Critics of these companies become, in this narrative, themselves a kind of ‘stick’: people who, in Langley’s words to one police chief, seek to “normalize lawlessness,” “weaken public safety,” and “let murderers go free.” This is precisely how “dispositionism” performs for corporate power. By promoting a worldview in which behavior is attributed to “disposition-based choice,” corporations protect their ability to “manipulate members of the public to maximize profit while escaping liability and regulation.”

A tech-savvy person with physical access to a Flock camera could easily gain full control of the camera and the sensitive data it stores in roughly thirty seconds.

For all the talk of ‘eliminating crime’ and making our communities safer, however, Flock Safety did a remarkably unremarkable job of ensuring the safety of the products it puts out.

Independent security researcher John Gaines spent months auditing Flock’s hardware and documented fifty-one separate vulnerabilities. He found that a tech-savvy person with physical access to a Flock camera could easily gain full control of the camera and the sensitive data it stores in roughly thirty seconds. And once inside, that person could plant images and files directly into the camera.

Gaines disclosed the vulnerabilities to Flock through multiple rounds of responsible reporting. The company’s response, he said, was that “some of this is too expensive” to fix. By the end of the process, Flock had fired its chief information security officer, the engineering director who had been managing the remediation effort, and the sole engineer assigned to the project. 

The Flock cameras sold to law enforcement to “eradicate crime”, in other words, were designed in ways that would allow anyone to manipulate footage and frame an innocent individual. When asked if this was surprising, Gaines commented that this was just “venture capitalists shipp[ing] customer growth over everything” as usual. Once a product functions, it gets shipped; companies don’t go back to “continue to iterate on security.”

“I don’t think it was on purpose,” Gaines said. “I just don’t think that security was even a concern from the get-go.”

After all, what is a corporation’s role in society, besides, as Milton Friedman put it, “to make as much money as possible?” Central to Friedman’s thesis was the belief that corporate executives should not have to worry about social responsibility. In fact, his framework relied on an external regulatory system—such as environmental and labor laws—to establish the boundaries within which profit-seeking serves the public interest.

The question, then, is whether our legal regime is doing its job in addressing the harms that result from dragnet surveillance. It does not. 

Why Existing Law Fails to Constrain the Harms of Dragnet Surveillance

The most natural place to start is the Fourth Amendment, which protects the right of people to be free from “unreasonable searches and seizures” by the government.  But the Amendment’s third-party doctrine holds that individuals have no reasonable expectation of privacy in information that they voluntarily share with third parties, such as phone companies, internet service providers and banks. That carve-out has effectively gutted Fourth Amendment protections in the digital age, where almost every detail of daily life passes through some third party.

The Supreme Court has made one narrow exception. In Carpenter v. United States (2018), the Court held that the government generally needs a warrant to obtain a person’s historical cell phone location data, reasoning that the sheer volume and ‘intrusive’ nature of that data made it different in kind from the records the third-party doctrine had previously covered. But courts have refused to extend Carpenter to license plate data captured on public roads. 

A growing number of courts have instead held that because a “mere observation” of an object in plain view does not implicate the Fourth Amendment, automated license plate readers do not constitute a “search” at all. What courts have not yet confronted is whether the kind of comprehensive, real-time dragnet surveillance Flock’s platform facilitates triggers the same constitutional concerns Carpenter raised about cell-site data.

The Supreme Court will soon rule on a different kind of digital dragnet—geofence warrants, which allow police to demand that companies like Google identify every phone that was in a given location during a given window—and whether that practice violates the Fourth Amendment. But the Court has not yet taken up license plate readers directly, suggesting that roadway data captured in public may not be recognized as raising the same constitutional concerns.

If Flock-like platforms lead to wrongful arrests, why not hold the officers accountable? Civil rights litigation has attempted to do just that. However, such case-by-case litigation simply treats each wrongful arrest or injury as an isolated policing failure rather than a systemic design defect embedded in the surveillance technology industry. 

Privacy law fares no better.  The United States lacks a single, comprehensive federal privacy statute. States have filled the gap with their own laws, but the resulting patchwork varies enormously in scope and ambition. Data broker registration laws target companies that “knowingly collect and sell” personal information, a definition that a company like Flock Safety conveniently avoids because it claims to provide tools, not data, to law enforcement. 

States have passed statutes or administrative rules regulating the use of automated license plate readers (ALPRs). California was an early mover: its Senate Bill 34 requires ALPR operators to maintain security procedures, adopt written usage policies, and log every system query.

Virginia significantly tightened its rules in 2025, requiring ALPR data to be deleted within 21 days unless preserved for an active investigation, prohibits sharing with out-of-state or federal agencies, and mandates annual public reports. Maine, meanwhile, bans private deployment of ALPRs altogether, restricting use to a small set of state and local government agencies. 

Washington has gone the furthest, making it unlawful for any state or local agency to operate an ALPR system without a specifically authorized purpose. The law caps data retention at 21 days, bans collection near schools, places of worship, courts, healthcare facilities, and food banks, prohibits use for immigration enforcement, and creates both criminal penalties and a private right of action.

