What Adam Is Reading
A Classifier With No Package Insert
WIRED rebuilt Flock's AI search tool from the code the company sends to a police browser. The model that decides which people an officer may search for has never published an error rate, and the department that uses it never sees the score.
Single source review with claim cards · WIRED, 3 September 2026 · 11 sources · 19 September 2026

Dell Cameron and Dhruv Mehrotra collected the JavaScript that Flock Safety sends to a police officer's browser before the officer logs in, and rebuilt the interface from it. That is a clever piece of reporting. It is also the only way anyone outside the company could learn what the software does, which is the part worth sitting with.

The tool does what the marketing says. An officer types a plain language description of a person ("person wearing scrubs" is the example Flock itself offers), draws a shape on a city map, and the cameras inside it run a continuous automated search for anyone matching. A second feature, the People Detection Alert, takes no description at all. The officer boxes a doorway or a stretch of pavement and gets a notification when a person is inside it.

Before the search runs, an AI model on Flock's servers scores the officer's description against eight categories of sensitive content and returns one of three verdicts. Allow. Block. Warn. The model reaches the verdict using a confidence score. The department never sees that score. It gets a canned outcome.

I have spent a decade in rooms where somebody proposes to deploy a model against patients, and the first question is always the same. What are its operating characteristics, in whom, measured how. Flock has shipped a classifier into thousands of police departments and answered none of it.


What the code actually shows
1
Officers can run a continuous AI watch list on a written description of a person
What the reporting establishes

The FreeForm search accepts natural language and, on video cameras, matches against people. The watch list version cordons an area on a map and runs the description against every camera inside it on a standing basis. 404 Media reported in July that officers were already using FreeForm to search by clothing and tattoos. Flock says it has sold FreeForm for years.

What is missing

Nothing in the front end tells the officer how well the matcher performs. The opt in screen concedes that "accuracy and scope of results may vary" because of resolution, camera placement, lighting and training data, then assigns the officer "the risk of any inaccuracies." That is a vendor transferring model risk to the least informed party in the chain.

Solid
2
The moderation model is a confidence threshold the customer cannot see or set
What the reporting establishes

An AI model on Flock's servers scores the description against eight sensitive categories and returns allow, block or warn, driven by a confidence score that stays on the server. WIRED sent the company 16 questions. The written answer says queries are evaluated against content policies. It does not describe how the model was built, what instructions it runs on, or what separates one verdict from another.

What is missing

A threshold without a published operating point is a policy decision disguised as a technical one. Somebody at Flock picked the number that separates warn from block. That choice determines how often a lawful search is stopped and how often a prohibited one goes through, and it is being made for every department in the country by a party with no accountability to any of their voters.

Solid
3
The one category courts protect most is the one Flock protects least
What the reporting establishes

Race, ethnicity, nationality, religion, subjective or biased terms and offensive content are written as blocks. Political, social and cultural expression is written only as a warning. Religion and nationality appear both ways. Tom Bowman of the Center for Democracy and Technology points out that political and cultural expression is the most protected area under the First Amendment and, as he puts it, "seems like that actually has the least concern from a policing perspective."

What is missing

An officer who wants the protected search can have it. Tick the acknowledgment, type a comment, click Continue With Search Anyway. Kate Ruane of the same organization notes the blocked categories are porous in the other direction too, since the system blocks on religion but not on clothing, and distinctive religious dress is clothing. An officer in California typed "American flag" last year. Blocked against people, then run across 11,000 cameras against vehicles.

Solid
4
The guardrails are a record, not a brake
What the reporting establishes

WIRED's summary is that the controls "may discourage some abusive uses of its tools, and will record them, but will not stop them." Deepak Kumar at UC San Diego, who studies trust and safety systems, says logging is useful administratively but its value "depends entirely on whether anyone administrates it," and that the mechanism "functions less as a deterrent and more as a record." Flock's own Audit Assistance, announced this spring, was still off by default in the code WIRED reviewed. A South Carolina sheriff's office turned it on earlier this month and internal affairs flagged more than 2,700 allegedly unauthorized searches the next day.

Why this is Mostly Solid

The expert claims are about how warning interfaces behave in general, drawn from online harassment tools and browser malware alerts, not from measurements of this system. The 2,700 figure is one department on one day and the allegation has not been adjudicated. The direction of the evidence is clear. The magnitude is not established.

Mostly Solid
5
The only performance number in the whole product is a floor of 75 percent
What the reporting establishes

The People Detection Alert will not accept a setting below 75 percent certainty that what the camera is looking at is a person. One person in the box is enough to fire it.

What the number does not mean

That is a detection confidence floor, not a specificity, and a floor is the worst setting a department is permitted to choose rather than the setting it will get. Read literally, the product ships with permission to run an alert where one call in four is not a person. It is the single quantitative claim Flock makes about its own model, and it describes the failure case.

Solid

The arithmetic nobody is doing

Here is where the clinical training is useful, because the mistake in play is the oldest one in screening.

A cordoned watch list is a screening test. It runs continuously against an unselected population, almost none of whom are the person being sought. The performance that matters is not how often the model is right. It is how often an alert is right, and that depends on how rare the target is.

Take a downtown cordon with 20,000 people passing through in a day, exactly one of whom is the person in the description. Give the matcher a sensitivity of 95 percent, which is generous for moving video in variable light. Then vary the specificity.

