The Facts

What Birmingham residents need to know about the camera network watching our streets: how big it is, who runs it, what the state requires, and what the city will not say.

What Are Flock Safety Cameras?

Flock Safety cameras are Automated License Plate Readers (ALPRs) that capture and store data about every vehicle that passes by. They record license plate numbers, vehicle make, model, color, and timestamps with GPS coordinates. This data is stored in a nationwide network accessible to thousands of law enforcement agencies across the country.

Unlike red light or speed cameras that are triggered by violations, Flock cameras record every vehicle, every time—whether you're committing a crime or just driving to work.

The Alabama Power Contract: A Timeline

September 2018: City signs a pilot surveillance contract with Alabama Power.

March 2022: State rule requires a published LPR policy before capture. Birmingham never publishes one.

May 2024: Council consolidates the program into a $5.4 million Master Contract.

March 2025: Council amends the contract so new cameras are paid from a $4.2 million federal DOJ grant.

July 2025: Council raises the contract to $9.7 million. Alabama Power confirms electricity is about $3,000 a month; the rest is camera service.

February 2026: Alabama Power, not Flock, signs the state data security agreement.

August 2026: The police department gives its written LPR policy to a reporter. It has still not published it.

See every camera on our map.

How Many, and Where

• Inside Birmingham: 399 devices in service (297 readers, 100 edge boxes that pull other camera feeds into Flock).
• Three-county metro: about 1,500 in service.
• Alabama total: 3,626.

Birmingham's Own Record

• 419,000 searches since March 2022, the most of any agency in Alabama.
• 1,581 "training" searches. 71 of them swept more than 50,000 cameras nationwide. The officer's name is redacted in 1,555 of them.
• No case number on 93.8% of searches.
• Civil matters: 43 searches for "tow" and 24 for "repo," each hitting about 6,400 law enforcement agency networks.
• Birmingham has no reported misuse case. Three other Alabama agencies did this year, all caught by audits. Birmingham's audits, if they occur, have never been published.

The State Rule Birmingham Ignores

Since March 2022, Alabama has required agencies to publish an LPR policy before capturing data. Birmingham's policy remains unpublished. The rule's three-year audits have produced no public result.

As of November 2025, no published policy found for:

• Birmingham Police Department
• Jefferson County Sheriff's Office
• Shelby County Sheriff's Office

As of November 2025, Alabama agencies with published Flock transparency portals:

• Margaret, AL
• Moundville, AL
• Huntsville-Madison County Airport
• Red Bay Police Department
• Morgan County Sheriff's Office

Privacy and the Courts

"The government's unrestrained power to assemble data that reveal private aspects of identity is susceptible to abuse."

In Carpenter the Supreme Court held that the government needs a warrant for a person's historical cell phone location records, because tracking "the whole of their physical movements" reveals what no single sighting does. Massachusetts' highest court held that "with enough cameras in enough locations," plate-reader history would be a search. Whether Birmingham's network crosses that line depends on how many cameras, how long the data is kept, and who can reach it. The city has published none of the three. 60 cities and counties have already canceled or rejected Flock contracts.

Federal Data Sharing: The ICE Connection

One of the most alarming aspects of Flock's surveillance network is the documented sharing of local data with federal immigration enforcement—often without local agencies' knowledge or consent.

What We Know About Federal Access

August 2025: After months of denials, Flock Safety admitted to running "pilot programs" with U.S. Customs and Border Protection (CBP) and Homeland Security Investigations (HSI). The company claimed to pause these programs amid mounting privacy concerns.

The National Lookup Tool: 75% of Flock's 7,000+ law enforcement customers have enrolled in the "National Lookup Tool," which allows out-of-state agencies to access local data. Birmingham's participation status in this network remains unclear.

Default Contract Terms: Flock's standard agreement grants the company a "worldwide, perpetual, royalty-free" license to share customer data for "investigative purposes"—even if local departments think they've restricted access.

Overseas Data Processing: December 2025 reports revealed that Flock uses workers in the Philippines to annotate surveillance data, raising serious concerns about data privacy and security.

Documented Federal Access Incidents

Washington State (2025): University of Washington research found that at least 8 local law enforcement agencies had enabled direct sharing with Border Patrol. Additionally, 10 agencies had "back door" Border Patrol access to their data even though they hadn't explicitly authorized it.

San Francisco (2025): Out-of-state police ran more than 1.6 million illegal searches of San Francisco's Flock database, including at least 19 searches marked as related to ICE—in direct violation of California sanctuary laws.

Illinois (2025): Despite Illinois' sanctuary state status, Flock shared data with federal agencies. Illinois Secretary of State Alexi Giannoulias accused Flock of breaking state law.

Colorado (2025): After assuring the Loveland Police Department that federal agencies had no access, Flock admitted in November 2025 that Border Patrol had been given accounts with the ability to request access from local agencies. At least 25 Colorado departments agreed to share data.

