Hearings to examine flock's nationwide AI surveillance network.

Well, let me call to order this hearing of the Senate Judiciary Committee subcommittee on crime and counterterrorism which I'm delighted to chair and to work on with my colleague ranking member Durbin thank you to all of our witnesses for being here welcome to all of our guests who are here today in the gallery. This hearing is about a simple thing, it's it's trying to get to the bottom of what is going on with the expanding surveillance network that appears to be going coast to coast in this country, I have in mind the hundreds of thousands of individual cameras, all linked to the cloud, all powered by AI, that seem to be spreading all across the country. Practically every state in the union now has them, hundreds of thousands of them, recording billions of images every single month. And the question is, where are all of these images going? Who is using them? What are the privacy protections for them? How do we make sure that this kind of surveillance is consonant with the constitution of the United States? You know, there's many players in this industry, but there's one name that really stands out above the rest, and that is Flock. If you haven't heard of Flock, all I have to say is Flock's probably heard of you. In fact, uh, the truth is you have probably been scanned and surveilled and tagged and logged multiple times this week alone. And that's because, flock by its own admission and its own statistics, maintains a network of one hundred and twenty thousand individual cameras in forty-nine states all across this country. It estimates that those cameras scan and then generate some twenty billion images, that's with a B, twenty billion images of individuals in their cars or on their motorcycles or other vehicles every, single month. Twenty billion images. every single month. Falk is a privately held company. Based on what we know, it's backed by a venture capital firm, it's worth about ten billion dollars, and it has amassed in a very short time frame a surveillance network unlike any we've ever seen in this country. And really what makes it unique, based on what we can tell from the reporting and the reporting on what these networks can do, I have to tell you it's really kind of wild. What seems to make these networks unique is not just the sheer number of cameras, it's the fact that they're all linked together and power and searchable by AI. It's unlike anything we've ever seen in this country before. And to give you just a sense of it, I mean, here is some of what these cameras can do. This surveillance network uses thousands of these AI-powered cameras to capture and analyze images of passing vehicles. Let's see if we can give you a a sense of it. Here's a a flock image. They store and catalog deke details like the vehicles make. Model, color, location, date, time. Flock's searchable features include details like dents and roof cracks and vehicle damage and racks on the roof or racks on the back or specific bumper stickers even you think about that. I mean, flock can tell you if a car has a Trump sticker or a Harris sticker or a Pro-Life America sticker or an NRA sticker, it's really quite extraordinary. Fluck's cameras can even recognize whether people are in the images. And in fact, in fact, Fluck admitted in a letter to me ahead of this hearing that you could search their database based on people's images. You could ask to search people, im- images that had people, images that are scanning the inside of the cars. I mean, this is really quite extraordinary. Fluck is not the only player in this field, of course. There are other companies, Motorola, Axon, Vercadea. And they've also built these vast surveillance networks that are also supercharged by AI. And the thing is, when you harness all of these things together, you get a capability based on the reporting that is different in kind than anything we've ever seen in this country. And I just want to state right now my principal concern with all of this. Number one, I just want to get the facts as to what these networks are, how they operate, what they're doing. But I also just want to say this, and I want to be clear about it. The Constitution of the United States is just as valuable and valid and applicable today as it was almost two hundred and fifty years ago when it was first penned, and that includes the right to be innocent until proven guilty, that is, not treated like a criminal and tracked like one. It includes the right to personal privacy, control of your own data and information that is protected in our Bill of Rights. Our Bill of Rights is still good no matter what the technology of the day is. Now my bottom line in this hearing is we've gotta find a way to protect and enforce the Bill of Rights and the basic personal liberties of every law abiding citizen in this country, no matter what the technology is. That I think is the challenge that is facing us today. And I have to tell you, based on what these reports are, we've we've got some work ahead of us. You know, to give you another example, a customer in a flock network, for example, just needs to buy a single camera and a subscription that I'm told costs about three thousand dollars annually. And in return for that, they get access to a nationwide database of tens of thousands of cameras, about a hundred and twenty thousand in Flok's case, and billions of images. And Flok has admitted that until very recently, there were basically no curbs or restrictions on which of these subscribers, so to speak, could search their databases, what they could do with the images, how long the images were kept, Or what are the uses they were put to? In fact, customers can search using natural language across this data set, including images that are months and months old. Flok customers are even able to assemble a pattern of life. That's a comment from Flok itself, a pattern of life for the millions of vehicles that are caught up in what is becoming a massive dragnet. You know, the overwhelming majority of drivers or other travelers who are surveilled here have done absolutely nothing wrong. Nothing wrong at all. And I think that's what's so troubling to people as they learn about this technology. It sounds as if, based on the reports we've heard, it's treating every citizen in America, I mean by now surely almost all of us have been scanned and logged, as if we are criminals, yet without any due process, without any reasonable suspicion, without any articulable suspicion whatsoever. This just seems very, very strange, to put it mildly. And something I think this committee really needs to hear about. You're gonna hear in just a moment from someone who has suffered at the hands of this surveillance network, Lindsay Isaacs, who joins us from Palm Coast, Florida. She was falsely accused of being in a car crash, causing one in fact, and she spent thirteen days in jail because of a misidentification from one of these surveillance networks. She's totally innocent. You're gonna hear from Alastair Whitney, who's a legal expert for the Institute for Justice, which is an organization that's been documenting the use and sometimes abuse of these cameras. You're gonna hear from Sheriff Ross Teeple, who we're so proud is here today, from Arizona, who recently decided to terminate his department's use of these cameras in order to protect the privacy of his citizens and to comply with the Constitution of United States. You're gonna hear from Ben Jordan, who's a cyber security researcher, who's gonna speak personally to the very real risk that these cameras can be hacked. And all of those images, billions of them, can be accessed by malign actors. And you're gonna hear from Chad Marlow, who's a senior policy counsel at the ACLU where he leads their Get the Flock Out campaign. Sadly, who you're not gonna hear from today are the CEOs of Flock and Axon and Motorola and Verketa. I invited all of them, as Senator Durbin and I did, the whole committee. We sent letters to them and asked them to be here. And they're not. And I think that that's unfortunate. I think we need to hear from them about what it is their network's I think we need to hear from them about their intentions, about their capabilities, and we need to have an honest conversation about where this is leading us as a country. I'll close with this and let Senator Durbin make his opening remarks. I just want to say this. You know, this is still the United States of America, and it shouldn't be that when you walk out your door in the morning, you just have to agree and assent and accept the fact that you're gonna be on camera, morning, noon, and night. You'll be tracked by anybody and everybody in the world. You'll have no privacy whatsoever. You'll be tracked.

