Dell Cameron and Dhruv Mehrotra collected the JavaScript that Flock Safety sends to a police officer's browser before the officer logs in, and rebuilt the interface from it. That is a clever piece of reporting. It is also the only way anyone outside the company could learn what the software does, which is the part worth sitting with.
The tool does what the marketing says. An officer types a plain language description of a person ("person wearing scrubs" is the example Flock itself offers), draws a shape on a city map, and the cameras inside it run a continuous automated search for anyone matching. A second feature, the People Detection Alert, takes no description at all. The officer boxes a doorway or a stretch of pavement and gets a notification when a person is inside it.
Before the search runs, an AI model on Flock's servers scores the officer's description against eight categories of sensitive content and returns one of three verdicts. Allow. Block. Warn. The model reaches the verdict using a confidence score. The department never sees that score. It gets a canned outcome.
I have spent a decade in rooms where somebody proposes to deploy a model against patients, and the first question is always the same. What are its operating characteristics, in whom, measured how. Flock has shipped a classifier into thousands of police departments and answered none of it.
The FreeForm search accepts natural language and, on video cameras, matches against people. The watch list version cordons an area on a map and runs the description against every camera inside it on a standing basis. 404 Media reported in July that officers were already using FreeForm to search by clothing and tattoos. Flock says it has sold FreeForm for years.
What is missingNothing in the front end tells the officer how well the matcher performs. The opt in screen concedes that "accuracy and scope of results may vary" because of resolution, camera placement, lighting and training data, then assigns the officer "the risk of any inaccuracies." That is a vendor transferring model risk to the least informed party in the chain.
An AI model on Flock's servers scores the description against eight sensitive categories and returns allow, block or warn, driven by a confidence score that stays on the server. WIRED sent the company 16 questions. The written answer says queries are evaluated against content policies. It does not describe how the model was built, what instructions it runs on, or what separates one verdict from another.
What is missingA threshold without a published operating point is a policy decision disguised as a technical one. Somebody at Flock picked the number that separates warn from block. That choice determines how often a lawful search is stopped and how often a prohibited one goes through, and it is being made for every department in the country by a party with no accountability to any of their voters.
Race, ethnicity, nationality, religion, subjective or biased terms and offensive content are written as blocks. Political, social and cultural expression is written only as a warning. Religion and nationality appear both ways. Tom Bowman of the Center for Democracy and Technology points out that political and cultural expression is the most protected area under the First Amendment and, as he puts it, "seems like that actually has the least concern from a policing perspective."
What is missingAn officer who wants the protected search can have it. Tick the acknowledgment, type a comment, click Continue With Search Anyway. Kate Ruane of the same organization notes the blocked categories are porous in the other direction too, since the system blocks on religion but not on clothing, and distinctive religious dress is clothing. An officer in California typed "American flag" last year. Blocked against people, then run across 11,000 cameras against vehicles.
WIRED's summary is that the controls "may discourage some abusive uses of its tools, and will record them, but will not stop them." Deepak Kumar at UC San Diego, who studies trust and safety systems, says logging is useful administratively but its value "depends entirely on whether anyone administrates it," and that the mechanism "functions less as a deterrent and more as a record." Flock's own Audit Assistance, announced this spring, was still off by default in the code WIRED reviewed. A South Carolina sheriff's office turned it on earlier this month and internal affairs flagged more than 2,700 allegedly unauthorized searches the next day.
Why this is Mostly SolidThe expert claims are about how warning interfaces behave in general, drawn from online harassment tools and browser malware alerts, not from measurements of this system. The 2,700 figure is one department on one day and the allegation has not been adjudicated. The direction of the evidence is clear. The magnitude is not established.
The People Detection Alert will not accept a setting below 75 percent certainty that what the camera is looking at is a person. One person in the box is enough to fire it.
What the number does not meanThat is a detection confidence floor, not a specificity, and a floor is the worst setting a department is permitted to choose rather than the setting it will get. Read literally, the product ships with permission to run an alert where one call in four is not a person. It is the single quantitative claim Flock makes about its own model, and it describes the failure case.
Here is where the clinical training is useful, because the mistake in play is the oldest one in screening.
A cordoned watch list is a screening test. It runs continuously against an unselected population, almost none of whom are the person being sought. The performance that matters is not how often the model is right. It is how often an alert is right, and that depends on how rare the target is.
