When Andrae Wright left his job as an investigator at the Effingham County Sheriff’s Office in 2021, he handed in his gun and badge. But he kept something powerful: his log-in credentials for Flock, a police tool he used to search a vast network of roadside cameras tracking the locations of passing cars.
In the five years after leaving the force, Wright searched the system more than 60 times without being stopped by anyone at the Georgia sheriff’s office, according to a statement by the Georgia Bureau of Investigation and Flock audit logs reviewed by The Post. He repeatedly searched the location of a vanity license plate bearing the middle name of his wife, according to the audit logs. The couple divorced this year, court records show, and at the time of some of his Flock searches, Wright was fighting for permanent custody of their teenage daughter.
In July, after a tipster alerted local authorities, police arrested Wright and charged him with stalking his wife, claiming he misused Flock data “for the purpose of harassing and intimidating her,” according to his warrant. State law restricts the use of license plate readers to legitimate law enforcement investigations.
Wright did not respond to phone calls, text messages or voicemails seeking comment. Brian Bailey, a sheriff’s office spokesman, said that the agency had not conducted regular audits of who had access to its Flock system during that time but that it plans to begin doing so.
The case marked one of at least 11 times in which government officials have discovered unauthorized users have gained access to Flock databases and searched them without permission, sometimes to track the locations of romantic partners, a Washington Post investigation has found.
The incidents expose what security experts describe as alarming vulnerabilities within Flock’s nationwide network of license-plate-reading cameras and the law enforcement agencies that use them.
Though Flock has pitched itself as a security-first business that closely controls access to its trove of license-plate data, company leaders have resisted calls from their own staff to implement stricter guardrails, according to three former employees who spoke on the condition of anonymity to avoid professional repercussions.
Flock managers told staff repeatedly that they didn’t want to create barriers to securing camera contracts with law enforcement agencies that were resistant to more restrictive security controls, two of the employees said.
To provide the most detailed accounting to date of unauthorized access, including two incidents that have not been previously reported, The Post interviewed police or city officials in eight states and three former Flock employees who worked on technical issues. The Post also analyzed Flock software logs released in response to public records requests, court documents, police records and officials’ statements.
The 11 incidents of unauthorized access tallied by The Post reveal how easily users could gain or retain access to Flock’s data. In four of the cases, officers were able to keep using their log-ins to Flock after leaving the force or while serving a suspension, because their accounts were not shut off. In six of the cases, police shared log-ins or passwords with active law enforcement officers from other agencies, in what officials later deemed violations of state laws, department policies or Flock contracts.
In Indianapolis, a police recruit who was not authorized to access Flock was able to use the tool for more than two years after a more senior officer opened it on the more junior officer’s laptop and didn’t log out. The junior officer, Matthew Binford, used his colleague’s credentials to search his estranged wife’s license plate more than 1,000 times over a 12-month period, according to a court affidavit. Prosecutors criminally charged Binford and four other Indianapolis officers last month, after an August inquiry from The Post prompted an agencywide audit by the city’s police department.
Binford declined to comment when reached by phone.
Flock Safety, an Atlanta-based company valued by investors at $7.5 billion last year, has rapidly built a nationwide surveillance network, blanketing roadsides with at least 120,000 cameras that photograph passing cars and enable police to track suspects’ vehicles over time. The network’s growth has also expanded the potential for abuse: The Post has reported that at least 100 employees of law enforcement agencies have been charged with or accused of misusing license-plate readers for unauthorized purposes.
Flock has been slow to adopt basic safeguards that are standard practice among commercial and government software vendors — measures that could have prevented many of the intrusions, according to security experts interviewed by The Post.
Many police departments don’t require employees to register Flock accounts to a government-issued email address, which could be deactivated at the end of their employment, interviews and officials’ statements show. Though Flock contractually requires the use of official emails, the company acknowledges it hasn’t widely enforced that policy until recently.
While movie-streaming companies like Netflix have built tools to crack down on password sharing, Flock does not appear to closely monitor for log-ins occurring from unusual locations and devices, said Jon Gaines, an independent security researcher.
