The Sheriff Enrolled You in a National Surveillance Network — With No Guardrails on Its Biggest Users.

Over the past month, five North Carolina law-enforcement agencies produced their Flock Network Audits — the log of every outside search that touches their cameras — and, unlike New Hanover County, they left the searching-agency field intact. Two beach towns and three public universities: Carolina Beach, Kure Beach, NC A&T, UNC Pembroke, and UNC Charlotte. We combined all sixteen monthly files they gave us — 10.5 million rows — into one dataset, and deduplicated it on Flock’s own unique search ID. What remains is 3,877,890 distinct searches of these five North Carolina networks in a single quarter, run by 3,904 different agencies.

These are small agencies. Two towns of a few thousand people; campus police forces. Nobody would call them the center of American law enforcement. And yet their cameras were searched almost four million times in three months by police from nearly every state in the country. That is the tell. These are not local camera systems that occasionally cooperate. They are windows into one national network — and North Carolina towns are paying to keep the windows open.

It is not a local system. It is a national one.

Of the 3.9 million searches — all of them in a single three-month window, March through May 2026 — about 90% came from outside North Carolina, and only about one in ten (9.8%) from within the state. Here are the ten busiest searchers of these North Carolina cameras. Not one of them is from North Carolina.

#	Agency that searched North Carolina’s cameras	Home state	Distinct searches
1	Houston PD (single busiest — ~1,050 miles away)	Texas	306,799
2	Texas Department of Public Safety	Texas	60,172
3	Hillsborough County SO	Florida	46,827
4	Atlanta PD	Georgia	38,034
5	Louisville Metro PD	Kentucky	37,818
6	Coweta County SO	Georgia	36,652
7	Jacksonville SO	Florida	34,916
8	Dallas PD	Texas	30,937
9	Broward County SO	Florida	26,947
10	Federal Bureau of Investigation	Federal	26,164
	All searches, all 3,904 agencies (deduplicated)		3,877,890

The single busiest user of cameras New Hanover’s neighbors paid for is a police department in Houston, Texas, more than a thousand miles away, with 306,799 searches — roughly one of every twelve. The FBI ran 26,164; the U.S. Postal Inspection Service another 11,392; federal agencies together, 37,721. The North Carolina SBI and every North Carolina sheriff, combined, are a rounding error next to Texas and Florida.

And the immigration question is no longer hypothetical. We read the “Reason” field across every unredacted North Carolina audit we hold and found 2,698 distinct searches that named immigration as their purpose — 833 of them “civil/administrative” (deportation-type), 219 tagged “I.C.E.” — run against cameras in six NC communities, almost entirely by out-of-state agencies (Florida Highway Patrol, Florida Fish & Wildlife, Tennessee and Kansas police among them). Houston, for its part, is the volume leader — 315,285 searches of NC cameras — but labeled none of them; its immigration searches surface only in Utah’s unredacted records, where a Houston physician, Dr. Jake Kushner, counted 108 in 2025 out of 1.9 million HPD inquiries. Utah could see who searched and why because Utah did not redact the field; New Hanover redacts it on all 2,980,082 lines, which is the whole reason a Wilmington resident cannot check whether the same searches ran here. The 2,698 immigration searches, in our own records →

But do not let the out-of-state totals hide who is doing this at home. New Hanover County’s own Sheriff — the office whose contract placed these cameras on the nationwide network, and which blacks out the name of every agency and officer that searches its own system — turns up in the neighbors’ logs as a searcher itself. In the five-month Network Audit that Kure Beach released, the New Hanover County Sheriff’s Office searched that four-camera beach town 5,482 times, alongside Carolina Beach PD (1,263) and Kure Beach’s own department (939). The office that will not let the public see who searches its cameras is, one town over, among the searchers.

The same searches, grouped by state

Group those searches by the searching agency’s home state — counting the entire federal government as one — and the concentration sharpens. Just three states, Texas, Georgia, and Florida, account for more than 1.6 million searches of North Carolina’s cameras between them — over four times North Carolina’s own share.

The ten busiest states, plus the federal total and North Carolina’s own, of 3,877,890 distinct searches (March–May 2026). State is assigned from each agency’s name; about 0.5% could not be classified.

The first diagram showed who reaches in. Here is the same flow the other way — where a North Carolina plate read travels when these agencies run a search. This is the direction that should worry a New Hanover resident most: not the searches coming in, but their own data going out.