Senator Hawley, good hearing. Glad to be here and looking forward to the testimony. For the flock CEOs, For the flock CEOs, obviously they're nervous about being on camera. obviously they're nervous about being

Mm.

but uh i sure wish they would have joined us today it would have been interesting to hear their explanation of the statistics that have been given us by congress by senator uh hawley a hundred and twenty thousand flock cameras in forty nine states which state doesn't have them

hawaii

hawaii i wonder why maybe we'll learn the collection of information and data is what it's all about these days Amazon, I'm told, makes more money off the data that they've collected about their customers than they make off the merchandise that they sell. Hard to imagine, but that information is being sold regularly and collected constantly. And that's what this hearing is all about. I support law enforcement. I'm glad they're here, represented by Ross Teepel and others, uh, and we entrust them with keeping us safe in our homes, in our neighborhoods, in our businesses. and as we go about our business. But we also value privacy. If you're a constitutional scholar, please tell me where the word privacy is in this constitution. You won't find it. And yet the courts have found the inference of privacy and uh determinations as to things as basic as reproductive choices by couples. So we know that there is some privacy protection. We also know that uh as we look at the information that's gathered it's been gathered for many years this is not this is nothing new the volume of the uh undertaking his allure the state of illinois has had an alpr automated license plate reader uh as part of their uh state effort to catch people on the tollway who don't pay their fair share this has been around for a long time it's been used to locate people who have gone missing cars connected to crimes and stolen vehicles That all sounds good. And then you hear the story of Miss Isaacs. She'll tell you in detail what she's been through when the uh so-called fail-safe technology fails. And it certainly did in their case, in her case. Uh, I just wanna say to the Chairman, thank you for this hearing. We have got to find a way to balance in America privacy and security. I think there is a balance. Congress needs to lead the way. Thank you, Mr. Chairman.

