Caught by the Audit

On August 5, 2026, a now-former Mooresville, North Carolina police officer was arrested and charged — with a misdemeanor — after using the Flock license-plate-reader database to track a private citizen. According to the warrant, Officer Elizabeth Anne Snowman ran the system 31 times to follow her boyfriend’s ex-wife — twice while off duty — “for a purpose other than official law-enforcement duties.” She was dismissed from the department, booked into the Iredell County jail on a $5,000 secured bond, and is due back in court on August 27, 2026. (Read the redacted warrant; case reported by WSOC-TV. The charge is an accusation; Ms. Snowman is presumed innocent.)

What matters for the rest of North Carolina is how she was caught: an audit of the Flock system. Someone finally reviewed the log — and once they did, the problem did not stop at one officer. Mooresville’s police chief says he is now investigating ten more officers for accessing Flock for personal reasons, that three of those cases are “problematic,” and that another arrest could come “within days.” It is the second Charlotte-area officer charged in a single week: a Charlotte-Mecklenburg officer was charged July 29 (and arrested July 30) with the same misdemeanor computer-access offense (N.C.G.S. § 14-454(b)).

The chief’s own words are the argument for the cameras and the argument against secrecy in one breath. He called the misuse a “travesty” that “puts a stain on” a tool he says has helped find missing children — “but it all goes up in smoke when you have cops like this violating the system.” Exactly. So the question is not whether the tool can help. It is who is watching the people who use it.

Two different things get called “the audit” — and the gap between them is the whole problem

Be careful with the word, because it does double duty. Flock’s “Organization Audit” and “Network Audit” are just its product names for an export of the search database — a log of who ran which plate, when, and why. That file is only a record. It catches no one on its own; it sat in the system dutifully logging all 31 of Snowman’s searches as she made them.

What caught her was the other kind of audit: a human review of that log. Someone at Mooresville PD finally read the record and acted. The review — not the export — is the safeguard. And under North Carolina law that review is remarkably thin. G.S. 20-183.31 requires an agency’s ALPR policy to provide only for “annual or more frequent” auditing, reported to the head of the agency — the agency reviewing itself, as seldom as once a year. New Hanover’s Sheriff adopted exactly that floor (SOP 222): an annual, self-conducted review. Snowman ran 31 searches; a Kansas police chief ran more than 200 before anyone noticed. A once-a-year self-review gives that same pattern up to twelve months to run.

And infrequency is only half of it. The one field a reviewer would scan for trouble — the reason an officer types in for each search — is self-entered, and the New Hanover Sheriff’s Office has now told WECT (Aug 4) that its own “traffic infraction” reason codes were simply “mislabeled.” Take that at face value and it cuts a way the county may not intend: if a label can be wrong, then reading the labels is not an audit. An officer bent on stalking does not type “stalking” in the box. Catching misuse means going behind the reason code — matching each search to a real case, a real plate, a real justification. That is a real audit — and it is exactly what an annual, self-run pass over a log full of self-reported reasons cannot deliver. (More on the “mislabeled” defense.)

Now layer secrecy on top, and even that thin check disappears entirely:

• New Hanover redacts the record. The county’s network was searched 2.98 million times in sixteen months — and when we obtained the log (Flock’s “Network Audit” export), the county blacked out the name of every searching agency and every officer, down to “***.” No outside reviewer — not a reporter, a resident, or a commissioner — can do what Mooresville’s chief did.
• Wrightsville Beach won’t produce it at all. Thirty-six days and counting, the town has released none of its search logs. (The full story here.)

So the safeguard Flock advertises is real — but it is only ever as strong as the review behind it. An annual, self-run review of a log the public is forbidden to see is not much of a check on a system searched millions of times.

Sheriff McMahon told commissioners the program is just “License Plate Reader technology.” Mooresville is what that technology looks like in the wrong hands — and the only thing that caught it is the record New Hanover won’t show you and Wrightsville Beach won’t produce. (He said it; watch what the county’s own records show.)

On August 17, the commissioners who fund New Hanover’s Flock contract meet. Mooresville sharpens the question to a single line: who is auditing ours — and why can’t the public see the log?

The Mooresville case is reported by WSOC-TV (Aug 5, 2026); the charge is an accusation and Ms. Snowman is presumed innocent unless proven guilty. New Hanover figures are DeFlockILM’s own tally of the county’s produced Flock search log (its “Network Audit” export) and its SOP 222; the annual-audit floor is set by N.C.G.S. § 20-183.31. See our records repository. This page is general information and opinion, not legal advice. First published August 5, 2026.