North Little Rock is tracking every car in town. It's time for an ordinance. Opinion

If you drove through North Little Rock this week, the city has a record of it. Not a ticket, not a stop, just a timestamped photo of your plate, your vehicle, and where you were, sitting in a private company's database. Dozens of automated license plate readers, bought from two different vendors, now ring the city. Most residents have never been told they exist, never been asked whether they wanted them, and have no way to find out how they're used.

Here is what this system actually sees. Every camera logs the plate, the make, model, and color of the car, any bumper stickers or roof racks that make it distinctive, and the exact time it passed. Multiply that by dozens of cameras on the main corridors and you get something far more than a photo of a car. You get a map of a life. Anyone with access to this data can reconstruct a person's daily routine in an afternoon. Where they sleep, where they worship, which clinic they visit, whose driveway they park in. That's not a hypothetical. It's what the system is built to do.

What the city couldn't tell us

When the Arkansas Democrat-Gazette asked North Little Rock basic questions about its cameras last month, the answers weren't there. How many searches officers run, what they search for, who else gets the data, how long it's kept. The reporting found the data lacking. Think about that. A city that can produce a photo of your car at Pike and Main last Tuesday can't produce a count of how many times its own officers queried the system.

Meanwhile, next door in Sherwood, a Flock camera misread a plate by one letter in February and officers pulled over a family, weapons drawn, with a one-month-old baby in the back seat. Sherwood at least responded by publishing a transparency portal listing its 14 cameras and its retention rules. North Little Rock has done nothing comparable.

The system isn't even secure

Set aside for a moment how the police use this data. Ask instead who else can get it.

In December, journalists at 404 Media found more than 60 Flock cameras streaming live video to the open internet with no password at all. Anyone who knew where to look could watch the feeds, download 30 days of archived footage, and open the administrator control panel. The cameras were found with Shodan, a search engine for internet-connected devices that anyone can use for free. Security researcher Jon Gaines found 67 exposed Flock cameras and license plate readers using the same off-the-shelf tools and reported them to the federal CERT program. He described his effort as deliberately “light and quick.” It took him about as long as a weekend project.

Gaines went further. In a published white paper he documented more than 50 vulnerabilities in Flock's hardware, including a hardcoded Wi-Fi password shared across every camera, an operating system that stopped receiving security patches in 2021, and plate images and credentials stored unencrypted on the device. Twenty-two of those findings have been assigned official CVE numbers, the industry's standard registry of confirmed software flaws. Journalist Benn Jordan independently reproduced the results on cameras running in production. In one case a publicly exposed API key gave researchers access to police patrol locations and thousands of hot-list alerts. Flock has not publicly confirmed or denied the specific findings, and there is no published independent audit from a major security firm.

Then there's Mountain View, California, where the police department discovered this past winter that a “statewide lookup” feature had been quietly running on 29 of its 30 cameras for 17 months, letting more than 250 outside agencies run roughly 600,000 searches a year on the city's data. The city never authorized it. Flock kept no records of the period. Mountain View shut every camera off.

That's the vendor North Little Rock is trusting with a record of where every resident drives. The company has since promised outside cybersecurity audits and made multifactor login mandatory for police accounts, which is welcome. But a promise from a vendor is not oversight. Nothing in the city's current arrangement requires Flock or Motorola to notify North Little Rock, let alone residents, if our cameras turn up on Shodan tomorrow.

The rest of Arkansas is moving. We're standing still.

Since late July, Centerton, Greers Ferry, Searcy, Mayflower, Farmington, and Pea Ridge have all ended their Flock contracts. Cabot switched its cameras off pending a review. Beebe is letting its contract lapse in October. Van Buren kept its cameras but cut retention to seven days. Sherwood is reconsidering the whole program over the annual cost of complying with state law.

Even Flock itself has conceded the point. In August the company cut its recommended retention from 30 days to 7, made multifactor authentication mandatory, and announced that by year's end every officer will have to enter a case number for every search, with automated audits flagging unusual activity. The vendor is now setting stricter rules than our city council has.

And the state is getting involved. Arkansas law already caps plate data retention at 150 days for government entities, and the Highway Police put proposed rules for their own readers in front of the Legislative Council last month. The ACLU of Arkansas has documented Flock data being pulled by federal immigration agents and other outside agencies without a warrant. None of that protects a North Little Rock resident unless the city writes its own rules.