Take a downtown cordon with 20,000 people passing through in a day, exactly one of whom is the person in the description. Give the matcher a sensitivity of 95 percent, which is generous for moving video in variable light. Then vary the specificity.
| Specificity | False alerts per day | Chance an alert is the right person |
|---|---|---|
| 99% | 200 | about 1 in 210 |
| 99.9% | 20 | about 1 in 22 |
| 99.99% | 2 | about 1 in 3 |
A 99 percent specific classifier sounds excellent in a demo and generates 200 wrong people a day in this scenario. Getting to a coin flip requires four nines, which no deployed vision system has demonstrated on live street video against a free text description. Kate Ruane's observation that no content moderation done at scale is necessarily accurate, and that moving video goes wrong more often, is the same statement arrived at from the other direction.
Every one of those wrong people is a stop, a run, a name in a report, occasionally a use of force. In a clinic a false positive gets a confirmatory test. On a sidewalk it gets a police contact, and the confirmatory test is the officer's judgment under adrenaline.
The screening literature settled this argument decades ago. We do not deploy a test into a low prevalence population without knowing its operating characteristics, because the false positives will outnumber the true ones and the harms of the workup land on healthy people. Flock has built a screening program, sold it to police departments, and skipped the part where anyone computes the number.
None of this is exotic. It is the checklist any hospital AI committee would run before a model touched a patient, and it maps onto this product without much translation.
A validation set somebody else can inspect. Performance reported on held out data, stratified by the conditions that degrade it. Lighting, resolution, distance, camera angle, and the demographic subgroups where vision systems have a documented history of doing worse.
Published operating characteristics. Sensitivity, specificity, and positive predictive value at the deployed prevalence, not an accuracy figure from a curated benchmark.
A threshold the customer sets and can see. The tradeoff between a missed suspect and a wrongly stopped bystander is a value judgment. It belongs to the jurisdiction, not the vendor.
Output monitoring, not just input screening. Deepak Kumar makes this point in the piece. Best practice examines both what goes in and what comes back. Flock screens the query and lets the results out unexamined.
Post deployment surveillance. A standing count of alerts, confirmations, and false positives, reviewed on a schedule by somebody whose job it is. Audit Assistance is close to this and was off by default.
A named accountable owner. Flock says governance sits with local agencies. Don De Lucca, the former Miami Beach chief, agrees that is largely right and adds that departments have to set the rules before the technology goes into use. Most did not. The model was already choosing.
This reporting does not stand alone, and the two weeks after it ran matter for how you read it.
The Washington Post has identified at least 50 officers charged with or accused of misusing license plate readers, 46 of those cases involving Flock, and in more than half the alleged target was a wife, a girlfriend, an ex partner, an ex partner's new boyfriend, or a woman the officer wanted to meet. A Texas deputy searched more than 83,000 cameras for a woman who had an abortion, first described publicly as a welfare check. The Illinois Secretary of State audited Flock and found it had let federal immigration agents reach state camera data in violation of state law. Senator Wyden wrote to the company on 17 September. Two House members had already written to CEO Garrett Langley.
And on 18 September, WIRED reported that Flock is offering voluntary severance to its roughly 1,500 employees as cities cancel contracts. The market is doing the governance the product did not.
A model that decides who the police may look for is a diagnostic test, and it has been deployed at national scale without a single published error rate.
The interesting failure here is not surveillance. It is that a company built an AI gate, priced it as a safeguard, and never had to answer the questions any hospital committee asks in the first ten minutes.
Sources
Primary: Dell Cameron and Dhruv Mehrotra, "This Is Flock's AI Search Tool for Cops," WIRED, 3 September 2026. wired.com
Severance program: "Flock Offers Employees Buyouts as Customers Flee," WIRED, 18 September 2026. techmeme.com summary
Officer misuse: "How rogue officers turned a nationwide camera network into a tool for stalking," The Washington Post, 2 August 2026. washingtonpost.com
Departments unaware: "We found cops who misused Flock. Their police departments didn't know," The Washington Post, 19 August 2026. washingtonpost.com
Texas abortion search: 404 Media, "A Texas Cop Searched License Plate Cameras Nationwide for a Woman Who Got an Abortion." 404media.co; Electronic Frontier Foundation deeplink on the missing person framing. eff.org
Illinois audit: Office of the Illinois Secretary of State, "Giannoulias' Audit Finds License Plate Reader Company in Violation of State Law." ilsos.gov
Congressional pressure: Ranking Members Krishnamoorthi and Garcia, letter to Flock. krishnamoorthi.house.gov; Senator Wyden letter, 17 September 2026, as reported. ktvz.com
FreeForm clothing and tattoo searches: 404 Media, July 2026, as cited in the WIRED piece.
Company profile and valuation: Fortune, 24 August 2026. fortune.com
Positive predictive value arithmetic: standard Bayesian screening calculation. The inputs are illustrative and stated in the table note. No performance figures for Flock's models have been published by the company.