Surveillance worldwide: proposed, misused, and pushed back

NONE OF THESE LAWS SAYS 'TRAIN'. TWO OF THEM STILL REACH THE VENDOR. Checked on the official legislature sites, read through a text-extraction tool, so check the exact wording before quoting: Minnesota, Maine, Montana, New Hampshire, with California read through the Assembly's own analysis. NEW HAMPSHIRE: plates may not be recorded or transmitted anywhere and must be purged within three minutes unless there is a hit, so no vendor holds anything to learn from. MINNESOTA: data may not be shared, sold or traded to anyone beyond qualifying police agencies. The duty lies on agencies, but state law binds government contractors as if they were the agency. Minnesota also covers private cameras whose data are shared with police. MONTANA: a 90-day cap binds the 'custodian' of the data, and police-gathered data may not be sold. MAINE: only listed public uses are lawful at all, with a 21-day cap. CALIFORNIA: the sale ban binds public agencies only, and there is no retention cap. The 2025 fix was vetoed. Vermont and Utah could not be read. Ask your council: does our contract let the vendor do what our state's statute forbids us to do? UTAH REACHES THE VENDOR; VERMONT DOES NOT. Utah's plate-reader law defines the 'governmental entity' it regulates to include anyone acting as the agency's agent or on its behalf, so a vendor holding plates for police is bound by the same rules: use only for listed purposes, a nine-month retention cap, no sharing beyond those purposes, and no sale. It does not cover a private company collecting plates for itself. Vermont's law, rewritten from July 2025, is stricter on police -- seven days of active access, everything sent to the Department of Public Safety, 18 months then destruction -- but places every duty on agencies and the department. It has no sale ban and says nothing about vendors. Ask your council in Vermont: does our contract stop the vendor from keeping a copy?

Sen. Josh Hawley of Missouri, who chairs the Senate Judiciary Subcommittee on Crime and Counterterrorism, wrote to Flock CEO Garrett Langley on Aug 26, 2026 opening an inquiry into the company's collection, retention and dissemination of camera data, with a Sept 8 deadline to produce documents. Citing Flock's own figures, the letter describes about 120,000 cameras across 49 states and more than 20 billion vehicle scans a month, and argues Congress never authorised such a network, leaving the company's internal policies as the only practical safeguard. WHAT MAKES THIS DIFFERENT FROM A STATEMENT is the specificity of the demands: every confirmed instance of misuse since Jan 1 2021, what a user must enter to justify a search, the restrictions on search purpose, the parameters for statewide and nationwide searches, camera placement, accuracy and security, contracts with local governments, and the company's revenue sources and investors. Flock spokesperson Paris Lewbel said the company had received the letter and would respond. NOT ESTABLISHED: whether the documents will be produced. Axios reported the letter is a request and that a subpoena would be the next step if it is refused; none has been issued. Reporting also notes no bill has been introduced in Congress to ban ALPRs outright. The letter cites St Charles County, Missouri, which is on this map. UPDATE, 14 SEP 2026: THE DEADLINE PASSED ON 8 SEPTEMBER AND NO PUBLIC REPORTING ESTABLISHES WHETHER THE DOCUMENTS WERE PRODUCED. Searching six days after the date returns only coverage from the announcement week. Flock said at the time it would respond; nothing confirms it did, nothing reports a refusal, and no subpoena has been reported. A NON-EVENT IS STILL A FINDING and this map should say so rather than leave the record reading as though the deadline is still ahead. TWO DETAILS ADDED FROM THE SENATOR'S OWN RELEASE, which is now the primary source here rather than the news accounts of it. First, the letter did NOT mention or threaten a subpoena -- reporting noted Hawley COULD seek one, which is not the same thing, and the request was framed as an opportunity to cooperate voluntarily. Second, the letter ties the data question to MONEY: Flock's roughly $8.3 billion valuation creates pressure to monetise what it holds, and Hawley points to uncertainty over how the company or its customers might sell or repurpose driver information. That is a commercial-use concern from a Senate chair, and it is the same argument the Idaho tort claims make about AI training data, arriving from a different direction. The letter also cites a Milwaukee officer alleged to have searched his girlfriend's plate, alongside the St Charles County case already noted here. UPDATE, 22 SEP 2026: THE INQUIRY WIDENED TO THE WHOLE INDUSTRY AND BECAME A HEARING. On Sep 3 Hawley sent document demands to Flock's three main competitors -- Axon, Motorola Solutions and Verkada -- with a Sep 16 deadline, citing among other cases a Milwaukee officer who ran 124 personal plate searches. On Sep 18 he invited all four CEOs to testify on Sep 23 at a subcommittee hearing titled Always Watching: Flock's Nationwide AI Surveillance Network. That matters for the vendor-swap pattern on this map: a city leaving Flock for Axon or Motorola is now leaving one company under Senate inquiry for another. STILL NOT ESTABLISHED: whether Flock produced the Sep 8 documents, whether any CEO will appear, and whether a subpoena follows -- none has been mentioned.

TWO BIPARTISAN HOUSE BILLS NOW TARGET PLATE READERS, AND ONE USES HIGHWAY MONEY AS THE LEVER. The NO FLOCK Act, H.R. 10366, from Reps. Raja Krishnamoorthi (D-IL) and Michael Cloud (R-TX), would require every state to limit ALPR use to specified public-safety and toll-enforcement purposes or lose 10 percent of its federal surface-transportation funds each year after a two-year phase-in -- the same mechanism Congress used for the drinking age. A second bill, H.R. 9716, introduced July 15 by Rep. Keith Self (R-TX) and joined by Idaho's Russ Fulcher, would make federal agents get a warrant before tapping state and local camera data. Both follow Senator Hawley's inquiry into Flock. Neither has had a committee vote. NOT ESTABLISHED: the NO FLOCK Act's exact introduction date and committee referral, and what counts as a public-safety purpose -- the text will decide whether stalking-style searches are actually barred. WHAT TO WATCH: committee referral and cosponsor count on congress.gov.

SOUTH AFRICA'S POLICE MAY GET FACE RECOGNITION IN THEIR BODY CAMERAS. The State Information Technology Agency has put out a tender for police body-worn and dashboard cameras that must include facial recognition, both to unlock the devices and within the video analytics. Bids close on 29 September 2026 (tender RFB-3286-2026-ERP-496011, Gauteng). The tender gives no budget or camera count and does not say whether footage will be matched live against watchlists. Biometric Update notes the Protection of Personal Information Act appears unlikely to cover police body cameras. Ask SITA and SAPS what database faces would be matched against and under what legal authority.

A COUNCIL VOTE IS A DECISION, NOT A REMOVAL. This map holds 167 records marked `removed`, and each assumes that when a jurisdiction ended its contract the cameras came down. TWO DOCUMENTED CASES SAY THAT IS AN ASSUMPTION. In LITTLETON, MASSACHUSETTS the Select Board ordered all six cameras powered down in May 2026 while it reviewed the technology and the governance policies -- and found the vendor had turned them back on by itself. The town moved to cancel outright, ordered the cameras removed and had the electricity cut. In EVANSTON, ILLINOIS the city terminated in late August 2025 and deactivated 19 cameras; Flock then BEGAN REINSTALLING CAMERAS ACROSS THE CITY, apparently without the knowledge of local officials or residents. Evanston issued a CEASE-AND-DESIST ORDER in September, after which the company said it would uninstall them. TWO TOWNS, TWO STATES, TEN MONTHS APART, THE SAME PATTERN: service a customer had ended was restored, and in both cases it took a further enforcement step -- an electricity cut, a legal order -- before the hardware actually stopped. WHAT THIS SHOULD CHANGE ABOUT HOW COUNTS ARE READ, INCLUDING OURS: every tally of cancellations on this subject, ours and the seven public trackers, records the DECISION. None of them verifies the removal. NOT ESTABLISHED: how often this happens. Two cases is a pattern worth naming and not a rate. THE QUESTION TO ASK any jurisdiction on a cancellation list is simply whether the cameras are physically gone and on what date -- which is answerable, and which nobody appears to be asking.

FOUR ACCURACY NUMBERS CIRCULATE AND THEY MEASURE FOUR DIFFERENT THINGS. This is the most misquoted area of the plate-reader argument and the confusion runs in both directions, so here they are with their denominators. FLOCK ADVERTISES 93 PER CENT READ ACCURACY -- the share of plates the camera transcribes correctly. THE EFF MEASURED STATE MISREADS AT ABOUT ONE IN TEN in November 2024, the same kind of measure from an outside party. ROSEVILLE, CALIFORNIA FOUND 71 PER CENT OF ALERTS WRONG across 1,427 alerts in 2023 and 2024, from the police department's own analysis -- but that is the share of ALERTS, not of reads, and the two are not comparable. A VALLEJO POLICE STUDY reported in Police Chief magazine put HIT-LEVEL error as high as 37 per cent. AND THE LAPD INSPECTOR GENERAL FOUND 32.3 PER CENT OF STOLEN-VEHICLE ALERTS FALSE across two months, WITH THE CAMERAS READING CORRECTLY -- that one is database error, not recognition error. WHY THE 71 PER CENT FIGURE IS BOTH ACCURATE AND MISLEADING: a system can read plates correctly almost every time and still produce mostly false alerts, because genuinely wanted vehicles are rare. A high alert-error rate is arithmetically compatible with a high read-accuracy rate. Anyone citing 71 per cent as the camera's error rate is wrong; anyone citing 93 per cent as evidence the alerts are reliable is also wrong. THESE RATES COMPOUND RATHER THAN SUBSTITUTE. A misread can produce a false alert; so can a correct read against a stale hotlist; and the Institute for Justice found MACHINE ERROR ACCOUNTS FOR ONLY ABOUT A THIRD of its 27 documented wrongful-stop cases. AT FLOCK'S OWN STATED SCALE of more than 20 billion vehicle scans a month, even the vendor's 93 per cent implies on the order of 1.4 billion misreads monthly -- which is why a per-read rate is the wrong unit for arguing about consequences, and why the alert and hit-level rates are the ones that reach people.

THE REASON FIELD, READ AT SCALE, SAYS 'LOL'. The Electronic Frontier Foundation analysed Flock search logs obtained through public-records requests, covering networks of more than 82,000 cameras, and published on Sept 14, 2026 the reasons officers typed to justify searches. Barberton, Ohio police logged searches as 'LOL' for more than two years; Richmond, California as 'Hehe'; Corona, California as 'WEIRD KID'; Lake County, Indiana as 'LMAO'; Eatonton, Georgia and Lake County, Ohio entered keyboard mashing. Accountability varied: Richmond counselled its officers, Columbus said a 90-day union-contract limit barred discipline, and Thornton said its 'weird' searches checked out. Flock replaced free text with a dropdown of offence categories in late 2025, which makes nonsense harder to type and false reasons easier to pick -- Mooresville's officer chose motor-vehicle infraction 29 times. Read it with Norfolk's 'la la la la': the justification field records whatever is typed, and nobody reads it unless a records request forces them to. NOT ESTABLISHED: how many searches carried nonsense reasons in total.

56 SEARCHES WITH NO CASE NUMBER -- MISUSE OR PAPERWORK, DEPENDING ON WHO YOU ASK. The Alexandria Times found, in Alexandria, Virginia police audit reports, 56 Flock searches run without the case number or explanation department policy has required since at least September 2025, and counted at least 81 plate-reader cameras in and around the city against 65 disclosed. The police department told council on Sep 18, 2026 it reviewed all 56 over three years and found none used for an improper purpose -- missing or mistyped case numbers, it says. It has since cut off 12 Virginia agencies that hold 287(g) immigration agreements, and says an outside audit by Ohio State criminologist Robin Engel will start by Oct 1. Police credit the cameras with 266 arrests and 134 stolen cars since 2023. The contract runs to April 2027. NOT established: what the 56 searches were for, and why the camera count differs. Listening sessions are pencilled for Sep 24 and Oct 7.

THE LAW SAYS 21 DAYS; THE SOFTWARE KEPT EVERYTHING, AND NOBODY CAN BE CHARGED. Leonardo plate-reader cameras used by Brewer and Veazie police, the Waldo and Washington county sheriffs and Penobscot Nation public safety did not delete plate data after Maine's 21-day legal limit, because of a software bug the company could not fix. Veazie found it on Jul 13, 2026 and told Leonardo; Brewer only learned on Aug 31 and cut power the next day, as did Waldo County. Brewer's safety director faulted Leonardo for warning no one else. The Penobscot County district attorney says prosecution is all but impossible: breaking the limit is a Class E misdemeanour, the servers sit outside Maine, and there is no one obvious to charge. A retention law is only as good as the vendor's delete button and someone checking it. NOT established: how far back the data goes, and whether any over-age records were searched.

ONE CAMERA, THREE WEEKS, 1.6 MILLION PICTURES -- AND THE KEY LEFT NEXT TO THE LOCK. A group calling itself stegan0gram dismantled a Flock camera taken from a roadway and, according to reporting by WIRED and 404 Media relayed by The Auto Wire, recovered about 1.6 million images and more than 27,000 video clips from roughly 21 days: about 50,200 vehicles, some 28 photos of each passing car. The media was encrypted, but the encryption keys sat unencrypted on the same storage. Flock's response was that removing a camera is illegal and that nobody had filed a detailed report through its disclosure programme -- the programme it launched in August alongside a promised independent security review. The finding matters beyond the stolen unit: retention limits describe the cloud database, and this is data sitting on a pole. NOT ESTABLISHED: where the camera came from, and whether Flock disputes the key finding on the merits. SOURCING: relayed by The Auto Wire from WIRED and 404 Media, whose pieces have not been read directly.

A NEW CAR, FLAGGED TWICE IN TWO DAYS ON OLD DATA. WSB-TV reported in September 2026 that a DeKalb County, Georgia student's newly bought car was flagged by Flock cameras twice within 48 hours; her family blames out-of-date records. Later write-ups say the flag was for missing insurance and that an officer ticketed her even after she showed proof of coverage -- that detail is from secondary sites and needs confirming from WSB. NOT ESTABLISHED: which agency stopped her, whether the ticket stands, and which database kept the stale entry. Ask the agency who is responsible for clearing an outdated insurance flag.

FLORIDA REVOKED PLATE-READER PERMITS ON ITS STATE HIGHWAYS AND GAVE AGENCIES 30 DAYS TO TAKE THE CAMERAS DOWN. A Florida Department of Transportation memo signed by Chief Operating Officer Will Watts -- dated Aug 31, 2026 in the Ocala Gazette's account, signed Sept 1 in ABC News' -- withdraws permission for law-enforcement readers on the state highway system, including I-10 and I-75, and says no new permits will be issued. Gov. Ron DeSantis announced it on Aug 31, citing growing signs of misuse, and alluded to an officer who used the data to track an ex. It does NOT cover city and county roads, where most readers sit. Scale, attributed: Pasco County had 70 cameras on state roads and Tampa 17; Hillsborough declined to give its count. Reaction split along the lines this map sees everywhere: Polk Sheriff Grady Judd called readers the best tool to keep people safe and will keep those off state roads; Ocala police said they would comply; Pembroke Pines suspended its whole programme; Brevard, Bradford, Volusia and Jacksonville were reported discontinuing; Franklin, Liberty and Putnam county sheriffs ended their programmes; Miami Beach's mayor and two neighbours asked the state to pause enforcement and let the Legislature write safeguards. THE CONTRADICTION IS THE STORY: the same administration had approved about $4.6 million in grants for roughly 440 readers for 18 agencies, much of it for immigration enforcement. THE LIMIT DeSantis named himself: an agency order can be undone by the next governor, who takes office in January 2027, so he asked the Legislature to write it into law. NOT ESTABLISHED: the statewide count and whether removal is complete by the deadline. SCOPE OF THE RESPONSE, confirmed Sep 2026: Brevard's and Volusia's sheriffs shut down all their readers, and Bradford's and Jacksonville's ended use countywide; Nassau (34 cameras), the Alachua sheriff (27 of 42), Marion, Union, the Orange sheriff and Tallahassee police removed only state-road cameras. Most Panhandle sheriffs paused (WFSU). Individual agencies are now separate records.

