Auto-transcript: Hearings to examine flock's nationwide AI surveillance network.

Josh Hawley [0:04]

Well, let me call to order this hearing of the Senate Judiciary Committee's Subcommittee on Crime and Counterterrorism, which I'm delighted to chair and to work on with my colleague, Ranking Member Durbin. Thank you to all of our witnesses for being here. Welcome to all of our guests who are here today in the gallery. This hearing is about a simple thing. It's trying to get to the bottom of what is going on. With the expanding surveillance network that appears to be going coast to coast in this country, I have in mind the hundreds of thousands of individual cameras, all linked to the cloud, all powered by AI, that seem to be spreading all across the country. Practically every state in the Union now has them, hundreds of thousands of them, recording billions of images every single month. And the question is, where are all of these images going? Who is using them? What are the privacy protections for them? How do we make sure that this kind of surveillance is consonant with the Constitution of the United States? You know, there's many players in this industry, but there's one name that really stands out above the rest, and that is Flock. If you haven't heard of Flock, all I have to say is Flock's probably heard of you. In fact, the truth is you have probably been scanned and surveilled and tagged and logged multiple times this week alone. And that's because Flock, by its own admission and its own statistics, maintains a network of 120,000 individual cameras in 49 states all across this country. It estimates that those cameras scan and then generate some 20 billion images. That's with a B, 20 billion images of individuals in their cars or on their motorcycles or other vehicles every single month. 20 billion images every single month. Falk is a privately held company. Based on what we know, it's backed by a venture capital firm. It's worth about $10 billion and it has amassed in a very short time frame a surveillance network unlike any we've ever seen in this country. Really what makes it unique based on what we can tell from the reporting and the reporting on what these networks can do, I have to tell you, is really kind of wild. What seems to make these networks unique is not just the sheer number of cameras, it's the fact that they're all linked together, empowered, and searchable by AI. It's unlike anything we've ever seen in this country before. And to give you just a sense of it, I mean, here are some of what these cameras can do. This surveillance network uses thousands of these AI-powered cameras to capture and analyze images of passing vehicles. Let's see if we can give you a sense of it. Here's a flock image. They store and catalog details like the vehicles make, model, color, location, date, time. Phlox searchable features include details like dents and roof cracks and vehicle damage and racks on the roof or racks on the back or specific bumper stickers even. You think about that. I mean, Flock can tell you if a car has a Trump sticker or a Harris sticker or a Pro-Life America sticker or an NRA sticker. It's really quite extraordinary. Flock's cameras can even recognize whether people are in the images. And in fact, Flock admitted in a letter to me ahead of this hearing that you could search their database. based on people's images. You could ask to search people, images that had people, images that are scanning the inside of the cars. I mean, this is really quite extraordinary. Flock is not the only player in this field, of course. There are other companies, Motorola, Axon, Verceda, and they've also built these vast surveillance networks that are also supercharged by AI. And the thing is, when you harness all of these things together, You get a capability based on the reporting that is different in kind than anything we've ever seen in this country. And I just want to state right now my principal concern with all of this. Number one, I just want to get the facts as to what these networks are, how they operate, what they're doing. But I also just want to say this, and I want to be clear about it. The Constitution of the United States is just as valuable and valid and applicable today as it was almost 250 years ago when it was first penned. And that includes the right to be innocent until proven guilty. That is not treated like a criminal and tracked like one. It includes the right to personal privacy, control of your own data and information that is protected in our Bill of Rights. Our Bill of Rights is still good no matter what the technology of the day is. Now, my bottom line in this hearing is we've got to find a way to protect and enforce the Bill of Rights and the basic personal liberties of every law-abiding citizen in this country, no matter what the technology is. That, I think, is the challenge that is facing us today. And I have to tell you, based on what these reports are, we've got some work ahead of us. You know, to give you another example, a customer in a flock network, for example, just needs to buy a single camera and a subscription. that I'm told costs about $3,000 annually. And in return for that, they get access to a nationwide database of tens of thousands of cameras, about 120,000 in Flock's case, and billions of images. And Flock has admitted that until very recently, there were basically no curbs or restrictions on which of these subscribers, so to speak, could search their databases, what they could do with the images, how long the images were kept, or what other uses they were put to. In fact, customers can search using natural language across this data set, including images that are months and months old. Flock customers are even able to assemble a pattern of life. That's a comment from Flock itself, a pattern of life for the millions of vehicles that are caught up in what is becoming a massive dragnet. The overwhelming majority of drivers or other travelers who are surveilled here have done absolutely nothing wrong. Nothing wrong at all. And I think that's what's so troubling to people as they learn about this technology. It sounds as if, based on the reports we've heard, it's treating... every citizen in America. I mean, by now, surely almost all of us have been scanned and logged as if we are criminals, yet without any due process, without any reasonable suspicion, without any articulable suspicion whatsoever. This just seems very, very strange, to put it mildly, and something I think this committee really needs to hear about. You're going to hear in just a moment from someone who has suffered at the hands of this surveillance network, Lindsay Isaacs, who... joins us from Palm Coast, Florida. She was falsely accused of being in a car crash, causing one, in fact, and she spent 13 days in jail. because of a misidentification from one of these surveillance networks. She's totally innocent. You're going to hear from Alistair Whitney, who's a legal expert for the Institute for Justice, which is an organization that's been documenting the use and sometimes abuse of these cameras. You're going to hear from Sheriff Ross Teeple, who we're so proud is here today, from Arizona, who recently decided to terminate his department's use of these cameras. in order to protect the privacy of his citizens and to comply with the Constitution of the United States. You're going to hear from Ben Jordan, who's a cybersecurity researcher, who's going to speak personally to the very real risk that these cameras can be hacked. And all of those images, billions of them, can be accessed by malign actors. And you're going to hear from Chad Marlow, who's a senior policy counsel at the ACLU, where he leads their Get the Flock Out campaign. Sadly, who you're not going to hear from today are the CEOs of Flock, and Axon and Motorola and Verketa. I invited all of them, as Senator Durbin and I did, the whole committee. We sent letters to them and asked them to be here. And they're not. And I think that that's unfortunate. I think we need to hear from them about what it is their networks do. I think we need to hear from them about their intentions, about their capabilities. And we need to have an honest conversation about where this is leading us as a country. I'll close with this and let Senator Durbin make his opening remarks. I just want to say this. This is still the United States of America. And it shouldn't be that when you walk out your door in the morning, you just have to... agree and assent and accept the fact that you're going to be on camera morning, noon, and night. You'll be tracked by anybody and everybody in the world. You'll have no privacy whatsoever. You'll be tracked when you take your kids to school and tracked when you go to church and tracked when you go to the grocery store. My gosh, that isn't the free society that we've known. That's not what the Constitution guarantees. We've got some work to do, I think, to make sure that the Constitution is real and protected in this area. And I look forward to doing it today, getting a start at least. Senator Durbin.

Richard J. Durbin [8:50]

Senator Hawley, good hearing. Glad to be here and looking forward to the testimony. For the flock CEOs, obviously they're nervous about being on camera, but I sure wish they would have joined us today. It would have been interesting to hear their explanation of the statistics that have been given us by Senator Hawley. 120,000 flock cameras in 49 states. Which state doesn't have them? Hawaii. I wonder why. Maybe we'll learn. The collection of information and data is what it's all about these days. Amazon, I'm told, makes more money off the data that they've collected about their customers than they make off the merchandise that they sell. Hard to imagine. But that information is being sold regularly and collected constantly. And that's what this hearing is all about. I support law enforcement. I'm glad they're here represented by Ross Teeple and others. And we entrust them with keeping us safe in our homes, in our neighborhoods, in our businesses, and as we go about our business. But we also value privacy. If you're a constitutional scholar, please tell me where the word privacy is in this Constitution. you won't find it. And yet the courts have found the inference of privacy and determinations of things as basic as reproductive choices by couples. So we know that there is some privacy protection. We also know that as we look at the information that's gathered, it's been gathered for many years. This is nothing new. The volume of the undertaking is little. The state of Illinois has had an ALPR, automated license plate reader, as part of their state effort to catch people on the tollway who don't pay their fair share. This has been around for a long time. It's been used to locate people who have gone missing, cars connected to crimes, and stolen vehicles. That all sounds good. And then you hear the story of Ms. Isaacs. She'll tell you in detail what she's been through when the so-called fail-safe technology fails. And it certainly did in her case. I just want to say to the chairman, thank you for this hearing. We have got to find a way to balance in America privacy and security. I think there is a balance. Congress needs to lead the way. Thank you, Mr. Chairman.

