This is a five-page letter dated August 26, 2026 from Senator Josh Hawley, as Chairman of the Senate Judiciary Subcommittee on Crime and Counterterrorism, to Garrett Langley, chief executive of Flock Safety. Two pages carry the letter; three carry an annex of definitions, ten interrogatories and twelve document requests. It opens an investigation into "Flock Safety's collection, retention, and dissemination of the data generated by its artificial intelligence surveillance cameras."
The argument
The letter's substance is a constitutional and structural argument rather than a document demand. Hawley writes that the company "boasts more than 120,000 cameras across 49 states and more than 20 billion vehicle scans every month," citing Flock's own blog, and that "[t]he overwhelming majority of the Americans captured in those records did nothing wrong." The objection is to aggregation: rather than "serving discrete local investigations, as contemplated by our constitutional processes and safeguards, these camera networks harness artificial intelligence to pool what they capture into a national database that customers can search."
Two sentences carry the core claim. "Congress never authorized the network your industry has built." And: "Your company's internal policies are, in practice, the only safeguards for hundreds of millions of Americans." The constitutional anchor is Carpenter v. United States, 585 U.S. 296, 309–10 (2018), cited for the proposition that "a comprehensive, retrospective record of a person's movements is different in kind from ordinary observation in public."
Hawley states a countervailing position in the same paragraph: "To be sure, I want law enforcement to have tools to catch offenders and keep the public safe. But Americans do not surrender their privacy rights when they drive to work, drop their kids off at school, or go to church."
The misuse and accuracy record cited
The letter's factual predicate is five incidents, each footnoted to public reporting:
- In St. Charles County, Missouri, the police department terminated its Flock contract in August 2026 after an audit found a civilian employee had run Flock searches for personal reasons unrelated to law-enforcement duties.
- In Milwaukee, prosecutors charged a police officer who allegedly searched his girlfriend's licence plate 124 times and her former boyfriend's plate 55 times, entering "investigation" as the justification each time. The letter emphasises the detection path: "the officer was not caught by the company's audit systems — he was caught because a private citizen looked up his own plate on a public website."
- A Florida woman spent 13 days in jail and faced eight felony counts, including three counts of vehicular homicide, after investigators arrested her based on a search of Flock's network for a vehicle description. Charges were dismissed seven months later when a different person was arrested.
- One California police department found that 71% of its alerts were wrong.
- The Los Angeles Police Department dropped its Flock contract after an audit showed officers had stopped 161 vehicles incorrectly flagged as stolen within two months.
A commercial-pressure argument follows: "Flock's $8.3 billion valuation comes with enormous pressure to find new commercial applications."
The annex
The "Relevant Period" is January 1, 2021 to the present. The definition of "Flock" reaches Flock Group, Inc. and its affiliates, present and former personnel, and each product line by name — Flock Safety, Flock OS, Flock Nova, Falcon, Sparrow, Raven, Condor, and Aerodome — as well as any third party from which Flock "has the practical ability to obtain" documents, "including cloud service providers."
Ten interrogatories ask for: the parameters under which customers can run statewide or nationwide searches and whether those are enabled by default; the default retention period for each data category, every change since 2021 with dates and reasons, the maximum customer-selectable period and how many customers exceed the default; the total number of confirmed misuse instances by year, and for each whether it was first identified by Flock's own monitoring, by the customer, or by a third party; what a user must enter to justify a search, whether it is validated against any external record, whether supervisory approval is required, and whether a search proceeds if the field is blank or filled with generic text such as "investigation"; every purpose restriction and whether Flock has assessed if it can be circumvented; measured accuracy "at the level of a complete and correctly attributed vehicle identification," the testing that produced the figure, and the rate at which alerts are later found incorrect; every category of data the deployed devices capture including still images, video, audio, wireless signals and biometric identifiers, with start dates and whether customers may decline; whether Flock links its data to external sources including commercial data brokers, and whether it "has ever ingested, licensed, evaluated, or tested data obtained from a security breach"; whether multi-factor authentication is required of all users and since when; and whether Flock has the capability to track individuals biometrically and what limits exist on it.
Twelve document requests cover access vetting and training and any waiver of prerequisites; camera siting and whether notice to or approval by local governing bodies is required, including model ordinances and communications with local officials; when devices record or transmit and whether recording can be suspended and by whom; retention schedules including the treatment of backups and "derived data such as vehicle fingerprints or model embeddings," deletion verification, and disposition on contract termination; query permissions, default geographic scope, and sharing with other law-enforcement agencies, federal agencies, foreign governments, private entities or data brokers; search-justification requirements and every audit capability, "including whether audit records are complete, immutable, and exportable"; all known or suspected misuse since 2021 with internal investigations and resulting policy or product changes; accuracy documentation including character-level and plate-level read accuracy, false-positive rates, confidence thresholds and how they are displayed, and any stop, detention or arrest later found to be a misidentification; security documentation including credential compromise, unauthorized access to camera feeds, penetration testing, data-storage location and ownership, and "access to production systems by personnel or contractors located outside the United States"; all government contracts, price lists, pilot programs, discounted or donated equipment and grant-funding assistance; data categories beyond licence-plate images and the use of customer or third-party data to train Flock's models; and revenue and capital sources including investors holding more than 5% of any class of equity, government-derived revenue, federal grant programs used by customers, lobbying expenditures and political contributions.
Production is due no later than September 8, 2026.
Relationships
- supports: Flock Safety, AI and Surveillance, Surveillance Technology.
- depends-on: Sen. Josh Hawley.
- related: AI and Civil Liberties, DHS — Department of Homeland Security (AI Deployer).