The logs point to one shared national system, not five local ones

This is the strongest evidence in the dataset. When we merged the five agencies’ files, the very same search — identical down to Flock’s own unique search ID — repeatedly appeared in more than one of them at once. The records strongly indicate that these are not five separate town databases that occasionally trade tips, but doors into a common search infrastructure: a single query does not appear to check one town’s cameras, it registers across the shared network in one stroke. In this data, the median search reached roughly 6,000 separate camera networks, and each distinct search appeared, on average, in 2.7 of our five North Carolina networks at the same instant.

Put concretely: when Houston runs a search, the record is consistent with it reaching directly into the same system Kure Beach’s cameras feed — as are the FBI, Texas DPS, and 3,900 other agencies. On this evidence, a plate photographed in a North Carolina beach town appears searchable from Houston the instant the camera captures it, and New Hanover’s cameras feed the same system. We are careful not to overstate it: the audit logs cannot alone rule out every alternative architecture. But they are far more consistent with one functionally unified national search network than with five databases that stop at the county line.

Hundreds of thousands of searches are logged for a use the statute forbids

The audits also record the stated reason for many searches. Across the combined data, 341,281 carry the reason “Traffic Infraction.” North Carolina law is blunt about that use for its own agencies: ALPR data “shall not be used for the enforcement of traffic violations” (N.C. Gen. Stat. § 20-183.31(b)). A label in an audit is not, by itself, proof of a broken law: it is a reason an officer picks from a dropdown menu, not a legal finding — some may have been miscoded, and many were run by out-of-state agencies under their own rules. We are not calling any single search a crime. But a third of a million searches pointed at the one purpose the statute goes out of its way to prohibit is hard to wave off as clerical noise, and it is the fourth most common reason in the entire dataset, behind only drug, warrant, and stolen-vehicle work. And it is a floor: some agencies left the reason field blank, so the real number is higher than we can see.

To be fair: what actually crosses state lines

It matters to be precise about what an out-of-state search does and does not obtain, and we want to state it plainly. When a Texas or federal agency searches this shared network, it is not handed a copy of New Hanover’s entire camera feed. A search returns hits — detections of the specific plate or vehicle the agency queried: the plate, the timestamped and GPS-tagged images, and the make, model, and color each camera recorded. If a New Hanover or Kure Beach camera happened to photograph a vehicle that agency was looking for, the agency sees that detection — a North Carolina location, a time, an image — and can pull it into its own case file. (Flock’s own developer documentation describes a search returning vehicle detections.) What does not cross, by default, is a bulk copy of every plate these cameras read.

But do not mistake a “hit” for a thin record. A single plate search returns the queried vehicle’s location history across the network — the cameras that have seen it, and when and where — which is a map of where its driver has been. Flock has expanded these tools to find a vehicle across multiple cities and states and, through what it calls Convoy analysis, to surface the other vehicles that repeatedly travel alongside a target — a machine-built list of associates. (Government Technology.) So what an agency in another state can assemble from a single North Carolina plate is not one sighting but a pattern of life — routes, routines, and relationships — with no warrant required.

So the honest concern is narrower than “Texas has all our data” — and sharper for being narrower: every North Carolina detection an outside agency pulls into its own records then lives under that agency’s rules — its retention limit, its disclosure and sale rules, its oversight, or the absence of any — not North Carolina’s. The data that leaves is smaller than the whole. The protection that leaves with it is smaller still.

And the plate data is only half the system

Everything above concerns plate searches. But New Hanover also runs Condor cameras — a separate Flock system whose AI follows people, not plates, streaming live and recorded video, and in this county one of them points at a children’s soccer field at Veterans Park. A plate search does not return that video, and live feeds default to the host agency — so an out-of-state plate search is not, by itself, pulling up Veterans Park. But Flock lets agencies share video with one another, and New Hanover has not disclosed how its Condors are shared, or who can view them. An audit trail catches misuse only after it happens, not before. And the exposure is not hypothetical: in late 2025, security researchers found Flock had left dozens of Condor cameras livestreaming on the open internet — no password, unencrypted, with a month of archived video anyone could download. Among the feeds strangers could watch were cameras zoomed in on children on playground swings. (404 Media.) Who can watch Veterans Park, and under what rules, is one more question the county has left unanswered.

Your plate is only as protected as the state that’s searching it

Here is the part that should trouble anyone who assumes state law is protection enough. North Carolina does have real rules for its own agencies: delete the data within 90 days (warrants and preservation requests can hold it longer), use it only for a short list of law-enforcement purposes, no traffic enforcement, and disclose it only to law enforcement, for a legitimate purpose, on a written request. On paper, that is real protection. We think it is thinner than it looks.