Josh Hawley [11:20]

Thank you very much, Ranking Member Durbin. It's the practice of this subcommittee to administer an oath to our witnesses before they testify. So if you're willing, I'll ask you to stand and answer the following question. Do you swear that the testimony you're about to give will be the truth, the whole truth, and nothing but the truth? So help you God. Very good. The record reflect everyone answered in the affirmative. Let me now give each witness an opportunity to make an opening statement. We're so glad that each of you is here. We'll go right down the dais here, starting with Ms. Isaacs. Lindsay Isaacs is from Palm Coast, Florida. As I said a moment ago, she was falsely accused of causing a fatal car crash in an incident that involved flock cameras. Ms. Isaacs, we're glad you're here. The floor is yours.

Lindsey Isaacs [12:05]

Thank you. Good afternoon. My name is Lindsay Isaacs. I'd like to share with you what happened to me beginning on October 4th of 2025 and how it forever changed the trajectory of my life. On October 4th, 2025, I spent the day with my mom cooking at my apartment in Palm Coast, Florida. We left my apartment separately at around 6.30 p.m. She drove home to Ocala and I drove to a store in Davenport. It was a normal drive. I stopped for gas and then continued to the store. I stayed at the store for about an hour before heading home. I arrived home at approximately 10.25 p.m., ate some of the food my mother and I cooked earlier that day, and called my parents to say goodnight. At approximately 1.04 a.m. on October 5th, an FHP trooper and three deputies from the Marion County Sheriff's Office arrived at my parents' home in Ocala looking for me. They asked where I was and where my vehicle was and told my parents that I had been involved in a fatal crash. My parents were confused and terrified. They told law enforcement I was home asleep in Palm Coast and gave them my address. They could not understand what they were being told and they were now worried about whether I was even alive. My parents immediately drove to my apartment. They arrived at approximately 4.45 a.m. and found additional troopers there already. I woke up frantic. My parents were at my door, multiple troopers were outside, and an in-pound truck was taking my Dodge Durango away right in front of me. I gave the troopers my receipt and information showing where I had been. I told them that I had not been involved in any crash. The troopers told me that there was damage to my vehicle consistent with the collision, but I could not see the damage they were describing. My Durango was in immaculate condition, yet I stood there watching law enforcement take it away while telling me that my vehicle had been involved in a crash where three people died. The same day, October 5th, 2025, I retained criminal defense attorney Patrick McGeehan. In February of 2026, my defense team sued the FHP seeking the return of my vehicle. I later learned that a Flock automated license plate recognition camera had captured my Dodge Durango approximately two to three miles west of the crash scene. Investigators were looking for a black Dodge Durango. I also later learned that the witnesses had described a maroon Dodge Durango as being involved in this crash and that 911 callers provided information about that vehicle including a partial license plate of 458. Despite this information, the investigation continued to focus on me and my vehicle. On April 17, 2026, a warrant was issued for my arrest. I was ordered to surrender myself at the Volusia County Jail by 2 p.m. I could not understand what was happening. I was placed in solitary confinement for approximately three and a half days. Correctional officers told me I had to stay there because of the severity of my charges, and I could not be housed with other inmates until I had been evaluated. I was placed in a blue suicide prevention dress with a broken Velcro on the left side that left me exposed. The cell door was shut and it was not open for approximately 86 hours. I'm sorry. I was then moved into a mental health unit for approximately 24 hours before ultimately being transferred to G Block, a maximum security housing unit where I remained for approximately 10 days. I was terrified. I was facing the possibility of spending the rest of my life in prison for a crash that I knew I had not been involved in. I did not know if I would ever get out of jail. At my lowest point, I didn't want to be alive. The television was constantly on in the jail. My mugshot appeared on the news, and I watched as information about me and my case was broadcasted publicly. Other inmates harassed me about my charges. Every day I prayed that the truth would come out. When another inmate was sent to prison, she gave me her Bible. I read that Bible every day. I slept with it as my pillow. I even took it into the shower because I almost had nothing else, and I was afraid someone would take it and steal it. I still have that Bible today, and I cherish it. On April 22, 2026, I was denied bond at my pretrial detention hearing. On April 28, my attorney, Patrick McGeehan, presented the court with multiple photographs of my Durango sitting in the FHP impound lot. without the collision damage investigators had claimed was present. This prompted the state to reevaluate my vehicle and the case against me. The following day, April 29th, I was finally granted bond. After 13 days in jail, I ran into my mother and father's arms. I could not believe I was free. In May, 2026, the state ultimately declined to prosecute me and filed a no information and information was never filed against me. The investigation instead resulted in charges against another individual. I came here today because I want you to understand that surveillance technology does not exist in a vacuum. Information collected by technology can become part of an investigation that affects a real human being. In my case, a flock camera captured my vehicle a few miles from the scene of a terrible crash. That piece of information became part of an investigation that ultimately led to my arrest on three counts of vehicular homicide and 13 days in jail for a crash I had nothing to do with. I'm not here to tell you how to do your jobs. I'm here to tell you what happened to me. Thank you for allowing me to share my story with you today. I thank God, my family, and my attorney, Patrick McGeehan, for standing beside me and helping me get my life back.

Josh Hawley [18:47]

Thank you so much, Ms. Isaacs. Thank you for being here, for sharing that.

Lindsey Isaacs [18:51]

Thank you.

Josh Hawley [18:52]

Mr. Whitney is next. Mr. Alistair Whitney, who serves as legislative counsel for the Institute for Justice. Mr. Whitney, the floor is yours.

Alasdair Whitney [19:00]

Good afternoon, Chairman Hawley, Ranking Member Durbin, and members of the subcommittee. Thank you so much for inviting me to testify today. My name is Alistair Whitney, and I'm legislative counsel at the Institute for Justice. IJ is a nonpartisan public interest law firm that works in both state houses and courthouses around the country to defend your constitutional rights. ALPR technology now lets the government do something it could never do before, and that is travel back in time and reconstruct your movements, where you've been, and with whom you've associated, all without a warrant and with the ease of running a Google search. Governments say they need this kind of frictionless access to fight crime, and the goal is, of course, laudable. But as the Supreme Court has said, the warrant requirement is not an inconvenience to somehow be weighed against the claims of police efficiency. Technology may make surveillance more convenient, but it does not make the Fourth Amendment's protections any less important. Now, most people picture ALPRs as a camera that reads a plate, but that picture is roughly a decade out of date. As the chairman mentioned earlier, modern license plate readers photograph every single car that passes. They never blink. They never sleep. They can record make, model, color, bumper stickers, dents. They can map everywhere a car has been photographed. They can flag cars that travel together. And they are networked. One vendor alone runs a dense network of more than 120,000 cameras in 49 states and logs 20 billion photographs of vehicles every single month. This means, of course, that an officer in California or Florida can access information and data showing where somebody has driven in Missouri or Illinois with the ease of a couple of keystrokes or clicks. No federal law governs any of this, and many states don't have any law in the books either. Where rules exist, a vendor often wrote them, and they change with a software update or a publication of a missive on a website. The result is what you would come to expect and, sadly, what we've come to see. For example, in Kentucky, an officer allegedly searched a flock database for his child's mother thousands of times over several months, despite the woman having received an order of protection against him. In North Carolina, an officer was arrested after allegedly accessing Phlox database to look up an undercover investigator's vehicle at the request of a drug suspect. Innocent families have been held at gunpoint over a misread letter on a plate. Images from these cameras have been shipped to gig workers in the Philippines to train Phlox AI. IJ's public database now documents hundreds of incidences like these, and unfortunately, the number of abuses are growing by the day. The Fourth Amendment has something to say about this. In Jones, in Carpenter, and this June in the court's decisions in Chattree, the Supreme Court made clear that we do not surrender our constitutional rights when we are in public. In Chattree, two hours of location data was enough to require a warrant. Here, we are talking about weeks or months. That is why IJ is challenging this warrantless surveillance in two federal courts. In Norfolk, Virginia, 175 unblinking eyes captured 41 million vehicle images in less than a month. In San Jose, California, the city had four cameras at a single intersection in 2021. Today, just under 500 cameras are across the city, taking hundreds of millions of photographs a year. which more than 1,000 city employees and nearly 300 other agencies in the state search roughly 15,000 times a day. Networks that dense let the government track anyone cheaply for weeks at a time. That is exactly why law enforcement likes them. Regardless of how these cases turn out, here's the point that matters here the most. The Fourth Amendment is a floor, it's not a ceiling. Congress did not wait for the courts on wiretaps or bank records. And it should not wait here. Even the judge who ruled against us in Norfolk said that the guardrails should come from legislatures. This Congress should act now. Congress can require federal agents to get a warrant before they search historical location data, as our model legislation does. It can impose tight limits on how long that data is kept, and it can condition federal dollars on states and localities doing the same. To be clear, none of these restrictions would stop law enforcement from finding a missing child or a stolen car. We're not asking for you to turn the cameras off with this model legislation. The warrant requirement is the bare minimum, though. Without it, there is simply no constitutional way to run these systems because they sweep in the overwhelming majority of drivers who have simply done nothing wrong. And what they capture is not just a day in the life, but a way of life. This is why Americans' opposition to their unchecked spread crosses every single political line, prompting a growing number of cities and states to slam the brakes on this technology. So we urge the honorable members of this subcommittee to enforce constitutionally grounded restrictions on this technology before these cameras end up on every street corner. That is not just IJ's concern. That is Flock's stated goal. Is that the America that we want to live in and hand to our children? For IJN, for me personally, the answer is no. Thank you very much for your time, and I look forward to your questions.