Critical Finding: Flock did not tell its customers about the CBP pilot until journalists found it.

What This Means for Birmingham

We don't know:

• Whether Birmingham has enrolled in Flock's National Lookup Tool
• Which federal agencies can access Birmingham residents' location data
• Whether Birmingham's contract allows the city to prevent Flock from sharing data with federal agencies
• If ICE, CBP, or other federal agencies have already accessed Birmingham's surveillance data

What we do know:

• Flock's standard contract language gives the company broad rights to share data
• Multiple cities discovered federal access only after investigative reporting
• Even when agencies believe they've restricted access, "back door" access has occurred

Documented Abuses of ALPR Systems

The power to track anyone, anytime, without oversight has led to widespread abuses across the country:

"When officers have unfettered access to location tracking with no oversight, abuse follows."

Police Stalking and Harassment

Sedgwick, Kansas: Police Chief Lee Nygaard used Flock cameras to track his ex-girlfriend 228 times. He resigned and was sentenced to 18 months probation.

Georgia: A police chief was arrested for using ALPR systems to stalk and harass individuals.

Pattern: These are not isolated incidents. When officers have unfettered access to location tracking with no oversight, abuse follows.

Targeting Reproductive Healthcare

Texas (2024-2025): An officer of the Johnson County, Texas Sheriff's Office searched the nationwide Flock database for a woman who had obtained an abortion. Court documents and Flock's own data contradicted claims that this was a "missing person" search. The search terms explicitly referenced abortion and reproductive healthcare.

This incident demonstrates how ALPR networks can be weaponized against individuals exercising constitutionally protected rights.

False Positives and Wrongful Stops

Aurora, Colorado: A family was held at gunpoint after an ALPR mistakenly matched their vehicle to a stolen motorcycle from out of state. Officers failed to verify the alert. The incident resulted in a $1.9 million settlement.

Multiple Jurisdictions: A 12-year-old child was handcuffed after an ALPR misread a license plate, leading to a wrongful stop.

Immigration Enforcement in Sanctuary Cities

Westchester County, New York: Federal immigration officials accessed ALPR data despite the county's sanctuary status.

Multiple Jurisdictions: Local police have conducted searches on behalf of ICE agents, sometimes using vague search terms like "law enforcement" or "ICE ASSIST" to obscure the true purpose.

Critical Cybersecurity Vulnerabilities

In November 2025, independent security researcher Jon Gaines (GainSec) published a comprehensive whitepaper documenting 51 vulnerabilities in Flock Safety's camera systems. The research, which has been submitted to MITRE for CVE assignment, reveals serious security weaknesses that raise concerns about data integrity, unauthorized access, and the reliability of evidence.

Device-Level Security Failures (Require Physical Access)

Physical Access Vulnerabilities: Security researchers demonstrated that someone with physical access to a Flock camera can gain root-level control of the device. While cameras are mounted on utility poles in public locations, this access requires:

• Physically reaching the camera
• Knowledge of specific button sequences or use of USB devices
• Time to perform the exploit (30 seconds to several minutes depending on model)

Important Context: Flock Safety responded that "exploitation of these vulnerabilities would not only require physical access to a device, but also require intimate knowledge of internal device hardware." However, the research demonstrates these exploits are achievable by individuals with moderate technical knowledge.

Local Data Storage Issues: Images captured by cameras are stored unencrypted on the local devices themselves. While Flock states that data transmitted to and stored in their cloud infrastructure is encrypted, the local storage vulnerability means:

• Anyone gaining physical access can extract unencrypted images
• Local device integrity cannot be assured
• Chain of custody for evidence may be compromised

Exposed USB Ports: Camera models have accessible USB-C ports that can be exploited with inexpensive tools to gain device control.

Software and Infrastructure Vulnerabilities

Outdated Operating System: Cameras run Android 8.1.0—an operating system discontinued in 2021 with no further security updates. This version has 64 documented critical vulnerabilities (CVEs) that will never be patched.

Hardcoded Credentials (CVE-2025-47823): Security analysis found a Java keystore and its password hardcoded in plain text in the camera firmware, and hardcoded WiFi network names the cameras connect to automatically.

These cannot be changed by customers and represent permanent security weaknesses.

Network Security Concerns: During diagnostic and setup modes, researchers documented credentials transmitted in cleartext, creating opportunities for man-in-the-middle attacks under certain network conditions.

