[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSBS5mbMoHqL8fK008FSGk3M558r7azMkSERJMi9-bnc":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":25,"status":26,"created_at":27,"published_at":28,"article":29,"tags":33,"podcasts":52,"controls":53},"f85ce5ba-b98b-4bca-af5b-456a565f3fb8","unchecked-license-plate-data-sharing-exposes-surveillance-overreach","1da8f5c7-2df3-4cb3-a093-48a246d58c61","Unchecked License Plate Data Sharing Exposes Surveillance Overreach","Alpharetta's police department enrolled in Flock Safety's license plate reader network without fully accounting for the scale of automatic data-sharing agreements the platform enables, ultimately exposing citizen movement data to over 2,000 organizations. The root problem is a failure of data governance: third-party vendor agreements were accepted without rigorous review of downstream sharing permissions, data retention policies, or recipient vetting. This matters because license plate data constitutes sensitive location information that can reveal personal patterns of life, and its exposure to federal agencies, colleges, and other entities creates serious civil liberties and misuse risks. Past incidents of officers abusing the technology demonstrate that without strict access controls and auditing, surveillance tools become vectors for harm.","**Immediate actions:**\n- Conduct a full audit of all active data-sharing agreements with Flock Safety and other surveillance vendors to identify unauthorized or unapproved recipient organizations.\n- Suspend automatic data-sharing with unvetted third parties until each recipient has been individually reviewed and approved by legal and privacy officers.\n- Require officers with access to license plate reader data to complete mandatory privacy and acceptable-use training.\n\n**Long-term improvements:**\n- Establish a formal Data Sharing Agreement (DSA) review process requiring legal, privacy, and executive sign-off before any new third-party recipient is authorized.\n- Implement strict data minimization and retention policies, limiting how long license plate records are stored and who can query historical data.\n- Develop a vendor risk management program that evaluates surveillance-as-a-service platforms for privacy impact before procurement.\n\n**Detection & oversight measures:**\n- Deploy continuous logging and auditing of all queries against license plate databases, with anomaly alerts for unusual access patterns or bulk data exports.\n- Publish annual transparency reports disclosing the number of data-sharing partners, query volumes, and any misuse incidents to maintain public accountability.\n- Appoint a dedicated Privacy Officer or review board to perform quarterly assessments of surveillance technology use and data-sharing scope.",[12,13,14,15,16,17,18,19,20,21,22,23,24],"CIS Control 3 – Data Protection","CIS Control 6 – Access Control Management","CIS Control 14 – Security Awareness and Skills Training","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 AC-21 (Information Sharing)","NIST SP 800-53 AU-6 (Audit Record Review, Analysis, and Reporting)","NIST SP 800-53 PT-1 (Policy and Procedures – Personally Identifiable Information)","NIST Privacy Framework – Govern-P \u002F Control-P","GDPR Article 5 (Principles of Data Processing)","GDPR Article 28 (Processor Obligations)","GDPR Article 44 (Transfers to Third Countries)","ITIL – Supplier Management Practice","CJIS Security Policy Section 5.4 (Access Control)",{},"published","2026-08-28T10:20:39.985312+00:00","2026-08-28T10:20:39.876+00:00",{"id":7,"url":30,"slug":31,"title":32},"https:\u002F\u002Fwww.wired.com\u002Fstory\u002Fhow-an-atlanta-suburb-ended-up-sharing-flock-data-with-more-than-2000-organizations\u002F","how-an-atlanta-suburb-ended-up-sharing-flock-data-with-more-than-2-000-organizat-78add9","How an Atlanta Suburb Ended Up Sharing Flock Data With More Than 2,000 Organizations",[34,40,46],{"id":35,"name":36,"slug":37,"description":38,"color":39},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":41,"name":42,"slug":43,"description":44,"color":45},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":47,"name":48,"slug":49,"description":50,"color":51},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[54,58],{"slug":55,"name":56,"problem":57},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":59,"name":60,"problem":61},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached."]