Thank you very much, Ranking Member Durbin. It's the practice of this subcommittee to administer an oath to our witnesses before they testify. So if you're willing, I'll ask you to stand and answer the following question. Do you swear that the testimony you're about to give will be the truth, the whole truth, and nothing but the truth? So help you God.

I will, yeah.

Very good. The record reflect everyone answered in the affirmative. Let me now give each witness an opportunity to make an opening statement. We're so glad that each of you is here. We'll go right down the dais here, starting with Miss Isaacs, Lindsay Isaacs is from Palm Coast, Florida. As I said a moment ago, she was falsely accused of causing a fatal car crash in an incident that involved flock cameras Miss Isaacs we're glad you're here, and the floor is yours.

Thank you. Good afternoon. My name is Lindsay Isaacs. I'd like to share with you what happened to me beginning on October fourth of twenty twenty five and how it ch how it forever changed the trajectory of my life. On October fourth, twenty twenty five, I spent the day with my mom cooking at my apartment in Palm Coast, Florida. We left my apartment separately at around six thirty PM. She drove home to Ocala and I drove to a store in Davenport. It was a normal drive, I stopped for gas, and then continued to the store. I stayed at the store for about an hour, before heading home. I arrived home at approximately ten twenty five PM, ate some of at approximately one O four am on october fifth an fhp trooper and three deputies from the marion county sheriff's office arrived at my parents home in ocala looking for me they asked where i was and where my vehicle was and told my parents that i had been involved in a fatal crash my parents were confused and terrified they told law enforcement i was home asleep in palm coast and gave them my address they could not understand what they were being told and they were now worried about whether i was even alive my parents immediately drove to my apartment they arrived at approximately four forty five a.m. and found additional troopers there already i woke up frantic my parents were at my door multiple troopers were outside and an impound i gave the troopers my receipt and information showing where i had been i told them that i had not been involved in any crash the troopers told me that there was damage to my vehicle consistent with the collision but i could not see the damage they were describing my durango was in immaculate condition yet i stood there watching law enforcement take it away telling me that my vehicle had been involved in a crash, where three people died. The same day, October fifth, twenty twenty five, I retained criminal defense attorney, Patrick McGeehan. In February of twenty twenty six, my defense team sued the FHP seeking the return of my vehicle. I later learned that a flock automated license plate recognition camera had captured my Dodge Durango approximately two to three miles west of the crash scene. investigators were looking for a black dodged Durango. I also later learned that the witnesses had described a maroon dodged Durango as being involved in this crash, and that nine one one callers provided information about that vehicle, including a partial license plate of four five eight. Despite this information, the investigation continued to focus on me and my vehicle. On April seventeenth, twenty twenty six, a warrant was issued for my arrest. I was ordered to surrender myself at the Volusia County jail by two PM. I could not understand what was happening. I was placed in solitary confinement for approximately three and a half days. Correctional officers told me because I had to stay there because of this severity of my charges, and I could not be housed with other inmates until I had been evaluated. I was placed in a blue suicide prevention dress with a broken velcro on the left side that left me exposed. The cell door was shut and it was not open for approximately eighty-six hours. I'm sorry. I was then moved into a mental health unit for approximately twenty-four hours before ultimately being transferred to G block, a maximum security housing unit. where I remained for approximately ten days. I was terrified. I was facing the possibility of spending the rest of my life in prison for a crash, I knew, that I knew I had not been involved in. I did not know if I would ever get out of jail. At my lowest point, I didn't wanna be alive. The television was constantly on in the jail. My mugshot appeared on the news, and I watched as information about me and my case was broadcasted publicly. Other inmates harassed me about my charges. Every day I prayed that the truth would come out. When another inmate was sent to prison, she gave me her bible. I read that bible every day. I slept with it as my pillow. I even took it into the shower because I almost had nothing else. and i was afraid someone would take it and steal it i still have that bible today and i cherish it on april twenty second twenty twenty six i was denied bond at my pretrial detention hearing on april twenty eighth my attorney patrick magian presented the court with multiple photographs of my durango sitting in the fhp impound lot without the collision damage investigators had claimed was present this prompted the state to re reevaluate my vehicle and the case against me the following day april twenty ninth i was finally granted bond after thirteen days in jail i ran into my mother and father's arms i could not believe i was free in may twenty twenty six the state ultimately declined to prosecute me and filed a no information an information was never filed against me the investigation instead resulted in charges against another individual i came here today because i want you to understand that surveillance technology does not exist in a vacuum. Information collected by technology can become part of an investigation that affects a real human being. In my case, a flock camera captured my vehicle a few miles from the scene of a terrible crash. That piece of information became part of an investigation that ultimately led to my arrest on three counts of vehicular homicide and thirteen days in jail for a crash, I had nothing to do with. I'm not here to tell you how to do your jobs. I'm here to tell you what happened to me. Thank you for allowing me to share my story with you today. I thank God, my family, and my attorney, Patrick McGeehan, for standing beside me and helping me get my life back.

