Flock's Frictionless Dragnet

#054: What a hundred thousand cameras and a single search box reveal about surveillance, the design of consent, and the importance of intentional friction.

Photo by Etienne Girardet on Unsplash

Somewhere in Texas, last spring, a sheriff’s deputy sat down at a computer, typed a few words into a search box, and went looking for a woman across the entire country.

He didn’t bother to hide why. The search record said it in plain language: “had an abortion, search for female.” With that query he reached into more than eighty-three thousand cameras spread across roughly six thousand separate networks — cameras owned by towns and police departments that had never met him, in states like Washington and Illinois where the thing he was investigating isn’t even a crime. Flock and the sheriff’s office later recast the search as a hunt for a “missing person”, a story the logs themselves contradict. He had no warrant. He had no permission from any of those jurisdictions. He had a login and a hunch, and the system did the rest, because the system was built to make exactly that easy.

The company that built it is called Flock Safety, and if you have driven anywhere in America lately you have been photographed by its hardware. Flock now runs something north of a hundred thousand automated license-plate-reader cameras, feeding a searchable network that more than five thousand law enforcement agencies can query. It was sold to city councils as a neighborhood crime tool — find the stolen car, catch the hit-and-run, bring the missing kid home. What it quietly became is a nationwide record of where ordinary people drive, wired into a single search interface with almost nothing between a curious officer and anyone he wants to find.

The interface is the policy

In product work we treat friction as the enemy. It’s the thing we run usability tests to hunt down and kill: the extra tap, the confirmation dialog, the form field nobody wants to fill out, the load screen that makes someone bounce. A frictionless experience is the compliment we give our best work. We say a good product “just works,” meaning it gets out of your way, meaning it asks nothing of you, meaning the distance between wanting a thing and getting it collapses to zero.

Most of the time that instinct is right, and it’s humane. Taking the friction out of filing taxes or refilling a prescription or reporting a pothole is a genuine gift to people who have better things to do with their lives.

Some friction, though, is often essential to stave off a poor or erroneous decision, or — in the case of Flock — protect basic civil liberties.

Think about what used to sit between a police officer and a map of your movements. To track someone across state lines you needed probable cause, a warrant signed by a judge, cooperation from other jurisdictions, physical surveillance, hours of labor, and a paper trail somebody could examine later. All of that was friction, and all of it was also a check — a small deliberate cost that forced a human being to stop, justify the intrusion, and leave a record of having done it. We poured that speed bump on purpose, because at some point we decided the power to watch people should be expensive.

The grim brilliance of Flock and its design is that it took a capability that used to require a small army and a judge’s signature and turned it into a text field. Every abuse in this story is the system working as designed, used by people doing exactly what the design invites. When you make a cross-country dragnet as easy as searching your email, you’ve made a decision about how much friction should protect a person from being followed, and you’ve answered: almost none. Calling it a neutral tool that a few bad apples misused doesn’t survive contact with the logs. The interface is the policy. Whoever designs and builds the search box is writing law that nobody voted on.

No contract required

You can watch the same logic launder accountability at the federal level, which should worry anyone regardless of where they sit politically.

Flock will tell you, correctly, that it has no contract with Immigration and Customs Enforcement. This is true, and it is beside the point, and the fact that it can be both at once is the whole magic trick. Reporting by 404 Media, built on public records pulled from a single police department in Danville, Illinois, documented more than four thousand searches run by local and state officers on behalf of federal immigration enforcement — queries tagged, in the officers’ own words, “immigration,” “ICE,” “ICE+ERO,” “illegal immigration.” Every search that named immigration as its reason came after January of 2025. ICE got in without buying anything. All it took was local cops willing to run a lookup as a favor, and a system frictionless enough that the favor took thirty seconds.

