u/thepcninja

Yesterday, the safety committee said it needs questions on security, auditing, and oversight answered before making a recommendation. Most have already been submitted but never answered.

I work in cybersecurity, so a lot of these come from that angle, but this is everyone's data and everyone's town. What else should be on this list?

Edit/Update: I've had a few messages. Anyone who wants the actual FOIA records I've received from the Town and another reddit user, https://drive.proton.me/urls/32XF704W4G#WvPev7LtRzo8

I'll keep adding to this folder as more records come in, so check back as new requests are fulfilled.

---------------------------------------------------------------------------------------------------------------------------

Securing, Auditing & Oversight: The Questions

The threshold point: you cannot secure data you do not control

No answer to any question below changes the central fact: once Apex's license plate data leaves the Town's hands, the Town cannot secure it, audit it, or control it.

Apex's own records show its data is shared with more than 1,100 outside agencies, most of them out of state. Apex cannot audit those agencies' logins, cannot enforce multi-factor authentication on them, cannot review how they use the data, cannot discipline their officers, and in most cases cannot even see that a search happened. One agency with a weak or shared password, one careless or malicious user among a thousand, is a door into the entire network, including Apex's cameras.

Flock does not require multi-factor authentication. Stolen police logins have been sold on criminal forums. Nationally, officers have been caught entering nonsense search 'reasons' and using these systems to stalk people. The 2026 state budget (SB 257) authorized the NC SBI to place readers on state-maintained roads through Apex without the Town's approval, and Apex sits inside the Atlanta-Carolinas HIDTA, a federal program documented funneling local ALPR data to federal agencies, some of it beyond the reach of public-records requests.

So the honest answer to 'can the data be secured?' is no, not once it is collected and shared. The only control the Town actually holds is the decision not to collect it. Everything short of that is a safeguard on Apex's end of a pipe whose other end the Town does not own.

Questions on mobile and off-duty access

• Flock offers an officer app for iOS and Android, and Apex's own audit data shows searches run from mobile devices ('Mobile' search types). Is the Flock app permitted only on Town-managed devices, or can officers install it on personal phones?
• Can the system be accessed off-duty, and is off-duty access restricted or logged differently than on-duty use?
• Does Apex require multi-factor authentication for Flock access, on both desktop and the mobile app? (Flock did not require MFA until it began phasing it in during 2026.)
• If MFA is enabled, what kind? Is it a hardware or RADIUS token / authenticator app restricted to Apex PD-managed devices, or is it SMS or email codes that work on any personal phone? The distinction determines whether the control is real or cosmetic.
• In Amarillo, TX, an officer used off-duty mobile access to run a private citizen 76 times over five months, entering fabricated reasons, before anyone noticed. What in Apex's setup would catch the same abuse?

Questions on auditing

• Has Apex enabled Flock's 'Audit Assistance' feature, which flags high-volume or repeated searches? It is off by default, and only a minority of Flock customers have turned it on.
• Who at the Town reviews Flock search logs, how often, and what specifically triggers a review?
• The Town's own records show no case number on 46-60% of searches. What is being done to reconcile that with the requirement that each search have a legitimate law-enforcement purpose?
• Apex received the Organization Audit, Network Audit, and Event Log in response to records requests, but the operator-entered reason text and FreeForm/natural-language search text came back blank. Can the Town produce the Search Audit export, which contains the actual text officers typed?
• Apex's own data shows FreeForm (natural-language) searches were run. What were they, and does Apex's moderation log show whether any were flagged or blocked?
• How does the Town know Flock will not add new capabilities, including facial recognition, through a software update, without the Town asking for it or even knowing it happened? Flock has repeatedly expanded its systems remotely (audio detection, FreeForm search, drone and airborne-ALPR tools). The hardware stays on the pole; the capability changes in the cloud. What contractual or technical guarantee prevents a silent capability change, and who at the Town would even be notified?

Questions on outside and federal access (the ones that matter most)

• How does Apex audit the more than 1,100 outside agencies that can search its data? If the Town cannot audit them, on what basis can anyone claim the data is 'secured'?
• Has the Town, the County, or any partner agency signed a data-sharing agreement with the Atlanta-Carolinas HIDTA, and is Apex's ALPR data being funneled to federal agencies through it?
• Apex PD's own audit reportedly shows thousands of federal searches reaching Apex cameras in a single quarter. Who were they, and under what authority?
• Under SB 257, the NC SBI can place ALPRs on state-maintained roads through Apex. Will the Town acknowledge that ending its own contract does not stop that, and that only a Town Code prohibition addresses it?

