Flock Safety, a maker of AI-powered license plate cameras used by U.S. police, is under scrutiny for allegedly lax cybersecurity – and now federal lawmakers are asking regulators to step in. In a letter Senator Ron Wyden (D‑OR) and Representative Raja Krishnamoorthi (D‑IL) urged the Federal Trade Commission to investigate Flock Safety’s practices, highlighting the company’s failure to require strong authentication for access to its vehicle tracking database.
Despite handling highly sensitive location information on millions of drivers, Flock does not mandate multi-factor authentication (MFA) for its police customers. The platform uses basic passwords by default; while Flock offers an MFA option, it isn’t phishing‑resistant and isn’t turned on by default. Wyden’s letter notes that at least 35 police or government accounts using Flock were compromised by hackers—incidents that likely could have been prevented with stricter login security.
Lawmakers cited scenarios where weak access controls allowed some law enforcement users to improperly share passwords and even access other agencies’ data within Flock’s system. The concerns intersect with broader privacy debates, as Flock’s data has reportedly been used in sensitive investigations, including monitoring travel to abortion clinics and tracking immigrants.
Wyden and Krishnamoorthi invoked the FTC’s authority over unfair or deceptive practices, noting prior settlements against companies that failed to implement MFA, including Uber, Chegg, Drizly, and Blackbaud. Those cases set precedent that not using readily available security like MFA, especially after known breaches, can be considered negligent.
Sources: The Record, Sen. Wyden press release
—
By the ID Tech Editorial Team
