The Camera Caught the Officer. Would Regulation Catch the Rest?

The question this page asks is narrow and, we think, unavoidable after the last two weeks: if the tool is going to be regulated rather than removed, does regulation actually reach the problem the misuse cases exposed? We take the case for regulation seriously and state it at full strength, because it is a serious case. Then we say where we come out, and why: a capability this intrusive, this resistant to audit, this far outside any one state’s control, and resting on law this unsettled, is not something to refine. It is something to end.

What are the misuse cases driving this?

Two North Carolina officers, charged eight days apart. On August 5, 2026, a now-former Mooresville officer was dismissed and charged with a misdemeanor for running the Flock database 31 times to track her boyfriend’s ex-wife — caught by an audit, after the searches. Her chief says ten more officers are under investigation, three cases “problematic,” and another arrest could come “within days.” A week earlier, the SBI charged a Charlotte-Mecklenburg officer with the same misdemeanor computer-access offense for an unauthorized Flock search; WBTV reports he is accused of passing information to the target of a drug investigation. And this is a national pattern, not two bad apples in North Carolina: CNN, the Washington Post, and Newsweek have documented officers across at least a dozen states turning the network on their exes and personal targets. (Our running tally of the abuse cases, and the North Carolina misuse record.)

Even the law-enforcement side now expects a response. Steven Brochu, a consultant who spent nearly thirty years with Charlotte-Mecklenburg police, told WBTV the arrests will likely bring “audit trails, increased supervision” and tighter access controls, and that “the state will come in with additional measures.” When the tool’s own defenders concede that after-the-fact audits are the current control, the argument has shifted from whether to how.

What would regulation look like?

Rules on the three things that matter, plus a public say. The reform answer — associated most closely with the ACLU and the Electronic Frontier Foundation — targets how long ALPR data is kept, who it is shared with, and how it may be used, backed by mandatory audits. At the local level, both groups push Community Control Over Police Surveillance (CCOPS) ordinances: before a department may acquire surveillance technology, it must bring the decision to an elected body and adopt a published policy in the open. Credit the model on its own terms — it moves a choice now made quietly between an agency and a vendor into a public room, with a vote attached.

Which states have actually done it?

A handful, and it is hard to pass. California’s SB 34 (2015) requires a written policy and bars sharing plate data with private parties or out-of-state agencies — and yet that ban has been broken in the open. California’s own Attorney General had to declare out-of-state sharing unlawful, and reporting in 2025 found agencies still sharing plate data with ICE and out-of-state agencies in violation of the law. A rule the state cannot make its own departments follow is a limit on paper, not in fact. Virginia’s 2025 statute imposes a 21-day retention limit, prohibits out-of-state and federal sharing, sets up vendor approval, and requires annual reports. Illinois, Maine, and New Hampshire also cap retention and restrict sharing. But the track record is thin: in 2025, roughly sixteen states introduced ALPR bills and only three enacted them, and California’s follow-on measure — SB 274, which would have added a 60-day cap and randomized state audits — passed the legislature and was vetoed by Governor Newsom in October 2025 over concerns about criminal investigations. Regulation is winnable. It is not automatic, and it is not durable.

Here is the catch: in North Carolina, even a caught officer’s file stays secret

This is the part the “mandate audits” answer does not reach. Suppose every North Carolina agency ran a rigorous audit tomorrow. In most cases the results would still be invisible to the public, because an officer’s internal-affairs file is a confidential personnel record. G.S. 160A-168 (city police) and G.S. 153A-98 (sheriffs’ deputies) shield the investigation itself. What is public is narrow: an officer’s name, rank, salary, and the fact and date of a promotion, suspension, or dismissal — and, for a city employee, the written reason for a dismissal. What is not public is the investigation: which searches, what the audit found, whether officers were disciplined short of firing, what the department concluded. In a sheriff’s office, even the reason for a suspension or demotion stays sealed.

The practical result is a gap between two promises that sound the same. Misuse becomes public mainly when it becomes a criminal charge — which is why the Mooresville and Charlotte cases are visible: prosecutors filed. The mechanism is the courthouse, not the personnel office. Once charges issue, the audit logs and investigative findings enter the public court file and criminal discovery, while the internal-affairs file itself stays sealed. The ten other Mooresville officers under review are not visible. If they are reprimanded, suspended, or quietly allowed to resign, the public may learn only that a personnel action occurred — and, in a sheriff’s office, not even why. North Carolina’s ALPR statute sets the audit floor at an annual, self-conducted review reported to the head of the agency (§ 20-183.31). That is the department grading its own paper, once a year, and sealing the grade. “An audit will catch it” and “the public will know” are different sentences. The first can be true while the second is false.