Security experts also said Flock could have prevented Binford, the Indianapolis officer, from using his co-worker’s credentials if it had taken the simple step of periodically asking users to reenter their password — a common practice for apps that deal with medical, banking or other sensitive data.
“There’s zero reason you can’t prompt a cop to put in his password,” Gaines said. “Even if it’s once a month.”
After The Post presented Flock with its findings, the company said in an emailed statement that it plans to implement additional security measures that it had not previously announced. Paris Lewbel, Flock’s spokesman, said that since earlier this year, the company has been working with customers to identify and remove accounts that violate its terms of service, “including accounts registered to non-agency email addresses and logins shared among multiple people.”
Starting next year, the company said, it will also begin requiring users to log back in every 12 hours.
Lewbel declined to comment on the individual cases of unauthorized access or the accounts of former employees but said: “When we identify security gaps or violations of our policies, we take action. In several of the incidents described, we’ve done exactly that.”
Several of the incidents of unauthorized access could have been prevented if Flock had required its users to provide an additional form of verification, such as a code from an email message or an app, a security practice called multi-factor authentication (MFA) that has been standard for many companies, including at least one of Flock’s competitors.
Flock “should have had this on day one and enforced it,” said Mert Karakaya, a senior research engineer at IPVM, a surveillance industry research group. “It’s cybersecurity ABCs.”
Flock made MFA the default option for users in 2024. In August, amid a flurry of reports of officers misusing Flock to stalk romantic partners and exes, the company began requiring MFA.
One of Flock’s competitors, Rekor, has required MFA for all customers since 2019, the company’s chairman, Robert A. Berman, said in an interview.
Lewbel said MFA has always been available to Flock customers who wanted it.
Multiple employees implored the company to require MFA after an unauthorized user obtained the Flock log-in credentials of a police officer in Mishawaka, Indiana, in August 2024, said two of the former employees, who were involved in detecting and responding to the incident.
The person, who used the name “grimoire,” obtained license-plate data and, in an online forum, published files containing the locations of 24,356 Flock cameras across the United States and the details of 167,944 “hot list” alerts triggered by Flock cameras in the vicinity of Mishawaka, according to a copy of the raw data reviewed by The Post and screenshots of the forum post that were published on the blog Dark Web Informer.
“I thought I would post this if anyone is interested in how US mass surveillance tools like Flock work,” the unauthorized user wrote, according to the Dark Web Informer post.
Following the incident, Flock employees told senior executives that the breach could have been prevented if the company had required police departments to use multi-factor authentication, the two former employees said. Soon after that, Flock made MFA the default setting but continued to allow agencies to opt out.
Though the former Flock employees said they discussed the incident on a “war room” videoconference call and Slack messages, Mishawaka officials say Flock never informed them of a data breach. In an Aug. 16, 2024, email to Mishawaka, which the city later shared with The Post, Flock said it had deactivated one of the department’s users who was “running an abnormal number of lookup searches,” but it did not mention a breach.
In a blog post and in emails to customers, the company maintained that it had never been hacked. “I want there to be zero confusion about what is happening,” Garrett Langley, Flock’s CEO, said in December 2025 emails to several local agencies. “Flock has never been hacked. Ever.”
In his statement for this article, Lewbel said the August 2024 incident was not a hack, because it “involved unauthorized access or misuse of customer accounts, not a compromise of Flock’s underlying cloud infrastructure.” Flock, he added, has “taken significant steps to strengthen account security and make it harder for unauthorized users to gain or retain access.”
Matthew Lentsch, a spokesman for Mishawaka, said the city has not found evidence of a data breach. He declined to comment on the details the former Flock employees provided to The Post. Five months after the incident, Flock notified Mishawaka that it was offering MFA, which the city “worked with Flock to expediently implement,” Lentsch said.
In a letter last year to the Federal Trade Commission, Sen. Ron Wyden (D-Oregon) and Rep. Raja Krishnamoorthi (D-Illinois) said the company’s “cavalier attitude towards cybersecurity needlessly exposes Americans to the threat of hackers and foreign spies.” The lawmakers cited evidence that hackers used malware to steal the Flock passwords of 35 police officers and highlighted that the company did not require MFA.
