Surf City Has Run Flock Since 2023 — and Shares It With 187 Agencies

On September 15 we asked the Town of Surf City for its automated license plate reader (ALPR) records, ahead of the Council’s September 17 work session on the subject. Credit where it’s due: the Town Clerk produced the core of it in two days — the contract, the policy, the vendor records, the memorandum with the State Bureau of Investigation, and, unusually, the complete list of agencies the Town’s cameras are shared with. Most agencies fight that last one for months. Surf City handed it over. What it shows is worth a close look.

This was never a fresh decision

The September 17 session was framed as information and input — a discussion about whether and how to use this technology. But the records show Surf City signed a five-year agreement with Flock Safety in November 2023, and has been buying “Flock Safety Falcon” cameras on Town purchase orders ever since. The program has been running for nearly two years. That doesn’t make it wrong — but residents should understand they were being briefed on a system that is already live, not asked whether to start one.

The part worth reading: who the cameras are shared with

Surf City’s Flock “shared networks” file, dated September 1, 2026, lists 281 organizations. The Town is actively sharing its cameras out to 187 of them, and receiving from 202. That list is not confined to the Cape Fear, or even to North Carolina. It includes out-of-state police departments — among them Houston, Texas and Fort Worth, Texas, and agencies in Georgia, Florida, South Carolina, Delaware, Tennessee, Pennsylvania, Alabama, Michigan, Indiana, and Louisiana — along with the North Carolina State Bureau of Investigation and the South Carolina State Law Enforcement Division.

So when a plate is read on a Surf City street, that read is reachable by 187 agencies, most of which have nothing to do with Surf City, several of which are a thousand miles away, and none of which the Surf City Town Council appears to have voted to share with.

What the Town told residents, next to what it produced

The presentation the Town prepared for the meeting addresses the sharing question directly. Under “fear vs. fact,” it tells residents that Surf City “owns and controls its ALPR data,” that “no local, state, or federal agency has automatic access,” and that “any outside sharing is discretionary and controlled by us.”

Read narrowly, that can be true at the same time as the shared-networks list — each share is a setting the department chose to switch on, so the access isn’t “automatic” in the sense that Surf City enabled every one of the 187 connections deliberately. But that is the point, not the reassurance it’s meant to be. “Discretionary” means someone at the department decided to send this town’s plate data to Houston, to Fort Worth, to the SBI, and to 184 other agencies — and residents and the Council are seeing that list, for the first time, in a records production. The honest version of the slide is: we share with 187 agencies, and we chose each one.

The “transparency portal” isn’t transparent

Surf City points residents to a Flock “Transparency Portal” from its Town ALPR page. It is a marketing dashboard, not a record you can check — and several of its claims don’t survive contact with the Town’s own production.

• There’s no data on it. The portal publishes round-number summaries — and no downloadable file, no CSV, and no audit log. Above all, it does not show the one field that matters: which agencies searched Surf City’s cameras. The entire “who is searching” question — the reason these records matter — is simply absent. (This is the pattern across the state; we’ve documented why Flock’s transparency portals aren’t transparent.)
• “21 searches” hides the exposure. The portal’s headline “Number of Searches: 21” counts only Surf City officers’ own search sessions in 30 days. It says nothing about the 187 agencies Surf City shares with — how often they reached into Surf City’s cameras, or why. Meanwhile the same page reports 102,926 plate reads in 30 days in a town of roughly 3,000 residents. The portal foregrounds the Town’s 21 clicks and leaves out the national reach it switched on.
• “What’s Detected: License Plates, Vehicles.” Even the portal concedes it captures “Vehicles,” not just plates — that’s Flock’s “vehicle fingerprint” (make, model, color, decals, bumper stickers), which identifies a car with or without a readable plate. And the vendor’s own patent describes a system built to do far more than read a tag. “License plates” is not the whole of what these cameras record.
• The prohibited uses bind Surf City — not its 187 partners. The portal lists “immigration enforcement” and “traffic enforcement” as prohibited. Good — for Surf City. But those rules govern Surf City’s own officers; they have no force over the agencies it shares with, each operating under its own state’s law. Surf City shares its network with Houston, Texas PD, among others — and once a read reaches an outside agency, Surf City’s prohibitions don’t travel with it. A department cannot “prohibit” a use by a partner it has handed the keys to. (Houston and other out-of-state agencies have, in fact, run immigration-labeled searches on the shared Flock network.)
• “Flock’s cloud environment has never been breached.” That’s an absolute claim, and a hard one to square with the record. Weeks ago, WBUR reported that Flock failed to properly secure the vehicle data it collected during a 2025 Boston Police pilot — a documented security failure. A blanket “never been breached” is exactly the kind of unfalsifiable assurance a transparency page should not rest on.
• The portal’s own words undercut “you control your data.” Under the “Flock shares your data” myth, the page admits: “Other agencies who you share footage with have been responding to FOIA requests and sharing this search data.” That is the concession. Once Surf City shares, the data sits in 187 other agencies’ hands, released under their disclosure rules, not Surf City’s. “We control our data” and “187 agencies are releasing it under their own laws” cannot both be the whole story.

What’s actually solid here

We’re not going to overstate this. Surf City’s ALPR policy is better than several we’ve read: it sets a 31-day retention period — below North Carolina’s 90-day cap — limits use to authorized law-enforcement purposes under N.C. Gen. Stat. § 20-183.31(b), requires a case or call-for-service number for searches, and commits to monthly audits. Those are real safeguards, and the Town deserves credit for a fast, substantive records production. The contract also bars Flock from selling the data.

But a policy governs Surf City’s own officers. It does not govern what 187 outside agencies do with a plate read once it reaches them, under their own rules, in their own states. North Carolina’s protections don’t travel with the plate — once a Surf City read reaches a Texas or Georgia agency, it lives under that state’s law, not ours. That is the gap between “we control our data” and where the data actually goes — and it is exactly the question a Town Council should put to a vote before the network grows further.

The ask

Surf City straddles Pender and Onslow counties, and its residents deserve the same thing every Cape Fear community does: the chance to see the sharing list, decide as a community which agencies — if any — should reach their plate data, and put that decision on the record with a vote. The Town has shown it will produce the records. The next step is for the Council to look at what’s in them — and to hear from the people they represent. Email the Surf City Town Council and tell them where you stand: review the sharing list, and put it to a recorded vote.

The full production — the contract, Policy 4.43, the shared-networks list, the SBI memorandum, the vendor records, and the Council presentation — is mirrored at the Internet Archive. General information on public records and ALPR policy, not legal advice.