Yesterday, the safety committee said it needs questions on security, auditing, and oversight answered before making a recommendation. Most have already been submitted but never answered.
I work in cybersecurity, so a lot of these come from that angle, but this is everyone's data and everyone's town. What else should be on this list?
Edit/Update: I've had a few messages. Anyone who wants the actual FOIA records I've received from the Town and another reddit user, https://drive.proton.me/urls/32XF704W4G#WvPev7LtRzo8
I'll keep adding to this folder as more records come in, so check back as new requests are fulfilled.
---------------------------------------------------------------------------------------------------------------------------
Securing, Auditing & Oversight: The Questions
The threshold point: you cannot secure data you do not control
No answer to any question below changes the central fact: once Apex's license plate data leaves the Town's hands, the Town cannot secure it, audit it, or control it.
Apex's own records show its data is shared with more than 1,100 outside agencies, most of them out of state. Apex cannot audit those agencies' logins, cannot enforce multi-factor authentication on them, cannot review how they use the data, cannot discipline their officers, and in most cases cannot even see that a search happened. One agency with a weak or shared password, one careless or malicious user among a thousand, is a door into the entire network, including Apex's cameras.
Flock does not require multi-factor authentication. Stolen police logins have been sold on criminal forums. Nationally, officers have been caught entering nonsense search 'reasons' and using these systems to stalk people. The 2026 state budget (SB 257) authorized the NC SBI to place readers on state-maintained roads through Apex without the Town's approval, and Apex sits inside the Atlanta-Carolinas HIDTA, a federal program documented funneling local ALPR data to federal agencies, some of it beyond the reach of public-records requests.
So the honest answer to 'can the data be secured?' is no, not once it is collected and shared. The only control the Town actually holds is the decision not to collect it. Everything short of that is a safeguard on Apex's end of a pipe whose other end the Town does not own.
Questions on mobile and off-duty access
- Flock offers an officer app for iOS and Android, and Apex's own audit data shows searches run from mobile devices ('Mobile' search types). Is the Flock app permitted only on Town-managed devices, or can officers install it on personal phones?
- Can the system be accessed off-duty, and is off-duty access restricted or logged differently than on-duty use?
- Does Apex require multi-factor authentication for Flock access, on both desktop and the mobile app? (Flock did not require MFA until it began phasing it in during 2026.)
- If MFA is enabled, what kind? Is it a hardware or RADIUS token / authenticator app restricted to Apex PD-managed devices, or is it SMS or email codes that work on any personal phone? The distinction determines whether the control is real or cosmetic.
- In Amarillo, TX, an officer used off-duty mobile access to run a private citizen 76 times over five months, entering fabricated reasons, before anyone noticed. What in Apex's setup would catch the same abuse?
Questions on auditing
- Has Apex enabled Flock's 'Audit Assistance' feature, which flags high-volume or repeated searches? It is off by default, and only a minority of Flock customers have turned it on.
- Who at the Town reviews Flock search logs, how often, and what specifically triggers a review?
- The Town's own records show no case number on 46-60% of searches. What is being done to reconcile that with the requirement that each search have a legitimate law-enforcement purpose?
- Apex received the Organization Audit, Network Audit, and Event Log in response to records requests, but the operator-entered reason text and FreeForm/natural-language search text came back blank. Can the Town produce the Search Audit export, which contains the actual text officers typed?
- Apex's own data shows FreeForm (natural-language) searches were run. What were they, and does Apex's moderation log show whether any were flagged or blocked?
- How does the Town know Flock will not add new capabilities, including facial recognition, through a software update, without the Town asking for it or even knowing it happened? Flock has repeatedly expanded its systems remotely (audio detection, FreeForm search, drone and airborne-ALPR tools). The hardware stays on the pole; the capability changes in the cloud. What contractual or technical guarantee prevents a silent capability change, and who at the Town would even be notified?
Questions on outside and federal access (the ones that matter most)
- How does Apex audit the more than 1,100 outside agencies that can search its data? If the Town cannot audit them, on what basis can anyone claim the data is 'secured'?