Josh Hawley [24:38]

Thank you, Mr. Whitney. Next is Sheriff Ross Teeple. It's an honor to have you here, Sheriff. Sheriff Teeple is from Pinal County. Did I get that right? Yes. Am I saying that right? In Arizona. Thank you again for your service, and thank you for being here. The floor is yours.

Sheriff Ross Teeple [24:53]

It's an honor to serve. Good afternoon, Chairman Howley, Ranking Member Derman, and distinguished members of the subcommittee. Thank you for the invitation to speak before you today on this critical issue. Before I begin, I would like to acknowledge the passing of John Kyle last week. Senator Kyle dedicated his life to serving his country and Arizona. I extend my deep condolences to his family and his colleagues that worked alongside him here in the Senate. My name is Ross Teeple, and I am honored to be elected the 25th Sheriff of Pinal County, Arizona, and proud to be married to my beautiful bride for the last 33 years. Protecting public safety and defending constitutional rights are law enforcement's most important jobs. I am here today because I firmly believe we can use technology to keep our communities safe while still achieving both of these vital goals. Let me be entirely clear. Automatic license plate readers or ALPRs are a great tool. Technology that is strictly limited to reading a license plate helps us solve crimes. catch dangerous criminals, and find missing people. It allows us to cross-reference plates against stolen vehicle database or respond to active AMBER alerts instantly. Under the Supreme Court's landmark 2020 ruling and Kansas v. Glover, running a license plate to check registration status provides the reasonable suspicion needed to make a proactive traffic stop. Used properly, point-in-time license plate reading is common sense policing. The committee reached out to me because I was one of the first law enforcement leaders in the country to end our contract with Flock. Make no mistake, that decision was controversial, but it was extremely popular on both sides of the political spectrum. Pinell County represents a unique law enforcement challenges. It's the size of Connecticut, lies between Arizona's two biggest cities, and is about 60 miles from the border. Interstates 10 and 8, some of the busiest human and drug trafficking corridors in America, run right through the heart of my county. There is a good chance that the fentanyl being sold outside Union Station right across the street or in your hometown came through my county. Given those challenges, it would be irresponsible not to equip my deputies with the best technology to help them do their jobs. But I will never allow technology to supersede your rights. I believe the latest camera networks powered by artificial intelligence and machine learning are capable of violating our citizens' Fourth Amendment rights. We have entered an area where some camera networks are capable of capturing much more than just a snapshot of a plate on a highway. If my deputies need a search warrant to put a physical tracker on a vehicle, where is the line for camera systems that build an identical AI-driven map of a citizen's life? Recently, I received an email from a law enforcement colleague regarding these cameras that I found chilling. He wrote, quote, some courts compare point in time to continuous tracking as the reasoning. Will there someday be a Supreme Court ruling on these? No doubt. But today, as I type this, there is no violation of the Fourth Amendment, end quote. With all due respect to my colleague, that is the wrong mindset. We shouldn't wait for the Supreme Court to tell us something is a violation before we decide to protect the privacy of our citizens. History has shown us the cost of law enforcement moving faster than the Supreme Court constitutional rulings. 60 years ago, in my state of Arizona, a detective arrested a man named Ernesto Miranda. The detective got a confession and secured a conviction. But because procedural safeguards weren't actively protected, the Supreme Court threw that conviction out in Miranda v. Arizona, fundamentally changing law enforcement forever. Now everybody in America has heard of the Miranda rights. What people forget or don't know about Miranda rights is that detective should have known better. It was already common practice back then to let suspects know they have a right to remain silent and they have a right to an attorney. Now everyone in America has heard the word flock and in Pinell County it's become a four-letter word. If we rely on private camera networks to act as a dragnet, continuously logging the habits of innocent Americans without a warrant, we are paving the way to an AI-driven surveillance state. If we allow government-funded private surveillance companies to push this envelope blindly, we risk a sweeping judicial correction that could strip away the legitimate, life-saving aspects of ALPR technology entirely. We must establish clear statutory boundaries for automatic license plate readers. We cannot wait for a future Supreme Court ruling to correct AI overreach. We must protect the Fourth Amendment today. Thank you, and I look forward to your questions.

Josh Hawley [30:00]

Thank you very much, Sheriff. Thank you again for being here. Next up is Mr. Ben Jordan. Mr. Jordan is a cybersecurity researcher with extensive experience investigating the surveillance networks flock in particular, as well as its peer companies. Mr. Jordan, thank you for being here. The floor is yours.

Benn Jordan [30:14]

Thank you for having me. As the senator just mentioned, I'm an independently funded cybersecurity researcher, so I don't really work for a company or anything to do so. I sort of do so as my own hobby that is then funded through a YouTube channel and Patreon and stuff like that. And that's a nice way of saying I'm a hacker. Over the summer of 2025, I started learning about some of the weaknesses and the security and the efficacy of the ALPR industry's ecosystem in hardware. I found that Flock, at the time, did not require their clients to use multi-factor authentication. This led me to find Flock law enforcement accounts for sale by a Russian vendor on a dark web marketplace, which was referenced in Senator Wyden and Representative Krishnamoorthy's letter urging the FTC to investigate Flock as a national security risk in November of 2025. I then met and worked with John Gainsec Gaines, who had discovered, detailed, and published 55 security vulnerabilities related to Flock. Some of these vulnerabilities are published through MITRE, who manages security vulnerabilities for the Department of Homeland Security. The most alarming of John's reported vulnerabilities was in the most common model of Flock's ALPR camera. I publicly demonstrated that by pushing the button on the camera three times, I was able to access all of the data or reprogram the device however I wanted in under a minute. Backdoor, malware, I even played Doom on a Flock camera. In addition to this, John and myself found insufficiently protected sensitive information stored on Flock cameras, including photos, license plate data, logs, API keys, passwords, and communications. Then, in December of 2025, through a specialized search engine, I found the unprotected administrative interfaces for over 60 newly deployed Flock Condor cameras that had AI-enabled pan-tilt zoom features. This allowed me to remotely view, delete, and modify 30 days of streaming footage from the cameras across the country in potentially sensitive locations like forest trails, people's front porches, and playgrounds. And I could also zoom in on people's mobile phone screens. Another security researcher, Joshua Michael, independently found a misconfigured flock development demo via a Google search that included ArcGIS API keys with virtually unlimited usage limits. ArcGIS stores enormous amounts of data from local governments ranging from the live GPS location of police vehicles to aerial drone feeds. Flock has, over the last year, repeatedly claimed that their service utilizes end-to-end encryption. Both John and myself have verified the lack of end-to-end encryption in a variety of different ways, but the most alarming consequence of this was in Dunwoody, Georgia, where FOIA requests show that Flock employees had viewed cameras on their network over a thousand times, including the ones in sensitive areas like the interior of a Jewish community center and a playground. Flock's response to my videos over the past year and media stories about our research had primarily been defensive or in denial of the many reported vulnerabilities. But in light of recent events, they have invited myself and other researchers to review their hardware and platform. And while there hasn't been enough time for a thorough review before this hearing, I can testify that, in my opinion, it does appear that they're taking security a lot more seriously than they were a year ago. I have been one of Flock's harshest critics for years, but everything that I just stated about them is a symptom of a much larger problem, in my opinion. What I've been asking for around the country is for privatized government surveillance vendors to require independent security testing and inspections. I cannot legally open a restaurant or a barber shop without a health inspector and a fire marshal making sure that it's safe for people to enter. Yet there is not a single city or police department in this country that requires this from a third-party company tracking their citizens. I want to use my time here to ask our legislators to take this rare bipartisan agreement they're having to view Flock as a canary in the coal mine and understand that this doesn't go away by just removing one company from the equation. Both Axon and Motorola are actively rolling out the same reckless features that we're shaming Flock for, and you can expect these same vulnerabilities will continue to happen over and over again when innocent people's data is traded between private companies and police without any safeguard or protection. Some members of this community are in support of the combating organized retail crime act. which has broad definitions that could lower the security posture of sensitive civilian data to the standards used by retailers. After reading that bill, I immediately imagined the scenario where Home Depot or Target, with their data breaches, would all of a sudden... Their data breaches affected hundreds of millions of Americans, but now I'm imagining them also including their location data and sensitive information related to ongoing investigations. So to be as concise as possible... From a security perspective, it would be absurd to be concerned with the scenarios playing out with Flock while supporting bills like CORCA or the extension of FISA 702 that would be the equivalent of feeding a monster in an attempt to defeat it. An effective solution to many of the problems that we're going to be hearing about today would be using this momentum to make clear, effective, and unified federal privacy laws on par with the GDPR and literally every other developed country on the planet. ALPRs are used all over the world. But viewing license plates as personal data with modern privacy guardrails would have prevented nearly every single problem that we're learning about in this hearing. This is an opportunity for Congress to build the overdue framework to protect the privacy of Americans for generations to come. Thank you. Thank