What an ordinance needs to say

None of this requires tearing the cameras down. It requires the city council to do its job and put the program under written, enforceable rules. At minimum:

1. Retention capped at 7 days for any plate not tied to an active investigation, matching Flock's own current default. Anything longer requires a documented case number.
2. No sharing outside Arkansas law enforcement without a warrant or court order, and a written prohibition on federal immigration access to the database.
3. A public transparency portal, updated monthly, showing camera locations, total reads, total searches, the reason categories for those searches, and every outside agency that received data.
4. Mandatory audit logs with case numbers on every query, reviewed quarterly by the city attorney and reported to the council in open session.
5. Council approval for any new camera, any new vendor, and any contract renewal, with a public comment period first.
6. Prohibited uses spelled out: no tracking of protests or religious gatherings, no queries on elected officials, journalists, or city employees without a documented criminal predicate, and no use for civil matters like debt collection or code enforcement.
7. A sunset clause. The program expires in two years unless the council votes to renew it after reviewing the audit data.
8. Security and breach requirements. Any vendor must provide the city an annual independent security audit and notify the city within 72 hours of any unauthorized access or exposure, and the city must notify the public within 7 days.

Every one of these provisions already exists somewhere. An Arizona town wrote one to keep its cameras while eleven of its neighbors cancelled. Washington State passed restrictions this spring. Sherwood built a portal in a few weeks after one bad stop. North Little Rock can adopt this at its next regular council meeting if members decide residents deserve to know how they're being watched.

What you can do

Email your council member and the mayor's office and ask two questions: how many times has NLRPD searched plate data this year, and who outside the department has received it. If they can't answer, that's the case for the ordinance right there. Then show up to the next council meeting and say so out loud.

Cameras are cheap. Trust isn't. The city spent the money on the first without earning the second. An ordinance is how it starts to.

References

1. Data lacking on North Little Rock's use of license plate reading cameras, Arkansas Democrat-Gazette, Aug. 23, 2026
2. Little Rock, North Little Rock use 2 companies for their dozens of license plate cameras, Arkansas Democrat-Gazette, Aug. 15, 2026
3. Sherwood police reconsidering Flock Safety cameras over annual $15,000 fee to comply with Arkansas law, Arkansas Democrat-Gazette, Sept. 6, 2026
4. Sherwood stop sparked after Flock camera misread plate by one letter as stolen, KATV
5. Several Arkansas cities pull plug on Flock cameras, Arkansas Advocate, Aug. 19, 2026
6. Marshall installs Flock license plate readers as Arkansas cities reassess or suspend use, KATV
7. Arkansas police chiefs association endorses use of Flock license plate readers amid backlash, Arkansas Democrat-Gazette, Aug. 28, 2026
8. Flock Safety sets 7-day default for ALPR data, adds mandatory misuse safeguards, Police1, August 2026
9. Flock rolls out new police auditing and accountability controls following surveillance concerns, CNN Business, Aug. 13, 2026
10. Flock Exposed Its AI-Powered Cameras to the Internet. We Tracked Ourselves, 404 Media, Dec. 22, 2025
11. Finding 67 Flock Safety live camera feeds and debug web interfaces accidentally exposed without authentication, GainSec, Jan. 9, 2026
12. Flock Safety camera vulnerabilities: 50+ flaws found, SimeonOnSecurity, 2026 (summary of the GainSec white paper, Zenodo DOI 10.5281/zenodo.17529423)
13. Big Brother Left the Door Open: Flock's AI surveillance cameras exposed to the internet, PetaPixel, Dec. 29, 2025
14. Flock cameras shared license plate data without permission, Malwarebytes, February 2026
15. Arkansas Highway Police proposes new rules for license plate reader data use and privacy, Deltaplex News, August 2026
16. Arkansas Code § 12-12-1803, Automatic License Plate Reader System Act
17. 11 Arizona cities have terminated Flock contracts. One town passed new rules to keep the cameras, KJZZ, Sept. 8, 2026
18. What to know about the new restrictions on Flock and similar camera systems, MRSC (Washington), April 2026