Questions on accountability and consequences

• If a review reveals misuse, what is the process, for disciplining the officer, for notifying the person who was tracked, and for involving anyone outside the department?
• When an audit or review finds a problem, a security flaw, a misuse, a breach, what is the actual written procedure to rectify it, and on what timeline? Does the Town have direct, responsive access to Flock to fix these, or does it wait on the vendor? The Town's own records show the opposite: when IT reported a hacked camera, the investigation stalled for months because Flock never made contact, and IT never verified a fix. What has changed so that would not happen again?
• The contract caps Flock's liability at roughly $35,000 and disclaims data loss and 'acts of hackers.' If a breach or misidentification harms a resident, who pays, and has the Town budgeted for that exposure?
• Apex IT reported, in a Town email, that one of our deployed cameras was 'successfully hacked' over a missing patch, and that the investigation was never verified as resolved. Has that specific incident been confirmed fixed, and can the Town produce a record showing it?

Questions on the crime-reduction claim

At the October 1 committee meeting, the Police Department stated that vehicle theft is down roughly 60% because of Flock. Before that figure is used to justify renewal, it has to be examined, because a percentage with no underlying numbers and no controls is not evidence.

• 60% of what? What are the actual raw numbers? A drop from, for example, 10 vehicle thefts to 4 is technically a 60% reduction but is statistically meaningless at that scale.
• What were Apex's vehicle-theft numbers for each of the three years before Flock was installed, and for the period since? Without the multi-year baseline, there is no way to tell a real trend from normal year-to-year variation.
• How is this 60% directly attributed to Flock rather than to other factors, broader regional crime trends, other policing changes, staffing, or simple statistical noise? Correlation is not causation, and vehicle-theft rates rose and fell for decades before ALPRs existed.
• Were these numbers produced by an independent analysis, or by the department and the vendor that benefit from the renewal? What is the methodology, and will the Town release the raw data so residents can check it?
• Even if the reduction is real and fully attributable to Flock: does catching a marginal number of additional vehicle thefts justify tracking and storing the movements of every resident and sharing them with 1,100+ agencies? That is the actual trade being proposed.
• What is the actual return on investment? What does Flock cost the Town per year, and how many crimes has it been documented to solve or prevent, cases that would not have been solved by ordinary police work? A cost-per-outcome number, not a percentage, is what a purchasing decision requires.
• The department says this technology makes officers' jobs easier and more efficient. If that is true, is the Town planning to reduce the size of the police force or its budget accordingly? If not, what is the efficiency actually buying taxpayers beyond expanded surveillance?

Questions on community trust

At the October 1 committee meeting, it was acknowledged that residents' trust in the police is likely to decline because of this program. That is a remarkable thing to concede and then propose continuing anyway.

• If the Town already knows this surveillance erodes residents' trust in their own police, how is the department prepared to operate once that trust is gone? Policing depends on community cooperation. What is the plan for when residents stop cooperating because they feel watched and treated as the enemy rather than citizens?
• What is worth more to public safety: a marginal, unverified reduction in vehicle theft, or the trust between residents and the officers who protect them? The Town cannot claim this makes the community safer while admitting it makes the community trust its police less.

The standard the Council should apply

'I need answers on how the data can be secured before I make a recommendation' is the right instinct. But the answers are already in writing, and they point one direction: the data cannot be secured once it is shared with over a thousand out-of-state agencies, placed on state roads by the SBI, and funneled into federal programs the Town cannot see. 'Middle ground' and 'more safeguards' govern only Apex's end of a system whose risks live everywhere else. The only measure that actually secures Apex residents' data is not collecting it. That is the case for ending the program and prohibiting ALPRs in the Town Code.

Public records obtained by 404 Media show Flock created a fake police department, "Flock City PD," and used it to search real, live cameras watching real people, all to demo its system to potential  buyers.  Live cameras, real cities, real people, queried to make a sale. Flock's defense is that the searches were meant to show its filters block sensitive queries. But that misses the point entirely. To run that demo, they built a system that can search for people by their religion, their politics, and their presence at a protest, and they pointed it at actual citizens to close a deal. A system that can search for a Star of David or a protest sign is capturing and storing a lot more than a license plate.

Here’s what they chose to search for:

• "Star of David"
• "religious cars"
• "coexist bumper sticker"
• "don't tread on me flag"
• "white truck with a Trump sticker"
• "vehicle with a political sticker"
• "person wearing a mask"
• "people holding signs"
• "crowd"
• "man holding rifle"
• "car that a pretty girl would drive"
• "person in scrubs"

 

September 22nd at 6pm. Show up if you can and tell them: no Flock, no Axon, no ALPRs. Let’s get our rights and privacy back. 