At least 56 US cities and towns deactivated, rejected or cancelled Flock contracts during 2026 by DeFlock's tally reported in Newsweek. THE SENTENCE THAT MATTERS MOST: there is NO CENTRAL GOVERNMENT DATABASE tracking these local decisions. Every count that exists -- DeFlock's, IJ's, Newsweek's, and this one -- is assembled by advocacy groups, journalists and volunteers from local reporting. There is no authoritative denominator, and any figure is a floor built from what someone happened to notice. THE COUNT MOVING IN REAL TIME MAKES THE POINT BETTER THAN THE ARGUMENT DOES: the Institute for Justice launched a dedicated cancellations database on Aug 26, 2026 listing 92 local governments; its own page said 128 as of Aug 27, and 137 as of Aug 28, with 140 entries displayed when we read it on Aug 30. Four figures in five days from one source, because it is updated daily as volunteers find more. IJ's rule is also STRICTER than DeFlock's: it excludes jurisdictions that only paused operations or switched provider, counting cancellations only. The gap between the counts is therefore DEFINITIONAL, not contradictory, and any figure this site publishes should say which rule it uses. Reading that database also found a duplicate in it -- one Michigan township listed twice, once under a county that does not exist -- which is the same caution applied to the best available source.

ONE VENDOR IS NO LONGER ONE TECHNOLOGY, and this map could not see it until now. The stacked category counted VENDORS: a community appeared only if two or more companies had readers on its streets. That test cannot catch a council that bought plate readers and got an aerial programme from the same company, because the vendor count never moves. Applying a technology count instead adds ELEVEN communities the map already held records for and had never grouped: six running Flock (Dunwoody GA, Green Bay WI, Alameda County CA, Oakland County MI, Stockton CA, Fort Worth TX) and five running Axon (Syracuse NY, Knoxville TN, Denver CO, Douglas County CO, Grand Chute WI). Stacked goes from 12 to 23. THE CLEAREST CASES ARE IN THE DATA ALREADY. Dunwoody's vendor line literally reads plate readers, 911 dispatch and drones together, and the renewal that expanded it passed unanimously after the council had twice refused to vote. Green Bay signed a five-year, roughly $1.3 million extension that added Flock's drone-as-first-responder programme ON TOP OF the plate readers, in December 2025, while neighbouring Fox Valley cities were dropping Flock. Alameda County approved a $2.4 million extension 3-2 whose package runs well past plates. WHY IT MATTERS PRACTICALLY, and it is the same reason vendor stacking matters: a retention limit, an audit rule or a cancellation is written against ONE thing. A council that ends 'the Flock contract' may find the drone programme, the dispatch product or the data feed sat in a different line item and continues. The Asheville case recorded separately on this map is the same problem arriving from the other direction -- plate-reading rights bundled inside a body-camera contract. WHAT IS NOT ESTABLISHED: whether these eleven are the whole set. They are the ones whose existing records happened to name a second technology in a structured field. A community whose second system is mentioned only in prose, or not at all, is still invisible, and the answer to that is the same records request already noted -- ask for the FULL vendor agreement rather than the plate-reader line.

TEXAS STOPPED STATE-AGENCY MONEY FOR FLOCK CAMERAS. Gov. Greg Abbott ordered state agencies not to fund Flock cameras, confirmed by his spokesman Andrew Mahaleris on Aug 27, 2026. The state has put at least $30 million into the network since 2023 through the Motor Vehicle Crime Prevention Authority, whose board Abbott mostly appoints, and the Department of Public Safety holds a $15.9 million three-year contract for about 1,200 cameras; at least 3,200 Flock cameras run statewide. THE LIMIT IS IN THE SAME SENTENCE: the spokesman said most of the money is federal, and federal and local funds are untouched. Abbott called the problem easily containable and said the cameras must be used responsibly if at all. The trigger was misuse: a Lufkin officer indicted on 100 counts, and at least six Texas agencies disciplining or investigating officers in a month. Robinson and Manor cited the freeze when they left Flock. NOT ESTABLISHED: a written order -- only a spokesman statement is on record -- and whether existing contracts end or only new spending stops. Ask DPS and MVCPA which grants are frozen.

Speaking at Florida International University in Miami on Aug 26, 2026, Gov. Ron DeSantis said plate-reader use in the state is out of control and warned against Florida becoming a surveillance state, while saying he backs law-enforcement tools generally. THREE CONCRETE THINGS FOLLOWED THE LANGUAGE: he said he has asked for an overview of how state agencies use the readers, noting state use is small next to city police and sheriffs' offices; he said any statewide restriction would have to come from the Legislature; and he named New Hampshire's approach as a possible model, which bars installing the cameras along public roads while allowing in-vehicle use with rapid purging. He tied it to an AI bill of rights that passed the Florida Senate last session and was not taken up by the House. THE OPPOSING VIEW, STATED: Florida Democratic Party chair Nikki Fried said Republicans have held power for 30 years and let the technology spread without meaningful safeguards, and that the governor now wants credit for sounding the alarm. SCALE, ATTRIBUTED TO WHOEVER COUNTED IT: GovTech reported last year that at least 100 Florida agencies use Flock, and WUFT put the number of readers in the state at nearly 7,500. UPDATE: A DIRECTIVE FOLLOWED FIVE DAYS LATER -- on Aug 31 the state transportation department revoked plate-reader permits on state highways and gave agencies 30 days to remove them (separate record). No bill has been filed.

EVERY FLOCK CONTRACT HAS AN END DATE, AND ALMOST NOBODY KNOWS THEIRS. Flock sells on subscription -- typically two to five years, at roughly $2,500 to $3,000 per camera per year on published cooperative price lists. That means the decision point is not the day cameras go up but RENEWAL DAY, which arrives on a schedule nobody publicises. THE MEASURE OF HOW HIDDEN IT IS comes from the Who Approved This public-records project, which tracks 305 contracts across 46 states and $83.1 million in documented spending: only FIFTEEN of those 305 records carry a future end date, and two more a scheduled vote. For the overwhelming majority of communities on that tracker, the contract's expiry is simply not on any public record anyone has found. A cancellation campaign that does not know its own deadline is arguing on the vendor's timetable. WHAT ELSE THE RECORD SHOWS ABOUT HOW THESE ARRIVE: 158 of the 305 records carry an approval method of UNKNOWN -- the largest single group in the file -- and only 27 carry a vote stored name by name. Just 47 records carry both a dollar figure and a camera count, which is why per-camera costs are so rarely checkable. AND THE THRESHOLD TRICK IS DOCUMENTED: after Denver's council rejected a $666,000 Flock renewal, the city signed a $498,500 extension -- $1,500 under the amount that would have required a council vote. THE PROJECT IS EXPLICIT ABOUT WHAT IT LEAVES OUT, which is why it is usable: privately owned Flock cameras bought by homeowner associations and businesses are not contracts any public body approved, so they are absent even where police can search them, and agencies whose documents have not been obtained are absent too -- so the real national total runs above 305. Empty fields are left empty rather than estimated. THAT IS THE SAME DISCIPLINE THIS MAP APPLIES, and it makes the tracker a usable source rather than another tally to reconcile. ITS OWN COUNT OF ENDINGS -- 97 documented, 83 cancelled, expired, rejected or suspended -- is a THIRD figure alongside DeFlock's and the Institute for Justice's, and the site says plainly it counts contract trails rather than jurisdictions, which is why the numbers differ.

MOST OF THESE CAMERAS WERE NEVER VOTED ON, AND THAT IS MEASURABLE. The Who Approved This public-records project holds 305 Flock contracts and finds that 158 OF THEM -- THE LARGEST SINGLE GROUP IN THE FILE -- carry an approval method of UNKNOWN, meaning no public document anyone has obtained states how the contract was approved. Only 27 records carry a vote stored name by name. This map records the fights; the fights are the exception. HERE ARE THE ROUTES, each documented on this map. THE PROCUREMENT THRESHOLD. Cottonwood, Arizona had four readers by 2021 and eleven by 2025 without a single council vote, because the cost sat inside the police department's budget below the level at which councils decide. The programme only reached the council when a package hit $199,000 -- and that one included two drones. Procurement thresholds, not privacy policy, decided what got debated. THE THRESHOLD USED DELIBERATELY. Denver's council REJECTED a $666,000 Flock renewal. The city then signed a $498,500 extension -- $1,500 under the amount that would have required a council vote. The council said no and the cameras stayed. THE CONSENT AGENDA. Broken Arrow, Oklahoma approved its contract as item K on a consent agenda, file 23-1170: a block of items passed together without separate discussion. It is a recorded council approval with no debate attached. NO MEETING AT ALL. In Wilder and Greenleaf, Idaho, cameras went up with no public meeting and no council vote; in Wilder the police chief and the mayor approved them between them. NO CONTRACT TO VOTE ON. Avondale, Arizona reaches 192 Home Depot cameras and four from an HOA with no memorandum of understanding and no contract at all -- the department requests access and the owner grants it. There is nothing for a council to approve or refuse. AND THE EXIT HAS THE SAME PROBLEM. Sierra Vista, Arizona ended its contract by council CONSENSUS rather than a numeric vote, so no roll call exists and nobody is on record as having been for it. Asheville's mayor found the contract barred removing the cameras without terminating the whole agreement, so a moratorium was not available as an option. WHY IT MATTERS FOR EVERY COUNT INCLUDING OURS: a map built from reported decisions sees the places where a decision happened. The 158 unknowns are not places without cameras -- they are places where the public record does not say who said yes. WHAT WOULD SETTLE IT is not a search. It is asking a department, in writing, which agenda item authorised its ALPR programme and on what date, and publishing the answer or the absence of one.

DETAINED IN HIS OWN DRIVEWAY, CLEARED BY A FAST-FOOD RECEIPT. On 20 Aug 2026 a Flock camera tied Amadeus Purcell's car to an investigation into someone driving about 100 mph on Scale Street in Reidsville. Several police units detained him at home. What cleared him was a Wendy's receipt in his cup holder showing he had been elsewhere, after which officers noticed his car did not match the suspect's. Reidsville police declined to explain, citing an ongoing investigation, and gave WXII no incident report. Purcell complained to the Justice Department and gathered 400-plus signatures to remove the cameras. Within weeks the department stopped using Flock and said it would not renew, though the chief cited privacy concerns generally, not this stop. NOT ESTABLISHED: whether the camera misread a plate or officers acted on a loose match, and how many other hits were checked the same way. Ask Reidsville PD for the alert log for 20 Aug.

THE CAMERA WAS NOT WRONG. THE INVESTIGATION STOPPED. On Oct 4, 2025 a car travelling over 100mph swerved across lanes in Sanford, Florida, hit a motorcycle and a Ford Focus, caused a pileup and fled. Three people died at the scene. Witnesses described a speeding Dodge Durango; the Florida Highway Patrol used Flock data on a Durango seen nearby to arrest Lindsey Isaacs, 23. She was charged with EIGHT FELONY COUNTS and spent 13 days in jail. FOUR PIECES OF PHYSICAL EVIDENCE CONTRADICTED THE ARREST AND WERE AVAILABLE THE WHOLE TIME. When crash investigators later took the case over they found her car was not damaged, though troopers had reported that it was; the paint colour did not match paint left on another vehicle; the driver airbag had never deployed, though witnesses said the airbag in the car involved had; and a partial plate reported by a 911 caller did not match her tag. Prosecutors dropped the charges in May 2026 after investigators arrested Alisa Lee Montalvo, whose Durango had damage consistent with the crash and matched the partial plate. Montalvo faces felony charges and has not been convicted. A Volusia County assistant state attorney who had misgivings about the case is credited with pushing for the detailed investigation that unwound it. THE SUIT: Isaacs is suing the Highway Patrol and Sgts Tiffany Jateff and Joshua Buday, alleging they insisted her impounded vehicle showed crash damage when photographs showed otherwise. She was publicly named as a criminal defendant and was sued by relatives of the people who died. WHY THIS RECORD IS ABOUT PLATE READERS EVEN THOUGH THE READER READ CORRECTLY: a Flock hit is a lead, and here it functioned as a conclusion. The technology produced a name fast enough that the ordinary work of testing it against the physical evidence did not happen for seven months. Every accuracy statistic on this map measures whether the camera read the plate; this case measures what a correct read is allowed to substitute for.

AT LEAST FIVE FLOCK CAMERAS DESTROYED OR DAMAGED ACROSS NORTHEAST INDIANA IN MID-AUGUST 2026, and the public comment ran toward the vandals. Two cameras were destroyed in Adams County on the morning of Aug 18, two damaged in Wells County, and one cut down on State Road 218 in Berne -- solar panels shot, units burned, poles cut. Days later cameras were reported damaged in Fort Wayne and Allen County, and in Toledo, Ohio lenses were spray-painted and wires cut. A local station's post drew more than 3,500 comments, many calling the vandals heroes and doubting a jury would convict. The Adams County sheriff said charges could run from misdemeanor vandalism to felony criminal recklessness for the gunfire. Recorded without endorsement: destruction is a crime, and this map also records Virginia's camera-sawing prosecution. NOT ESTABLISHED: any arrest, and the total count.

TEN PEOPLE HAD ACCESS THE LAW DID NOT GIVE THEM. Henrico County found on Aug 18, 2026 that 10 members of its Fire Marshal's Office could search the county's Flock plate-reader system, and pulled their access. Virginia's plate-reader law, in force since Jul 1, 2025, limits access to police, sheriffs and certain other law-enforcement agencies; fire marshals are sworn and armed but are fire-department employees. They had used Flock in five arson investigations, one of which produced an arrest. The police division and County Attorney Andrew Newby, who acknowledged the oversight, made the call; no one was disciplined, because the searches were for investigations. The consequence the county described: the Flock evidence cannot be used when those cases reach trial. NOT ESTABLISHED: how long the access existed and who granted it. Ask other Virginia localities who else holds logins.

NO CONTRACT MEANS NO RECORD, AND NO RECORD MEANS NO COUNT. Every tracker of Flock deployments -- the Institute for Justice's, DeFlock's, Who Approved This, and this map -- counts contracts a public body approved. Avondale, Arizona shows what that structurally cannot see. Asked how its police reach privately owned cameras, the department said plainly that THERE ARE NO MEMORANDA OF UNDERSTANDING AND NO CONTRACTS governing the sharing of Flock data from the Roosevelt Park HOA or from Home Depot: the department submits a request for access and the private owner either grants it or does not. Access by request and grant leaves no agenda item, no vote, no dollar figure and no renewal date. It cannot appear in a contract tracker because there is no contract. THE NUMBERS IN ONE MID-SIZED CITY: four cameras from one HOA, and 192 FROM HOME DEPOT. A single retailer supplied roughly forty-eight times as many cameras as the neighbourhood association, to a department whose own council debates its public contract. Avondale says its internal policies govern officers' use of that data the same way they govern its own ALPR data -- which is the department's answer, and it is a policy commitment rather than a contractual one, because there is nothing to breach. AND THE ACCESS TREE RUNS FURTHER THAN THE CITY. As of Aug 16, 2026 Avondale appeared alongside SIXTY-ONE other law enforcement agencies and organisations granted access to University of Arizona CAMPUS POLICE Flock data, among them the Arizona Department of Public Safety and Northern Arizona University campus police. A camera on a university campus, reachable by 62 named parties, none of whom the university's students voted for. HOW BIG THE GAP MIGHT BE, attributed: Flock says it operates in more than 5,000 communities across 49 states and performs over 20 billion vehicle scans a month, and it markets directly to homeowner associations, places of worship, retail, healthcare, property management, banking, logistics and manufacturing. DeFlock ILM counts more than 200 HOAs signed up, and notes that an HOA which integrates with law enforcement turns its private street into a node any participating agency can query -- local, out-of-state or federal. THE HONEST POSITION IS THAT NOBODY KNOWS THE DENOMINATOR, INCLUDING US. Who Approved This says so explicitly, excluding private cameras because no public body approved them EVEN WHERE POLICE CAN SEARCH THEM. This map has the same hole, and holds only two records on private integration. A resident who cancels their city's contract has not necessarily removed a single camera from their street. WHAT THE RETAILERS SAY. All three big-box chains now disclose plate readers in their parking lots, and none says whether police get standing access to them. Home Depot says it shares ALPR data outside the company only with service providers, who get anonymized aggregates, and with law enforcement for safety, security and legal compliance. It keeps the data 'as long as necessary'. Lowe's discloses on legal process or when it believes disclosure protects safety or property, including on police request, and keeps data typically no more than 90 days. Walmart keeps its ALPR data 60 days and points to its general disclosure terms. Avondale described 192 Home Depot cameras reachable by request-and-grant. Nothing in these policies tells a shopper whether that grant is one search or a standing login. Ask your police department which retailer cameras it can search, and under what written terms.