Thank you so much, Miss Isaacs. Thank you for being here, for sharing that.

Thank you. Thank you.

Mister Whitney is next. Mister Alastair Whitney who serves as legislative counsel for the Institute for Justice. Mister Whitney, the floor is yours.

Good afternoon. Good afternoon, Chairman Hawley, uh, ranking member Durban, and members of the Subcommittee, um, thank you so much for inviting me to testify today. My name is Alistair Whitney and I'm legislative counsel at the Institute for Justice. IJ is a, uh, nonpartisan public interest law firm that works in both state houses and court houses around the country to defend your constitutional rights. ALPR technology now lets the government do something it could never do before. And that is travel back in time and reconstruct your movements, where you've been, and with whom you've associated. all without a warrant, and with the ease of running a Google search. Governments say they need this kind of uh frictionless access to fight crime, and the goal is of course laudable. But as the Supreme Court has said, the warrant requirement is not an inconvenience to somehow be weighed against the claims of police efficiency. Technology may make surveillance more convenient, but it does not make the Fourth Amendment's protections any less important. Now most people picture ALPRs as a camera that reads a plate, but that picture is roughly a decade out of date. As the chairman mentioned earlier, modern license plate readers photograph every single car that passes. They never blink. They never sleep. They can record make, model, color, bumper stickers, dense. They can map everywhere a car has been photographed. They can flag cars that travel together. And they are networked. One vendor alone runs a dense network of more than one hundred twenty thousand cameras in forty nine states, and logs twenty billion photographs of vehicles every single month. This means, of course, that an officer in California or Florida can access information and data showing where somebody has driven in Missouri or Illinois. With the ease of a couple of key uh key strokes or clicks. No federal law governs any of this, and many states uh don't have any law on the books either. where rules exist, a vendor often wrote them, and they change with a software update or a publication of a missive on a website. The rule, the result is what you would come to expect and sadly, what we've come to see. For example, in Kentucky, an officer allegedly searched a flock database for his uh child's mother, thousands of times over several months, despite the woman ha- uh the woman having received an order of protection against him. In North Carolina, an officer was arrested after allegedly accessing Phlox database to look up an undercover investigator's vehicle at the request of a drug suspect. Innocent families have been held at gunpoint over a misread letter on a plate. Images from these cameras have been shipped to gig workers in the Philippines to train Phlox AI. IJA's public database now documents hundreds of incidences like these, And unfortunately, the number of abuses are growing by the day. The Fourth Amendment has something to say about this. In Jones, in Carpenter, and this June in this court's decisions in Chattree, the Supreme Court made clear that we do not surrender our constitutional rights when we are in public. In Chattree, two hours of location data was enough to require a warrant. Here we are talking about weeks or months. That is why IJ is litiga- is challenging this warrantless surveillance in two federal courts. In Norfolk, Virginia, one hundred seventy-five unblinking eyes captured forty-one million vehicle images in less than a month. In San Jose, California, the city had four cameras at a single intersection in twenty twenty one. Today, just under five hundred cameras a- are across the city, taking hundreds of millions of photographs a year, which more than a thousand city employees and nearly three hundred other agencies in the state search roughly fifteen thousand times a day. Networks that dense let the government track anyone cheaply for weeks at a time. That is exactly why law enforcement likes them. Regardless of how these cases turn out, here's the point that matters here the most. The Fourth Amendment is not as, excuse me, the Fourth Amendment is a floor, it's not a ceiling. Congress did not wait for the courts on wiretaps or bank records. And it should not wait here. Even the judge who ruled against us in Norfolk said that the guardrails should come from legislatures. This Congress should act now. Congress can require federal agents to uh get a warrant before they search historical location data. As our model legislation does, it can impose tight limits on how long that data is kept, and it can condition federal dollars on states and localities doing the same. To be clear, none of these restrictions would stop law enforcement from finding a missing child or a stolen car. We're not asking for you to turn the cameras off with this model legislation. The warrant requirement is the bare minimum, though. Without it, there is simply no constitutional way to run these systems because they sweep in the overwhelming majority of drivers who have simply done nothing wrong. And what they capture is not just a day in the life, but a way of life. This is why Americans' opposition to their unchecked spread crosses every single political line, prompting a growing number of cities and states to slam the brakes on this technology. So we urge the honorable members of this cons- of this subcommittee to enforce constitutionally grounded restrictions on this technology before these cameras end up on every street corner. That is not just i j s concern, that is Flock's stated goal. Is that the America that we wanna live in and hand to our children? For i j and for me personally, the answer is no. Thank you very much for your time and I look forward to your questions.