The audit is thin, and the “written request” may be a formality. The only audit the statute requires is annual — and in New Hanover County it is conducted by the same official who administers the system and controls access to it, auditing his own program. There is no requirement for an independent, outside audit, and none for a system-security audit at all. As for the “written request” that is supposed to gate every disclosure: across every production we have collected, we have found no separate written requests for the data. In practice, agencies appear to treat the network-sharing switch being turned on — plus an out-of-state agency running a search — as itself the “written request.” Whether that satisfies the statute is undefined: the term is not spelled out in the law, and no North Carolina court has ruled on it.

And even taken at face value, these rules govern North Carolina agencies. They do not — and cannot — dictate what a Texas police department or a federal agency does with the data once a search pulls it across the shared network. Flock’s own founder says that patchwork is by design: asked about the lack of guardrails, CEO Garrett Langley told CNN the company builds its system so that “every city, county or state can adopt this technology” and set its own limits. (CNN, July 26, 2026)

So we looked up the ALPR statute in each of the top searchers’ states, and held it against North Carolina’s. Here is how the rules that govern your license plate change depending on who is searching it:

Sources: N.C. Gen. Stat. §§ 20-183.30 to .33; Fla. Stat. §§ 316.0777–.0778; O.C.G.A. § 35-1-22; Kentucky KRS 189.632 (HB 58, effective July 15, 2026); Texas — no enacted comprehensive law-enforcement ALPR statute (regulatory bills died in committee, 2023–2025); Federal — no comprehensive ALPR statute (agencies remain subject to the Privacy Act, 5 U.S.C. § 552a, and internal policy). * Georgia’s 30-month rule and Florida’s traffic-citation ban carry statutory exceptions (Florida’s applies to state right-of-way systems, and its day-count is set by administrative schedule, not fixed in statute); Kentucky restricts access and sharing tightly but has no express public-records exemption. “None / No rule / No ALPR ban” means no ALPR-specific statute on that point — general criminal, constitutional, public-records, and contract law, plus agency policy, may still apply.

The pattern is stark. The two largest categories of agencies searching North Carolina’s cameras — Texas police (Houston, the busiest of all, plus the state DPS and Dallas) and the federal government (the FBI) — are not covered by any comprehensive ALPR statute like North Carolina’s: no retention cap, no audit requirement, no defined use limits written into the law. (Other laws, agency policy, and the Constitution can still apply — there just isn’t an ALPR rulebook.) Georgia, home to several of the heaviest searchers, generally allows the data to be held thirty months against North Carolina’s ninety — with broad exceptions — and its law reaches the traffic and toll enforcement North Carolina forbids. The point is not that every out-of-state search breaks a rule.

Can they sell it? That is the question residents ask most, and the answer should stop a commissioner cold. Of the ten states whose agencies search North Carolina’s cameras most, exactly one — Kentucky — clearly bars selling this data by statute. The other nine do not. Texas, Ohio, Indiana, and South Carolina have no ALPR statute at all; Georgia, Florida, and Tennessee have statutes that never address a sale; Alabama restricts it only by administrative rule; and Illinois bars a sale only when the purpose is abortion- or immigration-related. North Carolina forbids its own agencies from selling plate data outright — but the moment a plate is pulled by an agency in one of those nine states, that protection is gone.

Sale sources: North Carolina G.S. § 20-183.32 and Kentucky KRS 189.632 expressly prohibit sale. No comprehensive ALPR statute found in Texas, Ohio, Indiana, or South Carolina; Georgia (O.C.G.A. § 35-1-22), Florida (Fla. Stat. § 316.0777), and Tennessee (Tenn. Code § 55-10-302) regulate ALPR but do not prohibit a sale; Alabama bars sale by administrative rule (Ala. Admin. Code r. 265-X-6-.04), not statute; Illinois (625 ILCS 5/2-130) bars a sale only for abortion- or immigration-enforcement purposes. This area is changing quickly; verified against primary statutes and the LAPPA 50-state survey as of August 2026.

The protections North Carolina writes for itself do not travel with your plate

That is the heart of it. The Sheriff did not merely enroll New Hanover residents in a nationwide network; he enrolled their vehicles in a system where the rules that apply depend on whoever is doing the searching — and North Carolina’s are among the strictest in the country.