FLOCK MOVED ITS DEFAULT RETENTION FROM 30 DAYS TO 7 ON AUG 13, 2026 -- AND LEFT EVERY EXISTING CONTRACT WHERE IT WAS. The company's own announcement says current customers keep their approved retention, so the thousands of agencies already running Flock are unaffected unless their council or chief opts in. The 7-day default applies to new deployments, sweetened with a free Evidence Mode for those who adopt it. The same post makes two controls mandatory by the end of 2026: Audit Assistance, the tool that flagged Colleton County's 2,700 searches within a day of being switched on and that only about a third of customers used, and a case code on every search, with emergency searches flagged for review. It also promises automatic account lockouts for abnormal activity, mandatory multi-factor login, and a Bishop Fox security review due in September. READ IT AGAINST THE MAP: every control here is the vendor's, applied through a contract the vendor can rewrite, and Mooresville shows a required justification field can be filled in falsely every time. WHAT A RESIDENT CAN ASK: has your council voted to adopt the 7-day default, and is Audit Assistance switched on today? NOT ESTABLISHED: how many existing customers have changed retention.

The Institute for Justice's database of ALPR abuse lists 181 documented incidents across 33 states, each with its own source, sorted into four kinds: stalking, error, non-law-enforcement use, and other misuse. It is the most comprehensive public list that exists, and IJ says plainly it may be the tip of the iceberg. THE REASON WHY IS THE MOST IMPORTANT FINDING ON THIS PAGE. In IJ's litigation against Norfolk, Virginia, the three most common search justifications -- cj, stolen, and inv -- accounted for nearly a third of 230,000 searches over two years. One officer repeatedly typed la la la la as his reason, and nobody noticed. Officers rarely record a specific reason, the volume is far too large to audit by hand, and so the searches that were improper are indistinguishable from the ones that were not. Every count on this map is therefore a floor. WHAT THE 181 SHOW WHEN READ TOGETHER: the stalking cases overwhelmingly involve current or former partners, and several ran for years -- a Haines City officer searched his estranged wife more than 700 times over 22 months, a Jefferson Parish deputy searched his ex-fiancee's plate thousands of times, a Katy officer more than 2,000 times in 11 months. The error cases end the same way over and over: guns drawn on people who did nothing, including grandparents detained while a three-year-old watched from the car after a camera read an O as a 0. And in Roseville, California, Flock sent 1,427 alerts over two years flagging cars as stolen or used in a felony, and 71 PERCENT of them were misreads. Detection is the variable, not conduct: a great many of these surfaced only through an internal audit, a reporter's query, or a victim checking HaveIBeenFlocked. Departments that do not audit do not find them. TWO NEWSROOM COUNTS, EACH WITH ITS OWN RULE. The Washington Post's review of police and court records, published in early August 2026, found at least 50 officers accused of or charged with plate-reader misuse, 46 of them on Flock's network; a follow-up said it had found officers whose own departments did not know. InvestigateTV, on Aug 10, counted more than 70 cases in which officers or employees were investigated, disciplined, fired or arrested for misusing Flock, most found by internal audits. IJ's 181 covers all ALPR abuse including misreads; the Post counts officers; InvestigateTV counts cases at any stage. Every one is a floor.

A CAMERA NOBODY ORDERED. Millcreek city staff found a Flock plate reader mounted on city property near Millcreek Common during a routine review of surveillance devices, and took it down, KUTV reported on Aug 11, 2026. Neither the city nor the Unified Police Department has a Flock contract. The camera is in city storage while officials try to find out who put it there; Flock did not answer questions about who authorized it. Councilmember Thom DeSirant said the city took it down and is trying to work out why it was there at all. The city is now reviewing every Flock camera inside its limits. NOT ESTABLISHED: who owns the camera, whose account it reported to, and how long it had been running.

THE AUDIT TRAIL GOT THINNER. As of summer 2026, Flock's Network Audit logs no longer show, for searches run by other agencies, the searching officer's name, the plate searched or the free-text reason, InvestigateTV reported on Aug 10, 2026. Flock said it made the change at the request of customer agencies, citing concern that activists were using audit records to identify undercover officers. Those fields are how outsiders have found misuse: the same report counted more than 70 cases of officers or employees investigated, disciplined, fired or arrested for misusing Flock, and victims and researchers found several by reading public audit logs. NOT ESTABLISHED: the exact date of the change, and whether a host agency can still see the full record of who searched its cameras. Ask your department for its unredacted network audit.

A STALE HOTLIST ENTRY, NOT A MISREAD, PUT GUNS ON THE SAME DRIVER TWICE IN ONE WEEK. On Aug 6, 2026 Brookfield police stopped Amber Newell on I-94 at gunpoint and ordered the occupants out with hands raised because a Flock camera matched her vehicle to a Milwaukee homicide alert. The camera read the plate correctly. Milwaukee police had cleared the vehicle from the investigation and never removed the alert -- MPD told FOX6 it was a personnel issue, not a Flock malfunction. Newell says Milwaukee officers had already stopped her at gunpoint earlier that week, towed the car and let her go without explanation; she had retrieved it from evidence with paperwork. Brookfield's chief said his officers acted on the information they had, which is the problem: nobody at the stopping agency can see that an alert is stale. This is the failure mode the LAPD Inspector General documented at scale -- correct reads against an uncorrected list -- and no camera accuracy improvement touches it. ASK MILWAUKEE PD: who is responsible for clearing an alert when a vehicle is released, and how many active entries have not been reviewed in 90 days? NOT ESTABLISHED: the date of the first stop or whether a claim has been filed.

MISA Regional's preliminary statement on the 13 August 2026 general elections, published 17 August 2026, says the Zambia Cyber Security Agency supported police investigations into critics of the president and of the Electoral Commission of Zambia. The agency's head is appointed by the president, which MISA calls a structural conflict of interest. MISA also reports public warnings issued by the Zambia Police Service and the army that it describes as unlawful, and attributes a chilling effect to the Cyber Security Act 2025 and the Cyber Crimes Act 2025. MISA says a Constitutional Court challenge to both Acts is pending; the outcome is not established and no hearing date is recorded here. No government response is included in the statement. Ask the Agency for the number of investigations it supported and the statutory basis for each. Coordinates are Lusaka, not a specific facility.

A procurement pattern this map has now documented twice, and it explains how cameras arrive in places that never debated them. Most councils require a vote above a spending threshold. Below it, a department buys on its own authority. FORT WAYNE: police spent $25,200 in July 2024 and $92,995 in 2025 -- each under the $100,000 that triggers council approval -- and ended up with 36 cameras. The renewal only reached the council at all because the cumulative figure finally crossed the line, and when it did, the council rejected it 8-0. DENVER: an extension was written at $498,500 after the council had rejected a $666,000 renewal, coming in $1,500 under the amount that would have required a vote. NEITHER IS ALLEGED TO BE UNLAWFUL, and that is the point. Both are ordinary uses of delegated spending authority. But the effect is that the public debate happens, if it happens, only after the system is already installed and relied upon -- which is a much harder argument to win than one held before the first camera goes up. Fort Wayne is the clearest illustration in both directions: it took two years of sub-threshold purchases to build the network, and one vote to refuse to renew it. WHAT WOULD SETTLE HOW COMMON THIS IS: a comparison of ALPR contract values against each jurisdiction's own approval threshold. Two cases is a pattern worth naming, not a measurement.

The failure that recurs most often across this map is not an officer misusing a search. It is a sharing configuration nobody locally approved, and in several cases nobody locally knew about. SAN FRANCISCO: out-of-state authorities ran more than 1.6 million searches of the city's plate data, including for immigration enforcement, which California law forbids. DAYTON: more than 140 agencies nationwide searched the city's system for immigration purposes over several years, against city policy. SPRINGFIELD, ILLINOIS: an Illinois Secretary of State audit found Customs and Border Protection had obtained access to state plate-reader data in violation of state law. EAGAN, MINNESOTA: out-of-state agencies searched Twin Cities suburbs' data for civil immigration enforcement, though Minnesota law limits it to criminal cases. STORY COUNTY, IOWA: other agencies had obtained access without permission. RICHMOND, VIRGINIA: the system administrator granted access to a federal ATF analyst, who then ran immigration searches against departmental policy; separately a sergeant shared data with the FBI in breach of a policy barring federal sharing. SPARKS, NEVADA: the department receives immigration-violation hot-list alerts from ICE despite its own policy prohibiting immigration use. PFLUGERVILLE, TEXAS: a RESIDENT'S open records request revealed hundreds of outside agencies holding unauthorised access -- and the city responded by shutting the system down and covering the cameras. THREE THINGS THIS SET SHOWS. The violated rule is usually the jurisdiction's OWN policy or its state's law, not an absence of rules. Discovery is almost always external -- an audit, a reporter, a records request by a resident -- rather than routine oversight. And the destination is disproportionately federal immigration enforcement, in places whose policies specifically excluded it. A council can vote on whether to have cameras; these cases turn on who can search them afterwards, which is rarely what the vote is about.

This map flags 23 communities under two or more surveillance systems at once -- 12 running several VENDORS, and 11 more running several TECHNOLOGIES bought from a single vendor, which a vendor count structurally cannot see (recorded separately as inc-us-one-vendor-many-systems). That number is still almost certainly low, and Asheville shows a third reason why. WHEN ASHEVILLE'S COUNCIL VOTED TO TERMINATE ITS FLOCK CONTRACT ON AUG 25, 2026, THE MAYOR NOTED THAT THE CITY'S EXISTING AXON CONTRACT -- for police body and dash cameras -- ALSO INCLUDES STATIONARY LICENCE PLATE READERS. The city had not voted for a second ALPR vendor. It acquired the capability inside a contract about something else. A council can end the ALPR programme it debated and still hold plate-reading rights it never discussed. THAT IS A DIFFERENT MECHANISM FROM THE STACKING THIS MAP ALREADY RECORDS. Renton, Lenexa, Berkeley and the rest chose several systems. Bundled capability arrives as a line item in a procurement about body cameras, evidence storage or a real-time crime centre -- so it does not appear in an ALPR debate, an ALPR budget line, or an ALPR vote, and a records request asking about ALPR contracts may not return it. HOW BADLY IT SKEWS THE COUNT IS NOT KNOWN, and this record does not guess. What is known: 15 community records in this dataset name a second vendor somewhere in their text without being flagged as multi-vendor, most of them Axon appearing alongside Flock, and each needs reading to establish whether it is a switch, an evaluation, a bundle, or genuine simultaneous operation. WHAT WOULD SETTLE IT: for each community, the full vendor contract rather than the ALPR line -- whether the body-camera, evidence-management or crime-centre agreement carries plate-reading rights. That is a records-request question, not a search question, and it is the single most likely source of undercounting in the stacked category.

The accuracy number behind every wrongful-stop record on this map: an analysis of alerts sent to the Roseville Police Department found that in 71 percent of cases where Flock flagged a vehicle as stolen or tied to a felony, the system had misread the license plate -- 1,427 alerts over 2023-2024, per Business Insider via Gizmodo. Roseville PD had reported bad reads to Flock dozens of times over four years, and spent roughly $450,000 on the system. BOTH SIDES, in full: Flock called the figure a mischaracterization, said performance has significantly improved (Roseville PD disputes that), blamed a unique deployment -- older hardware, non-standard mounting higher and farther from vehicles than recommended, and rear-only scanning the city chose to avoid capturing faces -- and cited its own testing of over 99 percent capture and over 96 percent OCR accuracy in optimal conditions. Read that defence carefully, because it concedes the asymmetry: the system is extremely accurate at logging every passing car into the searchable database, and far less accurate in the moment it accuses a specific driver. Roseville says it never stopped or arrested anyone on a bad scan. Other departments were not as careful -- the Institute for Justice counts at least 27 drivers pulled over, detained at gunpoint, or jailed on Flock misreads, including an Arkansas family held at gunpoint over a one-letter misread and a San Diego man jailed nearly a month over a car that was five miles from the crime.

THE CAMERA FOUND THE CAR; POLICE ARRESTED THE WRONG MAN. After a shooting between two vehicles in Auburn, Washington at 3 a.m. on Jul 28, 2026, Flock cameras read the suspect vehicle's plate and police arrested a Des Moines man in his 40s. He was later cleared of the shooting; a police spokesperson called it a miscommunication. What he told detectives led to a different Auburn resident being arrested for felony harassment. The department still describes Flock as having led directly to an arrest and a quick resolution -- both statements are true, and one of them was the wrong person. NOT established: how long he was held, his link to the vehicle, and whether any charge was filed against him. The general point: a plate read identifies a car, not who was in it.

A LEGAL THEORY THIS MAP HAS NOT RECORDED BEFORE: that letting the vendor learn from your residents' plates is a COMMERCIAL USE, not a law-enforcement one. On Jul 27, 2026 Tyler Cain, a Wilder resident and chair of DeFlock Idaho, filed a tort claim against the City of Twin Falls alleging it allows Flock to use residents' captured plate images to teach and improve the company's recognition software. The argument is not about who can search the data. IT IS THAT TRAINING THE PRODUCT ON CAPTURED FOOTAGE AMOUNTS TO A COMMERCIAL, NON-LAW-ENFORCEMENT PURPOSE that Idaho's statute does not permit -- the state passed a law in 2025 restricting Flock data access to authorised law enforcement. A separate claim was filed against Idaho Falls. BOTH CITIES MOVED RATHER THAN LITIGATE. Idaho Falls' council voted to amend its contract so the company cannot use the images to train its artificial intelligence systems; its public information office said the city does not believe its contracts breach Idaho law but had heard residents' concerns and was already amending them. Twin Falls' police chief proposed the same amendment. WHY IT GENERALISES: every ALPR contract on this map was argued over retention, access and audit. None of those terms addresses whether the vendor may keep learning from the images after the search is over. If a state statute limits data use to law enforcement, and model training is not law enforcement, the argument reaches every jurisdiction with a comparable statute -- and it does not require proving anyone was harmed by a search. NOT ESTABLISHED: neither claim has been decided, and a tort claim is a precursor to suit rather than a ruling. THE CONTRACT CLAUSE EXISTS, AND IT IS BROADER THAN 'TRAINING'. Flock's standard terms (last updated Aug 21, 2026) give the company an irrevocable, perpetual licence to use captured Customer Data to support and improve its products and services, and define the models built through the service as Flock's property. The terms never use the word 'train'; they do not need to. Until December 2025 the terms required data to be stripped of identifying information before being used for improvement; the February 2026 rewrite deleted that condition, per an analysis by Footnote4a, and the ACLU notes the licence outlives the contract. The August 2026 version restores an explicit promise not to sell data -- sale, not use, is what it rules out. THE STATUTE SIDE IS WEAKER THAN THE IDAHO CLAIMS IMPLY: Idaho's 2025 law bars non-law-enforcement use by agencies and never mentions vendors. Virginia's 2025 law is the one checked that reaches the vendor directly, allowing access only at the agency's request for maintenance and quality assurance. ASK YOUR COUNCIL: does our Flock order form carry the standard section 4.1, and did we amend it as Idaho Falls did? THE SENATE HAS NOW MADE THE SAME ARGUMENT: Sen. Hawley's Aug 26 letter to Flock ties its roughly $8.3 billion valuation to pressure to monetise the data it holds.

Junction City is considering a 90-day free trial of eight Flock cameras, drawing civil-liberties objections at a mid-July 2026 council meeting where residents warned the system would build a searchable record of ordinary people's movements. It follows Eugene, Springfield and Lane County cutting ties with Flock and a 2026 Oregon law adding data-retention limits, encryption and sanctuary-law compliance for plate readers. No decision was made; the council set further discussion for August 11.

One day after the Huntington City Council approved a $2.1 million Flock Technologies surveillance contract on a 6-4 vote -- following a meeting that ran past 4 a.m. and more than 50 public comments against it -- the ACLU of West Virginia, the Haslam Law Firm and Glazer, Saad and Anderson sued the city in Cabell County Circuit Court on behalf of resident Greg Jimison. The suit seeks to void the deal, arguing the city ignored its own procurement rules and that city code bars letting a private company use city property for commercial purposes without public notice and a hearing. The contract covers plate-recognition cameras, vehicle-fingerprint technology, live video, gunshot detection and automatically dispatched drones.

On July 15, 2026 the San Francisco Police Commission approved a $3 million gift from billionaire Chris Larsen's San Francisco Police Community Foundation to expand SFPD's Real Time Investigation Center, which tracks plates via hundreds of street cameras and dozens of drones and runs the city's 400 Flock cameras. The money funds drone docking stations, counter-drone technology and center infrastructure. The approval came days after WIRED reported that feeds from five SFPD surveillance drones had been left accessible on the open internet for more than seven months through a mishandled Skydio sharing link.