Thank you, Mr. Whitney. Next is Sheriff Ross Teeple. It's an honor to have you here, Sheriff. Uh, Sheriff uh Teeple is from Pinal County. Did I get that right? Shoot, am I saying that right?

Yep.

In Arizona. Uh, thank you again for your service, and thank you for being here. The floor is yours.

It's an honor to serve. Good afternoon, Chairman Howey, Ranking Member Durbin, and distinguished members of the subcommittee. Thank you for the invitation to speak before you today on this critical issue. Before I begin, I would like to acknowledge the passing of John Keil last week. Senator Keil dedicated his life to serving his country and Arizona. I extend my deep condolences to his family and his colleagues that worked alongside him here in the Senate. My name is Ross Teeple, and I am honored to be elected the twenty-fifth sheriff of Pinal County, Arizona, and proud to be married to my beautiful bride for the last thirty-three years. Protecting public safety and defending constitutional rights are law enforcement's most important jobs. I am here today because I firmly believe we can use technology to keep our community safe while still achieving both of these vital goals. Let me be entirely clear. Automatic automatic license plate readers or ALPRs are a great tool. Technology that is strictly limited to reading a license plate helps us solve crimes, catch dangerous criminals, and find missing people. It allows us to cross-reference plates against stolen vehicle database, or respond to active AMBER alerts instantly. Under the Supreme Court's landmark twenty twenty ruling and Kansas v. Glover, running a license plate to check registration status provides the reasonable suspicion needed to make a proactive traffic stop. Used properly, point in time, lace and plate reading is common sense policing. The committee reached out to me because I was one of the first law enforcement leaders in the country to end our contract with flock. Make no mistake, that decision was controversial, but it was extremely popular on both sides of the political spectrum. Pinell County represents a unique law enforcement challenges. It's the size of Connecticut, lies between Arizona's two biggest cities, and is about sixty miles from the border. Interstate ten and eight, some of the busiest human and drug trafficking corridors in America, run right through the heart of my county. There is a good chance that the Fentanyl being sold outside Union Station right across the street, or in your hometown, came through my county. Given those challenges, it would be irresponsible not to equip my deputies with the best technology, to help them do their jobs. But I will never allow technology to supersede your rights. I believe the latest camera networks, powered by artificial intelligence and machine learning, are capable of violating our citizens' fourth amendment rights. We have entered an area where some camera networks are capable of capturing much more than just a snapshot of a plate on a highway. If my deputies need a search warrant to put a physical tracker on a vehicle, Where is the line for camera systems that build an identical AI driven map of a citizen's life? Recently, I received an email from a law enforcement colleague regarding these fa- cameras that I found chilling. He wrote, quote, " Some courts compare point in time to continuous tracking as the reasoning. Will there someday be a Supreme Court ruling on these? No doubt. But today, as I type this, "there is no violation of the fourth amendment." With all due respect to my colleague, that is the wrong mindset. We shouldn't wait for the Supreme Court to tell us something is a violation before we decide to protect the privacy of our citizens. History has shown us the cost of law enforcement moving faster than the Supreme Court constitutional rulings. Sixty years ago, in my state of Arizona, a detective arrested a man named Ernesto Miranda. The detective got a confession and secured a conviction. But because procedural safeguards weren't actively protected, the Supreme Court threw that conviction out in Miranda v. Arizona, fundamentally changing law enforcement forever. Now, everybody in America has heard of the Miranda rights. What people forget or don't know about Miranda rights is that detective should have known better. It was already common practice back then to let suspects know They have a right to remain silent, and they have a right to an attorney. Now, everyone in America has heard the word flock, and in Pinell County it's become a four-letter word. We rely on private camera network, if we rely on private camera networks to act as a dragnet, continuously logging the habits of innocent Americans without a warrant, we are paving the way to an AI driven surveillance state. If we allow government funded private surveillance companies to push this envelope blindly, we risk a sweeping judicial correction that could strip away the legitimate, life-saving aspect aspects of ALPR technology entirely. We must establish clear statutory boundaries for automatic uh license plate readers. We cannot wait for a future Supreme Court ruling to correct AI overreach. We must protect the Fourth Amendment today. Thank you, and I look forward to your questions.