Apex Town Hall

73 Hunter Street

Flock City PD:' The Fake Flock-Owned 'Police Department' That Searched Real Cameras for Real People (Sept 2026). https://www.404media.co/flock-city-pd-the-fake-flock-owned-police-department-that-searched-real-cameras-for-real-people/

If Apex drops Flock, the vendor waiting to replace it is Axon, a company Apex already buys Tasers and body cameras from. Swapping one for the other isn't a fix. NO ALPRs is the fix.

Item CN4 would extend the Town's existing Axon agreement to June 30, 2030, adding Axon Air drone software and an interview-room camera system (drone software for a capability APD already has). It was on the August 11 consent agenda, which normally passes with no discussion, until council member Sue Mu pulled it and sent it to the Public Safety Committee for review. Apex already buys body cameras, vehicle cameras, and Tasers from Axon. This four-year extension is about locking in that vendor.

Who is Axon?

• Their own ethics board quit over drones. Axon built an AI ethics board of 12 outside AI experts. In June 2022, 9 of them resigned at once after Axon announced Taser-armed drones for schools, a plan the board had already voted 8-4 against piloting. CN4 is drone software. The people Axon hired to advise it on drone ethics walked out over Axon drones. (1)
• Axon's AI writes police reports, then deletes the evidence of what it wrote. Axon's "Draft One" generates police reports from body-cam audio. The EFF found that when an officer exports the report, the original AI draft is deleted, leaving no record of which words were the officer's and which were the machine's. EFF called it "designed to defy transparency." An Axon product manager admitted the non-retention was intentional, to avoid "disclosure headaches." The King County, WA prosecutor's office now refuses to accept any report written with AI. CN4 includes an interview-room system on the same evidence platform. (2)
• It reaches into your home. After the Super Bowl backlash, Ring dropped its Flock partnership but kept the one with Axon. Shared Ring doorbell footage flows straight into Axon's evidence system. Most people filming their own porch have no idea. (3)
• It's the whole surveillance stack, and that's a real danger. Axon's platform pulls ALPRs, body cams, drone cams, fixed cameras, interview rooms, private Ring doorbells, and AI analytics into one screen. One company, one database, watching from everywhere. So one breach, one abused login, one bad actor, and it's everything, on everyone, exposed in one place. Every foreign adversary is hoping we're this careless. And the ACLU put out a paper warning cities that Axon is not a safe alternative to Flock. (4)
• Surveillance state. When plate reads, body-cam video, drone feeds, and doorbell footage all flow into one AI system, you've crossed into a full surveillance state, not the foundation of one. And Axon already builds facial recognition into its platform. Once the cameras are up, turning it on is a software update, not a new debate. The Supreme Court ruled in Carpenter that tracking a person's movements over time requires a warrant. This system does it to everyone, with none. (5,8)
• One vendor, from the 911 call to the courtroom. Axon already sells Apex its body cameras, Tasers, and evidence storage. In February 2026 it bought Carbyne, the 911 call-handling platform, for $625 million. Axon's own words are "from call to courtroom." The FTC challenged Axon's last big acquisition (VieVu, 2018) as anticompetitive in a 5-0 vote, warning it would let Axon raise prices; the case was dropped in 2023 on procedural grounds, never decided on the merits. A four-year lock-in means no competitor to check the price at renewal. (6)
• It's pushed because it's profitable. Axon's federal lobbying hit $2.47 million in 2025, more than five times the $480,000 it spent in 2020. Swapping vendors doesn't reduce surveillance. It just changes whose logo is on the camera and who profits from watching us. (7)
• They fight wrongful-death cases as a matter of policy. Axon makes the Taser, a weapon Reuters tied to more than 1,000 U.S. deaths following police shocks, nine in ten of them unarmed. And in Axon's own SEC filings, the company states its policy is not to settle wrongful-death or injury cases, settling only when it's "strategically beneficial to us." They fight the families in court. (9)

The bottom line: Extending with Axon, or swapping Flock for it, isn't less surveillance. It's more, it's consolidated, and it's with a company that's becoming the for-profit operating system of American surveillance, one whose own ethics advisors quit over drones, whose AI hides its own tracks, and who now wants to own everything from the 911 call to the courtroom exhibit. "It's not the brand, it's the surveillance" isn't a slogan. It's the whole point.

*edit incorrect date* CN4 goes before the Public Safety Committee on October 1st at 3:00 p.m. It's a two-person committee that will recommend whether Apex keeps Flock, switches vendors, or extends with Axon. What's missing from that list is dropping ALPRs entirely. That's the real option, and it's the one to demand.

September 22nd at 6:00 p.m. Show up if you can and tell them: no Flock, no Axon, no ALPRs. Let’s get our rights and privacy back.  