When the nation's third-largest police force let its Flock Safety contract expire on Jul 11, 2026, the 138 pole-mounted cameras in Los Angeles did not switch off. LAPD Cmdr. Randy Goddard told the Police Commission on Jul 14 that the cameras continue capturing plates and storing the results in Flock's cloud while city attorneys negotiate new terms, that the department cannot access any of it during the lapse, and that letting them run is deliberate -- once a new agreement is signed LAPD could go back and retrieve footage from the gap for investigations. Why this matters beyond one city: on this map, 'let the contract expire' is recorded dozens of times as an ending, and the assumption behind every one of those records is that expiry stops the collection. Here it did not. It stopped the department's ACCESS while the vendor's collection continued uninterrupted on public infrastructure, with the backlog explicitly preserved for retroactive retrieval. Pair it with Littleton MA, where cameras a town had ordered powered down were found switched back on by the vendor without notice: in both cases the municipality discovered that the switch it thought it controlled sits on the vendor's side. Any community whose campaign ends at non-renewal should ask what happens to the hardware and the feed on the day after.

On July 11, 2026 the Los Angeles Police Department -- the nation's third-largest police force and once one of Flock's largest government customers -- let its Flock Safety contract expire. Chief information officer Dean Gialamas said the decision was not about cost but about serious civil-liberties and civil-rights concerns over the privacy of the data the cameras collect. Thirty-nine Flock contracts were reported terminated nationwide in the first five months of 2026.

WHAT THE INSPECTOR GENERAL ACTUALLY COUNTED. The Inspector General's review (letter dated July 10, 2026; posted July 14) covered August and September 2025: 50,183 alerts on 5,911 plates. In 161 cases officers confirmed the camera had read the plate correctly and investigation then found the car was not stolen; over the same period readers led to 337 stolen-vehicle recoveries, 24 stolen plates and 74 arrests. The IG attributes stale hits to records not being updated in time -- a plate stays on the hot list after the car is recovered. Three things this map said that the report does not: it gives no denominator of 498 (that is 161 plus 337, computed by others), no 32 per cent or one-in-three rate, and no cause-by-cause breakdown of the 161. The finding stands in its plainer form: for roughly every two recoveries, one correctly-read car was flagged stolen when it was not. The IG warned such alerts risk wrongful stops but did not count any. It also found LAPD lacks formal contracts covering data security and access with all its ALPR vendors, and recommended pausing new deployments. LAPD's Flock contract lapsed in mid-July (ABC7 reported the non-renewal on Jul 11); its Axon and Motorola contracts remain active. CORRECTION: earlier versions of this record, and a duplicate now merged into it, carried '161 of 498', '32.3 per cent' and 'one in three' -- figures other outlets computed, not the report's.

On 29 July 2026 the FSB said Ukrainian intelligence had used the Telegram dating chatbot Daivinchik, also called Leo, to recruit Russians for sabotage and arson, and that 46 users aged 12 to 22 had been detained across 16 regions since July 2025. Russia's Investigative Committee, in a separate statement about the same chatbot, gave 19 teenagers aged 14 to 18, detained in Moscow, St Petersburg, Novosibirsk and the Rostov and Saratov regions. Both counts come from the agencies themselves. The record does not resolve which is correct or whether the two describe the same detentions. Meduza reported that the chat interfaces in videos the security services released as proof were from a Russian application rather than Telegram. The FSB charged Telegram founder Pavel Durov with aiding terrorism and he was placed on Rosfinmonitoring's register of terrorists and extremists; a separate terrorism case had been opened against him in February 2026. None of the allegations has been tested in an adversarial hearing. Coordinates are Moscow; the detentions were spread across regions.

The numbers behind the wave this map tracks city by city, and the denominators matter. Counting Flock alone: 53 municipalities have canceled or rejected Flock Safety contracts -- 39 terminations in the first five months of 2026 alone, per an Institute for Justice tally, across 28 states -- driven by unauthorized data access, changed terms, immigration-enforcement lookups, and cameras that stayed on after cities ordered them off. But most departures are vendor swaps, not surveillance retreats: Axon is winning the replacement contracts, and Denver is the model -- fewer cameras, shorter retention, no national database, mandatory audit trails, and the tracking continues under a fresher logo. Two January 2026 rulings, Schmidt v. City of Norfolk and State v. Simonson, upheld limited ALPR use while flagging scale, retention, and sharing scope as the constitutional variables -- exactly the ones contract language cannot lock across vendor cycles. New Hampshire's three-minute deletion rule and Vermont's approval regime are the standing proof that only state law survives a vendor swap. The independent Who Approved This tracker now documents 168 contracts across 46 states, 55 of them ended. The corporate backstory sharpens the point: Flock and Axon were previously integrating their technologies before a public split when Axon launched its competing plate reader -- and while Axon markets itself as running no national camera network, it holds multiple Department of Homeland Security contracts of its own. As one security researcher who documented Flock's vulnerabilities put it: 'I wouldn't see moving to Axon as an improvement.' The mechanics of the swap, documented July 2026: Flock crossed 100,000 cameras even as 53 cities canceled, and Axon -- which spent years feeding Flock plate data into its in-car systems before ending that partnership in early 2025 -- launched direct competitors to capture the exits: Axon Outpost, a pole-mounted reader, and Axon Lightpole, a streetlight retrofit built with Ubicquia, the same smart-streetlight vendor Flock uses. The pitch to cities is deliberate: similar capability, tighter contract terms, and seamless integration with the body cameras and Evidence.com cloud they already run. The civil-liberties case that the swap solves nothing rests on hard numbers -- the ACLU notes fewer than 1 percent of scanned plates connect to any alleged crime, and the LAPD's own inspector general flagged high rates of false stolen-vehicle alerts that put innocent drivers through stops. Jalopnik warns Axon's deeper integration may raise privacy risk rather than lower it, aggregating data far beyond a plate number. Counting every vendor, the tally is larger: on a July 8, 2026 press call the Institute for Justice put it at more than 113,000 ALPRs operating nationwide and at least 82 jurisdictions that have canceled ALPR contracts or taken the cameras down. Do not add those two numbers together or read one as a correction of the other -- 53 counts Flock cancellations and rejections, 82 counts ALPR departures across Flock, Axon, Motorola Solutions and the rest. IJ attorney Michael Soyfer, whose office brought both the Norfolk and San Jose suits, framed the Chatrie ruling as the Court focusing on the mass-surveillance character of these systems rather than on any single search. This map still adds only named, sourced places, which is why its own verified switch count stays well below every press figure above.

The ACLU has assembled a pattern of Flock Safety giving false information to the city councils and police departments that buy its cameras. In Loveland, Colorado, told a police chief and the press that federal agencies had no access to local data and that federal sharing was moot because Flock held no federal contracts -- then admitted it had CBP and DHS pilot contracts granting direct access. In Oshkosh, Wisconsin, the council revoked approval one day after granting it -- the shortest approve-to-cancel span on record -- after concluding it had been given bad information. Denver's mayor negotiated secretly with what one council member called Flock's 'discredited CEO.' The through-line of the whole removal wave: cities aren't just worried about what the cameras do, they've stopped trusting what the vendor says they do.

An Institute for Justice review of media reports and court records, published in July 2026, counted at least 27 cases since 2018 in which an ALPR error led to an innocent motorist being pulled over, detained or jailed -- the majority of them since 2023. The number that matters more than the count: in nearly two thirds of those cases officers did not realise the error until after they had drawn and pointed their guns. IJ attorney Michael Soyfer, who represents residents in the San Jose and Norfolk suits, put the stakes as every one of those stops being a high-risk encounter where a wrong move or a moment of fear can turn deadly, and nobody should have to prove their innocence at the roadside because a camera could not tell a zero from an O. The failure mode is mundane and mechanical: the readers confuse visually similar characters, 0 for O and 2 for 7, and get worse in rain, snow, mud and glare. Flock claims it captures 93 of every 100 plates accurately, which sounds tolerable until it is multiplied by the company's stated ambition of reading 20 billion plates a month -- that leaves well over a billion inaccurate reads in the same period. A police-conducted study in Vallejo, California found up to 37 percent of ALPR hits were erroneous. Separately, a six-month CBS News investigation verified more than a dozen wrongful stops plus several instances of the technology being abused outright. Read this alongside the individual records on this map: they are not isolated failures, they are the expected output of a system operating at that scale and that error rate. THE BREAKDOWN INSIDE THAT COUNT IS THE PART THAT REDIRECTS THE ARGUMENT: of the 27 cases, MACHINE ERROR ACCOUNTS FOR ONLY ABOUT A THIRD. The rest trace to stale government data -- recovered vehicles never cleared from hotlists, outdated theft reports, uncorrected entries -- and to officers acting on an alert without verifying it. So roughly two in three of the documented wrongful stops would not be prevented by a more accurate camera. Every debate this map records is about whether the technology reads plates correctly; the cases say that is the smaller half of the problem.

Every `removed` entry on this map records a decision. It does not establish that the hardware left, and across 2025-26 the two came apart often enough to be a pattern rather than a series of delays. DeFlock Dane puts it flatly: physical removal is a separate question from the vote. Verona's contract lapsed in December and the cameras were still standing in January, until the mayor covered them with black plastic bags and Flock began removal in February. Dane County's subscription ended May 31, Flock did not remove the cameras, and on June 6 deputies bagged all 26 themselves. Oshkosh's police chief bagged his too. UW-Madison's contract ended June 26 and removal was announced July 3, yet the solar-powered cameras were still in place and uncovered afterward, with police able to say only that they assumed the cameras were no longer collecting. Guthrie OK cancelled effective February 18, 2025 and Flock did not schedule the uninstall until July 21, five months of cameras running free of charge. Macon County NC lost access to all 16 cameras on July 14 and they were still standing on July 21, with the school district hosting four of them saying nobody had contacted it. Fort Collins voted in June and the last of 15 cameras came down July 23, about six weeks later. Cleveland, Cambridge and Eugene all kept cameras live past termination. Syracuse took eight months. TWO SEPARATE FAILURES ARE BUNDLED HERE, and they need different fixes: the vendor controls the removal schedule and has no deadline in most contracts, and a covered or unpowered camera is not a verified-offline camera. For anyone reading this map to judge whether surveillance actually stopped somewhere, the vote is the beginning of the answer and not the end of it. Practical test for any new entry: is there a dated confirmation that the hardware is down, and who confirmed it -- the agency, the vendor, or a reporter who went and looked. TWO CHEAP VERIFICATION TOOLS, both vendor-published: Flock's own transparency portal lists departed agencies as "[Inactive]" -- Natick MA PD reads Inactive today -- so a departure can be confirmed, or a stale `removed` record caught, without hunting local coverage. And the same portal publishes each agency's sharing counts, which is how UW-Madison's 168 outbound and 467 inbound agency relationships were established. SEPARATELY, AND LARGER: a municipal cancellation never reaches private cameras. Framingham City Council Chair George King, on his own city's exit -- the cameras are everywhere, Home Depot and Lowe's have them in their parking lots, so they come off city streets without leaving the city. Denver's privately owned Flock cameras kept operating after the city removed all 110 of its own. Every `removed` pin on this map means police-operated cameras, and nothing more.

This map is organised around public decisions, which quietly assumes there was one. Often there is not. After Denver's council rejected a $666,000 Flock renewal, the city signed a $498,500 extension instead -- $1,500 below the threshold that would have required a council vote. In Westland, Michigan the police chief declined to bring an expiring contract to the council at all, so no vote was held and no roll call exists. In Dane County, Wisconsin the sheriff had signed with Flock without board approval in the first place, which is why the board could only reach the money and not the capability. The Who Approved This tracker, which records how each contract was authorised, finds 168 contracts across 46 states, 55 of them ended, $50.8M documented -- and that only 14 of 164 records state a funding source at all (6 grants, 4 general fund, 3 asset forfeiture, 1 ARPA). The other 150 show an approval but not the money, which matters because grant-funded programs die when the grant does rather than when the politics change: Guthrie, Oklahoma's Flock system was bought with a federal DOJ grant and ended when the grant ran out. Contracts are subscriptions, typically 2 to 5 years at $2,500-$3,000 per camera per year. For scale, an Institute for Justice tally counts communities in 28 states terminating Flock contracts between August 2021 and May 2026, 39 of those in the first five months of 2026 alone. The practical lesson for reading this map: absence of a cancellation vote is not evidence a program is uncontested, and the spending threshold, the renewal date and the funding source are often more decisive than any council debate.

A Chilean court on Jun 30, 2026 sentenced a former judge and a former army general to five years in prison for illegally spying on investigative journalist Mauricio Weibel Barahona while he was reporting Milicogate -- his 2015 investigation for The Clinic into the theft of the army's copper reserve fund. The Committee to Protect Journalists called the decision unprecedented for Chile. Two details give it weight beyond the country: the surveillance was run through the machinery of state -- a judge and a general, not a rogue operator -- against a journalist for the act of reporting on the military that employed one of them; and accountability took eleven years from publication and six years of judicial process to arrive. Custodial sentences for state officials over journalist surveillance remain rare enough worldwide that each one is a record; this is Latin America's counterpart to Greece's Feb 2026 Predatorgate convictions, and unlike Greece's suspended terms, these are prison sentences.

VERMONT'S LAW LIMITED ITS OWN CAMERAS; POLICE SEARCHED EVERYONE ELSE'S. Public records obtained by VTDigger show Vermont police ran more than 100 searches since 2023 of plate data from other states, through a regional police intelligence network and Flock's national network. Vermont State Police ran 30-plus; Berlin 15, Brattleboro 12, Colchester 10, Hartford 8, Rutland 5, Barre City 4. The state's plate-reader law, first passed in 2013, sets strict rules for local systems but, as VTDigger reads it, is silent on national networks that did not exist when it passed. State Police say they complied with the statute; Rep. Barbara Rachelson says the law needs to say so explicitly and the department should have asked. THE DEADLINE THAT MATTERS: Vermont's plate-reader statutes sunset in 2027, so the Legislature has to rewrite them anyway. NOT ESTABLISHED: whether any search broke the law as written, and what the Franklin County Sheriff ran. How the changes that took effect in July 2025 (recorded under Manchester) bear on these searches is not established here.

CANADA'S CABINET CAN NOW ORDER TELECOM COMPANIES TO ACT -- AND ORDER THEM TO KEEP IT SECRET. Bill C-8 received Royal Assent on 15 June 2026. It lets the federal cabinet bar carriers from using named suppliers and lets the Industry Minister order a provider to do, or stop doing, anything needed to secure its network -- including cutting off service to specified persons -- with orders that can forbid disclosure of their own existence. The Minister can share what is collected with CSIS, the Communications Security Establishment, other departments, 'any other prescribed' body and foreign governments. Challenges go to court only after the fact, and the judge can hear evidence the challenger never sees: on 25 March the Speaker ruled out amendments that would have required a judge to approve orders first. The final law does bar ordering decryption of private communications or interception. A new Critical Cyber Systems Protection Act makes designated operators report incidents to CSE within 72 hours. The Privacy Commissioner, OpenMedia and the CCLA all said safeguards fall short. NOT ESTABLISHED: whether any secret order has been issued -- by design, the public may not learn. Read with Bill C-22, the lawful-access bill still in the Senate.

In June 2026 Metropolitan Police Commissioner Sir Mark Rowley announced the most significant expansion of live facial recognition in London to date: static LFR cameras mounted on street furniture across the West End and Soho by the end of 2026, meant to grow into a citywide infrastructure programme rather than time-limited van operations. It followed a six-month Croydon pilot (October 2025 to March 2026, 24 operations, 173 arrests, more than 470,000 faces scanned) and an April 2026 High Court ruling that the Met's LFR policy was lawful, now under appeal. Big Brother Watch urged the force to stop until Parliament legislates, noting the UK still has no specific statutory framework for LFR.

To solve a 2019 bank robbery in Midlothian, Virginia, police used a Google geofence warrant covering a 150-meter radius that swept up every device near homes, businesses, and a church. Okello Chatrie was identified and convicted, and in 2026 his case became the first geofence-warrant dispute heard by the Supreme Court. Decided June 29, 2026: the Court held 6-3 that acquiring Google Location History through a geofence warrant is a Fourth Amendment search. Justice Kagan wrote for the majority, joined by Roberts, Sotomayor, Jackson, and Kavanaugh; Gorsuch concurred but would have reached the same place on a property theory, treating the location history as Chatrie's own even while it sat on Google's servers. Alito dissented, joined by Thomas and in part by Barrett, calling the majority an irresponsible escapade that would send seismic waves through Fourth Amendment doctrine while changing nothing about Chatrie's own case. The operative move is narrow and large at once: the Court dropped the temporal floor Carpenter had built in, so the question is no longer how many days of location data the government took. What the Court did not do is decide whether this warrant was any good. Particularity, probable cause, and the scope of the government's discretion all go back to the Fourth Circuit, and the good-faith exception -- which the lower courts split on -- was left untouched, meaning Chatrie can win the doctrine and still lose the suppression motion. For this map the relevant reach is sideways rather than downward: a geofence warrant and an ALPR network do the same thing, sorting everyone who passed a place at a time in order to find one person, and the ruling supplies the reasoning that warrantless plate-reader dragnets have so far avoided.