Josh Hawley [35:47]

you very much, Mr. Jordan. Finally, Mr. Chad Marlowe. Mr. Marlowe is Senior Policy Counsel at the ACLU. Mr. Marlowe, thank you for being here. The floor is yours.

Chad Marlow [35:57]

Chairman Hawley, Ranking Member Durbin, members of the Senate Judiciary Subcommittee on Crime and Counterterrorism, on behalf of the American Civil Liberties Union, I want to thank you for the privilege of testifying before you today. My name is Chad Marlowe, and for the past 12 years, I have served as a senior policy counsel at the ACLU, where my work focuses on surveillance, privacy, and technology issues. In that role, I lead the ACLU's policy and advocacy work on automatic license plate readers, or ALPRs, including the ACLU's Get the Flock Out campaign. I want to begin my testimony by answering the question I think is on the mind of every person in America, namely, how did a country founded upon principles of liberty, personal freedom, and inalienable rights, including the right to privacy, find its people's vehicular locations and movements being tracked by governments at the local, state, and federal levels, even though virtually none of us are suspected of committing a crime? Put more succinctly, how did we get here? As you know, ALPRs are not new technology. They have been in use in America since the late 1990s. So why then in the last several years have we seen an explosion in ALPR use and its tracking of innocent people? The answer is twofold. The first is the entry of venture capitalist funding into the mass surveillance industry. Let me be clear. These massive investments do not reflect a rise in venture capitalist interest in public safety. Rather, it reflects a view that ALPR use, if scaled up, could produce the massive profits venture capitalists seek. But to achieve such returns, the ALPR industry needed to go bigger, much bigger. And that meant pushing far greater ALPR deployment, tracking, data retention, and data sharing to produce far greater profits. In short, ALPR companies are in the business of trading our privacy for profits and they are getting rich off of it. Welcome to the surveillance industrial complex, America. The second cause of the spike in ALPR use is the advent of artificial intelligence. While the massive deployment of ALPRs allows for the collection of an unimaginable amount of location data, at some point you create a data haystack so big it becomes impossible to find the needle within it. But with the advent of AI going through billions of ALPR scans and using them to identify drivers' intimate patterns of life, like what doctors' offices, religious institutions, political meetings, or businesses a person frequents, and even using the AI to generate flimsy criminal suspicion has become light work. Because ALPR systems are most commonly sold to local police departments, a nationwide ALPR surveillance network crept up on us slowly and silently until it was too big not to notice. In early 2022, the ACLU became the first organization to sound the alarm about this emerging threat as embodied by Flock Safety's ALPRs on steroids business model. The rest of America soon joined us, and here we are. Today, flock safety ALPRs collect more than 20 billion license plate scans per month. That's 57 scans per person in America every month. And that's just flock. If you think that sounds like an Orwellian nightmare, you'd be right. Beyond revealing intimate patterns of life and generating questionable suspicion, the most concerning impact of AOPR mass surveillance is that it can chill the exercise of people's rights and freedoms. This is why authoritarians love surveillance. In places like Cold War East Germany and modern-day China, the main benefit of mass surveillance isn't catching the few people who break the law, but rather putting all their people in fear of stepping out of line with the government's interests. That is the chilling effect. and it's coming to America. In 1755, Benjamin Franklin wrote that those who would give up essential liberty to purchase a little temporary safety deserve neither liberty nor safety. While that is certainly true, today's situation with ALPRs is even worse because the people are being asked to give up their privacy for virtually nothing in return. Decades of studies demonstrate that surveillance does not deter crime outside of its use in public parking lots and on public transportation. So we get no public safety benefits from ALPRs there. Moreover, a recent study of FBI crime data for Atlanta shows that the deployment of more than 5,000 ALPRs in that city had no effect on case closure rates. What that means is that where an AOPR identified a stolen vehicle or a wanted person, that vehicle or person would have been found anyway. Yes, perhaps the AOPR would have found the person a few hours or days faster, but that marginal gain does not justify undermining the privacy of 350 million Americans. Because of all this, nonpartisan opposition to flock, ALPRs, and mass surveillance has reunited America in 2026, and our leaders are listening. Vermont banned the use of ALPRs effective July 1, 2027. The governors of Texas and Florida have taken strong executive action to prevent the funding and deployment of ALPRs in their states. Locally, more than 200 municipalities have terminated their relationships with FLOC and other ALPR companies. The question is, will their Congress join them? The time has come for Congress to prohibit any law enforcement entity who receives federal funding from using ALPRs without exception, because when it comes to protecting civil rights and civil liberties, if you make one exception, you invite others, and that is a slippery slope we must avoid at all costs. So I implore you, Senators, to be brave and unrelenting in responding to these mass surveillance threats. And please know with absolute confidence that the ACLU and the American people stand behind you. Thank you for the opportunity to testify. I look forward to answering your questions.

Josh Hawley [42:11]

Thank you very much, Mr. Marlowe, and to all of the witnesses. Now we'll start some rounds of questioning, and I'll begin. And I want to start with you, Mr. Whitney, if I could, and help me and everybody watching understand what's the difference between this technology that we're talking about today, this AI power technology, and a traditional license plate reader technology. And here's why I ask. I'm a former prosecutor. We've got Senator Blumenthal is a former prosecutor. I think Senator Klobuchar is a former prosecutor. Yeah, that's right. I'm sorry. I should have started with you, Senator Klobuchar. My mistake. This is common. And when I was Attorney General of Missouri, we used license plate readers all the time. Sheriff, I'm sure you use them constantly. I mean, they're very familiar technology. However, my understanding is what we're talking about here today. with this linked network of private cameras all uploading to the cloud, searchable and powered by AI, is something very different. So explain that to us, if you could. What's the difference? Why is this a qualitatively different kind of technology?

Alasdair Whitney [43:11]

Well, thank you for the question, Mr. Chairman. You said it. The fact that this technology is now interlinked with cameras across the country in this network that allows a government official or an officer in one side of the country, say California, reconstruct the past movements over weeks or even months of somebody driving in Maryland or Virginia is something that is both qualitatively and quantitatively different than something that, you know, a technology that we've ever seen before. And that is why we are concerned about this and what makes it different from the ALPRs of yesteryear. Law enforcement can do this right now, as I said, with the ease of typing in a Google search, right? And then they can get this information showing where you've been, what you've done. In our San Jose litigation, for example, we've seen these cameras placed in front of attorney's offices, medical facilities, churches, mosques, other places of worship. And to allow government officials all over the country to access that information and potentially track where somebody has been going and what they've been doing is concerning. And of course, this is all supercharged by AI. A couple of years ago, you couldn't possibly sift through 20 billion images with just a few. officers or even 100 or 1 ,000 officers. But AI now makes it much easier to do that with, again, a click of a button or a couple of keystrokes.

Josh Hawley [44:35]

Just to pick up on that point, if you have hundreds of billions of images now that are being collected and collated and available on the cloud, and you've got AI able to search them, you really can reconstruct, or the AI can reconstruct, the very granular movements of individuals. over long periods of time. Isn't that right? I mean, they could track me driving from Missouri, out here, taking my kids to school, going to church, doing everything that it is that I do. And you could do it for days and weeks at a time using this vast network. I mean, am I exaggerating? Is that right?