The case for regulating rather than removing

Stated fairly: the cameras are already deployed across the state, and the 2026–27 budget just expanded them. Regulation may reduce harm now. A 21-day retention cap, a ban on out-of-state sharing, a warrant requirement, an enforceable audit requirement by an external agency — not only of use but of the system’s security provisions — and a public-approval ordinance each close a door that is open today. CCOPS puts the decision with officials who answer to residents at the next election. And regulation is achievable in a way a wholesale ban may not be. To its supporters, declining to regulate because regulation is imperfect simply leaves the worst version of the system running untouched.

The case that regulation is not enough — or entrenches the problem

The skeptics’ case, also stated fairly, has three parts. First, enforceability: the field that would catch abuse is the “reason” an officer types in, and it is self-entered — an audit confirms the box was filled, not that the reason inside it was true — the New Hanover Sheriff’s Office has already said its own “traffic infraction” codes were “mislabeled” — so a stalker types “stolen vehicle” and passes review. The audit is also self-run and after the fact: the search runs, the target’s home address is already exposed, and only later might anyone look. And the platform captures only half the trail — an officer can run a facially valid search and pass what he learns by phone or text to someone off the system, leaving the log clean and the leak invisible, which is the shape the Charlotte case is alleged to take. Second, secrecy: as above, North Carolina’s personnel statutes keep even a working audit’s results from the public. Third, and most fundamental, the legitimation critique. Legal scholars and some civil-liberties advocates warn that oversight and community-control laws “risk legitimizing surveillance technologies in police hands” — that writing careful rules for a suspicionless dragnet accepts the dragnet, and answers “how should we run mass plate surveillance?” while skipping the prior question of whether a government should hold a standing, searchable record of where everyone drove at all. This is a real disagreement within the privacy movement, not between it and the police.

The audit problem also runs deeper than self-entered reasons, because an audit is only as good as who runs it and what it examines. North Carolina’s is the agency’s own, reported to its own chief — and the standing objection to self-policing is exactly that a department reviewing itself has a conflict of interest. A meaningful audit would be independent, run by an outside body, and it would check not just use but security — because these cameras have been found exposed on the open internet, where a researcher pulled up live feeds and watched people jog while the system’s AI zoomed in on the phones in their hands. A use-audit never sees that — and the New Hanover contract separately opens the system to non-law-enforcement vendor access. Trust also has to be earned. The office being asked to audit itself here is the same New Hanover County Sheriff’s Office that still will not say which agencies ran its 2.98 million searches — when every other North Carolina agency that answered our requests named them. A department with that record is not a safe candidate to grade its own work in private.

Can North Carolina regulate what happens after the data leaves the state?

Largely no — and this may be the hardest limit of all. North Carolina’s statutes bind North Carolina agencies. They cannot bind a police department in Texas, a sheriff in Georgia, or a federal agency like the FBI or ICE. The moment a North Carolina agency joins Flock’s national network or shares with an out-of-state department, that data is queried and logged under the recipient’s rules, not ours — and no North Carolina audit can reach it. New Hanover’s own contract makes the point starker: it grants Flock a perpetual, worldwide license to the data and lets the company share it at its own discretion — terms we read as difficult to square with North Carolina law, and ones no county audit controls. The infrastructure underlines the point: Flock hosts law-enforcement data on Amazon’s AWS GovCloud, whose facilities sit in Virginia, Oregon, and Ohio — not North Carolina. And our own records show what this means in practice: when five North Carolina agencies produced their Flock audits, about 90% of the searches of their cameras came from outside the state — Houston, Texas ran the single largest share, and the FBI is in the logs. A flawless North Carolina audit regime would still govern only North Carolina officers searching North Carolina cameras — a sliver of the traffic. That is why reform advocates list a ban on out-of-state sharing among their asks, and why some argue only federal legislation, or an absolute prohibition on any interstate transfer, could actually close the border. State-line rules stop at the state line. The data does not.

Where North Carolina stands

Light regulation, and expansion. Article 3D (§§ 20-183.30–.33) caps plate-data retention at 90 days, limits use to law-enforcement purposes, bars traffic-enforcement use, and requires that annual self-audit — real limits, but a floor, with no public-audit right and no CCOPS-style vote. And the cap has a built-in exception: Flock’s own evidence policy keeps a read past the deletion window once it is tagged to an investigation, and preserves the search audit trail indefinitely — so “90 days” governs the rolling database, not the copy saved to a case file. Meanwhile the state budget makes the SBI’s highway camera program permanent. North Carolina’s current posture sits at the “regulate lightly, keep expanding” end of the spectrum — which is precisely the posture the misuse cases are testing.