Authentication and Access Control Weaknesses

Multi-Factor Authentication Not Mandatory: Until November 2024, Flock did not enable multi-factor authentication (MFA) by default. As of November 2025:

• MFA is now default for new customers
• 97% of existing law enforcement customers have enabled MFA
• 3% of agencies (potentially dozens of departments) still rely solely on username and password

Stolen Credentials in Circulation:

• Police login credentials have been found for sale on Russian dark web forums
• Hudson Rock (cybersecurity firm) identified stolen Flock credentials in malware databases
• At least one documented case: DEA used a stolen police officer's password to access Flock cameras without the officer's knowledge

Evidence Integrity Concerns

With root access to local devices (via physical compromise), an attacker could potentially:

• Modify locally stored images before they're uploaded
• Delete specific captures from local storage
• Install malware that alters future captures

Critical Question: Can courts and investigators trust that ALPR evidence hasn't been tampered with, given these device-level vulnerabilities?

Federal and Expert Response

Congressional Action: In November 2025, Senator Ron Wyden (D-OR) and Representative Raja Krishnamoorthi (D-IL) sent a formal letter to the Federal Trade Commission requesting an investigation into Flock Safety's cybersecurity practices. The lawmakers stated that the company's failure to require multi-factor authentication, combined with stolen credentials on the dark web, exposes the surveillance network to "hackers and spies."

Flock's Response: The company stated that the documented vulnerabilities "have no impact on our customers' ability to carry out their public safety objectives" and emphasized that physical access is required for device-level exploits. Flock continues to remediate findings through hardware and software updates.

Independent Security Assessment: The research has been formally documented and submitted to MITRE's CVE database, with disclosure windows extending through February 2026 as additional vulnerabilities are processed.

What This Means for Birmingham

Questions Birmingham Must Answer:

• Have Birmingham's Flock cameras been independently tested for these known vulnerabilities?
• What protections exist to detect if cameras have been physically compromised?
• How is evidence integrity verified before use in court proceedings?
• What security updates has Flock deployed to Birmingham's cameras?
• Does Birmingham require multi-factor authentication for all users accessing the Flock system?

What It Costs

What Needs to Happen

Answer these

1. Publish the Police Department's written LPR policy and adoption date.
2. Publish the Alabama Power Master Contract and itemized monthly bills.
3. Publish retention limits, sharing settings, and national lookup participation.
4. Publish the required state audit results.

Limit the system

5. Disable nationwide and state data sharing.
6. Restore full public audit logs (officer name, vehicle description, specific search reason).
7. Cap retention at 30 days for data without an open investigation.
8. Ensure the city owns all data and retains deletion rights.
9. Prohibit merging resident data with third-party datasets.
10. Require city approval for any AI or analytic expansions.
11. Keep contract terms in official city records, not on vendor websites.
12. Require independent third-party security audits.
13. Fix liability terms to protect residents.
14. Publish quarterly system usage reports.

Pause and decide in public

15. No expansion until questions are answered and a hearing is held.
16. Hold public hearings on neighborhood surveillance.
17. Establish a civilian oversight board.

Sources and Additional Reading

• Alabama Administrative Code Chapter 265-X-6: admincode.legislature.state.al.us
• University of Washington ALPR Research: Leaving the Door Wide Open
• Flock Security Vulnerabilities Research: GainSec Whitepaper
• Congressional Letter to FTC: Wyden & Krishnamoorthi
• ACLU Analysis of Flock Contracts: data.aclum.org
• Birmingham $9.7M Contract: Birmingham Times
• DeFlock - Community Mapping Project: deflock.me
• Atlas of Surveillance: atlasofsurveillance.org
• Have I Been Flocked (Flock audit-log search data): haveibeenflocked.com
• Flock device records, December 14, 2025 export: flocksurveillance.org
• City of Birmingham GIS, "Flock Location" layer.
• Schmidt v. City of Norfolk, E.D. Va., case page and filings.
• City of Moody, Master Contract for Public Safety Services (Surveillance, Governmental), Oct 3, 2019 (PDF, 1.3 MB).
• City of Pelham council packet, June 17, 2024, Res. 2024-06-17-06, including the contract template.
• Birmingham City Council, Special Called Committee of the Whole, July 7, 2025, video, 0:20:54.
• Columbiana Res. 11-24-03, council minutes, Nov 5, 2024. Helena FY2026 budget, Res. of Jan 26, 2026.
• The Real Truth with Tommy Spina, S3 E26, Mayor Randall Woodfin, Sept 16, 2026.
• Alabama Public Service Commission public access portal, docket search 2005 to 2026, and Alabama Power Rate RSE annual filings 2018 to 2026, Appendix B, from the same portal.
• Shelby County Commission, agenda of March 25, 2024, Res. 2024-03-25-04, ALPR camera bid 2024-2-11454.
• USAspending award 15PBJA24GG00328BRND. WBRC, Mar 4, 2025 and Jul 8, 2025. BirminghamWatch, Jul 8, 2025.
• Inside Climate News, "The Grid Has Eyes," Aug 29, 2026.

This is not a partisan issue. It is a question of whether the people being recorded get a say.