Justin Craig, a Georgetown, Indiana police officer, has been charged with official misconduct and two counts of fraud after allegedly using Flock automated license plate readers (ALPRs) to track his wife and a previous acquaintance of hers — with no investigative justification. Court documents show Craig searched his wife's plate more than 80 times and the acquaintance's nearly 250 times between January and July, mislabeling each query under categories like narcotics, assault, and stolen vehicles to make them appear legitimate. The investigation was not triggered by internal controls. A Washington Post reporter called Georgetown's police chief with the tip. Only then did an internal review confirm that Craig's hundreds of Flock searches were unrelated to any active case. The system's own audit trail existed but nobody was watching it — a pattern that repeats across the roughly 4,800 law enforcement agencies and nearly 1,000 businesses using Flock's platform. Flock's network is massive: approximately 120,000 cameras conducting roughly 2 billion license plate scans per month across the United States. Every scan logs a vehicle's location, timestamp, and direction of travel. In aggregate, this creates a continuously updated map of movement patterns for millions of people who are not under investigation. The technology is also routinely accessed by Immigration and Customs Enforcement, whose enforcement posture under the second Trump administration has intensified scrutiny of the data-sharing pipeline. Craig's case is not an outlier. Multiple officers across several states have been accused of misusing Flock cameras to stalk former romantic partners and to track individuals seeking abortions. Each case follows the same structure: the technology provides frictionless access, the audit tools exist but are not enforced, and misconduct is discovered externally — by journalists, victims, or third parties — rather than by the system itself. Craig's attorney, Matthew Lemme, mounted a defense that inadvertently underscores the regulatory vacuum. He argued that the conduct alleged "does not violate any law or department policy" and that Flock sells the same technology to cities, homeowners associations, and shopping malls. The implication — that ubiquity equals legitimacy — is precisely the argument privacy advocates find most alarming. If no law or policy prohibits an officer from running hundreds of personal surveillance queries, the problem is structural, not individual. Flock CEO's August announcement that the company would mandate agencies switch on audit features is an acknowledgment that these features were optional — meaning thousands of departments operated for years with tracking capabilities and no required oversight. Making audits mandatory after years of voluntary non-adoption is remediation, not prevention. The question is whether agencies will comply and whether compliance will be independently verified. The broader pattern is a surveillance infrastructure that was deployed at speed, adopted at scale by law enforcement, and is now being retrofitted with accountability features after repeated abuse. The cost of that sequencing — build first, govern later — is borne entirely by the people whose movements are logged without consent, warrant, or recourse.
