New Hanover Sheriff Ran a Protest Leader’s Plate Under a Case It Labeled “Protest”

On the morning of Saturday, November 22, 2025 — hours before an anti-ICE protest gathered on the steps of the New Hanover County Sheriff’s Office — the Sheriff’s Office ran a series of license-plate searches its own system recorded under a case named “Protest.” One of the plates it searched, we have confirmed, belongs to a leader of that protest.

What the record shows

Between about 10:13 and 10:33 a.m. on November 22, 2025, a New Hanover operator — shown in the log only as “S.,” because the Sheriff’s Office redacted the searching user’s identity, and the plate numbers, across the audit it produced — ran four broad license-plate searches, entering the reason as “Intel” and the case as “Protest.” These were not narrow, single-plate lookups. Each swept 2,568 to 6,676 camera networks and tens of thousands of individual devices, drawing on a 30-day lookback window. Together, the four searches touched three distinct license plates.

The protest, that evening

That same day, Saturday evening, more than fifty people gathered at the New Hanover County Sheriff’s Office to protest the federal immigration-enforcement surge then unfolding in North Carolina, including raids in Charlotte and the Triangle, in an action organized by the ILM Action Network (WWAY, Nov. 23, 2025). The Sheriff’s Office confirmed to WWAY that it had housed “federal inmates within the past 48 hours” under its federal contracts to hold people for ICE, the DEA, and Homeland Security. The protest was aimed squarely at the office that, that same morning, had run searches its own system labeled “Protest.”

A protest leader’s plate

One of those searched plates is no longer anonymous. A leader of that evening’s demonstration — one of the organizers of the protest at the Sheriff’s Office — confirmed to us that one of the plates searched under the “Protest” case matches their car. They identified it by matching their own plate against the published audit record; we are not naming them.

Across the NHCSO records produced to us and the HaveIBeenFlocked records we reviewed, we found only one search involving that plate hash: the 10:27 a.m. “Protest” search on November 22, 2025. HaveIBeenFlocked’s national dataset is incomplete, so this does not establish that no other Flock search ever occurred; it also does not mean the vehicle was captured only once by Flock cameras, because these records document the searches an operator ran, not every camera detection. On the records we have, the only time this plate appears at all is inside a search the Sheriff’s Office’s own log labeled “Protest,” hours before they helped lead the protest at its doors.

We found no criminal charges or other apparent criminal predicate associated with the individual that would explain the search, and the individual says they have no criminal record. Nothing in the records produced by NHCSO identifies a crime, warrant, missing-person investigation, stolen vehicle, or other law-enforcement predicate for the search; the only visible case designation is “Protest,” and the stated reason is “Intel.” On this record, the only thing that connects them to a police plate-reader search is that they helped organize a lawful protest. That is the heart of the problem with a network like this: it does not wait for suspicion. It lets an operator query anyone’s movements on demand, and here it was pointed at a person whose sole apparent qualification was their protected political activity. A system that can run the plate of a law-abiding organizer, under a case it calls “Protest,” is a system that treats everyone as a potential suspect.

Why a case labeled “Protest” matters

We are careful about what this proves and what it doesn’t. The record establishes the case label, the timing, and — now — that at least one searched plate belongs to a protest leader. It does not, by itself, state the searches’ investigative purpose, and two of the three searched plates remain unidentified.

But those facts raise an obvious First Amendment question, and it is the Sheriff’s Office’s to answer. There is no blanket rule that police may never use license-plate data in connection with an event that happens to be a protest — a genuine investigation of a specific crime does not evaporate because it occurs near a demonstration. The question is which of two things happened here: were these searches tied to the investigation of a particular crime, or were license-plate records searched because of protected protest activity? Running a mass plate-reader query under a case a department itself calls “Protest,” the morning of a protest against that department, and sweeping in a protest leader’s own vehicle, is precisely the pattern that chills people from showing up — and precisely the pattern an agency should have to explain.

One anticipated response deserves a direct answer. The Sheriff’s Office may say “Protest” was merely an event-logging label for crowd or traffic management, not target tracking. But event logging does not require running an individual’s license plate. The record shows specific plates queried across thousands of networks — including an organizer’s plate that appears nowhere else — and calling the case “Protest” does not explain why particular people’s vehicles were searched.

Where the line falls

Reasonable people disagree about surveillance and protest, and the case on both sides is worth stating plainly. Law enforcement has legitimate reasons to plan around large demonstrations: to manage traffic and crowds, to prepare for emergencies, and to investigate actual crimes — a theft, an assault, a credible threat — that occur at or around an event, just as they would anywhere else. A protest is not a sanctuary for unrelated crime, and using plate-reader data to investigate a specific offense is not, by itself, improper.

The concern is narrower than the technology. Surveillance aimed at people because they are protesting — building intelligence on lawful political activity — is precisely what the First Amendment is meant to guard against, and what a long American history of monitoring civil-rights, antiwar, and other activists warns us about. Modern tools make that easy: plate readers, facial recognition, and social-media monitoring can sweep up large numbers of people suspected of nothing.