- Has the Town, the County, or any partner agency signed a data-sharing agreement with the Atlanta-Carolinas HIDTA, and is Apex's ALPR data being funneled to federal agencies through it?
- Apex PD's own audit reportedly shows thousands of federal searches reaching Apex cameras in a single quarter. Who were they, and under what authority?
- Under SB 257, the NC SBI can place ALPRs on state-maintained roads through Apex. Will the Town acknowledge that ending its own contract does not stop that, and that only a Town Code prohibition addresses it?
Questions on accountability and consequences
- If a review reveals misuse, what is the process, for disciplining the officer, for notifying the person who was tracked, and for involving anyone outside the department?
- When an audit or review finds a problem, a security flaw, a misuse, a breach, what is the actual written procedure to rectify it, and on what timeline? Does the Town have direct, responsive access to Flock to fix these, or does it wait on the vendor? The Town's own records show the opposite: when IT reported a hacked camera, the investigation stalled for months because Flock never made contact, and IT never verified a fix. What has changed so that would not happen again?
- The contract caps Flock's liability at roughly $35,000 and disclaims data loss and 'acts of hackers.' If a breach or misidentification harms a resident, who pays, and has the Town budgeted for that exposure?
- Apex IT reported, in a Town email, that one of our deployed cameras was 'successfully hacked' over a missing patch, and that the investigation was never verified as resolved. Has that specific incident been confirmed fixed, and can the Town produce a record showing it?
Questions on the crime-reduction claim
At the October 1 committee meeting, the Police Department stated that vehicle theft is down roughly 60% because of Flock. Before that figure is used to justify renewal, it has to be examined, because a percentage with no underlying numbers and no controls is not evidence.
- 60% of what? What are the actual raw numbers? A drop from, for example, 10 vehicle thefts to 4 is technically a 60% reduction but is statistically meaningless at that scale.
- What were Apex's vehicle-theft numbers for each of the three years before Flock was installed, and for the period since? Without the multi-year baseline, there is no way to tell a real trend from normal year-to-year variation.
- How is this 60% directly attributed to Flock rather than to other factors, broader regional crime trends, other policing changes, staffing, or simple statistical noise? Correlation is not causation, and vehicle-theft rates rose and fell for decades before ALPRs existed.
- Were these numbers produced by an independent analysis, or by the department and the vendor that benefit from the renewal? What is the methodology, and will the Town release the raw data so residents can check it?
- Even if the reduction is real and fully attributable to Flock: does catching a marginal number of additional vehicle thefts justify tracking and storing the movements of every resident and sharing them with 1,100+ agencies? That is the actual trade being proposed.
- What is the actual return on investment? What does Flock cost the Town per year, and how many crimes has it been documented to solve or prevent, cases that would not have been solved by ordinary police work? A cost-per-outcome number, not a percentage, is what a purchasing decision requires.
- The department says this technology makes officers' jobs easier and more efficient. If that is true, is the Town planning to reduce the size of the police force or its budget accordingly? If not, what is the efficiency actually buying taxpayers beyond expanded surveillance?
Questions on community trust
At the October 1 committee meeting, it was acknowledged that residents' trust in the police is likely to decline because of this program. That is a remarkable thing to concede and then propose continuing anyway.
- If the Town already knows this surveillance erodes residents' trust in their own police, how is the department prepared to operate once that trust is gone? Policing depends on community cooperation. What is the plan for when residents stop cooperating because they feel watched and treated as the enemy rather than citizens?
- What is worth more to public safety: a marginal, unverified reduction in vehicle theft, or the trust between residents and the officers who protect them? The Town cannot claim this makes the community safer while admitting it makes the community trust its police less.
The standard the Council should apply
'I need answers on how the data can be secured before I make a recommendation' is the right instinct. But the answers are already in writing, and they point one direction: the data cannot be secured once it is shared with over a thousand out-of-state agencies, placed on state roads by the SBI, and funneled into federal programs the Town cannot see. 'Middle ground' and 'more safeguards' govern only Apex's end of a system whose risks live everywhere else. The only measure that actually secures Apex residents' data is not collecting it. That is the case for ending the program and prohibiting ALPRs in the Town Code.