The Drive journalist Joel Feder was tracked for days by Plymouth, Minnesota police via Flock license-plate cameras and then boxed in by four squad cars, with a drone overhead, in a Kohl's parking lot in late June 2026. A manufacturer plate on his press-fleet Range Rover (34 10 DTM) was misread as a plate reported lost in Los Angeles that a police report had truncated to '34 DTM.' Flock's system flagged every Jaguar Land Rover fleet car sharing the 34 ## DTM format as stolen nationwide, and four other such cars were being tracked around Minnesota that week.

Flock is not the only ALPR company being sued. On June 18, 2026 a class action was filed against Motorola Solutions and its subsidiary Vigilant, alleging the companies unlawfully shared California drivers' plate and location data across jurisdictions and with federal agencies -- naming Pleasanton, Sacramento, Modesto, Merced, and Livermore. Vigilant is the legacy ALPR heavyweight: EFF documented its database reaching up to 1,000 agencies and, via Digital Recognition Network, selling plate data to lenders, insurers, and debt collectors, while ICE has held a $22.8M contract for database access through 2026. The vendor names change; the surveillance model is the industry's, not one company's.

Automobile journalist Tim Esterdahl was pulled over by police in Scotts Bluff after a Flock camera misread the license plate of a Range Rover he was testing. He wrote it up as being ambushed for no reason, and the significance is that he had the standing and the platform to trace the cause: systemic ALPR error rather than one bad read. A second automotive writer was tracked the same way in Plymouth, Minnesota the same month, also over a Range Rover test plate -- two cases in one month from the same niche, which says something about how many ordinary drivers experience this without ever learning why.

THE EVIDENCE THAT CLEARED HIM WAS INSIDE THE FLOCK DATA, AND NOBODY LOOKED. San Diego police arrested Hugo Parra and 23-year-old driver Ariel Beltran on attempted-carjacking charges in November 2025 after a Flock camera captured a red Alfa Romeo. They had a car description but NO PLATE NUMBER, a witness who picked Parra out at a curbside lineup, and a plate-reader hit they treated as corroboration. THE HIT WAS RECORDED FIVE MILES FROM THE CRIME SCENE, AND BEFORE ANY POLICE PURSUIT BEGAN. Their attorney Alex Coolman argues the timestamp and location in the Flock record itself show the captured car could not have been the suspect vehicle -- the same system that produced the hit also held the metadata disproving it, and that metadata was not consulted before the arrest. The witness account compounded it: Parra was wearing a white hoodie when arrested and the suspect had been described in grey. Parra and Beltran sued in June 2026, seeking $1.5 million each. WHY THIS RECORD IS NOT ABOUT ACCURACY: the camera did its job. A hit is a location and a timestamp, which is all it ever is, and it was read as an identification. Every accuracy statistic on this map measures whether the plate was read correctly; this case measures what a correct read was allowed to substitute for. NOT ESTABLISHED: the suit has not been decided and the department's account is not in the reporting reviewed here.

London's Metropolitan Police scanned the faces of about 80,000 people at a single protest and have run live facial recognition against millions of faces. Youth worker Shaun Thompson was wrongly flagged, detained, and threatened with arrest before being compensated. Campaigners call it stop and search on steroids.

An EFF analysis of millions of police searches of Flock ALPR data (May 2026) found a troubling pattern: with no warrant requirement to query the databases, agencies moved beyond specific investigations toward general, real-time tracking via 'hotlists' -- lists of vehicles flagged for live surveillance. It is the empirical backbone of the whole reform push: the problem isn't only who the data is shared with, it's that officers can watch anyone's movements without showing cause. No comprehensive federal ALPR statute exists; a 2025 Congressional Research Service brief confirms Congress has left the field to Fourth Amendment litigation and state law.

184 IMMIGRATION SEARCHES IN ONE MONTH, AFTER A PROMISE OF NONE. Outside agencies logged immigration as the reason for searching Kettering, Ohio's Flock cameras 184 times in January, according to an audit reported by the Dayton Daily News. When council approved the first 10 cameras in March 2022, the police chief told members the system would not be used for ICE. Kettering changed its internal practice on May 4 to shut off immigration-related access, and the mayor says access has been tightened -- but the written plate-reader policy still says nothing about immigration. Neighbouring Dayton covered its cameras in May 2026 over the same finding. NOT established: which agencies ran the searches, and whether the policy text will be amended. Ask council to put the ban in writing.

In State v. Contreras-Sanchez, the Minnesota Supreme Court ruled in 2026 that a geofence warrant violated the state constitution by giving police unchecked discretion over Google location data swept from everyone in an area.

In April 2026 ICE's acting director confirmed to Congress that the agency uses Paragon's Graphite spyware, which can silently compromise a phone with no user interaction and extract its contents; the Trump administration had reinstated the paused Paragon contract, and Democratic lawmakers pressed for answers about its use inside the United States.

Officers in Volusia County relied on a Flock capture to place an innocent driver's car at the scene of a deadly crash on Interstate 4. She was arrested and spent 13 days in jail before the charges were dropped. This is a human-error case rather than a misread: the camera recorded what it saw and officers drew the wrong conclusion from it. Thirteen days is among the longest wrongful detentions in the national tally, and it began with a photograph of a car.

In the Greek Watergate scandal, Intellexa's Predator spyware was used against politicians and journalists, and in 2026 a Greek court sentenced Intellexa founder Tal Dilian and others to eight years for illegal operations.

Zambia is one of 11 countries in Smart City Surveillance in Africa, published 12 March 2026 by the Institute of Development Studies with the African Digital Rights Network. The report names Zambia and Senegal as places where mass public-space surveillance was deployed despite what the researchers describe as no terrorist threat or serious crime challenge, and says they found no compelling evidence across any of the 11 countries that smart surveillance reduced terrorism or serious crime. Governments present the systems as crime prevention, counter-terrorism, modernisation and urban management. IDS gives the 11-country total as at least USD 2 billion. Reporting of the study's country tables (Nairametrics, 23 March 2026) puts Zambia at USD 210 million for about 1,600 smart cameras -- the fourth-largest spend of the eleven, and roughly USD 131,000 per camera by simple division. The figures are the researchers' counts, drawn from public accounts they describe as incomplete, not an audit. Coordinates are Lusaka, not a specific site.

IDS and the African Digital Rights Network, publishing 12 March 2026, put Nigeria's spending on facial recognition and automatic number plate recognition at over USD 470 million to date, the largest of the 11 African countries studied. A trade write-up of the same research (military.africa, April 2026) gives the 11-country total as USD 2.1 billion with Nigeria at nearly 23 per cent of it, against the IDS figure of at least USD 2 billion; the two are not reconciled and both are the researchers' counts rather than an audit. IDS says most of the technology is supplied and financed by Chinese companies, with Korea, Israel and the United States also supplying, and that no compelling evidence was found that these systems reduced terrorism or serious crime. Nigeria already appears on this map for the Hacking Team contract and the NIN biometric breaches; this record covers the camera programme. Coordinates are Abuja.

IDS and the African Digital Rights Network place Mauritius second among the 11 African countries studied at USD 456 million on smart city surveillance, in research published 12 March 2026. The programme predates that figure: Huawei made an unsolicited bid in 2015, the Police Service signed two operating-lease contracts with Mauritius Telecom on 19 December 2017, and China Eximbank signed a preferential buyer's credit of USD 73,687,000 with Mauritius Telecom on 1 April 2018 at 2 per cent interest over a 20-year maturity with a 7-year grace period, according to AidData. Answering a parliamentary question on 11 August 2020, Prime Minister Pravind Kumar Jugnauth said 2,761 intelligent video surveillance cameras were installed at 1,429 sites and 140 traffic cameras at 68 sites, and that 101 cases requiring police enquiry had been detected through Safe City cameras. That detection figure is the government's own count and no audit of it is recorded here. Mauritius Times reported the system's total cost as Rs 19 billion with roughly Rs 350 million a year to operate; that comes from one newspaper and is not corroborated here, and it is not established how it relates to the USD 456 million figure. In the judicial inquiry into the death of Soopramanien Kistnen, Safe City images were reported missing and a Huawei representative was questioned. Coordinates are Port Louis.

The IDS and African Digital Rights Network report published 12 March 2026 says research in Mozambique found smart CCTV cameras deployed in locations where political opposition is concentrated. Mozambique is one of 11 countries in the study, which puts combined spending at at least USD 2 billion; Reporting of the study's country tables (Nairametrics, 23 March 2026) puts Mozambique at USD 147 million for about 450 smart cameras, roughly USD 327,000 a camera by simple division. These are the researchers' counts from incomplete public accounts, not an audit. The report says all 11 countries fail to provide adequate means for people to obtain remedy or redress for smart surveillance errors or abuse. The government's account of how camera sites were chosen is not established, and the report's siting claim has not been tested against procurement or deployment records. Ask the Mozambican police for the site list and the selection criteria. Coordinates are Maputo.

IDS and the African Digital Rights Network put Kenya third among the 11 countries studied at USD 219 million on smart city surveillance technology, in research published 12 March 2026. The systems combine CCTV, facial recognition, number plate recognition and central command centres, and are mostly supplied and financed by Chinese firms. The researchers say they found no compelling evidence that such deployments reduced terrorism or serious crime, and that the countries studied lack laws defining who may conduct public-space surveillance, on what warrant and under whose oversight. The figure is the researchers' count, not an audit, and IDS notes the real total across the region is likely higher because surveillance spending is often secret. Kenya already appears on this map for Worldcoin, a suspected Pegasus deployment and the Huduma Namba ruling; this record covers the camera programme. Coordinates are Nairobi.

IDS and the African Digital Rights Network, publishing 12 March 2026, name Senegal alongside Zambia as countries where mass public-space surveillance was deployed despite what the researchers describe as no terrorist threat or serious crime challenge. Senegal is one of the 11 countries in the study; Reporting of the study's country tables puts Senegal at USD 167 million for about 500 smart cameras -- roughly USD 334,000 a camera, the highest unit cost among the countries where both figures are published, against about USD 9,700 in Egypt and USD 47,000 in Nigeria. Neither extreme is explained in the material reviewed. The report records that governments present these systems as crime prevention, counter-terrorism and urban management, and that the researchers found no compelling evidence of a reduction in terrorism or serious crime. Senegal already appears on this map for the 2026 national digital-ID breach; this record covers public-space cameras. Coordinates are Dakar.

FIVE THOUSAND CAMERAS AND NO PUBLISHED COST. Algeria is one of 11 countries in Smart City Surveillance in Africa, published 12 March 2026 by the Institute of Development Studies with the African Digital Rights Network. Reporting of the study puts roughly 5,000 smart cameras in Algeria, and NO SPENDING FIGURE IS AVAILABLE -- the researchers say figures could not be obtained for two of the eleven countries and that public accounts for the other nine were incomplete, which is why their at least USD 2 billion total is explicitly a floor. WHAT THE COUNTRY AUTHOR SAYS HAPPENED. Yosr Jouini, who wrote the report's Algeria section, says systems introduced as smart city projects promising to tackle crime and manage traffic became in practice primarily tools of the security forces, and that the framing is entirely a security one, dismissing other concerns and providing too few mechanisms for citizens to protect their rights. She notes that street protests in 2019 and 2021 were a significant part of Algerian political life, and warns expanded surveillance could make people hesitant to protest in future. THAT IS A FORECAST, NOT A FINDING, and is recorded as one -- no measurement of a chilling effect in Algeria appears in the coverage reviewed here. A CAUTION FROM WITHIN THE SAME RESEARCH worth carrying: Bulelani Jili of Georgetown University argues that even introducing legal frameworks to regulate this technology can be dangerous, because a framework can legitimise a deployment rather than constrain it. Coordinates are Algiers, not a specific installation.

SIX THOUSAND CAMERAS FOR FIFTY-EIGHT MILLION DOLLARS -- roughly $9,700 a camera, the cheapest per-unit deployment for which both numbers are reported. Egypt is one of 11 countries in the IDS and African Digital Rights Network report of 12 March 2026, which records USD 58 million spent and 6,000 smart cameras installed. FOR SCALE AGAINST THE REST OF THE STUDY: Nigeria spent over USD 470 million for about 10,000 cameras, Mauritius USD 456 million, Kenya USD 219 million, and the eleven countries averaged USD 240 million each. Egypt therefore has the second-largest camera count in the study at a fraction of the leading spend, which the sources do not explain -- it may reflect different equipment, different financing, or incomplete public accounts, and the researchers warn the accounts for nine of the eleven countries were incomplete. WHAT THE STUDY CONCLUDES ACROSS ALL ELEVEN: the systems are presented as crime prevention, counter-terrorism, modernisation and urban management; the researchers found little evidence that expanding digital surveillance reduces overall crime; much of the equipment is supplied or financed by Chinese companies and banks, often through loans; and none of the countries provides adequate means to obtain remedy for surveillance errors or abuse. Egypt already appears on this map for the Sandvine deep packet inspection deployment; this record covers public-space cameras. Coordinates are Cairo. THE SPREAD IS WIDER THAN EGYPT ALONE: by the same country tables as reported by Nairametrics, Senegal (USD 167 million, about 500 cameras) and Mozambique (USD 147 million, about 450) run at roughly USD 330,000 a camera -- so Egypt is one end of a thirty-fold range, not a lone anomaly. No source read explains either end; the report PDF could not be retrieved. WHAT WOULD SETTLE IT: the Egypt chapter of the report, or a question to its editors at IDS and the African Digital Rights Network. A POSSIBLE EXPLANATION, inferred rather than stated by the report: in February 2019 Honeywell signed to build a 6,000-camera IP system and command centre for Egypt's New Administrative Capital, reported at about USD 31 million (Global Construction Review). If the IDS figures come from that project, Egypt's low cost per camera reflects one US-built network in one new city, with video analytics rather than face recognition. The IDS report's Egypt chapter has still not been read.

THE SMALLEST DEPLOYMENT IN THE STUDY, AND STILL UNGOVERNED. Rwanda is one of 11 countries in the IDS and African Digital Rights Network report published 12 March 2026, with approximately 849 smart cameras -- the lowest camera count reported among the eleven -- and NO SPENDING FIGURE AVAILABLE. Rwanda is one of the countries for which the researchers could not obtain figures, which is part of why they describe their USD 2 billion total as a floor rather than an estimate. WHY A SMALL DEPLOYMENT STILL BELONGS ON THIS MAP: the report's central finding is not about volume. It is that across all eleven countries these systems were rolled out WITHOUT the legal frameworks needed to define who may conduct public-space surveillance, on what authority, and under whose oversight, and without adequate means for a person to obtain remedy for an error or an abuse. A network of 849 AI-enabled cameras feeding a central command centre with no statutory basis is a governance problem at any size. The researchers add that the systems are mostly supplied and financed by Chinese firms and banks. NOT ESTABLISHED: no Rwanda-specific misuse finding appears in the coverage reviewed here, and this record should not be read as one. Coordinates are Kigali.

On February 11, 2026 a Flock camera in Sherwood, Arkansas misread the plate on an SUV and Sherwood police ran a felony stop on the wrong vehicle. Officer Seth Kinkade drew his weapon and ordered the driver out; the driver complied calmly and was handcuffed. Officer Joe Lackey then arrived, drew his own firearm, and pulled the driver's partner from the car at gunpoint, cuffing her in front of the children in the vehicle. A six-week-old baby was left alone in a car seat in the back throughout. The correction came over the radio while officers were still walking to the rear of the car -- the dispatcher read the actual plate as ending '52'. They uncuffed the couple several minutes later. One officer's explanation on camera is the part worth keeping: those cameras are placed everywhere and they hit license plates, and he was not going to say they are completely perfect, because that is modern technology. The stop happened not far from a pair of Flock cameras.

Days after Flock Safety's February 2026 Super Bowl advertisement showed millions of Americans the true scale of its nationwide camera network, Amazon's Ring terminated its partnership with the company. The planned integration would have made it easier to feed Ring doorbell video into Flock's law-enforcement ecosystem; the swift corporate retreat under public backlash became one of the most visible moments of the anti-Flock wave and helped push the tally of canceled municipal contracts past 50.