Civil-liberties advocates and many law-enforcement professionals converge on the same distinction: surveillance directed at a specific, articulable criminal threat is defensible; surveillance conducted simply because people are protesting is not. Federal guidance for First Amendment–protected events makes the same point — lawful protest should not be treated as inherently suspicious, and agencies should have clear rules governing what is collected, retained, and shared.

That is exactly why the case label matters here. “Protest” is not a crime. If these searches were tied to a specific offense, the Sheriff’s Office can say so — and should. If they were not, they are the very thing that distinction is meant to prohibit.

On the guardrails, there is broad agreement across civil-liberties groups and law-enforcement policy bodies: individualized, articulable suspicion of a serious crime before anyone is targeted; tight limits on how long non-criminal data is retained; restrictions on real-time biometric tracking of people engaged in protected activity; transparency and independent auditing; and an explicit bar on compiling dossiers of peaceful dissenters. New Hanover’s own records show how far its practices sit from that standard — a mass query labeled “Protest,” with no visible individualized basis, on a system whose audit trail the County then redacted.

How federal rules draw the line around protest surveillance

The federal government’s own rules draw exactly this line. The FBI may not surveil individuals or groups solely to monitor First Amendment activity, and the federal Privacy Act (5 U.S.C. § 552a(e)(7)) bars agencies from keeping records of how people exercise those rights unless tied to an authorized law-enforcement purpose. These federal rules do not themselves govern a county sheriff’s office, but they illustrate the line federal law draws between legitimate law-enforcement intelligence and monitoring political activity merely because it is protected. Lawful protest, by itself, is not a permissible reason to build a file on someone.

In fairness, the rule is not absolute. A Justice Department Office of Legal Counsel opinion has concluded that merely monitoring and reporting lawful activity, standing alone, does not necessarily violate the First Amendment, and police plainly may assess credible threats and investigate actual crimes at or around a demonstration. That is why the facts — and the word “intel” — matter so much.

So ask it directly: intel about what? “We received a tip that someone plans to assault demonstrators on Saturday” is ordinary threat assessment. “We used plate readers to identify the vehicles at the demonstration and ran them to learn who was there” is a different proposition. And “we searched plate data to reconstruct where identified protesters traveled before and after, or which other events they attended” is more troubling still — because a networked plate-reader system does something an officer on a street corner cannot: it queries historical records, correlates a vehicle across thousands of cameras, and reconstructs a pattern of movement. The New Hanover searches labeled “Protest” were of that networked kind — each reached thousands of camera networks — and the record states their purpose only as “Intel.” Intel about what is the question the Sheriff’s Office has not answered.

New Hanover is not an outlier

What happened in New Hanover fits a national pattern the vendor itself has helped create. In late 2025, a leaked training video appeared to show a Flock representative teaching police how to use the company’s real-time crime-center tools to monitor demonstrations — a Flock director describing how agencies could watch “everything from small parades, to unexpected protests,” and walking officers through surveilling a “No Kings” protest in Denver, tracking traffic and identifying vehicles as demonstrators moved through public space (Yahoo News / The Cool Down; originally reported by The New Republic and 404 Media). Separately, the Electronic Frontier Foundation has documented more than fifty instances of law-enforcement agencies using Flock’s network to search for activity tied to protests and specific activist groups.

Flock, for its part, argues that protest-related search terms do not by themselves prove that peaceful protesters were monitored, since some searches may relate to crimes occurring around a demonstration, and it says such records need agency-level examination rather than assumption (Flock Safety). We take that point. But the New Hanover records add a fact that generic protest-tagged statistics do not: one of the queried plates belonged to an organizer of the demonstration that gathered against the searching agency later that day.

That context matters here for two reasons. It shows that a plate-reader query labeled “Protest” is not an idiosyncratic local choice — protest monitoring is a use case the vendor itself has featured in training and marketing for its real-time crime-center products. And it sharpens a contradiction: Flock publicly says its system should not be used solely to monitor First Amendment activity, even as its own training and its customers’ records show that use happening. New Hanover’s “Protest” searches are one more entry in that pattern — and, so far, the only one tied to a named local protest and a confirmed organizer’s plate.

Other North Carolina departments coded it the same way

New Hanover’s label is not even unique within North Carolina. Audit records surfaced by HaveIBeenFlocked show two other North Carolina agencies running plate searches under their own protest labels in the same season:

• Burlington Police Department. Over November 21–22, 2025 — the same weekend as the New Hanover searches — Burlington operators ran roughly 60 license-plate lookups under the reason code “Protest Intelligence.” Not one or two — about sixty, across two days.
• Asheville Police Department. On October 19, 2025, Asheville ran mobile plate searches coded “Protest Agitator.” Asheville is one of only two North Carolina departments whose policy is said to restrict using plate readers to monitor protests — which makes a search its own operator labeled “Protest Agitator” the sharpest illustration in this story of why a self-entered reason field, reviewed by no one outside the agency, is not a safeguard.