But state-specific legislative responses are not enough because they cannot prevent Flock Safety from operating across state lines or from selling products that fall outside the ALPR statutes.  Most importantly, these laws are primarily concerned with regulating how police use surveillance technology, not how manufacturers design it. Law enforcement agencies have easily bypassed such regulations by simply asking other public safety agencies not covered by the regulation to use the forbidden surveillance tools. 

Take New York’s POST Act, which requires police departments to file a public impact-and-use policy and to keep its use of surveillance technology within that policy. Jason Taper, an attorney who helped craft the law, recalled how easily “an [NYPD] officer [just] called up his buddy at a fire department at FDNY and said, hey, can you run this suspect’s face through your facial recognition Clearview AI? And the guy did, said, here you go. And voila, the POST Act was circumvented.”

Thus, as privacy scholars have noted, privacy regulations not only systematically fail to prevent the expansion of surveillance, but also actively encourage it. The law ignores “privacy nicks” or small, frequent, and mundane privacy diminutions. By the time aggregate surveillance is visible, the practice has been normalized, and the legal standard for what counts as a “violation” has receded along with it. 

Undoing this normalization will require more than new statutes or stronger regulations, though those remain necessary. It will also require scrutiny of the design of the surveillance systems themselves: the choices that determine how data is collected, shared, aggregated, and acted upon. 

Products Liability as an Untested Avenue

When a defective car causes a crash, the driver can sue the manufacturer. When a defective drug causes injury, the patient can sue the company that made it. Such lawsuits are brought under the products liability theory, which puts the cost of unsafe products on the people who design and sell them, not just the people who use them. To bring a products liability claim against a manufacturer, a plaintiff must establish four things: that the (1) manufacturer commercially sold a product (2) which contained a defect at the time of sale (3) that was the cause of the (4) plaintiff’s injury. 

A products liability claim can and should be brought against companies like Flock Safety when an individual like Brandon Upchurch is harmed by the dragnet surveillance their products are engineered to conduct.

First, Flock sells a product: an integrated platform that connects its hardware, AI, and data infrastructure into a unified surveillance system marketed to thousands of law enforcement agencies and private entities. 

Second, Flock’s product is defectively designed. Even assuming that Flock Safety cares to fix every vulnerability that Gaines found, the problem would still remain that the product’s architecture—a centralized, searchable, nationwide database of vehicular movement, powered by AI that generates matches and pushes real-time alerts to armed officers—enables mass surveillance by design. Thus, it is a defective product, not unlike how courts are finding social media platforms to be defectively designed to create addictive behaviors in children. 

Third, the product harms those whom it surveils when it leads to concrete injuries. The plaintiffs in those cases, although not customers of the product, are bystanders who are foreseeable victims of its design, and who are entitled to protection under products liability.  Their injuries are concrete harms that tort law recognizes: false arrests, physical assaults, financial ruin, emotional trauma.

Brandon Upchurch was attacked by a K-9, wrongfully arrested, lost his job, was evicted, and had to rehome his dogs—all because a Flock camera misread his plate. Thor Andrews Sr. was handcuffed in his own driveway in front of his family, on a false “association” flag. A Denver resident was accused of theft and forced to prove her innocence using her own GPS data.

Harvey Murphy Jr. was wrongfully arrested based on a facial recognition match from two thousand miles away, and was beaten and raped in jail before his innocence was established. Meanwhile, an officer in Milwaukee used Flock Safety for his own personal use to stalk two women nearly two hundred times.

Fourth, the defective design of the product is the cause of the plaintiffs’ harm. Manufacturers of surveillance technologies will argue that a law enforcement officer’s independent decision to act on the output of the technology breaks the chain of causation between the product’s defective output and the plaintiff’s injury. But what happens when the product is specifically designed to minimize, and ultimately replace, human judgment?

After all, surveillance technologies are increasingly being marketed as integrated systems that direct operational responses, not just as passive tools that assist officers in making decisions.  Flock’s product line, for example, is actively replacing the analytical functions that officers traditionally perform. Flock should not be able to simultaneously market its product as a substitute for human analysis and then, when the product causes harm, use that feature as a shield from liability to argue that human analysis should have caught the error. 

Turning Off the Surveillance Machine May Be the Only Way 

Products liability lawsuits will not dismantle the surveillance state. Its reach is limited to cases where a defective product causes concrete, individualized harm: a narrower category than the full range of injuries that mass surveillance inflicts. 

The only thing you can do is turn off the machine.

The truth is that we cannot rely on the law alone. Speaking about surveillance capitalism, Shoshana Zuboff has argued that the work of “interrupting and outlawing” such a system “will require collective action and collective solutions.” A public awakening that forces a fundamental shift in how we view privacy is needed.  Taper, who has spent years fighting surveillance technologies through litigation and legislation, put it more bluntly: “The only thing you can do is turn off the machine.”

Citizens are doing exactly that. Since the start of 2025, at least thirty U.S. cities have canceled their contracts with Flock Safety. Organized residents showed up at city council meetings, filed public records requests, and refused to be told that mass surveillance was the price of public safety. One can only imagine what Flock’s CEO has to say about such “terroristic”  and “lawless” behavior.  

Bunce is unmoved. “Do you really want a guy that says you’re a terrorist if you disagree with [him] having his cameras everywhere?” he said. “I’m a proud terrorist in that case.”