A draft Namibia Cybercrime Bill dated 30 January 2026 gives an investigatory authority powers of access, search and seizure of stored data under a court warrant at clause 39, real-time collection of traffic data by technical means on the order of a Judge in Chambers at clause 40, interception of content data at clause 41, and expedited preservation of stored computer data at clause 47. Clause 3 provides that the Act prevails over any other written law on cybercrime and cybersecurity matters. The Council of Europe's Octopus country page assesses a draft Namibian bill as supplying most procedural powers the Budapest Convention requires while not setting out their scope, with some powers appearing to reach only offences under the bill rather than electronic evidence generally, and with no powers specific to traffic data. That page is undated and refers to a drafting mission held in February 2020, so whether its assessment describes this 30 January 2026 text or an earlier draft is not established. The bill is not enacted and no commencement date is established. Coordinates are Windhoek.

In Suffolk, Virginia, Jeffrey Sovern, a 41-year-old U.S. Air Force engineer and mechanic, was charged with taking down 13 Flock cameras with a saw. He pleaded not guilty to 25 counts: 13 felony counts of destruction of property, six counts of petit larceny, and six counts of possession of burglary tools. The case shows how far frustration with unaccountable plate-reader networks has escalated -- and sits alongside the lawful route the same state offers, where Norfolk's Flock network faces a Fourth Amendment challenge (Schmidt v. City of Norfolk).

In the Denver suburb of Cherry Hills Village, Kyle Dausman was repeatedly pulled over after his license plate was mistakenly entered into the ALPR system. 'I continually get pulled over,' he told 9NEWS. 'I can't really use my truck in any fashion. I believe my safety is at risk. They zipped out of nowhere and immediately got behind me with the lights flashing.' A single bad database entry turned an automated dragnet into recurring police stops of an innocent driver.

A Boulder County driver was repeatedly stopped by police after officers mistakenly entered her license plate onto a Flock hotlist. Nothing was wrong with the camera or her car. The plate simply sat on a list of vehicles to be flagged, and every camera she passed generated a fresh alert until somebody worked out why. Colorado produced three of these in five months -- Boulder County, Jefferson County and Cherry Hills -- which points at the absence of any routine review of what goes onto a hotlist or how it comes off.

1,600 SCHOOLS IN PARANA ALONE. InternetLab's November 2025 study found facial recognition running in public schools in at least seven Brazilian states -- Alagoas, Amazonas, Goias, Parana, Rio de Janeiro, Sao Paulo and Tocantins -- and earlier use in six more, mostly to take attendance. Parana has installed it in 1,600 schools. There are no national rules setting minimum safeguards for scanning children's faces, and the company supplying most of the systems did not answer the researchers. No ruling by Brazil's data protection authority on school use is recorded here. Ask each state education department for the contract, the retention period and the legal basis under the LGPD.

At an Oklahoma House Public Safety Committee interim study on Oct 16, 2025, Rep. Tom Gann (R-Inola) argued that ALPRs in Oklahoma may STATUTORILY be used only to check whether a motorist carries auto insurance -- the purpose the legislature authorized in 2013 with HB 1792, the Oklahoma Temporary Motorist Liability Plan, passed to cut the state's uninsured-driver rate. On that reading, every investigative Flock deployment in the state is operating outside its statutory authority. Note precisely what this is: a legislator's argument at a committee study, not a court holding and not an attorney general opinion -- no ruling has tested it. But it is a live legal question rather than a policy preference, and it applies statewide. Speakers included University of Tulsa law professor Shena Burgess and former Logan County commissioner Marven Goodman, who described how ALPR data combines with other records into a "mosaic" tracking a person's movements whether or not they are suspected of anything. This matters directly for the deferred Oklahoma City Flock renewal: OKC, Edmond, Harrah, Jenks and Tulsa all run ALPRs, and if the statutory argument has force it reaches all of them at once, which no single council vote can do.

An officer in the Denver area misinterpreted Flock captures and identified an innocent woman as responsible for a series of thefts. The camera worked; the reading of its output did not. IJ classifies roughly two thirds of the cases in its national review this way -- not machine failure but officers entering wrong information or drawing unsupported conclusions from what the system showed them, which is the part no accuracy percentage from a vendor can address.

A STATE OFFICER AUDITED THE VENDOR AND FOUND A STATUTE BROKEN -- THEN FOUND A SECOND VENDOR DOING THE SAME. Illinois Secretary of State Alexi Giannoulias announced on 25 August 2025 that a sample audit of twelve local law enforcement agencies, begun in June, had found Flock Safety allowed US Customs and Border Protection to access Illinois plate-camera data, in breach of a 2023 state law that bars ALPR operators from sharing data for immigration or abortion enforcement and defines a private vendor as a party the Secretary can hold to it. He ordered CBP access shut off at once. THE DETAIL THAT MATTERS MOST: the audit found Flock had NO PROPER SAFEGUARDS for data sharing, compounded by a CBP PILOT PROGRAMME THAT FLOCK'S OWN LEADERSHIP WAS UNAWARE OF. The company then paused its pilots with CBP and other federal agencies not just in Illinois but NATIONWIDE -- so one state's sample audit of twelve departments changed federal access across the whole network. FLOCK'S POSITION, IN ITS OWN WORDS: chief executive Garrett Langley wrote that the company had communicated poorly and had not created distinct permissions and protocols in its system to ensure local compliance for federal users, and that some of its earlier public statements had inadvertently been inaccurate. The company ADMITS THE CONTROLS WERE INADEQUATE and DISPUTES THE LEGAL CONCLUSION. Both halves are on the record. THEN IT HAPPENED AGAIN WITH A DIFFERENT VENDOR. On 5 September 2025 the same office found the Village of Forest Park's police department giving CBP access to its camera data through MOTOROLA SOLUTIONS equipment; Motorola worked with the village to disable it. Two vendors, one audit programme, the same failure -- which moves the finding from one company's defect to a structural feature of how these networks share. Giannoulias urged every Illinois department to re-examine what access it grants, against the state's Trust Act, which bars local collaboration with federal immigration enforcement without a court warrant. Hundreds of out-of-state agencies hold access to Illinois readers. THE SEQUENCE IS THE REASON THIS RECORD SITS AT THE STATE LEVEL: Oak Park had already terminated over exactly this concern before the audit confirmed it; Evanston terminated the same week the audit was published, citing it directly. A council objection became a state finding, and the state finding then became grounds other councils cited. UPDATE: THERE WAS NO PENALTY TO IMPOSE. Capitol News Illinois reported two days after the audit that the 2023 data-sharing ban carries no specific penalty for violating it. The Secretary of State's leverage came from the statute treating a vendor that shares data as a regulated plate-reader user, which let his office demand the shutoff -- and Flock complied, pausing federal pilots nationwide. His office said it was consulting the Attorney General; no fine, suit or AG action has been reported since. That makes the Illinois model a disclosure-and-compliance power, not an enforcement one. COMPARED WITH OTHER STATUTES CHECKED: Virginia's 2025 law binds vendors more tightly on paper -- they may touch data only at the agency's request for maintenance, must certify they will not sell or share it, and the data belongs to the agency -- but it is enforced through each department's contract, with no state officer auditing the company. Idaho's 2025 law regulates only agencies. NOT ESTABLISHED: whether any other state gives an officer direct audit power over the vendor; a full 50-state review has not been done.

A Jefferson County driver was repeatedly pulled over after officers mistakenly placed her license plate on a Flock hotlist -- the same failure that hit Boulder County four months later and Cherry Hills the following spring. Three separate Colorado jurisdictions, the same mechanism, no camera malfunction involved in any of them. The error is administrative and it is the kind that persists until the person it happens to complains loudly enough to get it traced.

HANDCUFFED IN HIS OWN DRIVEWAY FOR SOMEONE ELSE'S WARRANT. Redmond police detained Thor Andrews Sr. after Flock flagged his Ford Fusion as 'associated' with his son, who had an outstanding felony warrant. The car was registered to the father. No character was misread: the system connected the right plate to the wrong person, and officers acted on the connection. KING 5 reported the case in November 2025; the Institute for Justice dates the stop to August 2025. Not established: whether guns were drawn, how long he was held, or whether he has filed a claim. Redmond's council voted in November 2025 to suspend the city's Flock program; accounts differ on how much this case drove that vote. Ask Redmond PD: what does an 'associated vehicle' flag require before officers act on it, and who can add one? SOURCING: KING 5's report could not be opened; the facts here come from two advocacy sites that reposted it, and the date is the Institute for Justice's.

Italy's intelligence services used Paragon's Graphite spyware against journalists and migrant-rescue activists, confirmed by Citizen Lab in 2025, including Fanpage journalist Ciro Pellegrino and Mediterranea Saving Humans founders.

In March 2025 Hungary's Parliament rushed through three amendments in 24 hours -- to the Assembly Act, the Infraction Act and the Facial Recognition Technology Act -- banning Pride events and authorising police to use live facial recognition to identify participants and anyone committing even minor infractions such as jaywalking. Effective April 15, 2025, it dramatically widened biometric surveillance of peaceful assembly. Rights groups (HCLU, EDRi, ECNL, Liberties for Europe) argue it violates the EU AI Act, which already bars real-time remote biometric identification in public, and the EU Charter; the European Commission has been slow to act. Budapest Pride went ahead in June 2025 as the country's largest anti-government demonstration in years.

A FLOCK PHOTO LED TO A FALSE ARREST IN CUMBERLAND, AND THE ACLU ASKED THE TOWN TO CANCEL. The ACLU of Rhode Island wrote to the Cumberland Town Council urging it to end its Flock Safety contract after an image from the system led to the arrest of the wrong person; the Valley Breeze reports a lawsuit over the arrest. Coverage suggests the case turned on a photo of a car's occupants rather than a plate misread. NOT ESTABLISHED: the date of the arrest and of the letter, the lawsuit's status, and whether the council acted. Ask the council whether the contract was renewed.

An Amnesty International report found that Serbian police and the BIA intelligence agency used Cellebrite forensic tools to secretly unlock the phones of journalists and activists during detention, then installed a homegrown Android spyware called NoviSpy that can copy data and switch on the camera and microphone. Investigative journalist Slavisa Milanov and environmental campaigners were among those hacked after being held for routine-seeming interviews.

A November 2024 Amnesty International investigation, 'Coded Injustice,' found Denmark's welfare agency Udbetaling Danmark and its administrator ATP run some 60 fraud-detection algorithms -- including a 'Really Single' model that guesses a person's relationship status and the 'Gladsaxe Model' -- that mine vast personal data and flag 'unusual' or 'atypical' living and family patterns, disproportionately targeting people with disabilities, low incomes, migrants and foreigners. Denmark's Parliamentary Ombudsman opened an inquiry; the agency denies it amounts to social scoring.

Lafayette police detained an innocent man at gunpoint in a Chick-fil-A drive-through after a Flock camera misread his license plate. He sued the department. The location is worth recording rather than treating as colour: a felony stop executed in a queue of cars at a fast-food window puts bystanders inside the encounter, and the decision to run it there followed from a computer hit nobody had confirmed.

In May 2024, Myrtle Beach, South Carolina police held a Black teenager at gunpoint and handcuffed her after a license-plate reader led officers to stop her vehicle. She filed a civil-rights lawsuit alleging the officers wrongfully detained her and knew before drawing their weapons that they had pulled over the wrong vehicle.

Brazil's expanding police facial recognition has repeatedly detained innocent people, overwhelmingly Black. One man was tracked across fifteen train stations in Bahia before being held on a false match, another was detained in front of a stadium crowd, and in 2025 an 80-year-old volunteer was taken to a police station after cameras mistook him for a wanted man. A study found about 90 percent of those arrested through the technology in several states were Black Brazilians.

Iranian authorities installed facial recognition at Amirkabir University of Technology in Tehran to identify and penalize women students who removed their headscarves, part of a wider rollout of cameras and drones to enforce hijab laws.

At Greece's EU-funded Closed Controlled Access Centres for asylum seekers, two systems -- Centaur (CCTV, drones and AI behavioural analytics that flag 'threats' and log incidents, monitored from Athens) and Hyperion (biometric fingerprint entry and exit) -- put residents under constant surveillance behind curfews, with cameras even in sleeping containers. Most residents interviewed said they were never told they were being filmed. In April 2024 the Greek Data Protection Authority fined the Migration Ministry 175,000 euros for GDPR breaches over the rollout.

In April 2024, Toledo, Ohio police pulled over Brandon Upchurch after a Flock plate reader misread a 7 on his license plate as a 2 and flagged his vehicle. He was attacked by a police dog, accused of resisting, and spent time in jail before the error came to light. Business Insider and the Toledo Blade documented the stop as one of several wrongful detentions caused by plate-reader misreads.

The American firm Clearview AI is expanding across Latin America, giving law enforcement in countries including Argentina, Brazil, Colombia, and Ecuador access to its database of billions of scraped faces, even as it faces fines and bans elsewhere. Rights advocates warn it puts much of the region in a perpetual police lineup, risking wrongful arrests and profiling.

An innocent motorist was detained at gunpoint in York County after a Flock ALPR misread a character on his plate and flagged the car as stolen. The sheriff's office attributed the misread to a tinted license plate cover. That explanation is the interesting part, because it shifts responsibility to the driver for an accessory sold legally in most states -- and it concedes that the system's output is unreliable enough that a plastic cover can put someone at gunpoint. UPDATE: THE DRIVER HAS A NAME AND A LAWSUIT. Steven Melvin, 42, of Lake Wylie, sued the York County Sheriff's Office in June 2026 over the Valentine's Day 2024 stop in which deputies held him at gunpoint at a community mailbox and handcuffed him because a Flock alert tied his BMW's plate to a stolen-vehicle report. The sheriff's own internal affairs report, issued nine months after the stop, concluded the stop came from erroneous information associated with a Flock alert. Sheriff Tony Breeden defends the system: access is restricted, case numbers are required, and he credits camera hits with about 250 incident resolutions in the past year. NOT ESTABLISHED: the court and case number, and whether the county has moved to dismiss. (The identification of Melvin as this driver rests on matching town and filing month across two reports; neither names both.)

London's Metropolitan Police scan millions of faces with live facial recognition. Youth worker Shaun Thompson was wrongly flagged in 2024, then stopped, detained, fingerprinted, and threatened with arrest over a false match. At one 2025 sporting event South Wales Police logged 2,470 alerts, 92 percent of them false, and the equality watchdog found the Met system disproportionately flags Black men.

On New Year's Day 2024 in the Tampa Bay area, a father and his daughter, who has epilepsy, were handcuffed and held at gunpoint after an officer made a typo while running their license plate through a plate-reader database, according to WTSP. The error wrongly flagged their vehicle before officers realized the mistake.

Harvey Eugene Murphy Jr., a 61-year-old grandfather, was wrongly jailed after facial-recognition software used by Sunglass Hut's parent EssilorLuxottica and retail partner Macy's falsely identified him as the gunman in a January 2022 armed robbery of a Houston Sunglass Hut. Murphy had been living in Sacramento, California at the time; when he returned to Texas to renew his license he was arrested in October 2023, denied bond, and held in the Harris County Jail, where three men sexually assaulted him before prosecutors verified his alibi and dropped the charges. His January 2024 lawsuit seeking $10 million spotlighted the dangers of low-quality footage, decades-old mugshots, and private companies steering police with unaccountable face matches.

THE PLATE WAS REAL, THE NUMBER WAS NOT UNIQUE. Matthew and Leah Spurlock's KU Alumni specialty plate reads 7007. So did the temporary tag on a stolen GMC pickup, and Flock reads characters, not plate designs. A Colwich officer and a Sedgwick County deputy stopped Leah on the alert and spotted the mix-up quickly. The entry was said to be corrected. About a month later a Flock alert in Catoosa, Oklahoma brought a high-risk stop: guns drawn, both on their knees and handcuffed. KAKE reports that Kansas reuses plate numbers across more than 100 designs, so a stolen-car entry can match an innocent car in another state's reader network. The danger ended only when the stolen-vehicle entry expired. A Wichita police captain called a Flock hit 'more like the hunch'. KAKE reported the case on Jan 30, 2024; the stop dates are not given. Not established: any lawsuit, or whether Kansas has changed its numbering. Ask the Kansas Department of Revenue.

A Predator spyware customer assessed as highly likely linked to the Philippines was identified by Recorded Future, the first time the tool's use was tied to the country.

Christopher Galtin was wrongfully arrested in St. Louis after a face-recognition misidentification, and jailed even though readily available evidence showed he was not the correct match.

Jason Vernau was wrongfully arrested in Miami after being misidentified by face recognition, and jailed despite available evidence that he was not the correct match. The local department had told Congress it does not arrest on face recognition alone.

In late 2023 investigative outlet Disclose revealed that France's national police and gendarmerie had for years quietly used Briefcam, an Israeli video-analytics system capable of facial recognition, to search and filter surveillance footage without public debate or, critics argued, a clear legal basis. A 2024 CNIL investigation concluded the Interior Ministry had not used the software for real-time facial recognition in public space, but the episode exposed how FR-capable tools were deployed in secrecy.