 

Sources:

1. Statement of Resigning Axon AI Ethics Board Members (June 6, 2022), NYU Policing Project; corroborated by AP, NPR, Reuters, TechCrunch. https://www.policingproject.org/statement-of-resigning-axon-ai-ethics-board-members
2. EFF, "Axon's Draft One Is Designed to Defy Transparency" (July 2025); King County (WA) Prosecuting Attorney guidance. https://www.eff.org/deeplinks/2025/07/axons-draft-one-designed-defy-transparency
3. Axon, "Building safer communities together: Axon and Ring launch Community Request partnership" (Oct. 2025). https://www.axon.com/blog/building-safer-communities-together-axon-and-ring
4. ACLU, "Beware of Other License Plate Surveillance Companies Besides Flock." https://www.aclu.org/news/privacy-technology/other-alpr-vendors
5. Carpenter v. United States, 585 U.S. ___ (2018). https://www.supremecourt.gov/opinions/17pdf/16-402_h315.pdf
6. Axon-Carbyne acquisition ($625M, closed Q1 2026), Axon press release, Nov. 4, 2025. https://www.axon.com/newsroom/press-releases/axon-to-acquire-carbyne ; FTC v. Axon/VieVu, docket D9389 (2020, 5-0 vote; dismissed Oct. 2023 on procedural grounds). https://www.ftc.gov/legal-library/browse/cases-proceedings/1810162-axon-enterprise-safariland-matter
7. OpenSecrets, Axon Enterprise federal lobbying ($2.47M in 2025, up from $480K in 2020). https://www.opensecrets.org/orgs/axon-enterprise/summary?id=D000057418
8. Axon facial recognition: testing of face-recognition body cameras and Fusus face-matching integrations (EFF, Dec. 2025). https://www.eff.org/deeplinks/2025/12/axon-tests-face-recognition-body-worn-cameras
9. Reuters "Shock Tactics" investigation (1,000+ U.S. deaths following police Taser use; Axon disputes causation), via PBS NewsHour: https://www.pbs.org/newshour/show/police-killed-1000-people-tasers-since-2000 ; and Axon Enterprise Form 10-Q (SEC), stating company policy is "not to settle suspect injury or death cases" except "where the settlement is strategically beneficial to us": https://www.sec.gov/Archives/edgar/data/1069183/000106918325000077/axon-20250331.htm

 

I'm an Apex resident and a cybersecurity engineer. I'm wondering about a specific, under-examined risk in the Town's Flock ALPR system: mobile access.

The Town's own audit records, which I obtained through a public-records request, show that searches of Apex's Flock network are being run from mobile devices. The exports label them "Mobile" search types. Flock offers an officer app for iOS and Android that allows plate lookups and searches of the network from a phone, in the field or off-duty.

This matters because of what just happened in Amarillo, Texas (article below). A police officer there used the Flock system to track a private citizen 76 times over five months. Entering fabricated reasons like "motor vehicle theft" and "wanted person" for searches that had no case behind them. He was able to do it from his phone, off-duty, and it went unnoticed for five months. It surfaced only because the victim filed a complaint, not because any automated audit caught it. He now faces 78 criminal charges. The victim said he had to change where his children sleep.

I emailed the Council to confirm, on the record, whether Apex has the safeguards in place that Amarillo did not.

• Is Flock's mobile app permitted only on Town-managed devices, or can officers install it on personal phones? How is this enforced, monitored, and audited?
• Can the system be accessed off-duty, and is off-duty access restricted or logged differently? How is this monitored and audited?
• Does Apex require multi-factor authentication for Flock access, on both desktop and the mobile app?
• Has Apex enabled Flock's "Audit Assistance" feature, which flags high-volume or repeated searches? (It is off by default.)
• Who at the Town reviews Flock search logs, how often, and what triggers a review?
• When a review finds abuse, what happens next, and is anyone outside the police department involved? Is the victim notified?
• The Town's records show a majority of searches carry no case number. What is being done to reconcile that with the requirement that each search have a legitimate law-enforcement purpose? And how do you confirm that the documented reason is actually legitimate? What are the repercussions of finding falsified search reasons?

The Amarillo case shows that "officers must enter a reason" is not a safeguard. The officer entered reasons, and they were lies. The only thing that catches this is active, independent auditing. I'd like to know what Apex has in place, if anything.

I haven’t heard anything back but if anyone else has the answers, I’d appreciate it.

https://www.newschannel10.com/2026/09/08/i-had-change-where-my-kids-sleep-man-shares-terrifying-experience-says-amarillo-officer-tracked-him-78-times/

**edit. If anyone wants my FOIA dump, I can setup a proton drive link. Just PM me.

It includes: the audit data (the full search logs, covering June 1 to August 18, 2026), plus the contract and procurement records, the data-sharing records (Flock's March and April 2026 sharing snapshots), and the department's own internal briefing deck.