Alasdair Whitney [45:09]

No, sir, you are not exaggerating. That is exactly right. I mean, again... We've heard from the proponents of this technology and using it in a way that they've been using it right now that they don't use it to track people. I think that that's just simply untrue. The value of this technology is tracking people and is determining where they are and what they've been doing.

Josh Hawley [45:32]

Including sometimes images of the person, right? Facial images. Let me just put up a poster here. Poster number nine, guys. ALPR does not use facial recognition as a claim we often hear from these companies. And of course, traditional license plate readers don't track individuals at all. I mean, that would have no purpose, right? Sheriff, you're trying to get the license plate so you can run. the chain of custody on the car, see the driver's license. It doesn't track individuals. But we now have, we know this technology is now able to track facial recognition despite what they say. And you can see it on the poster of the motorcycle. Let's take a look at this that I showed earlier. This is from a flock camera, I believe. Look, it's already, the analysis of the flock camera is already saying, there's the license plates. There's the vehicle and there's the person so it's separating out the person and this image would be totally searchable in this nationwide database We also know that flock has applied for a patent that would permit the tracking of individuals. They call it a patent for a dynamic surveillance network that would allow searches of individual persons by image in this huge database. I mean, this seems to me to be something unlike anything we've seen before. Am I right about that, Mr. Whitney? I mean, we're a long way from a traditional license plate reader here.

Alasdair Whitney [46:49]

Yeah, absolutely. And what we have seen, obviously, with the information that you've shown today, that these surveillance platforms, and that's really how they should be more accurately described, are capable, of course, with a click of a button of being enhanced with software to perhaps do this one day. And I will note that in the images that we just saw, if there are other motorists, motorcyclists around, pedestrians, the camera is capturing images of those individuals as well. So it's all very concerning.

Josh Hawley [47:18]

The Flock CEO wrote me a letter in response to my invitation to testify today. And in that letter, the CEO said some interesting things. And I just want to put these on the record to make sure that we all understand what we're talking about here. Flock acknowledged that it conducts very little oversight of client searches and instead relies on its clients to police themselves and said, and I quote now, the underlying search records are owned and controlled by each customer agency. So in other words, once you subscribe, you've got access to the whole database. Flock clients control the data retention. So these images, billions and billions of images a month, have not been set to expire, not been set to be expunged. Until last year, flock customers could enter the reason for a search into a free text field, that's their words, which did not have any meaningful accountability. And we know that various persons entered their reasons for searching into the database to include terms like the reason was just search or the reason was LOL. No cop would do that, right? I mean, Sheriff, you can attest to this, and we'll come back to this here in a minute, that when cops use license plate readers, and I want to say I think that's very valuable technology, but only a certain number of law enforcement agents have access to that technology. You've got to log a reason for using it. You've got a law enforcement purpose. I mean, this is how we do it in Missouri. It doesn't appear to me that that's how these flock cameras and others are being used. I mean, they're just open to just about anybody who subscribes. There are no controls on them put by the companies. And Flock also admitted in their letter that it is possible to search for humans in images. That is a direct quote. Let me say that again. It is possible to search for humans in images taken by Flock cameras. That's currently today that is possible. And again, all powered by AI. This just seems very concerning. Much more on this to come. Senator Durbin.

Richard J. Durbin [49:11]

I'd like to ask Mr. Marlowe, we are concerned in Illinois with Operation Midway Blitz, where ICE and the Homeland Security Department came into our state and started looking for people to deport. They ended up deporting a substantial number, and it turns out that their promise to limit those deportations to the worst of the worst. As the president characterizes them, the rapists, murderers, terrorists, sexual predators, it turned out that the majority of people they were deporting were American citizens not guilty of any crimes. Our state passed a law which limits law enforcement from using flock data for immigration purposes. Have you heard of such laws in other states?

Chad Marlow [50:02]

Yes, thank you for your question, Senator. So I have heard of laws like that in other states, and I believe that they constitute a good faith effort to protect vulnerable populations. But unfortunately, the news I have to share is the value of those laws is limited. If the federal government, you give an example of ICE, were to show up with a judicial warrant or an administrative subpoena for that data, it would not matter much what Illinois law said about it. It would have to be turned over. If they participate in a data sharing database where just one officer in the state of Illinois is sympathetic to whoever it is is trying to access that data, be it ICE or anyone else, they have the ability to run a search on someone else's behalf. And again, it's, you know. Looking at it in the immigration context is horrifying, but they've done the same to people who go to gun ranges. This really is nonpartisan. It is come up with the group you want to target, and with this level of technology, targeting them is fairly easy. So that is the challenge here.

Richard J. Durbin [51:05]

Mr. Whitney, I heard your testimony saying the answer is a warrant, and a warrant is certainly recognized under our Constitution as a valid use of government power, authority, if used properly. Is that the problem here? The bottom line is they collect the information before there's any specific allegation that wrongdoing has taken place?

Alasdair Whitney [51:26]

Thank you for the question, Senator. I think the problem is collection one, but also the just, frankly, in most places, limitless access to that information without a warrant. IJ didn't write the rules. We didn't write the rules. The framers of the Constitution did, and they said that whenever you want to search a person in the context of modern technology, this is what a search looks like, you must obtain a warrant.

Richard J. Durbin [51:49]

Sheriff Teeple, what was the breaking point for you? You used this information and then decided that there was just too much of a violation of the Fourth Amendment. Where did you break with the precedent that had been set before you?

Sheriff Ross Teeple [52:04]

Senator, thank you for the question. I'm old. This is the second time I've heard the word Patreon here, and I don't even know what that is. But that being said, I was the lieutenant over aviation and search and rescue until I was elected to be the 25th sheriff. I took office January of 2025. My knowledge of ALPRs were 20 years old when I worked Stone Garden, where they would be mounted on my vehicle, and I would see them passing. And then I started getting questions from my constituents, and they were asking very specific questions, and I started asking Flock, the company. questions and they were not getting answers to me. I think it's remarkable that Chairman Holloway got them to admit that they now can track a person because what I received from a flock representative was I was told our cameras don't take a high enough resolution picture to be able to recognize a person and when they told me that I'm looking at flock camera pictures where I could recognize the person on the camera. They're taking a picture, but that was their claim was their cameras didn't take enough, and there was just too much disinformation from them and dishonesty. I was trying to get answers from them, and they would not give me the answers to them, and there were too many concerns, so we just decided not to continue our contract.

Richard J. Durbin [53:15]

Thank you for raising that point, because it's not a matter of just reading license plates. That seems so routine, but it comes to the point where you can identify and recognize the people in the car. You can imagine in a state like Illinois, and your state as well, the Hispanic population views this as a threat to their existence, where they can be pulled over for driving while looking Hispanic. And unfortunately, we've seen too many instances where people with no criminal records, American citizens, removed from their homes and arrested and deported. It's just the kind of thing that's hard, if not impossible, to explain. I want to give a minute to Ms. Isaacs here. When I listened to your description of your experience, the thing that struck me was whatever the law enforcement agency involved there had tangible evidence in your car that could be viewed. I mean, did you take a look at it later and see the damage that they were referring to?

Lindsey Isaacs [54:16]

Thank you for your question, Senator. There was no damage on my car at all. That car was a brand new vehicle. I got it with zero miles on it, and when they took the car, it didn't even have 10,000 miles on it. It was in perfect condition, and they still said there was damage consistent with the collision on the vehicle.

Richard J. Durbin [54:38]

I don't understand that. If the notion here is to gather accurate information so we don't make the mistake that led up to your incarceration, there was a failure here, a complete failure. So a misuse of the information. Sorry for what you went through, and thanks for your courage in testifying.

A witness [54:55]

Thank you so much.

Josh Hawley [54:58]

Senator Britt.