Detroit police knew a shooting involved a Dodge Charger, then used plate readers to list every Charger in the area. Officers went to Isoke Robinson home, handcuffed her, placed her two-year-old in a patrol car, and impounded her car for three weeks, even though it had been recorded two miles from the shooting.

GUNS DRAWN ON THE WRONG CAMARO. On Aug 3, 2023 Harris County sheriff's deputies stopped two 19-year-olds in a Cypress neighborhood, drew weapons and handcuffed both. A Flock camera had logged a stolen Camaro's plate in the area. Deputies then stopped a similar-looking car whose plate neither they nor a helicopter crew had read. The camera did not misread anything. The stop went ahead without anyone confirming the plate. Neither man was charged. The sheriff's office said supervisors would review the body-camera footage, and the men were told how to file internal-affairs complaints. Their family said it would hire a lawyer. Not established: the outcome of any complaint, and whether a suit was filed. Ask HCSO: must a deputy confirm the plate before a high-risk stop on a Flock alert?

Sao Paulo's Smart Sampa program wires up to 20,000 cameras with facial recognition across a city of 12 million, watching streets, schools, and public spaces. Rights groups warn it could drive mass incarceration of Black residents, citing a 2019 study that found about 90 percent of those arrested through facial recognition in Brazil were Black. The Public Defender's Office sued to suspend it.

In July 2023 the European Court of Human Rights ruled that Russia violated Nikolay Glukhin's rights by using Moscow metro facial recognition to identify and arrest him over a peaceful solo protest. Glukhin had ridden the underground in August 2019 holding a life-sized cutout of jailed activist Konstantin Kotov; days later the system flagged him and police detained him. The court found the deployment incompatible with the values of a democratic society governed by the rule of law -- one of the first international rulings against live facial recognition.

Police in Espanola detained Jaclynn Gonzales at gunpoint and placed her twelve-year-old sister in a patrol car after a plate reader misread the last digit of the plate, a 2 read as a 7, according to a lawsuit against the city.

In July 2023, Frisco, Texas police held an Arkansas family at gunpoint on the Dallas North Tollway and handcuffed a child after an officer mistyped their license plate's state when running it, wrongly flagging their car as stolen. A sergeant arrived, caught the error, and called off the high-risk stop. The police chief apologized and opened a review, saying the department would not hide from its mistakes; the family, who were driving to a youth basketball tournament, hired a lawyer.

In the same month that Espanola officers stopped two sisters over a misread digit, a separate stop in the same town put an innocent teenager at gunpoint -- this time because officers had entered incorrect information into the ALPR system themselves. Two gunpoint detentions of young people in one small New Mexico city in one month, one caused by the machine and one by the people operating it. The sisters sued; their case is recorded separately on this map.

In June 2023 in Morristown, Tennessee, a Flock plate reader misread an O as a 0 and flagged the Herron family's vehicle, leading officers to pull them over at gunpoint with their three-year-old granddaughter in the car. The family, on their way to a doctor, said they posed no threat. Business Insider and local reporting cited the stop among cases where plate-reader errors put innocent drivers at gunpoint.

Dutch football clubs used retrospective facial recognition to scan crowds for banned supporters, and in one case wrongly issued a fine to a fan who had not even attended the match in question, a failure that drew warnings about expanding after-the-fact face surveillance in Europe.

British retailers including Southern Co-op, Home Bargains and Mike Ashley's Frasers Group deployed Facewatch live facial recognition to scan shoppers entering stores and match them against private watchlists of suspected offenders. After a 2022 Big Brother Watch complaint, the ICO concluded in March 2023 that Facewatch's processing had breached data-protection law on multiple principles, forcing an overhaul; campaigners say people were blacklisted over trivial accusations and, in cases like a teenager wrongly flagged at Home Bargains in 2024, misidentified and publicly accused.

Jackson Township officers pulled over and detained an innocent driver because they had failed to remove a license plate from a hotlist. The case is documented in federal court filings rather than only in news coverage, which makes it one of the better-evidenced examples of the pattern: a hotlist is easy to add to and nobody owns the job of taking things off it. The same failure produced the Greenville and Hercules detentions.

Porcha Woodruff, eight months pregnant, was wrongfully arrested in Detroit in February 2023 for carjacking and robbery after a face-recognition match. She was detained for hours before being released, and the charges were later dropped.

Pegasus was used against at least 16 Jordanian journalists and activists, including two Human Rights Watch staff and a Palestinian-American reporter hacked three times, many of whom had covered a teachers' strike the government crushed.

Vietnam deployed Predator spyware against targets including members of the European Parliament and used commercial spyware against bloggers, part of a broad surveillance campaign accompanying its jailing of online critics.

Angola was identified in the Predator Files as a likely customer of Intellexa's Predator spyware, with Amnesty International finding technical infrastructure tied to the tool active in the country.

Mongolia appeared among the governments linked to Intellexa's Predator spyware in the Predator Files, with Amnesty International documenting infrastructure associated with the tool.

Import records tied Botswana's Directorate of Intelligence and Security to shipments of Intellexa Predator spyware in 2023, the first identification of the tool's use in the country.

Sudan was among the countries where Amnesty International found technical infrastructure linked to Intellexa's Predator spyware in the Predator Files investigation.

Randal Reid was arrested near Atlanta in November 2022 for a Louisiana purse theft he did not commit, after a Louisiana agency used a face-recognition match. He spent several days in jail before the warrants were withdrawn.

Mexico is the most heavily targeted country in the Pegasus files. First exposed in 2017, the NSO spyware was used against journalists like Carmen Aristegui, whose teenage son was also hit, along with activists and lawyers for victims of disappearances. The Ejercito Espia investigation later showed the army kept using Pegasus against reporters and a human rights defender into 2021, even after the president pledged the practice had stopped.

After Russia's September 2022 mobilisation for its war on Ukraine, Moscow authorities turned the city's facial-recognition camera network on men avoiding the draft. Human Rights Watch documented at least seven men flagged as 'draft dodgers' and detained via surveillance cameras, taken to police stations and enlistment offices, with some ordered to the front. Enlistment offices even flag conscripts who legally challenge their call-up so they can be auto-detected on camera, and rights lawyers advise appellants to avoid the metro entirely.

Iran uses facial recognition, road cameras, drones, and a citizen-reporting app to enforce mandatory hijab rules on women. A 2025 UN fact-finding mission documented facial recognition installed at a Tehran university gate to catch uncovered students, and metro screens in Mashhad displaying passengers' faces, age, and gender to frighten women out of defiance.

Spanish football clubs have rolled out facial recognition on supporters: Valencia CF deployed a FacePhi system to control stadium access and Atletico Madrid announced face-scanning and cashless entry from the 2022-23 season, while other clubs use fingerprint scanning at turnstiles. Fans and privacy advocates warned that mandatory biometric entry normalises tracking of ordinary spectators.

In the scandal known as Predatorgate, the Predator spyware sold by the Israeli-founded firm Intellexa was used to target more than ninety journalists, the opposition leader Nikos Androulakis, ministers, and senior military officers between 2020 and 2022, alongside wiretaps by the national intelligence service. The case forced top resignations, and in 2026 an Athens court handed eight-year sentences to four people linked to Intellexa, a rare criminal reckoning for the spyware trade.

In Xinjiang, authorities use facial recognition to monitor the mostly Muslim Uyghur population, with face scans required to enter shops, hotels, and stations and tens of thousands of cameras in Urumqi alone. Leaked police files showed Hikvision systems used to screen all 23 million residents and flag people with overseas ties for arrest.

Buenos Aires's facial-recognition system was used to run unauthorized searches on more than 15,000 people not on any fugitive list, including journalists, politicians, and activists, and wrongly jailed a factory worker for nearly a week after a database error.

Citizen Lab's CatalanGate report found at least sixty-five people tied to the Catalan independence movement, including every Catalan president since 2010, members of the European Parliament, lawyers, and activists, targeted or infected with Pegasus or Candiru spyware between 2017 and 2020. The lab pointed to strong circumstantial evidence of a Spanish state nexus; the government later acknowledged court-authorized surveillance of about two dozen people and denied a wider operation.

Moscow's metro facial recognition, part of a Safe City camera network, has been used to detain and question thousands of people on their way to and from anti-war protests, sometimes preventively. The European Court of Human Rights later ruled the practice violated human rights.

In March 2022 Ukraine's defence and digital-transformation ministries began using Clearview AI facial recognition -- provided free, drawing on billions of scraped images including from the Russian network VKontakte -- to identify the bodies of dead Russian soldiers and message their relatives, and to identify operatives. Critics warned of the wartime normalisation of a controversial scraping tool and the risk of deadly misidentification at checkpoints.

A CAR RECOVERED 18 DAYS EARLIER WAS STILL ON THE LIST. On Feb 15, 2022 three Greenville police officers drew guns on sisters McKenzie and Kennedy Bryan, handcuffed them and put them in a patrol car. A plate reader had flagged their rental as stolen. Best Rent A Car had reported it stolen on Jan 27 and recovered the next day, but the stolen-vehicle entry was never cleared. The sisters were released once an officer called the rental company. They sued. Their lawyer argues a stop over an unreturned rental is not high-risk and did not justify drawn weapons. Greenville PD says trained dispatchers manage the database and it refreshes every six hours. That did not help here, because nobody removed the entry. Not established: any ruling or settlement. Ask GPD: who must clear a recovered-vehicle entry, and how fast?

Researchers confirmed Pegasus infections on 35 journalists and civil society members in El Salvador, with reporters at the outlet El Faro among the most heavily targeted as they investigated government corruption.

Alonzo Sawyer was wrongfully jailed in Maryland in 2022 after face-recognition software identified him as the man who assaulted a bus driver. He was held for nine days before the real suspect was identified.

A WHITE SEDAN, A FEW MINUTES AWAY, AND THAT WAS ENOUGH. Cameras caught a white sedan at the scene of a Fayetteville shooting that hospitalised a 19-year-old. The city's plate readers -- a Rekor system, not Flock -- spotted Jacqueline McNeill's white Nissan Versa a few minutes away, and according to a police affidavit that link alone was enough for detectives to issue a be-on-the-lookout alert for her car. She was surrounded by five or six cruisers in a convenience store car park while carrying food for her goddaughter's funeral, handcuffed, and accused of taking part in a drive-by shooting. THE MATCH WAS COLOUR AND BODY STYLE, NOT A PLATE. Her lawyer Patrick Anstead argues the technology was substituted for thinking critically about the case. North Carolina has paid roughly $70,000 in settlements across at least two such cases, one in Fayetteville and one involving Charlotte's separate network of more than 100 NDI Technologies cameras. TWO THINGS THIS ADDS TO THE MAP. First, the date: this happened in 2022, well before the wave these arguments are usually dated to. Second, the vendor: most records here concern Flock, and Rekor and NDI produce the same outcome, which means the problem is not one company's software.

Under the Law and Justice government, Polish services used NSO's Pegasus against the opposition. Senator Krzysztof Brejza was hacked dozens of times in 2019 while running the opposition's election campaign, and his stolen messages were doctored by state television for a smear campaign; a lawyer and a prosecutor critical of the government were also targeted. A Senate commission and the European Parliament found the spyware was deployed to entrench those in power, and prosecutors later seized the systems.

In October 2021 nine schools in North Ayrshire, Scotland switched on facial recognition to take payment in their canteens, scanning pupils' faces instead of fingerprints or cards. After public and regulatory backlash the ICO intervened, urging the schools to use a less intrusive method, and the rollout was paused -- an early flashpoint over normalising biometric identification of children for everyday transactions.

The 2021 Pegasus Project named Morocco as one of the heaviest users of NSO's spyware, with around ten thousand numbers selected. They included Moroccan journalists such as Omar Radi, who was later jailed, as well as foreign figures, among them French President Emmanuel Macron and several of his ministers. Morocco denied buying or using Pegasus and sued the journalists and Amnesty International for defamation.

In June 2021, Charlotte-Mecklenburg police surrounded teacher Jasmine Horne outside her west Charlotte home and arrested her at gunpoint after a license plate reader linked her car to a wanted suspect because the system had been given the wrong name. She was handcuffed and held before officers realized they had the wrong person; the actual suspect was arrested two days later. An internal review found the officers acted within department policy and in good faith, while Horne, who filed a complaint, said the experience left her traumatized; the department later said it would check plate-reader entries more often and bring in outside review. SETTLED FOR $10,000: Charlotte paid Horne $10,000 in July 2023, admitting no wrongdoing but apologising, per The News & Observer (syndicated copy). The paper says officers had entered the wrong name into the reader system and that she was held about 15 minutes.

Moscow's facial-recognition camera network, one of the world's largest, has been turned from catching criminals to hunting dissidents. Police have used it to identify and detain peaceful protesters, journalists covering them, and mourners at Alexei Navalny's 2024 funeral, tracing people right up to their door. In 2023 the European Court of Human Rights ruled its use against a protester unlawful.

In Atherton, California, police pulled over Jason Burkleo on his way to work on suspicion of driving a stolen vehicle and ordered him at gunpoint to lie on his stomach to be handcuffed. The plate reader had misread an H as an M. Officers acted on the alert without confirming the plate, one of a string of documented reader misreads that have put innocent drivers at gunpoint.

Daniel Ortiz was doing his children's laundry when Chicago police, responding to a ShotSpotter alert for gunfire that never happened, detained and arrested him on charges that were dismissed the next day.

Myanmar's military junta expanded Chinese-supplied safe-city camera networks with facial recognition across cities, raising fears of tracking dissidents after the 2021 coup.

Chinese authorities, working with surveillance firms including Hikvision, Dahua, and Uniview, drew up facial-recognition standards that sort people by traits such as ethnicity and skin color, which researchers warned opened wide scope to target minorities like the Uyghurs at scale.

Thirteen-year-old Adam Toledo was shot and killed by a Chicago police officer responding to a ShotSpotter alert in March 2021. The case became central to the city's decision to decommission the gunshot-detection system.

South Korean police tracked suspects with Videmo 360 facial recognition software, analyzing images pulled from CCTV and the internet, in a case that raised concerns over the legality of the surveillance.

In a decision made public in January 2021, the Lower Saxony data-protection authority fined online electronics retailer notebooksbilliger.de about 10.4 million euros for unlawfully video-monitoring its employees for at least two years. The regulator found blanket CCTV over workspaces and public areas, justified only by a general suspicion of theft, had no legal basis under the GDPR -- one of Germany's largest fines for workplace surveillance.

Azerbaijan was identified as a Pegasus operator with around 48 journalists selected for targeting, including OCCRP investigative reporter Khadija Ismayilova, whose phone was infected for nearly three years, and Meydan TV freelancer Sevinc Vaqifqizi.

Hungary's Interior Ministry bought Pegasus for about 6 million euros and used it against investigative journalists such as Szabolcs Panyi of Direkt36, along with opposition figures, lawyers, and a media-owning businessman, an EU member state turning spyware on its own critics.

Rwanda was named among Pegasus operators, with targets including the daughter and nephew of Hotel Rwanda figure Paul Rusesabagina; the leaked list also flagged South Africa's president as a possible Rwandan target.

Phone numbers of senior Lebanese figures appeared on the Pegasus list, including the president, a former prime minister, ministers, security chiefs, and numerous journalists and ambassadors, according to the Pegasus Project.

Bahraini human-rights activists were hacked with Pegasus in zero-click attacks that defeated new Apple protections, part of the Gulf state's documented use of commercial spyware against dissidents.

Forensic analysis confirmed Pegasus on the phones of at least 30 Thai pro-democracy protesters, academics, and rights defenders during the 2020 to 2021 mass demonstrations, the first confirmed use of the spyware in the country.

Four Kazakh civil society activists were confirmed targets of Pegasus, part of the leaked list of tens of thousands of phone numbers selected by NSO Group government clients.

Togo appeared among NSO Group's Pegasus clients in the Pegasus Project, which documented the spyware being used against journalists, opposition figures, and members of the clergy critical of the government.

Egypt is a documented user of Predator spyware; in one case the phone of an exiled Egyptian politician was found simultaneously infected with both Predator and Pegasus, run by two different government clients.

Armenia was identified by Citizen Lab as a Predator spyware customer, part of a cluster of governments deploying the Cytrox tool against phones alongside the better-known Pegasus.

Indonesia was documented as a Predator spyware customer, one of several governments Citizen Lab linked to the Cytrox surveillance tool used against people of interest.

Madagascar was named among the government customers of Predator spyware identified by Citizen Lab, part of a growing roster of states buying commercial surveillance tools.

Oman was documented as a Predator spyware customer by Citizen Lab, adding a Gulf state to the list of governments using the Cytrox tool against targets of interest.

