported to the Chief of Police. It cites N.C. Gen. Stat. § 20-183.31 and § 20-183.32 throughout. Somebody wrote this carefully.

Which makes the findings worse, not better.

Policy 427.4(g), in force since September 18, 2023: “ALPR data shall not be used for the enforcement of traffic violations.” The 41 searches labeled “Traffic Infraction” ran in March, April and May of 2026. Whichever version of the policy was operative on those days, that sentence was in it. The older policy does not answer the traffic finding — it establishes the rule has been on the books for three years.

Policy 427.7 is word for word 425.7: ALPR data “shall only be shared with another law enforcement agency or prosecutor upon a written request.” That has been the Town’s own rule since 2023. The network audits show roughly a million outside-agency searches a month. The gap between the policy and the system is not a recent drift. It is as old as the policy.

The policy authorizes more than the statute allows

Section 427.3 says the ALPR system “may also be used to gather information related to active warrants, homeland security, electronic surveillance, suspect interdiction and stolen property recovery.”

Two sections of the statute have to be read together. § 20-183.31(b) is the operative one: ALPR data “shall be obtained, accessed, preserved, or disclosed only for law enforcement purposes.” And § 20-183.30(5) defines that term for the whole article — as a closed list of four:

a. Actions related to criminal investigations, arrests, prosecutions, post-conviction confinement, or supervision.
b. Apprehending an individual with an outstanding felony warrant.
c. Locating a missing or endangered person.
d. Locating a lost or stolen vehicle.

That is the entire list. The definition is not advisory — § 20-183.31(b) restricts access to those purposes and nothing else.

“Homeland security” is not on it. Neither is “electronic surveillance.”

And two more, quieter, in the same sentence of the policy. It authorizes use for “active warrants” — the statute permits only an outstanding felony warrant. It authorizes “stolen property recovery” — the statute says a lost or stolen vehicle. A misdemeanor warrant and a stolen lawnmower are not on the list either.

We want to be careful here, because this is the kind of thing that is easy to oversell. We have no evidence any Carolina Beach officer ever ran a search for either purpose. The audits do not show it. What we are saying is narrower: the policy, on its face, authorizes uses the statute does not define — and no one at the Town wrote that sentence.

It is Lexipol’s template. Which means it is not a Carolina Beach problem. It is in the policy manual of every North Carolina agency running the same template, and we would like to know how many that is.

Seven items are still outstanding: the contract, the data-sharing agreements, the sharing configuration showing who reached those three million times, the camera locations, the native CSVs, a statutory basis for every redaction, and the written requests Policy 427.7 has required since 2023. Ten business days runs to July 30.

Whatever the Town sends back, we will publish it here — and if any of the above is wrong, tell us and we will correct it on this page, in public, with the same prominence. We have done that before.

Five cameras. Three million searches. A town of 6,400 people. Nobody voted for that, and until the Town produces the sharing configuration, nobody can tell you who was looking.