Katie Boyd Britt [54:59]

Thank you so much, Mr. Chairman, for putting together this hearing and for everyone taking time to be here today. Obviously, this is an important topic, and it's received a great deal of public attention in the last couple of weeks in debate and very much warranted. I think two things can be true at the same time. One, we want to keep and make sure that our law enforcement officers have what they need to keep Americans safe, to help make sure that children who have been abducted get home. But we must protect people's Fourth Amendment rights. And when we're looking at this... I want to make sure that we're kind of looking at the total picture. Senator Warnock and I came together and wrote a letter, and Mr. Chairman, I'd like to ask unanimous consent that this be submitted for the record. Thank you. We talked about our great concern over the widespread reports that there was misuse regarding these automatic license plate readers. In here, we talk about many of the... good things that we think have resulted, but ultimately believe that appropriate safeguards are necessary to protect against the unauthorized access and abuse that has come to light. Sheriff, I'd like to start with you. When we're looking at cases in Alabama, we kind of dug in and took a look at what we were seeing there. We saw that there were missing children, endangered persons, runaway kidnappings, that this has helped locate that person and bring them home. Also, more recently, someone, an older adult with dementia, and ultimately getting them home. However, you know, we've seen misuse and abuse in Alabama as well. When we're looking at this emerging technology, you know, we want to make sure that we get this right. Can you first talk about some of, you've obviously had access to this. it prior to recently. Can you highlight what you believe would be some legitimate uses of this technology and maybe something anecdotally that you've seen it help actually solve with regards to safety and security of the people that you serve?

Sheriff Ross Teeple [57:10]

Senator, thank you for the question. One thing I'd like to respond to is the National Sheriff's Association and the Major County Sheriff's Association recently published guidelines, September 15th of 2026, and I've read through them guidelines, and I think that they're an amazing step in establishing those. I'd like to be clear on the fact that... I have absolutely no indication or belief that my deputies did anything wrong. My deputies were using the technology correctly. What our concern was is we knew what access we could get from it. We could put a license plate in there, a license plate number or a partial license plate, and then find matches. The best one that I can give you most recently, unfortunately, was in my county. There was an aggressive driver that... rammed a young lady's vehicle and pushed her into oncoming traffic. And she died, unfortunately. And we found him because of an automatic license plate reader.

Katie Boyd Britt [58:05]

When you talked about some of those safeguards that you saw in this letter with the National Sheriff's Association, can you talk about what some of those may be that you feel like can help make sure that this is being used the right way?

Sheriff Ross Teeple [58:17]

Yes, ma'am. One of the biggest ones is, you can read right in there, is taking still images of license plates. Not live streaming, not taking video, taking still images of license plates for use of that data alone. Another one is that there should be, if I access assiduous information incorrectly, in Arizona it's a Class 6 felony. I don't know a law enforcement official that doesn't think that the same penalty should apply if you access this data incorrectly.

Katie Boyd Britt [58:45]

I think when you're looking to some of the reports that we've heard about people... whether it's domestic violence victims, whether it's gun owners, everything in between, this technology being utilized to harass and or track someone is absolutely completely unacceptable. We've got to figure out how we can do this the right way. And based on your experience from what you're telling me is there are some guidelines, there are some things that we could be doing that we're not doing now that we could demand that would ensure that. One of the things that... We've talked about in this letter and that I hope, Mr. Chair, I hope you get an opportunity to look at it, is making sure that DOJ does its part in all of this. We've asked for the proper oversight, the proper guidance, and we hope that state and local law enforcement officers will get that because something has to be done here. Ms. Isaacs, I just want to say thank you so much for telling your story. Elevating your voice in any arena is challenging. When you do it on a national stage like this, it comes with a great deal of both courage and conviction. So I appreciate you doing that and telling your story so that others don't have to go through what you did. And I'm so sorry for all that you endured.

Lindsey Isaacs [1:00:02]

Thank you so much. That means a lot to me. Thank you.

Josh Hawley [1:00:07]

Thank you, Senator Britt. Senator Padilla.

Alex Padilla [1:00:09]

Thank You mr. Chairman and I as well miss Isaacs wanna Say my heart goes out to you and appreciate you being here today and your willingness to share Your story, hoping something good comes out of this going forward. My first question is for Mr. Marlowe. Part of the conversation we've had here today is not just what does the federal law say or not say, state law, what does state law say or not say, even local laws that can address some of the concerns here. But the use of this technology is also different. Federal government use. state government use, local government use, let alone private sector use of the technology can just at a high level kind of break down maybe some distinct concerns between federal government use, state government use, local government use, and private sector use.

Chad Marlow [1:01:01]

Yeah, thank you for your question, Senator. I mean, I have concerns about all of the potential uses of this. And as an introduction to answering your question, and I appreciate what the committee is doing today, a lot of times we frame these questions as a balance between public safety and privacy. I would like to suggest that this technology is the threat to public safety. It is not a solution to it. How it is used really depends on different levels. I think the largest use of this technology occurs on the local level. That makes a lot of sense, right? Tens of thousands of local police departments using it. And how they use it and how they choose to use it really varies from department to department, which is why the inconsistency in and of itself is a problem. You can adopt rules on the local level. But again, as you drive through a particular state, you could experience 50 different sets of rules governing you. So states have stepped up recently. What's very interesting to me is a year ago. A lot of the states, and I work in practically all of them, were talking about guardrails as being the best thing you could possibly do to rein in this technology. The problem with those guardrails, whether they apply to state actors, federal actors, local actors, there's a couple of problems with them. One, when I look at them, I try to write the best guardrails I can, and I can never close the holes. And if I can see the holes... other people can see them as well. I think that's a major problem. The other thing with the guardrails is actually there's two other things. One, we know that people don't always follow guardrails. So you create an attractive nuisance and people are going to be drawn to that nuisance like a moth to a flame. And I think that that's something we also just have to be attentive to that they're not always followed. I also think the final problem is even if you pass guardrails that attempt to strike a balance, When the public sees a flocked camera, they drive by their third flocked camera in a day, they may not have a copy of the applicable statutory law in their pocket and go, oh, shoo, data retention and data sharing limitations are better. Even if they have it, they may not have the confidence they're being followed. Now we have the chilling effect. On the federal level, because the last question you asked, we see it for immigration enforcement. But the idea that we need to have in our mind, because this is bipartisan, thank you, and let it stay that way, is the threat presented by the federal government today could be different tomorrow, could be different next year, the next year. And I think everyone on this panel understands that, which is why you have joined together. It's not about the current threat. It's about the ever -existing threat, right? Orwell wrote about 1984, but lo and behold, it also applies in 2026. So I

Alex Padilla [1:03:42]

appreciate that in a good high level. framework of concerns that I think on a bipartisan basis we are trying to tackle. I do want to follow up on one specific use at the federal level and in some ways is to follow up to a question from Senator Durbin earlier in the hearing. Broad data sharing with ICE. Is it happening or is it not happening? Flock claims that it does not partner. with ICE and that ICE does not have direct access to flock cameras or their systems or their data, but we know that ICE is still able to access flock data through state and local law enforcement agencies that have entered into agreements, cooperative agreements with ICE known as 287G agreements. So can you explain in more detail how these agreements can function as a loophole? For ICE or other immigration enforcement agencies, taxes stated that they otherwise couldn't.

Chad Marlow [1:04:39]

Yeah, thank you, Senator. It's a great question. So you actually quoted from Flock themselves, which I think shows the problem. First of all, I would point out Flock seems to change its story from week to week. It's hard to even run. But they did say for a long period of time that ICE does not have direct access to Flock data. And that was true. But the key word there is direct. Exactly. And so it doesn't even take a 287G agreement, although that's obviously a major problem. All it takes is one officer in one department who is a customer of FLAC and participates in their nationwide data sharing program. And you get a call from be it ICE or any other federal agency that says, hey, can you run a search for me? And either because they believe in the cause that that federal agency is pursuing or they just they want to be on good terms with them because they may need something from them tomorrow. They say. happy to help, and Flock never acknowledges that no security procedures it's put in place do anything to protect against the misuse of its system. The

Alex Padilla [1:05:41]

question becomes, how do we close that loophole?

Chad Marlow [1:05:43]

You ban them, sir. You ban them. Thank you.

Josh Hawley [1:05:48]

Senator Blumenthal.

Richard Blumenthal [1:05:50]

Thank you, Mr. Chairman, and thank you for having this hearing, which I think responds to a strongly felt need all across the country. In Connecticut, literally... This issue is on the front pages of newspapers almost every day with different communities reaching different conclusions and therefore individual rights potentially varying in 169 different towns. And so there is a need for some uniformity in protecting rights and liberties, most especially against surveillance. Connecticut adopted a law, Senate Bill 397, which was signed into statute in May of 2026, just this year, which establishes some restrictions on the use of data. For example, it can't be shared with other states unless there are guarantees of protecting privacy. It can't be shared with a national database. any multi-state or national data sharing system unless there's written authorization and possibly a warrant. So I am wondering whether states really maybe will offer more protection than Congress. and whether we can rely on states to fill the gap that exists right now. Of course, Connecticut's law requires that there be no retention beyond 21 days, which is way beyond the two hours that your organization, Ms. Whitney, would recommend. And the model statute you provided requires a warrant. Would you advocate that... there be a federal law that requires a Warrant in every instance seems to me that there might be objections in some states to that requirement Would you preempt state statutes?

