At least 28 officers used Flock to stalk romantic partners

Source and scope of this record

This Risk Digest record is current as of July 27, 2026. Its primary source is the Institute for Justice’s continuously updated catalog, which identifies at least 28 reported incidents across 19+ states in which police officers used license plate reader systems to stalk romantic interests, ex-partners, or other personal targets. IJ updated that catalog on July 25, 2026 and warns that the count is “almost certainly an undercount.” The majority of listed incidents occurred in 2025–2026, and nearly all accused officers were criminally charged and either fired or resigned, according to IJ’s case summaries. [1]

That scope matters for anyone evaluating police stalking allegations involving Flock cameras or other ALPR systems. The known record is not limited to one civil complaint, one city, or one officer. It is also not limited to Flock in every entry. Some incidents involved Flock Safety cameras; others involved ALPR systems more generally. Treating every case as “a Flock case” would flatten the record in exactly the wrong direction. The point is narrower and more useful: officers with access to plate-reader databases repeatedly used that access for personal surveillance, and the first effective detector was often the victim, a public-records tool, a journalist, or an outside report rather than the agency’s own controls.

The working catalog: what is verified, and what each entry proves

The full 28+ case list remains the IJ live catalog; it should be treated as the controlling source-linked record rather than copied as a frozen snapshot. The entries below are the incidents from the current source set that carry the most developed facts about volume, discovery, rank, network reach, and continuing cadence.

The Richmond County number is an audit failure before it is a headline

A single officer searching one woman’s plate 1,639 times is grotesque enough on its face. For a city attorney or county risk manager, it is also a control-environment fact. The system counted the searches. The access existed. The record, at least as summarized by IJ, does not show an internal alert stopping the conduct before it reached that number. [1]

That distinction is not academic. A municipality can discipline or prosecute an individual employee and still have to answer a different question: what did the agency require before a search, what did it log after a search, who reviewed repeat-query patterns, and what happened when a user searched the same private person again and again? In the Richmond County entry, the volume itself is the warning light. If no one in the institution saw it, or no one acted on it, the “rogue officer” explanation stops doing much work.

In Milwaukee, the victims found the paper trail

The Milwaukee case is important for a different reason. 404 Media reported that Officer Josue Ayala searched his partner and her ex 180 times over two months, and that the victims discovered the searches by using HaveIBeenFlocked.com. [2]

HaveIBeenFlocked is a public-records-based search tool built around disclosed ALPR audit logs. Its database has included 4.6 million+ plates and 233 million+ searches, but its own usefulness depends on FOIA disclosures, transparency portals, and the delay between a search and public availability of the logs. It is therefore an extraordinary detection mechanism and an incomplete one. [5]

That is the part public agencies should not miss. If a victim has to assemble the audit trail from public-records fragments, the agency’s internal review process has already failed at least once. The Milwaukee facts do not prove that every agency audit is useless. They do show that, in a documented stalking case, the decisive detection came from outside the department.

Rank and geography did not contain the misuse

The Sedgwick, Kansas entry removes the comfort of imagining this as a line-officer training problem. IJ identifies Police Chief Lee Nygaard as having tracked his ex-girlfriend and her new boyfriend more than 200 times before resigning. [1]

Chief-level misuse changes the access-control analysis. Supervisory status often means broader system permissions, less practical review by peers, and more institutional trust. A policy that depends on a supervisor noticing improper searches is thin protection when the supervisor may be the user creating the risk.

The Georgia-to-California matter adds the network dimension. Lookout Santa Cruz reported that Georgia Police Chief Michael Steffman, arrested for using Flock cameras for stalking and harassment, searched Capitola, California data earlier that year. [3]

For local governments, the legal exposure does not stop at the city line if the search tool does not stop there. A Georgia official’s ability to query California camera data raises questions about interagency permissions, reciprocal access, vendor-network settings, and whether the agency understood the practical reach of the tool it authorized.

July 2026 additions make this a current-risk file

Two July 2026 additions keep the record from being treated as a closed scandal. IJ’s catalog includes a Sumter County, Florida detective fired on July 24, 2026 and a Conyers, Georgia real-time crime center supervisor charged in July 2026. [1]

Those entries matter less for their individual narrative detail than for cadence. A risk file that gains new law-enforcement stalking entries in the same week cannot be managed as a legacy discipline issue. Agencies still operating plate-reader systems should assume that current logs may contain misuse that has not yet been surfaced by a victim, journalist, prosecutor, or public-records tool.

What failed: not only access, but internal detection

The recurring pattern in the documented record is not merely that officers had access to ALPR systems. Access is the premise of the job. The failure is that repeated personal searches appear, again and again, to have become visible only after someone outside the ordinary internal-control chain forced the issue.