Bring that home to New Hanover. We cannot show you the county’s own sharing setting — it withheld the configuration, the same kind of record it redacts for plates — but the evidence points one way: New Hanover’s network logged 2.98 million outside searches, which does not happen unless the network is shared widely, and every peer agency that did disclose its setting had sharing turned to “Nationwide.” So while the county will not confirm the switch, a Houston officer plainly reaches a New Hanover plate. North Carolina forbids its own agencies from selling this data or disclosing it to anyone but law enforcement. But once a plate has been searched from Texas, it is in Texas’s hands, under Texas law — and Texas has no ALPR statute barring a sale, no law-enforcement-only disclosure rule, no plate-data rule stopping it from moving on to a private party. Other law might still reach it — a general privacy statute, the terms of a contract, the Fourth Amendment — but there is no purpose-built backstop for this data the way North Carolina built one. The protection North Carolina wrote is real. It also stops at the state line, and nothing written for plate data carries it forward.

And the county’s own contract reaches further than the statute, in our reading. New Hanover’s Flock agreement (Contract #25-0364, p. 14) provides that Flock itself may access, use, preserve, and disclose footage not only to law enforcement but to “government officials and/or third parties” whenever the company has a good-faith belief it is reasonably necessary to comply with legal process, enforce its agreement, or address security, privacy, fraud, technical, or emergency matters. North Carolina law permits this data to be disclosed only to law enforcement, for a legitimate law-enforcement purpose, on a written request, and forbids selling it. We think a contract that lets a private vendor hand the data to third parties on its own good-faith judgment appears difficult to reconcile with a statute that limits disclosure to law enforcement — and it is one more question the Board should be asking before it renews a dollar of this.

The misuse is not hypothetical, either. In that same report, CNN counted at least two dozen officers who resigned or were arrested for using Flock to stalk romantic interests; in a single recent month, five officers in Albany, Georgia were arrested and fired for misusing it, and two in Greer, South Carolina were fired. We already know Georgia agencies search North Carolina’s cameras: the very Georgia sheriff’s offices whose officers were charged for Flock abuse appear in UNC Pembroke’s audit. And North Carolina just charged its own officer for the same conduct. Every one of them reached into a shared network to do it. The question in front of New Hanover is why its Sheriff keeps this county in a pool that large, that lightly governed, and that far outside his control — or the state’s.

What supporters will say — and our answer

The case for this network is real, and we will state it fairly. Sheriffs argue that nationwide reach is the whole point: a stolen car, a fugitive, an abducted child, or an interstate trafficking route does not stop at the county line, and a camera that can be searched only locally is far weaker against crimes that cross state lines. Flock argues that the very audit logs we relied on are the safeguard — every search recorded, attributable, and reviewable, which is how misuse gets caught in the first place. The examples are real and recent. This class of camera helped locate the suspect in last year’s Brown University shooting; and just this week, a deputy in Lucas County, Ohio used Flock to find a missing girl in under thirty minutes, reaching a suspect who turned out to be carrying a loaded handgun. The captain there said that without the system, they might “still have a missing teen.” (WECT.) We take that seriously, and so should anyone. Even measured outside voices grant the investigative value: Thaddeus Johnson, a former law-enforcement officer now a senior fellow at the Council on Criminal Justice, told CNN that ALPRs can improve certain investigations but do not, on their own, make a community safer — that turns on the policies, guardrails, and oversight around them. (CNN, July 26, 2026.)

So here is our answer, and the first half of it is a concession: we do not dispute that the system can work. Effectiveness was never the question. The question is at what cost, and to whom. The very tool that found that child in thirty minutes is the tool that logged, in these five North Carolina networks alone, nearly four million searches of everyone who was not missing — overwhelmingly by agencies in states that never voted on it. “It works” is not a blank check. By that logic you would put a camera on every porch and a reader on every corner, because that would “work,” too — the case we made, straight-faced, in a modest proposal to simply watch everyone and in the Casa Grande town-council satire. The joke in both is that if efficacy alone justifies surveillance, it justifies unlimited surveillance — which is exactly why efficacy cannot be the whole test.

And whatever the cost turns out to be, none of it requires secrecy. If the audit log is the safeguard, the public is entitled to see it — and five North Carolina agencies agreed, releasing the searching-agency field with no apparent harm to any investigation. If nationwide access is worth the trade, let the Board weigh it in the open, on the record, at a public meeting — which is exactly what never happened here. Policy arguments are meant to be won or lost in daylight; the one thing that cannot be defended is making the choice in the dark. That alarm is not ours alone: in national reporting the same month, the ACLU’s senior policy counsel, Chad Marlow, described local ALPR systems knitting into a nationwide vehicle-tracking network, and noted the opposition now runs clear across the political spectrum. (CNN, July 26, 2026.)