Thank you very much, Sheriff. Thank you again for being here. Next up is Mr. Ben Jordan. Mr. Jordan is a cyber security researcher with extensive experience investigating the surveillance networks flock in particular as well as its peer companies. Mr. Jordan, thank you for being here. The floor is yours.

Thank you for having me. Um, I'm a, as the senator just mentioned, I'm a independently funded cyber security researcher, so I don't really work for a company or anything. To do so, um, I sort of do so as my own my own hobby that is then funded through a YouTube channel and Patreon and stuff like that and that's a nice way of saying I'm a hacker. Um, over the summer of twenty twenty five I started learning about some of the weaknesses in the security and the efficacy of the AP- ALPR industry's ecosystem in hardware I found that flock at the time did not require their clients to use multifactor authentication this led me to find flock law enforcement accounts for sale by a Russian vendor on a dark web marketplace which was referenced in Senator Wyden and Representative Krishnamoorthy's letter, urging the FTC to investigate flock as a national security risk in November of twenty twenty five. I then met and worked with John Gainsec-Gaines who had discovered, detailed and published fifty-five security vulnerabilities related to flock. Some of these vulnerabilities are published through Meiter, who manages security vulnerabilities for the Department of Homeland Security. The most alarming of John's reported vulnerabilities was in the most common model of flock's ALPR camera. I publicly demonstrated that by pushing the button on the camera three times, I was able to access all of the data or reprogram the device however I wanted in under a minute. A back door, malware, I even played doom on a flock camera. In addition to this, John and myself found insufficiently protected sensitive information stored on flock cameras including photos, license plate data, logs, API keys, passwords, and communications. Then, in December of twenty twenty five, through a specialized search engine, I found unprotective, uh, I found the unprotected administrative interfaces for over sixty newly deployed flock condor cameras, that had ai enabled pan tilt zoom features this allowed me to remotely view delete and modify thirty days of streaming footage from the cameras across the country in potentially sensitive locations like forest trails people's front porches and playgrounds and i could also zoom in on people's mobile phone screens another security researcher joshua michael independently found a misconfigured flock development demo via google search that included arc gis api keys with virtually unlimited uh usage limits ARC-GIS stores enormous amounts of data from local governments ranging from the live GPS location of police vehicles to aerial drone feeds. Flock has over the last year repeatedly repeatedly claimed that their service utilizes end-to-end encryption. Both John and myself have verified the lack of end-to-end encryption in a variety of different ways, but the most alarming consequence of this was in Dunwoody, Georgia, where FOIA requests showed that Flock employees had viewed cameras on their network including the ones in sensitive areas like, in sensitive areas like the interior of a Jewish community center and a playground. Fleck's response to my videos over the past year and media stories about her research had primarily been defensive or in denial of the many reported vulnerabilities, but in light of recent events they have invited myself and other researchers to review their hardware and platform. And while there hasn't been enough time for a thorough review before this hearing, I can testify that in my opinion it does appear that they're taking security a lot more seriously than they were a year ago. I have been one of Flock's harshest critics for years, but everything that I just stated about them is a symptom of a much larger problem, in my opinion. What I've been asking for around the country is for privatized government surveillance vendors to require independent security testing and inspections. I cannot legally open a restaurant or a barber shop without a health inspector and a fire marshal making sure that it's safe for people to enter. Yet there is not a single city or police department in this country that requires this from a third-party company tracking their citizens. I want to use my time here to ask our legislators to take this rare bipartisan agreement they're having to view Flock as a canary in the cold mine and understand that this doesn't go away by just removing one company from the equation. Both Axon and Motorola are actively rolling out the same reckless features that we're shaming Flock for, And you can expect these same vulnerabilities will continue to happen over and over again when innocent people's data is traded between private companies and police without any safeguard or protection. Some members of this community are in support of the combating organized retail cr- retail crime act, which has broad definitions that could lower the security posture of sensitive civilian data to the standards used by retailers. After reading that bill, I immediately imagined the scenario where Home Depot or target with their data breaches, what all of a sudden, uh, th- th- their data breaches affected hundreds of millions of Americans, but now I'm imagining them also including their location data and sensitive information related to ongoing in- investigations. So, to be as concise as possible, from a security perspective, it would be absurd to be concerned with the scenarios playing out with flock while supporting bills like Corka or the extension of FISA seven O two. That would be the equivalent of feeding a monster in an attempt to defeat it. An effective solution to many of the problems that we're going to be hearing about today would be using this momentum to make clear, effective, and unified federal privacy laws on par with the GDPR and literally every other developed country on the planet. ALPRs are used all over the world, but viewing license plates as personal data with modern privacy guardrails would have prevented nearly every single problem that we're learning about in this hearing This is an opportunity for Congress to build the overdue framework to protect the privacy of Americans for generations to come. Thank you.