Alasdair Whitney [1:08:12]

Thank you for the question, Senator. I think ideally the warrant requirement would be, you know, first in line with making sure that federal agents are obtaining a warrant before accessing this information. I want to be very clear, too. There are numerous exceptions to the warrant requirement in emergencies to prevent the destruction of evidence, to find kidnapped children, stolen cars, when the person consents to their information being searched, things like that. So we're not recommending a complete, you know, horse-blinder view, you must get a warrant in all situations. The Fourth Amendment has never required that, and the Supreme Court's interpretation of the Fourth Amendment has never required that, too. But I think the federal government has some unique levers that it can pull to get states and encourage compliance with federal grant money, things of that nature. And ideally, I mean, we do see a patchwork right now, as Mr. Marlowe noted, in some of these states. I work in many of these states as well. As we all know, you travel very frequently. At least I do. I'm in Chicago. I travel into Indiana, Michigan very frequently. I would hope that my rights are respected in those places just like they would be respected in my home state. And that's where the federal government can come in and encourage these best practices and require it for federal officials. To

Richard Blumenthal [1:09:28]

what extent is the, I guess it's kind of a side door issue, federal... authorities using state law or vice versa? To what extent is that a problem?

Alasdair Whitney [1:09:42]

It's a big problem. Senator, in our San Jose litigation, we have discovered that federal agencies on 20 different instances have obtained access to San Jose's ALPR data, and state law expressly forbids that. So we've seen that also, I believe, in Virginia, where despite a law that looks actually, in some respects, pretty similar to Connecticut's law, that law enforcement agencies in that state are simply not complying with it. And so... All of this just funnels back to this front -end gatekeeping protection with the warrant requirement. Because without that, it is a self -executing enforcement mechanism. Without that, it's hard, or it's easy, rather, to abuse the system to get that side door or back door access. And on the

Richard Blumenthal [1:10:38]

retention issue, I can... see circumstances or reasons that the retention period should be longer than just two hours. Connecticut again is 21 days. Is there real harm done by that kind of more lengthy retention period?

Alasdair Whitney [1:10:59]

Yeah, absolutely. And just to clarify, first thing, Senator, is that our recommended retention period as reflected in our PEEPS Act is seven days, right? And we want to make sure that law enforcement ideally has the time to get a warrant and to keep that data and do it the right way, particularly in places where distances or lack of reception and internet, whatever, access can make that difficult. But I think that is the problem with anything longer. than a seven -day retention or a short retention period, really, frankly, for that matter, is that in most places, 30 days worth of data on 99 % of people who are probably indisputably innocent and not suspected of any wrongdoing. We think that it is a problem that the government just houses this information on all those people just in case. Thank you. Thanks.

Josh Hawley [1:11:51]

Senator Booker.

Cory A. Booker [1:11:53]

Thank you very much, Chairman. Mr. Temple, I just really enjoyed and appreciate your testimony. I didn't expect to feel such a kinship with you in the sense that I was a mayor 20 years ago. This technology was not in distant then, but I remember going to community meetings where people would ask me who had problems with crime and drug traffic on their communities, please, can you put up a camera here to make us safer? And it was we invested in shot spotters. I'm sure you know that technology to be able to respond quickly. And it helped us to get people to hospitals who were gunshot victims and more. But what has happened over the last 20 years is stunning. And I just want to ask you really quickly one more time. That you went from an understanding that this was a law enforcement to help keep people safer to now you seem to be very concerned about fundamental civil rights because of the massive advancement of this technology, correct?

Sheriff Ross Teeple [1:12:52]

Senator Cory Booker, it's actually good to see you again, sir. We used to own a condo on 111 Market Street in New Jersey, and I met you very many years ago, sir.

Cory A. Booker [1:12:59]

Forgive me for not remembering.

Sheriff Ross Teeple [1:13:02]

No, you

Unidentified speaker [1:13:03]

would not remember me at all, sir, but when you walked in, I remembered you. I'm blown away by that, sir. I'm blown away. I hope I was nice back then. Yes, sir, you were extremely nice. Okay, good. And we've since sold the condo.

Cory A. Booker [1:13:18]

I hope

Sheriff Ross Teeple [1:13:18]

you made a profit. My beautiful wife works for United Airlines, and she's transferring out to the San Francisco base, so that's why we sold it. Yeah,

Cory A. Booker [1:13:25]

we have a lot of flight attendants that are in Newark, yes. Yes, sir. Thank you, sir. To my question. Yeah, please tell me about your evolution.

Sheriff Ross Teeple [1:13:35]

So one of the points I wanted to make was, is that I forgot about earlier, is... I know my IT director always gives me a hard time about this when I say that AI is recent. He said that AI was started to create it in 1956 with a protocol. But artificial intelligence, the way we know it. Didn't happen until GROC chat GBT and GROC AI and those sort of things. The contracts that the Pinal County Sheriff's Office had with Flock were actually signed before AI became a thing. So that was one of my questions I explained to this gentleman earlier before the hearing started was I asked Flock. what type of AI do you have on your cameras? Their initial response to me was, oh, we don't use artificial intelligence on our cameras. Then I think it was about two months later, they put out a press release talking about how they use artificial intelligence to create a digital fingerprint of your vehicle. And so I reached back out to him and I said, wait a minute, you told me there was no AI in your cameras. And the response was chilling to me. They said, there wasn't the AI that you were asking about. I didn't ask about a specific AI. I asked about what was in your cameras. So that was a concern for

Unidentified speaker [1:14:44]

me. You see this advances in technology, obviously, as an infringement on potential fundamental civil rights.

Cory A. Booker [1:14:49]

It can definitely be an infringement on fundamental civil rights. And so, Chad, Mr. Marlowe, may I switch to you if I can? despite the fact that you have an obnoxious amount of hair on your head, sir. I deeply apologize. I feel very inadequate, sir. From the freedom of the press... to Second Amendment rights, we see how authoritarian countries like China arguably use this technology to repress human rights. And I want to just draw for you to give me some example of this. If a state has a law that prevents a woman from getting reproductive rights, and we're seeing this now where they pass laws about people leaving their state to access reproductive care. A state could be using this technology to track and ultimately, when they return home, prosecute women who are accessing reproductive care. Is that correct?

Chad Marlow [1:15:51]

Unfortunately, that is completely correct, Senator. And the thing that is even more disturbing about it, we've talked a lot about AI here today. In George Orwell's book, even though George Orwell didn't know it, Big Brother was never a person. It was AI. And so you can literally prompt AI to say, I want to find people who are leaving my state and seeking abortion care somewhere else where it remains legal. And the AI will look and they will find the Planned Parenthood clinics and they will find the major highways. They will identify the bridges. They will look for patterns who went to a doctor and then to a drugstore in the state and then returned to the state where it was illegal.

Cory A. Booker [1:16:32]

So just my time has expired, but I just want to put it this way. We have, when it comes to fundamental... Rights in the United States of America civil always had balances you have freedom of speech, but you cannot yell fire in a crowded movie theater Understanding the balances here and here we have as honorable. Mr Temple has said, you know, we have safety concerns But to me we have gone way out of balance now when it comes to certain societal interests in public safety in Concerns there with violating the average American's sense of fundamental rights to privacy, to speech, to be moving without government surveillance, and so much more. We are way out of balance right now. In fact, we are out of control for any government, state, local, or federal, to easily abuse the fundamental rights that we all assume we have a right to that these cameras seem to be so seriously violating, correct?

Chad Marlow [1:17:34]

Yes, that is correct. Although I would say that just because you are out of balance does not mean that there is a balance to be found. Sometimes things are simply too dangerous to use.

Cory A. Booker [1:17:44]

Understood. Thank you, Mr. Chairman.

Josh Hawley [1:17:46]

Thank you, Senator Booker. Just let me follow up on that, Mr. Marlowe, because it seems to me a suggestive line of questioning. When you have this amount of data available, the temptations to use it are going to be absolutely incredible, if not irresistible. And I'm just thinking... For those of us who are supporters of the Second Amendment, we've long feared national databases of any kind. You can easily put these cameras up in front of a gun show or near a gun store or a range. You can put them up in front of pregnancy care centers and you can do all the same things. that Senator Booker was talking about. You can query all the same, show me who's going here, show me who's doing this, show me what time they leave, show me what vendors are supplying these various places, right? And you can create those same patterns using this unbelievable data that basically at this point has no meaningful curbs on it. I mean, isn't that correct?

