ALPR Vulnerabilities & Public Safety Threats
A short summary from EFF on the decade-long pattern of ALPR security failures, vulnerabilities, and industry best practices.
Learn more
Quick answers to the questions people ask most, then short pieces you can read in a few minutes — how the technology works anywhere, what Alexandria specifically has, and what has changed lately.
Have a question you don’t see answered here? Email us and we’ll try to get it answered.
The questions we hear most, answered in a paragraph or two. Open any of them.
Automatic license plate readers (ALPRs) are cameras that continually operate and perform data analysis to identify and track vehicle movement. More than 99% of ALPR data is never tied to a crime. Each Flock ALPR camera captures data beyond just a license plate. This includes:
While Flock says its ALPRs don't target faces or biometric information, Flock's current AI models are already designed to parse granular features from every image. Adding facial recognition data logs could happen at the flip of a back-end switch and without knowledge or consent.
Alexandria shouldn't be kept in the dark on such powerful mass surveillance deployments and decisions in our city. Luckily, the ALCU and other cities have paved a path to get more surveillance transparency and accountability for Alexandria.
A red-light or speed camera only takes a picture when a rule is broken. An ALPR camera photographs every car that passes, all day, whether or not anyone did anything wrong. ALPRs are also increasingly integrated with AI-augmented search capabilities for sophisticated vehicle tracking and more.
Traffic cameras are for enforcement. ALPRs are for continuous tracking.
We cannot be certain. ALPRs are offered by multiple vendors and are owned by different public and private entities. In this vacuum, camera counts arise from conflicting first-party reports, public statements, news articles, and more.
However, we do know the number of ALPRs is relatively high: City Council member Sandy Marks highlighted that Alexandria has "roughly triple the camera-to-resident and camera-to-square mile ratio of neighboring jurisdictions."
At a minimum, Alexandria Police Department's (APD) Chief, Tarrick McGuire, recently confirmed that 61 Flock ALPR cameras are operated by APD. This number does not reflect other Alexandria Flock cameras that could be sharing data with APD. The Alexandria Sheriff's Office also has confirmed operation of two Flock ALPR cameras.
Unclear camera counts is a big transparency problem. Inconsistent answers on such a basic empirical question does not inspire public trust in current city technology practices and policy.
At a minimum, Alexandria Police Department (APD) staff, 153* APD sharing partners, and Flock have access to Alexandria's Flock ALPR data. But the full picture is more complicated than the city ALPR portal and transparency efforts suggest:
"Who can see this data" is a basic oversight question, and our city can't answer it confidently or consistently for ALPRs.
*As of Sept. 6, 2026.
Eyes Off ALX is calling on the Alexandria City Council to end the city’s unaccountable use of surveillance technology. Governments and police forces should not be able to use surveillance technologies, like ALPRs, without informing and securing the permission of the people they serve. The campaign’s framing draws on the ACLU’s Community Control Over Police Surveillance model, which has already been adopted in dozens of localities nationwide.
Alexandria uses at least eight categories of surveillance technology, including cell site simulators, drones, and GPS trackers. For several of these technologies, no public notice was made and no public policy is posted. Others operate under far looser rules than ALPRs. For instance, the city's trailer-mounted camera policy lets that camera footage be kept anywhere from seven days to a hundred years and enable facial recognition.
Eyes Off ALX is focused on ensuring all public uses of surveillance technology receive meaningful public input and oversight.
No.
Alexandria has a problem with how its surveillance is governed, not just which company sells it. Regardless of vendor, there has been no public input or oversight process for ALPR technology in Alexandria. A city that swaps vendors without passing a surveillance ordinance has changed its invoice, not its policy.
Without a better process, Flock's competitors offer the same types of vulnerabilities:
The evidence doesn't show that and the cybersecurity risks of ALPRs may in fact put Alexandrians at greater risk.
Statements and examples from the Alexandria Police Department (APD) have largely highlighted case-clearance and property-recovery statistics, not evidence of crime-reduction. That's likely because, as the Virginia State Crime Commission notes, "limited research exists on the effectiveness of ALPR technology." Most public "examples" of ALPR utility are anecdotal, drawn from fringe cases chosen for their emotional pull rather than their statistical weight. One of the few empirical studies of the technology's effectiveness — conducted by George Mason University researchers working with APD and the Fairfax County Police Department — found no statistically significant drop in auto theft, or in crime overall, at camera sites.
It is cybersecurity best practice to either "never store more data than [a department] can adequately protect within their limited resources," or to keep the "public safe from data breaches by not collecting the data at all." The figures APD cites seem consistent with a hot-list tool that takes seconds to check a match: it is unclear what requires storing 21 days of records on every other driver who happened to pass that camera. Holding that much data on uninvolved motorists doesn't make the hot-list hits any faster; it only expands what's exposed if the data is ever breached or misused.
Alexandria has never been shown the evidence that would justify that tradeoff, because the city has never run the process that would produce it.
We believe there should be a mandatory City Council process, with public input, for the approval of each specific form of surveillance technology. This would include:
The campaign’s framing draws on the ACLU’s Community Control Over Police Surveillance model, which has already been adopted in dozens of localities nationwide.
The "Get Involved" page has the current ways to help: events, a way to reach us, and updates on where the campaign stands.
A short summary from EFF on the decade-long pattern of ALPR security failures, vulnerabilities, and industry best practices.
A critical ACLU primer on ALPR companies beyond Flock and the security and privacy challenges inherent to each.
No. And a vendor this compromised shouldn't still have the keys our city's sensitive data.