600 LPR Lookups: Legal Fallout from Rogue Police Use of Flock Network

For legal professionals, this case highlights the urgent need for robust access controls and auditing in law enforcement surveillance tools, as well as potential liability for technology vendors under privacy laws and civil rights statutes. The outcome could shape litigation strategies and fuel a push for new regulations governing ALPR usage nationwide.

The case of Marci Bakely and former Braselton Police Chief Michael Steffman lays bare the dark side of the widespread deployment of automated license plate reader (ALPR) networks, specifically the Flock Safety system, which now covers thousands of law enforcement agencies across the United States. Steffman exploited his privileged access to Flock’s mappable database of vehicle locations to stalk Bakely and her teenage daughter, querying their license plates approximately 600 times over an extended period. The abuse went undetected by Flock’s systems and his own department, only coming to light when Bakely pressed Steffman for answers and he admitted to using Flock, later corroborated by public record aggregator 'Have I Been Flocked.' Steffman’s arrest in November on charges of stalking, harassment, and license-plate-reader misuse, followed by his suicide in April before trial, underscores the profound human cost of insufficient oversight in surveillance infrastructure.

“

For Flock Safety, the reputational damage is substantial.

The Flock system, like many ALPR networks, is marketed as a force multiplier for law enforcement, capable of solving crimes by tracking vehicles in real time and storing historical data. However, the system’s access controls appear surprisingly lax: a single user could conduct hundreds of searches on a private individual’s vehicles without triggering internal alarms or mandatory audits. This case illustrates a fundamental design flaw present in many law enforcement databases: once an officer is granted access, the only barrier to misuse is personal ethics and the threat of post hoc detection—often long after the damage is done. The absence of real-time anomaly detection, such as flagging when a user repeatedly queries a small set of plates unconnected to active cases, is a critical vulnerability that turns a public safety tool into a stalking weapon.

For Flock Safety, the reputational damage is substantial. The company, which positions itself as a privacy-conscious provider by not using facial recognition and keeping data for only 30 days by default, now faces a public relations crisis and potential civil liability. Victims of such abuse may bring lawsuits alleging negligence, invasion of privacy, and possibly violations of the Driver's Privacy Protection Act or state wiretapping laws, arguing that Flock failed to implement reasonable safeguards. Meanwhile, the thousands of police departments using Flock must reckon with the fact that their own officers could be similarly surveilling ex-partners, journalists, or activists without detection—eroding public trust in policing and surveillance technology.