The Sheriff Answered the Questions. His Answers Confirm the Problem.

Here is the through-line, and it is the whole reason this matters: a commitment to no outside review, and to redacting what the public is entitled to see, is not a neutral administrative choice. It is the same kind of commitment that — in the wrong hands — produces a J. Edgar Hoover. Hoover’s power was never the wiretaps themselves. It was that no one outside his building could see what he did with them. Sheriff McMahon is not Hoover, and we are not saying he is. But he has just told a county commissioner, in writing, that he intends to keep the two conditions that made a Hoover possible: the audit stays inside the office, and the record stays redacted. Design the system for the worst sheriff you will ever elect, and this is precisely the answer you do not want to hear. (What if Sheriff Hoover had Flock cameras?)

First, the fair part. The Sheriff described real steps, and we will state them plainly: he has cut data retention from 90 days to 30, committed to a monthly audit, requires two-factor authentication and individual user accounts, is building a public transparency portal, says the office has never sold or commercially shared the data, says the LPR policy is a public record, and says the office does not enforce federal immigration law. Those are improvements, and Commissioner Walker deserves credit for asking the questions that produced them. (The full Q&A is at WHQR; WECT Investigates published the answers in full on Aug 25.)

Now the part that matters. Three of the Sheriff’s answers confirm exactly the design problem we have been pointing to — not a prediction about a bad actor, but the structure itself.

1. He audits himself. No one outside his office has standing access.

Commissioner Walker asked whether anyone outside the Sheriff’s Office would have standing access to the audit logs. The answer:

“No. The audit will be conducted internally by my staff, and I will personally review the audit each month.”

That is the whole issue in two sentences. The one official with the most power to misuse a searchable record of where residents drive is also the only person who reviews how it is used. He adds that if he or his staff spot a problem, he will refer it to the District Attorney and request an SBI investigation — but read that carefully: it is discretionary and reactive. It depends on the Sheriff’s own office flagging the Sheriff’s own office. There is no independent, recurring review, because North Carolina law does not require one — and the Sheriff has now confirmed he will not add one voluntarily. (Why an internal-only audit is the fatal flaw.)

2. Misuse stays sealed — unless it becomes a crime.

Asked whether confirmed misuse would be reported to the Board and the public or only reviewed internally, the Sheriff pointed to personnel-confidentiality law and drew the line himself:

“If a deputy or other employee were to misuse the system in a manner that resulted in criminal charges, that criminal matter would be a public record… We will not use personnel confidentiality laws as a means of concealing criminal conduct.”

We take him at his word on criminal conduct. But look at what the sentence leaves out. Misuse that does not rise to a criminal charge — a search run out of curiosity, a favor for a friend, a look at an ex — is exactly the category that personnel confidentiality keeps sealed. Unless a search becomes a crime, the public never learns it happened. That is not a hypothetical: it is precisely the gap that let misuse in other departments surface only when a chief chose to announce it. (The misuse you’ll never hear about.)

3. He will keep redacting — more than the statute requires.

Asked whether the office would continue redacting the identity of every searching agency and officer in its audit records, the Sheriff said yes:

“Yes, the Sheriff’s Office will continue to redact information that is not a public record or that is otherwise protected from disclosure under North Carolina law.”

Here is our disagreement, stated plainly. North Carolina’s ALPR statute makes the captured plate data confidential — the images and reads themselves. It does not obviously make confidential the identity of which agencies searched the system, which is a different record entirely: it is the record of how a public power is being used, and by whom.

And we are not speculating that this can be released, because other North Carolina agencies already have. When we requested the same audits from a set of NC agencies — Buncombe County among them — they produced the names of the organizations that searched their cameras, unredacted. We built an entire analysis of who is searching North Carolina’s Flock network out of those logs. (Who is searching North Carolina’s cameras.) So the question answers itself: if peer agencies can disclose which departments searched their data, what is the New Hanover Sheriff’s Office hiding that theirs was not?