No vote. No hearing. No one asked you.

Step back from the numbers, because the most important fact about this network is how New Hanover County came to be on it. Nobody voted for it. The county’s roughly $219,000 Flock contract (#25-0364) was signed administratively, and we can find no public hearing, no comment period, and no recorded vote of the elected Board of Commissioners approving the program. There was never a night when residents were invited to weigh in before the cameras went up. The people whose vehicles are now searchable from Houston, and by the FBI, were never asked.

That is the quiet part, and it is the heart of it. A surveillance system of this reach — millions of searches, thousands of agencies, other states’ rules — was adopted the way one renews a software subscription: by signature, without the public ever having its say. August 17 is the first time that changes. It is the first scheduled chance for New Hanover residents to stand in front of the board that funds this and be heard on whether the county should be part of it at all.

Why this is New Hanover’s story

New Hanover County is on this exact network. Its own Flock audit logs 2,980,082 searches over sixteen months — a longer window than the three months above, so not a like-for-like comparison, but the very same nationwide network. The difference is not the surveillance. The difference is that the five agencies here let you see who is searching, and the Sheriff will not. On all 2.98 million of New Hanover’s rows, the searching agency is blacked out to “***.” Kure Beach released that field. NC A&T released it in eleven days. Carolina Beach released it after a records letter. UNC Charlotte released it. The one agency in this county that answers to no city council — the Sheriff’s Office — is the only one insisting the public may not know which out-of-state and federal agencies are searching cameras New Hanover taxpayers fund.

So we can now say plainly what the redaction hides. It is not sensitive tactics. It is the fact that the Sheriff enrolled the people of this county in a nationwide surveillance network — one where the FBI, the Postal Inspection Service, and a police department in Houston are among the heaviest users — and that he did it with a memo describing a limited local plate reader. The records of five neighboring agencies show what that network actually is. We are pressing New Hanover, through a request for mediation, for the single field — the searching agency — that would let residents see their own county’s version of this same picture. Every one of these agencies proves it can be released. Until it is, no New Hanover resident can confirm whether Houston, or the FBI, is searching their plate the way the records next door prove it is searching everyone else’s — and that inability to check, more than any single number in this article, is the story.

There is a decision point. On August 17, the five commissioners who fund this contract meet — and the county’s own agreement lets them cancel it at any time, without cause. The question in front of them is no longer whether Flock is a handy local tool. It is whether New Hanover County should keep paying to be a node in a national network it cannot see into — on a system its own Sheriff will not let the public audit.

How we counted — and how to check it

Every figure here is our own count of the five agencies’ own audit files — 10.5 million rows, deduplicated on Flock’s per-search ID to 3,877,890 unique searches. The whole thing is open: the sixteen source files, their SHA-256 fingerprints, the code, and the deduplicated dataset are laid out in our methodology write-up, so any reporter can reproduce or challenge these numbers. And it is a living count — we have records requests still pending with other North Carolina agencies for the same March–May 2026 window, and will fold their data in as it arrives (the figures can only grow). Follow the open requests in our records repository.

Figures are DeFlockILM’s own tally of the Flock Network Audit files produced by the Carolina Beach and Kure Beach Police Departments and the police departments of North Carolina A&T State University, UNC Pembroke, and UNC Charlotte (March–May 2026), deduplicated on Flock’s per-search identifier. Searching-agency identity is taken from the “Org Name” field as produced; individual searcher names and plate numbers are redacted in the source files and we attribute no search to any named individual and allege no wrongdoing by any specific searcher. “Outside North Carolina” is determined from each agency’s name (its two-letter state code or full state name; the federal government counted as one); about 0.5% could not be classified. UNC Charlotte’s and Kure Beach’s original monthly files were truncated at Excel’s 1,048,575-row limit, so the combined totals here are a conservative floor. Kure Beach has since re-exported in complete form: its five-month Network Audit alone holds 2,560,152 unique searches, 92.5% from outside North Carolina (see its page). We are re-ingesting the complete Kure and UNC Charlotte exports and will revise the combined figures. This article describes public records and is general information, not legal advice. If any figure here is wrong, write to mark@deflockilm.org and we will correct it in public. First published August 1, 2026; updated August 6, 2026. Full methodology, source files, and code: How we counted.