• Richmond County shows extreme query volume against one person: 1,639 searches. [1]
• Milwaukee shows victim-driven discovery through HaveIBeenFlocked after 180 searches over two months. [2]
• Sedgwick shows misuse by a police chief, not merely a low-level user. [1]
• The Georgia-to-California matter shows cross-state search reach through the Flock network. [3]
• The July 2026 Sumter County and Conyers entries show the disclosures are still arriving. [1]

That is the evidence supporting the systemic inference. It is not proof that every ALPR deployment is unlawful. It is not proof that every agency lacks audits. It is proof that the known stalking cases were not reliably stopped by internal safeguards before victims or outside systems exposed them.

Municipal Section 1983 exposure

For municipalities, the first risk question is no longer whether an officer violated policy. The harder question is whether the city or county can show a functioning control environment around database searches: defined permissible uses, search justifications, user-specific logs, supervisory review, anomaly detection, retention rules, and discipline that actually follows misuse.

In Section 1983 litigation, plaintiffs will look for facts that move the case beyond respondeat superior language and into municipal fault: known prior misuse, ignored red flags, inadequate training, permissions granted too broadly, failure to audit repeat searches, or a pattern of access that made personal surveillance predictable. The documented ALPR stalking record gives plaintiffs a practical roadmap for discovery even where final liability has not been determined.

The Virginia lawsuit reported by NBC News illustrates the civil posture. The complaint alleges police used Flock cameras to track a driver 526 times in four months. That allegation belongs in the lawsuit track; it should not be described as a final merits ruling. [4]

For agencies conducting risk review, the immediate task is evidentiary preservation. Preserve user logs, reason codes, plate-query histories, sharing settings, interagency-access records, vendor audit materials, internal complaints, discipline files, and any notice the agency received before the incident became public. If those records do not exist, that absence is itself a litigation fact.

Prosecutors have a separate Brady/Giglio problem

The criminal-charging outcome for the officer is only one file. Prosecutors also need to identify every case in which the accused officer was a witness, investigator, affiant, arresting officer, or source of database-derived investigative leads.

An officer accused of stalking through law-enforcement databases may create Brady/Giglio review issues in at least three ways. First, the conduct may bear on credibility or bias. Second, improper database use may call into question the integrity of an investigation if the same officer used ALPR data in a criminal case. Third, an agency’s failure to disclose known misuse could create downstream litigation over whether defense counsel received information needed to test the officer’s testimony or investigative steps.

The review should not be limited to cases where ALPR evidence was introduced at trial. If an improper or undisclosed plate search generated a stop, a surveillance decision, a witness interview, or a location theory, the defense may need the audit trail to understand how the case was built. That is especially true where the officer’s official explanation for a search conflicts with the search pattern in the logs.

What agencies should be able to answer now

A defensible ALPR program should be able to answer basic questions without waiting for a public-records request or a victim’s discovery.

• Who can search local and out-of-jurisdiction ALPR data?
• What reason must a user enter before a search runs?
• Who reviews repeat searches of the same plate, and how often?
• What threshold triggers supervisory review: a repeat search, a cluster of searches, a personal connection, or a cross-state query?
• Can the agency identify searches involving employees’ partners, ex-partners, family members, neighbors, or known personal associates?
• Are real-time crime center supervisors subject to the same or higher audit standards as patrol officers?
• When an officer is fired, charged, or resigns after ALPR misuse, who notifies prosecutors and civil counsel?
• How far back are logs retained, and can they be exported in a form defense counsel, plaintiffs, or courts can actually review?

Those questions are procedural, but they are not clerical. They decide whether the next case is discovered internally at search 10 or externally at search 180, 526, or 1,639.

Where this fits in the broader Flock litigation map

The stalking-misuse catalog is only one part of the larger Flock and ALPR legal landscape. Broader civil-suit exposure is tracked in How Flock Safety’s Three Lawsuit Tracks Create Exposure. Civil-liberties risk for cities is addressed separately in Flock Safety Civil Liberties Abuses Create Legal Risk for Cities, and the wider legal-fronts map appears in Flock Safety’s AI Surveillance Network Under Legal Siege.

This file fills the narrower gap: the officer-by-officer stalking-misuse record and the municipal and prosecutorial consequences that follow from it. At least 28 documented cases do not prove that every ALPR deployment is unlawful, and the known civil suits remain at different procedural stages. They do show enough repetition, enough search volume, and enough victim-driven discovery to make the “bad apple” framing inadequate for serious risk review.

References

1. Police Have Reportedly Used License Plate Readers to Stalk Romantic Interests at Least 28 Times — Institute for Justice — July 25, 2026
2. Cops Keep Getting Arrested for Using Flock to Stalk People — 404 Media
3. Georgia police chief, arrested for using Flock cameras for stalking and harassment, searched Capitola data earlier this year — Lookout Santa Cruz
4. Virginia police used Flock cameras to track driver 526 times in 4 months, lawsuit says — NBC News
5. HaveIBeenFlocked.com — HaveIBeenFlocked.com