These are the agencies’ own words — reason codes an operator typed at the time of the search, not our characterization — and we treat HaveIBeenFlocked as an additive record that can add to what the public documents show, never cap it. As with New Hanover, a protest label does not by itself prove a peaceful demonstrator was the target; some searches near a demonstration may concern an actual crime. But three North Carolina departments — Burlington, Asheville, and New Hanover — using three protest-specific labels in the same stretch of weeks (“Protest Intelligence,” “Protest Agitator,” and “Intel” under a case named “Protest”) is not an anomaly. It is a use case — and the only external check on any of it is the public managing to read the record before it is redacted or deleted.

The North Carolina question: which “law-enforcement purpose”?

North Carolina does not let police use plate-reader data for whatever they like. State law provides that ALPR data “shall be obtained, accessed, preserved, or disclosed only for law enforcement purposes,” and it defines that term: criminal investigations; making arrests or supporting prosecution, confinement, or supervision; apprehending a person with an outstanding felony warrant; locating missing or endangered people; and recovering stolen or wanted vehicles (N.C. Gen. Stat. § 20-183.30).

That definition is the sharpest question in this story. Under which of those purposes did New Hanover classify a search it labeled “Protest,” with the reason “Intel”? “Event security,” “situational awareness,” “crowd management,” and generic “intelligence” are not among the enumerated purposes. We do not assert the searches were unlawful — we do not know the underlying facts — but the Sheriff’s Office should be able to name the statutory purpose that authorized them, and so far it has not.

The questions New Hanover has to answer

We are not telling readers that the Sheriff’s Office surveilled the protesters as such; the record does not establish intent. What it establishes is a set of facts only the Sheriff’s Office can explain. About the November 22 searches labeled “Protest”:

• Whose plates were searched, and were any others associated with organizers or participants?
• Why were they searched, and what specific crime, if any, was under investigation?
• Why was the case/reason entered as “Protest”?
• Was any information from the searches shared with federal immigration agencies?
• Did a supervisor authorize these searches?
• Under which provision of North Carolina’s statutory definition of a “law-enforcement purpose” (N.C. Gen. Stat. § 20-183.30) did these searches fall?
• How did the Sheriff’s Office obtain the plates it searched, and why were those particular vehicles selected?

Those are answerable questions. Until they are answered, the label, the timing, and a protest leader’s plate stand on the record.

We put these questions in public, in this article, on purpose. The Sheriff’s Office is invited to answer any or all of them, and DeFlockILM will publish the Sheriff’s Office’s response in full and unedited, and update this report — whatever that response says. The records raise the questions; only the Sheriff’s Office can answer them.

What the law required — and what the audit should have caught

North Carolina does not leave license-plate-reader oversight to chance. State law requires an operating agency’s written ALPR policy to provide for supervisory oversight and for the auditing and reporting of the system’s use and effectiveness to the head of the agency (N.C. Gen. Stat. § 20-183.31(a)(7)). That auditing-and-reporting requirement is a built-in accountability step.

So the question almost asks itself: what did the Sheriff’s Office’s required audit make of a set of searches its own system labeled “Protest”? We have asked for the audit and report contemplated by § 20-183.31(a)(7). If it exists and flagged these searches, that is news. If it exists and did not, that is news. If it does not exist, that may be the biggest news of all.

The bottom line

Put the pieces together. A resident with no criminal record, charged with nothing, had their license plate run through a mass surveillance network under a case the Sheriff’s Office itself labeled “Protest” — hours before they helped lead a protest against that same office. The vendor has separately promoted its broader real-time crime-center platform for monitoring and managing protests and other public events. And the audit trail that would let anyone test what happened is the part the County redacted.

We are careful to separate what the record proves from what it does not. The record does not, by itself, state the Sheriff’s Office’s purpose, and the Office can still offer an innocent one. But the unexplained facts are serious: NHCSO searched the plate of a person organizing a protest against NHCSO, hours before the demonstration, under a case labeled “Protest” and a reason listed as “Intel.” Nothing in the records produced so far identifies the crime or other law-enforcement purpose that justified that search. If there is an innocent explanation, NHCSO possesses the records needed to provide it.

How we know

New Hanover produced its Flock search audit only after repeated public-records pressure, and it redacted the fields that would most directly answer these questions — including the searching user’s identity. But it left intact the search timestamp, the network count, the search type, and the case/reason field. A public archive of Flock audit data, HaveIBeenFlocked, publishes these records keyed to a consistent, one-way hash of each license plate — enough to see that a given plate was searched, and by whom, without exposing the plate number itself. The four November 22 searches carry the case label “Protest” in New Hanover’s own production; the three plate hashes are drawn from that record; and the protest leader confirmed the match by looking up their own plate. We are not reproducing any plate number, which remains confidential under N.C. Gen. Stat. § 20-183.32.

This is the first of two reports on New Hanover County’s plate-reader records. A companion piece examines who else has been searching New Hanover’s cameras — and what the County’s redactions concealed about it.

General information for public discussion, not legal advice.