In November 2020 the Swedish data-protection authority fined Gnosjo Municipality 200,000 SEK for unlawful video surveillance in an LSS home for people with functional impairments, after a resident was filmed in their own bedroom. The regulator found no legal basis and no impact assessment, calling it a severe and unjustifiable intrusion into the most private sphere of the home.

A UK Court of Appeal ruling in Bridges v South Wales Police found the force's live facial recognition unlawful. Its AFR Locate system scanned up to 50 faces per second against watchlists that could include anyone, with images drawn even from social media, breaching privacy, data-protection, and equality law.

Aurora police pulled over Brittney Gilliam and four children, including a six-year-old, at gunpoint and forced them face-down on the pavement after a plate reader flagged the SUV as stolen. The system had matched the Colorado plate to a stolen motorcycle with the same number from Montana. The city later settled the family lawsuit for 1.9 million dollars.

License-plate-reader misreads have repeatedly put innocent drivers at gunpoint. In 2020 Aurora, Colorado police forced a Black woman and four children, the youngest six, face-down on hot pavement after a reader matched their plate to a stolen motorcycle from another state; the city paid 1.9 million dollars. CBS News verified more than a dozen US wrongful stops, including a 12-year-old handcuffed in New Mexico over a single misread digit and a San Francisco woman seized at gunpoint in 2009, and one study found readers misread the state on roughly 1 in 10 plates.

In Bahia, a Black man was wrongly detained for 26 days over a robbery committed by someone else a decade earlier, after a facial-recognition system misidentified him. It is one of several mistaken-identity cases tied to face recognition in Brazil since 2020.

In 2019 the northern Italian city of Como quietly bought, installed and tested a live facial-recognition system in public squares near its train station, among the first Italian municipalities to do so. After a journalistic investigation, the Italian data-protection authority (Garante) found the deployment had no legal basis under GDPR and ordered it stopped in 2020 -- a case that helped drive Italy's later national moratorium on public-space facial recognition.

Baltimore police ran a months-long aerial surveillance program in 2020, flying planes that continuously photographed the whole city to track people and vehicles. A federal appeals court later ruled the warrantless program unconstitutional.

Michael Williams, 65, spent nearly a year in Cook County Jail after Chicago police charged him with murder based mainly on a ShotSpotter alert the system had first flagged as a firework. Prosecutors dropped the case, and in 2026 the city paid him 500,000 dollars; Chicago scrapped the system in 2024.

Delhi police used facial recognition to identify and arrest people from the 2020 anti-CAA protests and the communal riots that followed, later saying scores of the riot arrests were traced by the technology, and turned it on Sikh farmers during the 2021 farmers' protests. Rights groups documented its disproportionate use against Muslims and other minorities and a chilling effect on the right to protest.

Delhi police rolled out facial recognition that researchers found would inevitably fall hardest on the city's Muslim community, and used it to identify protesters, with much of the deployment kept under wraps.

In 2019 the Hellenic Police signed a roughly 4 million euro contract with Intracom Telecom for 'smart policing' devices -- handheld tools that let officers run live facial recognition and automated fingerprint identification on people during street stops. Part-funded by the EU, the deal was signed with no data-protection impact assessment and without consulting the Greek DPA, prompting complaints from digital-rights group Homo Digitalis.

Around 2019-2020 Prague police sought approval to switch on automatic facial-recognition cameras at six locations in the Czech capital and bought recognition software from the firm Cogniware, extending biometric identification into public space with little public debate or oversight.

By 2020 the Dutch national police maintained a facial-recognition database holding images of around 1.4 million people, and municipalities were rolling out face recognition in public space under 'pilot' and 'smart city living lab' labels that sidestepped regulatory scrutiny and frustrated public debate.

Detroit police wrongfully arrested Robert Williams in January 2020 after face-recognition software matched him to surveillance footage of a shoplifter. He was held overnight; the case became the first widely known wrongful arrest tied to the technology and led Detroit to tighten its rules.

Customs and Border Protection paid millions to data brokers Venntel and Babel Street for commercial smartphone location data, running tens of thousands of queries to track devices without warrants as a workaround to the Carpenter ruling.

Utah gave the firm Banjo a multimillion-dollar contract and access to state databases, including traffic cameras and 911 feeds, before a government audit found the company could not deliver the real-time crime detection it had promised.

At least fourteen people in the US are publicly known to have been wrongfully arrested after police relied on a false facial-recognition match, beginning with Robert Williams in Detroit in 2020. Nearly all were Black; the cases include a woman who was eight months pregnant and several people jailed for months over crimes in states they had never set foot in.

Belarus deployed facial recognition to identify and arrest participants in the 2020 post-election protests.

Austria's federal police began using facial-recognition software to search surveillance footage at the end of 2019, comparing camera images against stored photos of suspects for after-the-fact identification. Rolled out with little public debate and limited to retrospective (not live) use, it made Austria one of a growing group of EU states quietly normalising biometric identification in criminal investigations.

Contra Costa sheriff deputies stopped Brian Hofer and his brother at gunpoint on Thanksgiving after a plate reader flagged the car as stolen, even though the vehicle had already been recovered and police had not updated the hot list. Hofer chaired a local privacy commission and received a settlement of about 49,500 dollars.

Uganda built a Huawei Safe City network of facial-recognition cameras across Kampala. A 2019 Wall Street Journal investigation found Huawei technicians helped state agents crack the encrypted communications of opposition leader Bobi Wine, leading to his arrest, and police later confirmed using the cameras to track people detained during anti-government protests. Opposition figures call it a tool to hunt and persecute critics.

During the 2019 pro-democracy protests, Hong Kongers wore masks and carried umbrellas and tore down 'smart lampposts' in Kowloon, fearing they held facial recognition that could identify demonstrators and expose them to arrest. Police had access to AI able to match faces from video to databases, and the fear of being identified kept some people away from the streets.

In August 2019 the Swedish Data Protection Authority issued the EU's first GDPR facial-recognition fine -- 200,000 SEK (about 20,000 euros) against the Skelleftea municipal school board after Anderstorp High School piloted FR cameras to log the attendance of 22 students over three weeks. The regulator found consent could not be a valid legal basis given the power imbalance between school and pupils, that attendance could be tracked less intrusively, and that the school processed sensitive biometric data without an adequate impact assessment.

In July 2019 the football club Brondby IF switched on Panasonic facial recognition at Brondby Stadium -- the first FR deployment in Denmark, approved by the Danish Data Protection Agency -- scanning roughly 14,000 fans per match against a ban list of about 50 people. Digital-rights group IT-Pol argued the system was disproportionate and set a dangerously low bar, and a University of Copenhagen law professor who sat on the deciding council agreed it should arguably never have been allowed. In 2025 the agency granted FC Copenhagen a more extensive stadium face-recognition system, deepening the normalisation of biometric surveillance in Danish sport.

Michael Oliver was wrongfully arrested in Detroit in 2019 after face recognition misidentified him as the person who threw a teacher's phone. Charges were dismissed once it was clear he was not the man in the video, and he later sued.

A cautionary tale from the ALPR industry's deep end: Perceptics, the plate-reader vendor for U.S. Customs and Border Protection -- arguably the best-funded law-enforcement agency in the country -- was hacked, and the stolen data, including traveler images and license plates, was published online. The EFF cites it as the definitive proof that ALPR databases are a breach waiting to happen: if CBP's vendor could be cracked and dumped, so can a small town's. The lesson holds across every vendor on this map -- Flock, Axon, Vigilant, Rekor, ELSAG, Jenoptik -- a plate database is only as safe as the least-secure company holding it.

Nijeer Parks was wrongfully arrested in 2019 after New Jersey police relied on a face-recognition match tying him to shoplifting and an assault. He spent about ten days in jail despite being elsewhere at the time, and later sued.

Police in Avondale, Arizona obtained a Google geofence warrant that swept up every device near a 2018 murder. Jorge Molina was arrested and held six days even after a detective quickly deemed him highly unlikely to be the killer; his stepfather was later charged.

A Vigilant ALPR in Hercules flagged a vehicle as stolen and officers detained the driver and his brother at gunpoint. The car had been recovered already; nobody had updated the hotlist. The driver was Brian Hofer, who chaired Oakland's privacy commission -- so the person the system stopped at gunpoint was among the few in the state best placed to explain publicly what had gone wrong, and he did. The New York Times covered it. IJ's review dates this to November 2018 and places it in Hercules, which resolves a disagreement in later accounts that put it variously in 2018 or 2019 and in Contra Costa County generally.

Saudi dissident Omar Abdulaziz, a Canadian resident and confidant of Jamal Khashoggi, had his phone infected with Pegasus, and Citizen Lab detected suspected infections inside Canada.

Exiled Russian journalists based in Latvia, including Meduza founder Galina Timchenko and Novaya Gazeta Europe's Maria Epifanova, were infected with Pegasus between 2020 and 2023.

Investigative journalist Nuria Piera was repeatedly targeted with Pegasus between 2020 and 2023, confirmed by Amnesty International and Citizen Lab.

Pegasus was used to surveil journalists, activists, and lawyers in Panama, with early deployments linked to the government under former president Ricardo Martinelli.

The phone number of then prime minister Imran Khan appeared on the leaked Pegasus target list, and Citizen Lab detected suspected Pegasus infections in Pakistan.

Citizen Lab detected suspected Pegasus infections in Turkey, where associates of murdered journalist Jamal Khashoggi were among those targeted.

Citizen Lab detected suspected Pegasus infections in Bangladesh, where authorities have acquired a range of phone interception and surveillance systems.

Citizen Lab detected suspected Pegasus infections linked to an operator in Kenya.

Citizen Lab detected suspected Pegasus infections in South Africa.

Citizen Lab detected suspected Pegasus infections in Singapore.

Citizen Lab detected suspected Pegasus infections linked to an operator in Tunisia.

Citizen Lab detected suspected Pegasus infections linked to an operator in Qatar.

After the Pegasus Project, Algeria's public prosecutor ordered an investigation into reports the country was targeted, and Citizen Lab detected suspected infections there.

Citizen Lab detected suspected Pegasus infections linked to an operator in Iraq.

Citizen Lab detected suspected Pegasus infections linked to an operator in Uzbekistan.

Citizen Lab detected suspected Pegasus infections linked to an operator in Kuwait.

Citizen Lab detected suspected Pegasus infections in Yemen.

Citizen Lab detected suspected Pegasus infections in Switzerland.

Citizen Lab detected suspected Pegasus infections linked to an operator in Ivory Coast (Cote d'Ivoire).

Citizen Lab detected suspected Pegasus infections linked to an operator in Zambia.

Citizen Lab detected suspected Pegasus infections in Kyrgyzstan.

Citizen Lab detected suspected Pegasus infections linked to an operator in Tajikistan.

Citizen Lab detected suspected Pegasus infections linked to an operator in Libya.

Citizen Lab detected suspected Pegasus infections in Palestine, where Palestinian human rights defenders were later confirmed to have been hacked.

Germany's federal police ran live facial-recognition trials at Berlin's Sudkreuz station in 2017 and 2018, scanning volunteers against a watchlist to test automated identification in a busy transit hub. Interior Minister Horst Seehofer hailed the results and pushed to expand automatic facial recognition to more stations and airports, drawing fierce criticism from civil-liberties groups and data-protection officials over false positives and the normalisation of biometric mass surveillance in public space.

An analysis of more than 23,000 Geolitica (formerly PredPol) crime predictions for Plainfield, New Jersey found a success rate under half a percent, with fewer than 100 predictions matching a later-reported crime. The police captain said the money could have been better spent elsewhere.

Saudi Arabia used Pegasus against people close to murdered journalist Jamal Khashoggi, including an exiled dissident friend and his fiancee, whose phone was infected days after his 2018 killing.

From 2018 Zimbabwe acquired facial-recognition technology from CloudWalk and Hikvision for border control and mass surveillance, with citizens' biometric data sent back to the Chinese vendors. QUANTIFIED IN 2026: the IDS and African Digital Rights Network study of 12 March 2026 records USD 10 million spent by Zimbabwe on smart city surveillance, the smallest published figure among the eleven countries studied, with the camera count not specified. That is a useful corrective to reading deployment scale from spending alone -- Zimbabwe's earlier significance on this map is the DATA FLOW, citizens' biometric data returning to the Chinese vendors, not the size of the contract. The 2026 study found the same pattern of Chinese supply and financing across all eleven countries, and no adequate means anywhere to obtain remedy for surveillance errors or abuse.

Citizen Lab's 2018 Bad Traffic report found Sandvine PacketLogic devices on Turkey's network redirecting hundreds of users to malicious sites that delivered government spyware, alongside blocking of political and news content.

In 2017 Italy's Interior Ministry commissioned the SARI (Automatic Image Recognition System) facial-recognition platform for the scientific police from vendor Parsec 3.26. Rolled out with extreme secrecy and little oversight, SARI was shown to be biased and to draw heavily on a database skewed toward foreign nationals; its real-time mode was later blocked by the Garante pending a proper legal framework.

In Rochester, New York, Silvon Simmons was shot in the back by police after a ShotSpotter alert. The company's analysts had first classified the noise as a helicopter, then reclassified it as gunshots and raised the count on later reviews.

Miami police purchased a cell-site simulator specifically to surveil political protesters, turning military-grade phone-tracking gear on demonstrators.

The LAPD used Palantir's Gotham platform, PredPol hot-spot software, and Operation LASER's chronic-offender scores, built from arrest records, license plates, and social media. An inspector general and activists found the tools entrenched over-policing of Black and Latino neighborhoods; LASER ended in 2019 and the PredPol contract in 2020.

The UAE was an early and heavy Pegasus user, targeting activist Ahmed Mansoor with a zero-day exploit in 2016 and later the ex-wife and associates of Dubai's ruler, part of one of the most extensive deployments of the spyware.

Ethiopian diaspora journalists at the ESAT broadcaster were targeted with Hacking Team's Remote Control System and Gamma's FinSpy spyware, documented by Citizen Lab.

Colombian security agencies were clients of Hacking Team's Remote Control System spyware, revealed by the 2015 breach of the Italian vendor.

Ecuador's intelligence agency SENAIN purchased Hacking Team's Remote Control System spyware, revealed by the 2015 breach of the Italian vendor.

Chile's investigative police were clients of Hacking Team's Remote Control System spyware, revealed by the 2015 breach of the Italian vendor.

Honduras was among the government clients of Hacking Team's Remote Control System spyware revealed by the 2015 breach of the Italian vendor.

Nigerian government bodies were among the clients of Hacking Team's Remote Control System spyware revealed by the 2015 breach of the Italian vendor.

Malaysian agencies were among the clients of Hacking Team's Remote Control System spyware revealed by the 2015 breach of the Italian vendor.

South Korea's National Intelligence Service was a client of Hacking Team's Remote Control System spyware, revealed by the 2015 breach and sparking domestic controversy.

Baltimore police secretly deployed cell-site simulators (Stingrays) more than 4,300 times to locate phones, routinely concealing the technology from courts and defense attorneys.

Baltimore police used facial recognition combined with social-media location tracking to surveil and identify protesters after the 2015 death of Freddie Gray.

Hertfordshire police ringed the small town of Royston with ANPR cameras, logging every vehicle entering or leaving. After complaints by Big Brother Watch, Privacy International, and No CCTV, the UK data regulator ruled the scheme unlawful and excessive and ordered it halted.

New Orleans police secretly used Palantir's Gotham predictive-policing software from 2012 to 2018 without the city council's knowledge, building target lists from criminal records, social media, and alleged gang ties under a philanthropic-partnership cover that bypassed procurement and oversight.

San Francisco officers stopped Denise Green, a city worker, late at night and handcuffed her at gunpoint on her knees after a cruiser plate reader misread one digit and matched her car to a stolen vehicle. No officer confirmed the plate by eye. The city paid about 495,000 dollars, and the Ninth Circuit later held that a plate-reader hit alone, without human verification, cannot justify a stop.

The FBI used a Stingray cell-site simulator to locate Daniel Rigmaiden in his Santa Clara, California apartment in 2008. Working from a jail cell, he reverse-engineered the device and forced the FBI to publicly acknowledge the technology for the first time.

Cyprus hosted operations of the Intellexa alliance behind the Predator spyware and was a client of Hacking Team, tying the island to Europe's mercenary surveillance trade.

Sri Lanka received Chinese-made AI surveillance and facial-recognition technology as part of Huawei and partner safe-city deployments.

Telecom Egypt used Sandvine PacketLogic deep-packet-inspection middleboxes to inject Intellexa's Predator spyware into the connection of opposition presidential candidate Ahmed Eltantawy, alongside mass web-monitoring and news censorship; the US added Sandvine to its Entity List in 2024.