That’s what a frictionless architecture does to responsibility: it dissolves it. No single actor is holding the whole thing. Flock didn’t share your data with the feds; a local officer did, using a tool Flock built to make sharing effortless, for an agency Flock has no paperwork with. Everyone in the chain gets to point at someone else. The design spreads the action so wide that nobody has to own it, which is another way of saying the friction that used to attach a decision to a decision-maker has been engineered out. Congress noticed. Representatives Krishnamoorthi and Garcia opened a formal investigation last August, demanding records of every search tied to ICE, CBP, and abortion. Shortly after, Flock pulled some states out of its national lookup tool. The controls, as always, arrived after the reporting did.

The best case for the cameras

It’s worth being fair to the argument on the other side, because it isn’t stupid. Plate cameras do solve real crimes; Flock can point to recovered vehicles and found children and closed cases, and those are real people helped in real ways. There’s a legitimate legal theory underneath it, too: a license plate is displayed in public, the reasoning goes, so you have no reasonable expectation of privacy in something you show the world every time you drive to work.

But that argument swaps one plate for a lifetime of them. Watching your car pass on a single street is a different thing entirely from pulling up everywhere your car has been, anywhere in the country, in one query. The Supreme Court has started to say so — its recent decision in Chatrie, on location data, leans toward the idea that once privacy attaches, the size of the slice stops mattering — and a Fourth Amendment challenge to Flock’s cameras is climbing through the appellate courts right now. The law is catching up. The simpler answer sits underneath the caselaw, though: a system that makes total surveillance frictionless will be used for total surveillance, whatever anyone intended, because that’s what the design rewards. Intentions don’t govern a system like this. The architecture does, and this architecture was built to say yes.

You can see it in the reliability, too. When Los Angeles’s own inspector general audited Flock alerts, roughly a third came back wrong — a hundred and sixty-one cars falsely flagged as stolen in two months, each false flag a potential felony stop, a gun drawn on someone whose only crime was a misread plate. A frictionless system moves just as fast when it’s wrong as when it’s right, and it hands the consequences to whoever is standing on the roadside with their hands up.

Friction returns, by force

Here’s what gives me some hope, and it’s a very design-brained kind of hope: friction is coming back, because people are putting it back by hand.

More than fifty cities across twenty states have now canceled or refused Flock contracts, and the pace is picking up. In some towns, officials who couldn’t even figure out how to switch the service off resorted to pulling trash bags over the cameras until they could get them physically removed, which is about the crudest possible user interface for the word “no.” Council members in Santa Cruz and Mountain View found their own residents’ movements had been queried hundreds of thousands of times by agencies they’d never authorized, and they did the only thing a city can do to a system with no off switch that respects them: they reached for the cord.

That’s friction coming back the way it always does when it’s been stripped out too fast — reactively, expensively, through lawsuits and audits and hearings and, apparently, garbage bags. Designing it in would have been so much cheaper. A retention limit that actually expired. A search that required a reason a judge could read later. A hard wall between local data and federal fishing. A default set to no, with a little work required to get to yes. None of that is technically hard. We leave it out because friction looks like failure on a demo, and “frictionless” closes the deal with the city council.

What we call friction

We are the ones who build these things. Not Flock specifically — the broader we, the people who design the systems that decide how easily power can reach a person. And we’ve spent a decade training ourselves to treat every speed bump as a defect, every confirmation step as a conversion killer, every moment of deliberate slowness as a problem for next sprint.

Some of it is. But a lot of what we call friction is just protection wearing work clothes. The warrant, the expiring log, the jurisdiction line, the human who has to stop and sign their name to an intrusion — in the systems that touch people’s freedom, those are the system doing its job. The slowness is the protection. The real question underneath all of this is how much a society should have to work to watch one of its own, and whether that work should stay hard enough that we usually decide it isn’t worth it.

Flock answered that question in the shape of a search box. The rest of us still get to decide whether that’s the answer we design toward, or the one we finally build some friction against.

The deputy in Texas barely had to work to find her.

That should frighten us all.