Let us be scrupulously fair about what we are — and are not — asking for. We have never asked for the identities of the individual officers who ran searches. When one agency’s production actually included them, we redacted the officers’ email addresses ourselves before publishing anything — we do not believe law-enforcement officers’ personal contact information belongs on the internet. Our request is narrower than the Sheriff’s answer implies: not the names of deputies, but the names of the agencies reaching into a network New Hanover residents pay for. That is public-accountability information — and it is exactly what the county blacks out, roughly 96% of the searching-agency names redacted, on a system searched nearly three million times. “Protected from disclosure” is doing a great deal of work for information the statute may not actually protect. (The 2.98 million searches.)

The Sheriff also points to a coming transparency portal. But the portal his office already runs is worth a look before anyone treats it as the answer: it counts only the office’s own searches — not the roughly 90% run against these cameras by outside agencies — it hides the camera locations, and the public cannot even archive what it shows. A portal that cannot tell you who searched your plates is not transparency; it is a dashboard the office controls. (The “transparency portal,” fact-checked.)

And three admissions worth putting on the record

The answers also confirmed several facts the county had been vague about:

• Federal access is real, and now it is named. Asked to confirm whether federal agencies have access, the Sheriff listed six with active sharing agreements: the Federal Bureau of Investigation, the U.S. Postal Inspection Service, the Tennessee Valley Authority Police, Wright-Patterson Air Force Base (Ohio), the Natchez Trace Parkway / National Park Service (Mississippi), and the Indiana Dunes National Park Police. He fairly notes that participating in the sharing network is not the same as unrestricted access to the whole database — but the fact of federal access, including the FBI, is no longer in question.
• Searches are not tied to a case number. “Our policy does not currently require every search to be tied to a specific case number,” the Sheriff wrote — only a “purpose code.” That is the same self-reported-reason field that, in the Mooresville case, an officer filled in 31 times while tracking a personal target.
• Eight pan-tilt-zoom cameras. Beyond the 28 plate readers, the office runs eight PTZ cameras in county parks — WECT reports one appears to sit at Veterans Park, overlooking the soccer fields. The Sheriff says they are not Condor units and are not used to track individuals — but they are still cameras that pan, tilt, and zoom, and North Carolina has no ALPR-style statute governing PTZ video at all. We take the distinction at face value and hold the point that matters: eight county-run video cameras that can sweep and zoom, in public parks, under no state rulebook. Separately, he confirmed the county’s cameras are distinct from the 19 state-road cameras that logged more than 35 million reads under the SBI program in about seven months.

And what the answers left out

Answering a commissioner’s questions is not the same as answering all of them — and one of the people he did not answer is us. On July 22 we emailed the Sheriff directly, asked for comment, and confirmed by phone that his office had received it. We never heard back. He answered a commissioner in writing while leaving the residents’ organization, and the press, without a reply. Here is what the written answers still do not resolve:

• Retention is shorter — but is the data still leaving? Cutting retention from 90 to 30 days only matters if the data is not copied out first. The Sheriff did not confirm that no plate data is exported through Flock’s API into another system and retained there. A 30-day clock on one database means little if a copy lives somewhere else.
• “We don’t sell it” is not the whole question. We take the Sheriff at his word that his office does not sell the data. But that sidesteps what happens downstream: once New Hanover’s data is searched and pulled by an agency in a state with weaker rules than North Carolina’s, that state’s law governs the copy — and some permit commercial sale. We have already documented Texas reselling North Carolina plate data. (How NC data ends up for sale.) North Carolina’s protections stop at the state line — and out-of-state agencies are not a hypothetical here; they are most of who searches our data.
• Federal immigration use is not hypothetical here. The Sheriff says his office does not enforce immigration law — but the region’s own records tell a broader story. Immigration-labeled searches are documented against UNC Pembroke’s cameras, and the Kure Beach and Carolina Beach records show direct federal sharing partners — the same nationwide pool New Hanover shares into. He controls his own deputies; he does not control what the outside agencies he shares with do with a New Hanover match.
• The 36 cameras are the tip. The answers describe 28 plate readers and 8 park cameras — and stop there. They say nothing about the Sheriff’s separate “Connect New Hanover” program, an Axon Fusus camera-integration platform that registers private and business cameras and, at Level 2, gives the Sheriff’s Office direct access to those live feeds through a plug-in “CORE” device. The program’s own site reports 2,147 registered cameras and 716 already integrated for direct live-feed access — and, per the Sheriff’s own privacy FAQ, Axon Fusus AI that can “automatically recognize weapons, vehicles of interest.” The 36-camera Flock contract is the part with a public debate; a county-run, AI-assisted camera network dozens of times its size is the part almost no one is talking about. (connectnewhanoversheriff.org · what a Fusus real-time center does.)
• Where does it all flow? The Sheriff described Flock’s agency-to-agency sharing — but said nothing about whether the county’s camera data (the Flock reads and those integrated Connect feeds) is fused into a real-time crime center, forwarded to the SBI in Raleigh under the now-permanent state program, and onward to federal partners at the Department of Homeland Security. The pieces are all here: a Fusus platform, an SBI pilot the office joined, and federal sharing agreements including the FBI. Is that pipeline live? He did not say — and no one has asked him directly.

Kudos to Commissioner Walker — and the questions still unanswered

Commissioner Stephanie Walker did what oversight is supposed to look like: she sent the Sheriff a serious, specific list and then made the answers public. That deserves real credit, and it produced the admissions above. But her list did not cover everything, and before the commissioners take this back up in September, the rest has to be asked. Set her questions against the eight we proposed for the public hearing, and here is what the Sheriff still has not been asked — or answered:

• The warrant question. Does an officer need a warrant, or any judicial approval, before searching weeks or months of stored location data about a person — or can a retrospective search run on a deputy’s own judgment? (Walker asked about case numbers; not about warrants for historical searches.)
• The county’s legal and financial exposure. Has the County Attorney evaluated the county’s litigation exposure — and does Contract No. 25-0364 require Flock to indemnify New Hanover for legal costs if the system or its data-sharing is held unlawful? If not, who pays?
• The mechanism, not the policy, for out-of-state data. What technical or contractual mechanism — not a policy sentence — stops an out-of-state or federal agency from retaining or redistributing residents’ movement data? Can the county compel deletion once a record leaves the state, and is any out-of-state user ever audited?
• The advanced search tools. Does the system include vehicle-fingerprint or convoy-style tools that group and track vehicles, and can a law-abiding resident opt out?
• The Veterans Park camera. What assessment justified a pan-tilt-zoom live-video camera overlooking the children’s soccer fields at Veterans Park, and what independent security assessment has been performed on these devices — given the published research that found Flock cameras exposed on the open internet? (The soccer-field camera.)
• The cost and the exit. What is the full recurring annual cost, is there any cap on the number of devices, and will the county confirm on the record that Addendum Paragraph 29 permits termination at any time, without cause and without penalty?

If the program is what its defenders say it is, every one of those answers should be easy.

What this means before September

Give the Sheriff genuine credit for answering a commissioner in writing where he declined the press. But answering is not the same as fixing. Every safeguard he described is one he set, that he reviews, and that he can change — and the single review that would catch abuse is his own office’s, disclosed at his own discretion. That is the design, and it does not become safe because the current officeholder is careful. It has to hold up for the next one.

The fix is not a better internal audit. It is the one thing the Sheriff confirmed he will not do on his own: independent, external review; unredacted audit logs; and a public vote before the program expands. The commissioners fund this contract. They can require those terms — or end it. (The model resolutions · who has the authority · show up September 21.)

Sign the petition Email your commissioners

Quotations are from Sheriff Ed McMahon’s written answers to Commissioner Stephanie Walker, as published by WHQR (Benjamin Schachtman, Aug. 23, 2026). General information for public discussion, not legal advice; the reach of North Carolina’s confidentiality and public-records statutes as applied to ALPR audit logs is a contested legal question. Corrections: info@DeFlockILM.org.