Chad Marlow [1:18:36]

The only thing incorrect about what you said, Senator, was you said could, you should say are. They're doing all those things. right now. And again, you know, it reminds me of the movie Field of Dreams. A lot of people say minority report. I'm thinking Field of Dreams today. If you build it, they will come. And if you create those temptations, if you create the tools that government need to go after whatever population is, I so much appreciate that you're bringing abortion care seekers and gun owners because they are part of the same community when it comes to the threat of mass surveillance. So yes, absolutely, this is something we need to be worried about because When you create the temptation, when you create the option for population control, at some point, someone's going to use it. Mr. Chairman, can I ask you, I'll

Cory A. Booker [1:19:19]

make a point to you, if possible, just as a follow -up, even though you have the same hair issues as our witness. Sure. What's even more frightening than your government, I imagine, is that there's no data security here. And at a time that we're seeing more and more hacks, more and more sophisticated hacks, people using AI to supercharge their ability, the fact that this information could be made available, and you and I both know this because we spend a lot of time in skiffs. for foreign nationals to hack this and access this information and be able to use it against us. It presents a serious present risk.

Josh Hawley [1:19:55]

And you read my mind. I wanted to ask you, Mr. Jordan, the CEO of Flock has said, and let me just make sure that I get this right, because I think he said this in a letter to a sheriff in Stoughton, Virginia. He said, in response to a specific query from the sheriff, that Flock has never been hacked. I think we've got it right here. He says, hi, Virginia Stoughton PD team. I'm writing you directly because I want there to be zero confusion about what's happening. Flock has never been hacked, period, ever, period. Now, based on what you know, is that accurate?

Benn Jordan [1:20:26]

I would say that's inaccurate. The company has, at various times, changed the definitions of the word hacked, tracked, data breached. But in the general definition of accessing unauthorized data, yes, I would say that they've been hacked.

Josh Hawley [1:20:44]

How vulnerable? You've studied this. You are, as you said earlier in your own introduction, a hacker yourself. I mean, how vulnerable? in your professional opinion, are flock systems that contain all of these images, billions with a B, billions of images, probably everybody in this room, anybody who's driven a vehicle of any kind, I'm sure, we're all on the database. So how vulnerable are their systems to hacking and then manipulation in the sort of ways that Senator Booker was just talking about?

Benn Jordan [1:21:11]

In general, one sort of analogy that I really like is if you were in a tiny little box and you wanted to make sure that no ants could get in the box and you were equipped with Raid and a shoe to smash the ants or whatever, you could maybe caulk up the holes, you could pretty much make sure that no ants are going to get in your box, and that's great. But if you lived in a 30,000-square-foot warehouse, whether ants get in or not is up to the ants, not you. And that's kind of how I look at this in terms of... why create this much data when we can't secure it? But to answer your question a little bit more technically, the flock devices that we tested were running on an old version of Android that has been out of service for years, and newer devices of flocks run on a modified kernel of Android, which is far from government-grade security, but... It is better than the older ones. But to be fair, and to be completely frank, nobody required them to have government -grade security. Law enforcement infrastructure has been using Flock for nine years without any form of cybersecurity regulation or requirements. So expecting a tech startup to adhere to those standards is a little lofty to me.

Josh Hawley [1:22:20]

So are you telling me that they're basically using like 10 -year -old Android phones as the cameras?

Benn Jordan [1:22:26]

Not phones. They're running hardware that was running the Android operating system. And since then, they've had their own build of Android that they could secure a little bit better than they had. But a

Josh Hawley [1:22:39]

decade old, you said, in some cases, the technology is a decade old. Yeah, Android.

Benn Jordan [1:22:46]

Things 8 .1, I believe, was the core operating system, which was initially made for stuff like refrigerators and stuff. But it's a way where you could run Android without a screen, essentially. That's why that operating system exists.

Josh Hawley [1:22:58]

So how easy would it be for a bad actor to download... modify and or upload false ALPR data into this system? I mean, could that be done?

Benn Jordan [1:23:10]

Yeah, so right up with those older cameras, the ones that we had tested, I would say that the hardware requires a light to moderate knowledge of Android debugging. But I did find... an administrative interface, as I mentioned earlier, online of live cameras, which is as easy as clicking a link and then hitting a delete button to get rid of footage or something like that.

Josh Hawley [1:23:32]

Could you just say that again? As easy as clicking a link and then hitting a delete button?

Benn Jordan [1:23:35]

Yeah, I found them on a commercial search engine that searches for things like Internet of Things devices, and we found over 60 cameras that gave us the administrative interfaces, and it gave us access to 30 days of the past footage of those cameras. And these weren't ALPRs in the sense of what we're usually talking about. Flock makes a lot of different cameras. They make the Condor camera. They make the older Falcon ones, which are ALPRs. And I think we'll be talking about that a little bit more today because that also kind of defines what AI is, like how it's being used and stuff. But in this case, they were pan-tilt zoom cameras, so they would actually follow people. And in some cases, I was able to go back a week. and read what was on someone's phone screen as they were texting somebody walking under the camera.

Josh Hawley [1:24:22]

You could read what someone had on their phone while they were just walking by the camera? Yes. And you were able to just do this by just your own knowledge? You said clicking a link and getting in.

Benn Jordan [1:24:34]

Yeah, I could actually send, like I would have been able to send the link to you, and you would have just clicked it and browsed this interface from your phone.

Josh Hawley [1:24:41]

That's extraordinary. I mean, that's just extraordinary. Let me bring this back to... the very real personal cost. Ms. Isaacs, I just want to come back to you and your extraordinary story because I think it illustrates the dangers here in this technology if it's not properly cabined and accounted for. I think we have a picture of you with your beautiful new Durango. Here it is, I think, right? This is you. And that Durango does look like it's in pristine shape.

Lindsey Isaacs [1:25:09]

Yeah, that was the day I got it. This is the day you

Josh Hawley [1:25:12]

got it. All right. You kept it very nice. Now, as I understand it, the Durango that was involved in the vehicular crash that indeed caused three other people to die was a vehicular homicide. That Durango was maroon, red. Is that correct?

Lindsey Isaacs [1:25:25]

Correct.

Josh Hawley [1:25:26]

This Durango doesn't look red to me. What color is this?

Lindsey Isaacs [1:25:29]

It's a black Durango. This is

Josh Hawley [1:25:31]

a black Durango. So here you are returned as a false positive out of an AI search in a flock system. We know it wasn't a traditional license plate search because your car was never there, correct? There are no images of your car at the scene. Is that correct? Correct. And there was no assertion by anybody ever that you were there. Is that correct? Correct. It was just that the flock cameras, based on some general description entered into them, the AI... pulled out your car and said, this is a match, correct? And that led to 13 days in jail for you, including solitary confinement, and you very nearly lost your entire livelihood. Isn't that right?

A witness [1:26:07]

I was facing life in prison. I can't even believe it to this day.

Josh Hawley [1:26:13]

All because the AI falsely tagged you. And that brings me to what may be, I guess, my final point, which is a comment that the... Flock's CEO said recently about the trade-offs that we just have to make in this new technological age. He said that in this age of Instagram and Facebook, et cetera, I think maybe we have the quote here for you, we've all just agreed to surrender our privacy. He says, I think it's important to take a perspective of we've already given up the traditional sense of privacy because we have Instagram and Facebook and the internet, and we live in a pretty safe world given those trade-offs. I just... I want to ask everybody in this room, do you want to make that trade-off? I mean, are we going to live in a world where we may all have to suffer the deprivations that Ms. Isaacs did because some robot decides that we were at the scene of a crime? In fact, we were never there at all, and there's just nothing we can do about it? I just suggest to you that this viewpoint is the problem. I want to end where I started. The Constitution is as valuable... and as valid today as it was when it was first written. If anything, the Bill of Rights protections are probably more important today than they were all those years ago because the threats to our liberties are actually much greater. And the technology that both bad foreign actors, private actors, corporations, and government have at their disposal are much more powerful. We need the Bill of Rights more than we ever did, and we've got to find a way to enforce it. I want to thank all of the witnesses for being here. Thank you for your testimonies. Thank you for your work. Thank you, Senator Booker. Thanks to our audience. Let me see here. I think I'm supposed to read something about how long the record is going to be open. The record for this hearing will remain open for one week until Wednesday, September 30th at 5 p.m. for the submission of statements and questions for the record. And with that, the hearing is adjourned.