What’s in the Audit Logs: How to Read a Flock Search Trail

The three reports, quickly

When an agency runs Flock, three exports tell the story — and all three download as CSV spreadsheets from the platform’s Insights tab, which is why we name them by name in every records request:

• Organization Audit — every search your agency ran on its own cameras.
• Network Audit — every search any agency in the Flock system ran against your agency’s cameras. (This is the one that exposed 2.98 million searches of New Hanover County’s network.)
• Event Log — system events: logins, exports, configuration changes.

The columns, decoded

Open either audit CSV and you’ll see the same columns. Here’s what they actually mean:

• Search Time — the timestamp. Your most powerful column: it reveals volume, spikes, and after-hours activity.
• Org Name — the searching agency. In a Network Audit, this is who reached into your cameras. (New Hanover redacted it.)
• Name — the individual operator who ran the search. (Also redacted by New Hanover — the heart of our demand letter.)
• Reason — a free-text field the officer types to justify the search. Quality varies wildly — more below.
• Search Type — plate lookup, hot-list hit, “Nova” person search, and so on.
• License Plate / Text Prompt — the actual query. (Plate usually redacted; the text prompt can be revealing.)
• Case # — the investigation number, if the officer bothered to enter one.
• Camera Count, Time Frame, Filters, Moderation — the scope of the search.

How to actually crunch it

For a small file, a spreadsheet is plenty. Drop it into Excel or Google Sheets and build a PivotTable: rows = Org Name, values = count of ID, sorted descending. In sixty seconds you have a ranked list of who searched the most. Add Reason as a second field to see how they justified it.

New Hanover’s audit has nearly three million rows, which will make a spreadsheet cry. For that, a few lines of Python with pandas do the job:

import pandas as pd
df = pd.read_csv("network_audit.csv")
print(len(df), "searches total")
print(df["Org Name"].value_counts().head(20))          # who searched the most
print(df["Reason"].value_counts(normalize=True).head()) # how good were the reasons?
df["Search Time"] = pd.to_datetime(df["Search Time"])
print(df.groupby(df["Search Time"].dt.hour).size())     # what hours of day?

What to look for — the red flags

• Sheer volume. Start with the row count. New Hanover’s network was searched ~2.98 million times in 16 months. Context matters: nationally, for every one search a local agency runs on its own cameras, its data gets queried hundreds of times by other agencies through the network.
• Junk reasons. Sort the Reason column. You’ll find a lot of “Investigation,” “None,” single letters, and blanks. Vague reasons aren’t an accident — an FBI bulletin reportedly urged agencies to keep Flock search reasons vague to frustrate records requests. A reason field that says nothing is itself a finding.
• One person, thousands of searches. Group by operator. A single Colorado officer was found to have run nearly 20,000 searches; elsewhere, an audit caught an officer running 179 searches for personal reasons. Outliers are where the misuse hides.
• Repeated hits on one plate. The same plate searched over days or weeks can signal someone being personally tracked — an ex, a journalist, a protester.
• Out-of-state and federal searchers. In the Network Audit’s Org Name column, look for agencies a thousand miles away — or federal ones. That’s how local cameras feed national and immigration enforcement.
• Reasons that name protected activity. Search the reason and text-prompt fields for words like “protest,” “church,” “journalist,” or “immigration.” That’s the work Have I Been Flocked built its reporting on.

The wall you’ll hit — and why it matters

Here’s the catch in our own data: New Hanover produced the audits but redacted the Name and the searching agencies. You can see the volume, the timing, the reasons, the search types — everything except who. That’s not a technical limit; it’s a choice, and it’s exactly what our demand for the unredacted names is about. An audit log with the accountability column blacked out is a receipt with the signature torn off.

An honest caveat

Audit logs are powerful, but they’re not a polygraph. The officer types their own reason, so a determined bad actor can simply lie — type “investigation” and move on. The log captures only what Flock chooses to log. As the ACLU has argued, audit logs alone are a weak check without independent review. So treat them as a map of where to dig, not a verdict: the patterns point you at the questions; records requests and public meetings are how you get answers.

Do it yourself

Any North Carolinian can request these exact reports — the Organization Audit, the Network Audit, and the Event Log — using our records-request template. Pull the CSVs, run the analysis above, and send us what you find. The surveillance grid keeps its own receipts. We just have to read them.

Sources & tools

• Have I Been Flocked — Audit Logs explained · the tool
• ALPR Watch — Flock FOIA data · Footnote4a — Flock vs. FOIA
• 9News — officer ran ~20,000 searches · DeFlockILM — Three Million Searches, Zero Names

General information for transparency and education, not legal advice. Figures cited are from public records and the linked reporting; reason-quality statistics come from third-party FOIA analyses and may vary by agency. Last updated June 29, 2026.