Sensitive data, broad sharing
Police guidelines published this year by the International Association of Chiefs of Police, an Alexandria, Virginia-based trade group representing 35,000 police officials around the world, said access to license-plate readers should be granted only to staff members who need it to do their jobs “and promptly removed when an individual’s duties no longer require it.”
But in practice, some departments don’t keep track of who is using these tools or restrict those who don’t need access.
During an agencywide review last month, triggered by reports of Flock misuse in Georgia, the Cobb County Sheriff’s Office learned that around 200 of the agency’s roughly 900 staff members had access to Flock, including people who worked at the county jail.
“We had people on there who had no reason to be accessing it,” Assistant Chief Deputy Gina Hawkins said in an interview, adding that her review did not identify any cases of apparent misuse. Cobb County shrank the pool of authorized users to about 50.
Flock’s contracts restrict customers from granting access to any people “who are not officers, employees, or agents” of their agencies. But around the country, police have informally shared their passwords with nonemployees and sometimes even set up formal accounts to allow officers from other agencies access to their Flock dashboard, according to interviews and officials’ statements.
During an internal audit in August, Kevin Collins, the police chief in Covington, Louisiana, discovered that a previous chief of his department had granted access to officers from the Louisiana State Police and two neighboring law enforcement agencies. Realizing he had no way of governing their use or investigating their actions, Collins deactivated their accounts.
“Extending search access to outside agencies limits our ability to fully verify the purpose behind each individual query run against our system,” Collins said in a letter to the agencies, which The Post obtained through a public records request.
Last year, officials in Richmond learned that giving outsiders access to a Flock database can lead to unforeseen policy violations.
Shortly after President Donald Trump was inaugurated, the Bureau of Alcohol, Tobacco, Firearms and Explosives began deploying agents to work on immigration enforcement. An ATF analyst, who had previously been given access to Richmond’s Flock system to assist with local investigations, began using it to search for immigrants, including several who had escaped from a Virginia detention center in March 2025, according to a statement the city issued later that year.
Richmond officials became aware of the unauthorized access when the ATF agent used the city’s Flock system to search for an immigrant in Illinois. Because Illinois is one of several states that ban the use of license-plate readers for immigration enforcement, Flock says it scans for searches like these and automatically prevents the state’s cameras from being accessed for this purpose.
Flock sent Richmond police an alert “that two searches from the ATF analyst inadvertently accessed Illinois vehicle data with ‘ICE’ in the query field,” the city said. Richmond immediately terminated the agent’s access, and the city later banned all access to its Flock system by federal agencies.
The city said this month it would not renew its contract with Flock.
Since Andrae Wright was arrested and charged in July, authorities have investigated two more former police officers — another in Georgia and one in Michigan — for allegedly running Flock searches after their employment ended.
The Fulton County Sheriff’s Office, in Atlanta, told The Post last month it had become aware of unusual activity by a former officer who continued to use the agency’s Flock system after leaving the force. The activity had gone unnoticed, in part, because the officer had worked for the Fulton County Police Department, a sister agency that shared a Flock subscription with the sheriff’s office.
In an interview, Sheriff Patrick Labat suggested that the intrusion would have been uniquely challenging to prevent and compared it to a hack of federal infrastructure by sophisticated foreign actors.
But Wade Yates, chief of the Fulton County Police Department, said the problem was pretty clear: When the officer resigned, nobody at the police department told the sheriff’s office to remove her access. And because her department didn’t require MFA at the time, she would not have been prompted to authenticate her identity with an active government email.
The case is now being investigated by the GBI. The officer could not be reached for comment.
Yates said the department now has its own Flock account, separate from the sheriff’s office, as well as a process for deactivating former employees. It requires everyone to log in while connected to the government’s IT network.
“They didn’t remove the employee,” Yates said. “I’ll take the heat for that.”
Andrew Ba Tran contributed to this report.
The post Their police jobs ended. They kept using Flock’s vast surveillance network. appeared first on Washington Post.