And the law underneath it all is unsettled

Regulating now also locks in a system whose constitutionality no court has resolved. The leading civil challenge to a fixed Flock network, Schmidt v. City of Norfolk, is on appeal to the Fourth Circuit (No. 26-1227), the court whose rulings bind North Carolina. And in June 2026 the Supreme Court held in Chatrie v. United States that acquiring a person’s location history is a search even when a third party holds it and even for a limited window — reasoning that has not yet been applied to a plate-reader network, but that cuts directly at the “it’s public, you exposed it” premise these programs rest on. A retention cap or an audit mandate assumes the collection itself is lawful and moves on to housekeeping. If the Fourth Circuit reads Chatrie the way its logic points, the housekeeping was beside the point. Writing rules for a dragnet the courts may be about to narrow is not a settlement. It is a bet on the losing side of an open question. (For the doctrine in depth: the ALPR cases now in the courts, and our attorney memoranda on the state-constitutional and § 1983 claims.)

But the deeper question is not legal at all: who decided?

Before a county builds a highway, it holds hearings. Before it rezones a neighborhood or raises a tax, there is notice, a public meeting, a vote. Yet a permanent surveillance network can go up across nearly every major road in a community with almost none of that — a line in a procurement, a vendor contract, cameras on poles before most residents know the program exists. That is not a Fourth Amendment question. It is a democracy question, and it may be the one that matters most.

The distinction is simple and easy to miss. “Was it legal?” and “Was it authorized by the people it watches?” are different questions. A government’s legitimacy rests on consent, not only on statutes. A system that records everyone’s movements needs a social license, not merely a legal one — and a social license is something you ask for out loud, in advance, from the people who will live under it.

So the questions a resident is entitled to put to the Board are not technical. They are democratic:

• Did residents ever vote on this — or was it approved as a contract most never saw?
• Was there a public hearing, with notice, before the cameras went live?
• Was anyone told the data would be searchable nationwide, by agencies in other states and by the federal government?
• Were the privacy costs ever weighed in public? Were alternatives considered?
• Does the contract expire unless renewed after public review — or does it simply continue, unexamined, by default?
• If public support fell, would elected officials take the cameras down?

And there is a control problem beneath the consent problem. A New Hanover commissioner can vote to install these cameras. But as the county’s own audits show, that same commissioner cannot stop Houston, or Atlanta, or ICE, or the FBI from querying them afterward. If the people who authorized the system cannot govern who uses it, the vote that installed it was smaller than it looked. The county bought the network. It does not control it.

This is the principle beneath community-control ordinances, and it does not depend on winning a single constitutional argument: before a government installs technology capable of recording everyone’s movements, the people being recorded should have the chance to approve or reject it — through their elected representatives, after a real public debate. New Hanover County has not had that debate. It is having the first of it now, on August 17, because residents forced the question — not because the system was ever put to them.

Three responses — and the one that actually fits

The arrests force a decision, and there are three answers on the table. Regulate harder — retention caps, sharing bans, enforceable audits, CCOPS votes — the ACLU and EFF path, proven possible in a few states and vetoed in others. Demand transparency — rewrite the personnel and public-records rules so residents can see what the audits find, not only the cases that reach a courtroom — a reform almost no one is proposing. Or decline and remove — treat a capability this prone to misuse as one a community can choose not to run at all.

We have given the first answer its due, and it has real force: the cameras are here, the harm is happening now, and rules that cap retention or bar out-of-state sharing would close doors that stand open. But add the findings above together and regulation stops looking like a solution and starts looking like a permission slip. The audit catches the officer after the searches and reports only to the chief. North Carolina law then seals the result. The data lives on out-of-state servers, queried mostly by out-of-state agencies no North Carolina rule can touch. And the whole structure rests on a Fourth Amendment question the courts have not answered — and may answer against it. Underneath all of it, the public was never asked. To regulate all of that is to accept the premise the misuse cases should have retired: that a government may keep a standing, searchable record of where everyone drove, so long as it keeps a tidy logbook. That is not oversight of mass surveillance. It is the administration of it.

The honest conclusion is the plain one. This is mass government surveillance of people suspected of nothing, and the answer is not to manage it more neatly. It is to take it down — to decline the contract and remove the cameras, and to leave the rule-writing for the day someone can show why a free county needs a permanent record of its residents’ movements at all. On August 17, New Hanover County’s commissioners hold that choice. “There are safeguards” is a claim with a size — and now you know its size.

Sources: N.C. Gen. Stat. §§ 160A-168, 153A-98 (personnel-record confidentiality) and §§ 20-183.30–.33 (Article 3D); California SB 34 (2015) and SB 274 (vetoed Oct. 2025); Virginia’s 2025 ALPR statute; ACLU and EFF materials on ALPR regulation and Community Control Over Police Surveillance; Flock Safety’s CJIS / AWS GovCloud hosting documentation and its published evidence-retention policy; Schmidt v. City of Norfolk (on appeal, 4th Cir. No. 26-1227) and Chatrie v. United States (2026); WBTV (Aug. 7, 2026), WSOC-TV, CNN, and the Washington Post on the misuse cases. Criminal charges are accusations; the officers named in the linked coverage are presumed innocent unless proven guilty. This is general information and opinion, not legal advice. First published August 7, 2026.