Thank you very much, Mr. Jordan. Finally, Mister Chad Marlow, Mister Marlow is Senior Policy Counsel at the ACLU. Mister Marlow, thank you for being here. The floor is yours.

Chairman Hawley, Ranking Member Durbin, members of the Senate Judiciary Subcommittee on Crime and Counterterrorism, on behalf of the American Civil Liberties Union, I want to thank you for the privilege of testifying before you today. My name is Chad Marlow and for the past twelve years I have served as a Senior Policy Counsel at the ACLU where my work focuses on surveillance, privacy, and technology issues. In that role, I lead the ACLU's policy and advocacy work on automatic license plate readers, or ALPRs, including the ACLU's Get the Flock Out campaign. I wanna begin my testimony by answering the question I think is on the mind of every person in America. Namely, how did a country founded upon principles of liberty, personal freedom, and inalienable rights, including the right to privacy, locations and movements being tracked by governments at the local, state, and federal levels, even though virtually none of us are suspected of committing a crime. Put more succinctly, how did we get here? As you know, ALP R's are not new technology, they have been in use in America since the late nineteen nineties. So why then in the last several years have we seen an explosion in ALP R use and its tracking of innocent people? The answer is two-fold. The first is the entry of venture capitalist funding into the mass surveillance industry. Let me be clear. These massive investments do not reflect a rise in venture capitalist's interest in public safety. Rather, it reflects a view that ALPR use, if scaled up, could produce the massive profits venture capitalists seek. But to achieve such returns, the ALPR industry needed to go bigger, much bigger. And that meant pushing far greater LPR deployment, tracking, data retention, and data sharing to produce far greater profits. In short, LPR companies are in the business of trading our privacy for profits and they are getting rich off of it. Welcome to the surveillance industrial complex, America. The second cause of the spike in LPR use is the advent of artificial intelligence. of ALP R's allows for the collection of an unimaginable amount of location data, at some point you create a data haystack so big it becomes impossible to find the needle within it. But with the advent of AI, going through billions of ALP R scans and using them to identify drivers' intimate patterns of life like what doctor's offices, religious institutions, political meetings, or businesses a person frequents, And even using the AI to generate flimsy criminal suspicion has become light work. Because ALPR systems are most commonly sold to local police departments, a nationwide ALPR surveillance network crept up on us slowly and silently, until it was too big not to notice. In early twenty twenty two, the ACLU became the first organization to sound the alarm about this emerging threat as embodied by flock safety's ALPR's on steroids business model. The rest of America soon joined us, and here we are. Today, flock safety ALPRs collect more than twenty billion license plate scans per month. That's fifty-seven scans per person in America every month. And that's just flock. If you think that sounds like an Orwellian nightmare, you'd be right. Beyond revealing intimate patterns of life and generating questionable suspicion, The most concerning impact of ALPR mass surveillance is that it can chill the exercise of people's rights and freedoms. This is why authoritarians love surveillance. In places like Cold War East Germany and modern-day China, the main benefit of mass surveillance isn't catching the few people who break the law, but rather putting all their people in fear of stepping out of line with the government's interests. That is the chilling effect, and it's coming to America. In seventeen fifty-five, Benjamin Franklin wrote that those who would give up essential liberty to purchase a little temporary safety deserve neither liberty nor safety. While that is certainly true, today's situation with ALP R's is even worse because the people are being asked to give up their privacy for virtually nothing in return. Decades of studies demonstrate that surveillance