Marin County Flock Camera Data Accessed by Out-of-State Agencies Without Permission
The Marin County Sheriff’s Office confirmed that its network of 31 Flock license plate reader (LPR) cameras was accessed over 250,000 times by out-of-state and federal agencies without authorization. The unauthorized access occurred for nine weeks in late 2024, raising concerns about privacy violations and potential misuse of surveillance data.
The breach was uncovered by The Point Reyes Light, which reported that multiple external agencies conducted searches of Marin County’s camera data. The sheriff’s department acknowledged the incident, stating it had immediately disabled out-of-state access upon discovery but has yet to receive an explanation from Flock regarding how the breach occurred.
Critics, including the ACLU and Electronic Frontier Foundation (EFF), argue the incident reflects long-standing warnings about the risks of LPR data sharing. In 2022, a lawsuit filed by residents including Tara Evans, who later settled with the county revealed that the sheriff’s office had previously shared license plate data with federal immigration enforcement, violating state law. The ACLU and EFF have since demanded answers, expressing concerns that the data could have been used for abortion prosecutions, ICE tracking, or monitoring First Amendment-protected activities, though no specific misuse has been confirmed.
The sheriff’s office maintains that the cameras have been a “game-changing tool” for law enforcement but emphasized its commitment to privacy, transparency, and accountability. Evans, a plaintiff in the 2022 case, indicated she may pursue further legal action in response to the latest breach.
Source: https://www.nbcbayarea.com/news/local/residents-concerned-flock-data-breach/4152425/
Flock Safety TPRM report: https://www.rankiteo.com/company/flock-
"id": "flo1790994694",
"linkid": "flock-",
"type": "Breach",
"date": "10/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Residents of Marin County, '
'potential targets of '
'surveillance',
'industry': 'Public Safety',
'location': 'Marin County, California, USA',
'name': 'Marin County Sheriff’s Office',
'type': 'Government/Law Enforcement'}],
'attack_vector': 'Misconfigured/Unauthorized Access',
'data_breach': {'number_of_records_exposed': '250,000+ access instances',
'personally_identifiable_information': 'License plate '
'numbers, vehicle '
'movement data',
'sensitivity_of_data': 'High (location tracking, potential '
'for misuse)',
'type_of_data_compromised': 'License plate reader (LPR) data'},
'date_detected': '2024',
'description': 'The Marin County Sheriff’s Office confirmed that its network '
'of 31 Flock license plate reader (LPR) cameras was accessed '
'over 250,000 times by out-of-state and federal agencies '
'without authorization. The unauthorized access occurred for '
'nine weeks in late 2024, raising concerns about privacy '
'violations and potential misuse of surveillance data.',
'impact': {'brand_reputation_impact': 'Negative public perception, potential '
'legal action',
'data_compromised': 'License plate reader (LPR) camera data',
'legal_liabilities': 'Potential violations of state law, privacy '
'regulations',
'operational_impact': 'Immediate disablement of out-of-state '
'access',
'systems_affected': 'Flock LPR camera network (31 cameras)'},
'investigation_status': 'Ongoing (awaiting explanation from Flock)',
'lessons_learned': 'Need for stricter access controls and transparency in LPR '
'data sharing; risks of unauthorized surveillance '
'highlighted.',
'motivation': ['Surveillance',
'Potential misuse for law enforcement or immigration tracking'],
'post_incident_analysis': {'corrective_actions': 'Disable unauthorized '
'access; review and '
'strengthen access policies',
'root_causes': 'Improper access controls in Flock '
'LPR system; lack of oversight on '
'data sharing'},
'recommendations': ['Implement stricter access controls for LPR data',
'Conduct regular audits of data access',
'Enhance transparency with public and regulatory bodies',
'Review compliance with state and federal privacy laws'],
'references': [{'source': 'The Point Reyes Light'},
{'source': 'ACLU and Electronic Frontier Foundation (EFF)'}],
'regulatory_compliance': {'legal_actions': 'Potential future lawsuits (e.g., '
'from Tara Evans or ACLU)',
'regulations_violated': ['California state law on '
'data sharing',
'Potential privacy '
'regulations']},
'response': {'communication_strategy': 'Public acknowledgment via media and '
'statements',
'containment_measures': 'Disabled out-of-state access to Flock '
'LPR cameras',
'incident_response_plan_activated': 'Yes'},
'stakeholder_advisories': 'ACLU and EFF demanding answers; potential legal '
'action from affected residents.',
'threat_actor': 'Out-of-state and federal agencies',
'title': 'Marin County Flock Camera Data Accessed by Out-of-State Agencies '
'Without Permission',
'type': 'Unauthorized Data Access',
'vulnerability_exploited': 'Improper access controls in Flock LPR system'}