Flock Safety, the American maker of automated license-plate-reader (ALPR) cameras, has announced a set of privacy, security, and accountability changes after months of public and researcher criticism of its surveillance network.
The company says multi-factor authentication is now mandatory for everyone logging into Flock, and it has commissioned an independent security review by Bishop Fox and opened a formal coordinated vulnerability disclosure program so outside researchers have a route to report flaws. On the data side, Flock has cut its recommended default retention period from 30 days to seven, and added controls that let an agency decide which outside departments can search its camera data.
Several of the accountability measures land by the end of 2026. Flock will require law-enforcement customers to turn on its Audit Assistance feature, which flags unusual search patterns for an administrator to review, and it will require officers to enter a case code before running a search, with emergency searches flagged for later review. Accounts that trip the company’s abnormal-behaviour criteria are locked automatically until an administrator clears them.
The catch, noted by ASIS International’s Security Management among others, is that much of this depends on customers actually enforcing it. Mandatory authentication and a shorter default retention window are set by the vendor, but audit review, case-code discipline, and lockout follow-up all rely on the agency doing the work.
For a Canadian audience, the story is less about Flock’s own footprint, which is limited here, and more about the direction of travel. ALPR and biometric surveillance are under active scrutiny from Canadian privacy regulators, and the questions Flock is now answering, retention limits, misuse auditing, and vulnerability disclosure, are exactly the ones a Canadian buyer or integrator should be asking of any surveillance platform before it goes on a wall.