does not deter crime, outside of its use in public parking lots and on public transportation. So we get no public safety benefits from ALP R's there. Moreover, a recent study of FBI crime data for Atlanta shows that the deployment of more than five thousand ALP R's in that city had no effect on case closure rates. What that means is that where an ALP R identified a stolen vehicle or a wanted person, that vehicle or person would have been found anyway. Yes, perhaps the ALP R would have found the person a few hours or days faster, But that marginal gain does not justify undermining the privacy of three hundred and fifty million Americans. Because of all this, nonpartisan opposition to flock, ALP R's and mass surveillance has reunited America in twenty twenty six, and our leaders are listening. Vermont banned the use of ALP R's effective July first, twenty twenty seven. The governors of Texas and Florida had taken strong executive action to prevent Locally, more than two hundred municipalities have terminated their relationships with FLAC and other ALPR companies. The question is, will their Congress join them? The time has come for Congress to prohibit any law enforcement entity who receives federal funding from using ALPRs without exception. Because when it comes to protecting civil rights and civil liberties, if you make one exception, you invite others and that is a slippery slope we must avoid at all costs. So I implore you senators to be brave and unrelenting in responding to these mass surveillance threats. And please know with absolute confidence that the ACLU and the American people stand behind you. Thank you for the opportunity to testify. I look forward to answering your questions.

Thank you very much, Mister Marlow, and to all of the witnesses, now we'll start some rounds of questioning. And I'll begin, and I I wanna start with you, Mister Whitney, if I could, and help me and everybody watching understand what's the difference between this technology that we're talking about today this AI powered technology and a traditional license plate reader technology and here's why I ask I'm a former prosecutor we've got uh Senator Blumenthal is a former prosecutor uh we uh I think Senator Klobuchar is a former prosecutor yeah that's right I'm sorry I should have started with you Senator Klobuchar my mistake uh this is common and when I was Attorney General of Missouri we use license plate readers all the time sheriff I'm sure you use them Constantly. I mean, the the very familiar technology. However, my understanding is what we're talking about here today, with this linked network of private cameras all uploading to the cloud, searchable and powered by IAI, is something very different. So explain that to us if you could. What's the difference? Why is this a a qualitatively different kind of technology?

Well, thank you for the question, Mr. Chairman. Um, you said it. The fact that this technology is now interlinked with cameras across the country, in this network that allows a government official or an officer in one side of the countryside, California, reconstruct the past movements over weeks or even months of somebody driving in Maryland or Virginia, is something that is both qualitatively and quantitatively different than something that w- you know a technology that we've ever seen before. And that is why we are concerned about this and why it what makes it different from the ALPRs of yesteryear. Law enforcement can do this right now, as I said, with the ease of conduct, you know, typing in a Google search, right? And then they can get this information showing where you've been, what you've done. In our San Jose litigation, for example, we've seen these cameras placed in front of attorneys' offices, medical facilities, churches, mosques, other um places of worship, and to allow government officials all over the country to access that information and potentially track where somebody has been going and what they've been doing. is concerning. And of course, this is all supercharged by AI. A couple of years ago, you couldn't possibly sift through twenty billion images with just a few officers or even a hundred or a thousand officers. But AI now makes it much easier to do that with, again, a click of a button or a couple of keystrokes.