Specificity False alerts per day Chance an alert is the right person
99% 200 about 1 in 210
99.9% 20 about 1 in 22
99.99% 2 about 1 in 3
Illustrative, using the standard positive predictive value calculation at a prevalence of 1 in 20,000 and sensitivity of 0.95. Flock has published no sensitivity or specificity for any of these tools, which is the point of the exercise.

A 99 percent specific classifier sounds excellent in a demo and generates 200 wrong people a day in this scenario. Getting to a coin flip requires four nines, which no deployed vision system has demonstrated on live street video against a free text description. Kate Ruane's observation that no content moderation done at scale is necessarily accurate, and that moving video goes wrong more often, is the same statement arrived at from the other direction.

Every one of those wrong people is a stop, a run, a name in a report, occasionally a use of force. In a clinic a false positive gets a confirmatory test. On a sidewalk it gets a police contact, and the confirmatory test is the officer's judgment under adrenaline.

The screening literature settled this argument decades ago. We do not deploy a test into a low prevalence population without knowing its operating characteristics, because the false positives will outnumber the true ones and the harms of the workup land on healthy people. Flock has built a screening program, sold it to police departments, and skipped the part where anyone computes the number.


What governance would have required

None of this is exotic. It is the checklist any hospital AI committee would run before a model touched a patient, and it maps onto this product without much translation.

A validation set somebody else can inspect. Performance reported on held out data, stratified by the conditions that degrade it. Lighting, resolution, distance, camera angle, and the demographic subgroups where vision systems have a documented history of doing worse.

Published operating characteristics. Sensitivity, specificity, and positive predictive value at the deployed prevalence, not an accuracy figure from a curated benchmark.

A threshold the customer sets and can see. The tradeoff between a missed suspect and a wrongly stopped bystander is a value judgment. It belongs to the jurisdiction, not the vendor.

Output monitoring, not just input screening. Deepak Kumar makes this point in the piece. Best practice examines both what goes in and what comes back. Flock screens the query and lets the results out unexamined.

Post deployment surveillance. A standing count of alerts, confirmations, and false positives, reviewed on a schedule by somebody whose job it is. Audit Assistance is close to this and was off by default.

A named accountable owner. Flock says governance sits with local agencies. Don De Lucca, the former Miami Beach chief, agrees that is largely right and adds that departments have to set the rules before the technology goes into use. Most did not. The model was already choosing.

The asymmetry. In medicine the burden sits with the party deploying the model, and a vendor who said "results may be inaccurate, you assume the risk" would be laughed out of the committee and then reported. Flock puts that sentence on an opt in screen, the officer ticks the box, and the tool runs across 11,000 cameras.

Context, which arrived fast

This reporting does not stand alone, and the two weeks after it ran matter for how you read it.

The Washington Post has identified at least 50 officers charged with or accused of misusing license plate readers, 46 of those cases involving Flock, and in more than half the alleged target was a wife, a girlfriend, an ex partner, an ex partner's new boyfriend, or a woman the officer wanted to meet. A Texas deputy searched more than 83,000 cameras for a woman who had an abortion, first described publicly as a welfare check. The Illinois Secretary of State audited Flock and found it had let federal immigration agents reach state camera data in violation of state law. Senator Wyden wrote to the company on 17 September. Two House members had already written to CEO Garrett Langley.

And on 18 September, WIRED reported that Flock is offering voluntary severance to its roughly 1,500 employees as cities cancel contracts. The market is doing the governance the product did not.

So What

A model that decides who the police may look for is a diagnostic test, and it has been deployed at national scale without a single published error rate.

The interesting failure here is not surveillance. It is that a company built an AI gate, priced it as a safeguard, and never had to answer the questions any hospital committee asks in the first ten minutes.

The claims above rest on WIRED's reconstruction of client side code, which shows what the interface permits and not what happens on Flock's servers. The reporters say so plainly. The absence of published operating characteristics is not an inference from that limitation. It is the company's answer to 16 questions.

Sources

Primary: Dell Cameron and Dhruv Mehrotra, "This Is Flock's AI Search Tool for Cops," WIRED, 3 September 2026. wired.com

Severance program: "Flock Offers Employees Buyouts as Customers Flee," WIRED, 18 September 2026. techmeme.com summary

Officer misuse: "How rogue officers turned a nationwide camera network into a tool for stalking," The Washington Post, 2 August 2026. washingtonpost.com

Departments unaware: "We found cops who misused Flock. Their police departments didn't know," The Washington Post, 19 August 2026. washingtonpost.com

Texas abortion search: 404 Media, "A Texas Cop Searched License Plate Cameras Nationwide for a Woman Who Got an Abortion." 404media.co; Electronic Frontier Foundation deeplink on the missing person framing. eff.org

Illinois audit: Office of the Illinois Secretary of State, "Giannoulias' Audit Finds License Plate Reader Company in Violation of State Law." ilsos.gov

Congressional pressure: Ranking Members Krishnamoorthi and Garcia, letter to Flock. krishnamoorthi.house.gov; Senator Wyden letter, 17 September 2026, as reported. ktvz.com

FreeForm clothing and tattoo searches: 404 Media, July 2026, as cited in the WIRED piece.

Company profile and valuation: Fortune, 24 August 2026. fortune.com

Positive predictive value arithmetic: standard Bayesian screening calculation. The inputs are illustrative and stated in the table note. No performance figures for Flock's models have been published by the company.