A DEF CON 34 talk laid out the numbers on Flock’s camera network and police facial recognition. Here’s what the data shows, and why the purpose it was collected for matters.
I go to DEF CON most years—partly for the talks, partly because spending a few days around people whose full-time job is finding the weak point in a system is a good way to recalibrate how you think about your own data. This year, one talk stuck with me more than the others: a session on facial recognition and the Flock camera network, built around a slide titled “USed against US.”
Here’s what it showed.
The numbers
6,000+ police departments are on the Flock camera network. That’s not a handful of pilot cities—that’s a network with real national reach.
117 million+ driver’s license photos are likely already sitting in a police facial-recognition database. If you have a driver’s license, there’s a real chance your photo is already searchable.
10 to 100 times. That’s how much higher the false-match rate is for darker-skinned individuals compared to lighter-skinned individuals, according to the talk. A false match isn’t an abstract error rate—it’s a specific person getting flagged, stopped, or investigated for something they didn’t do, and it doesn’t fall evenly across the population.
The talk’s notes also mentioned that Flock cameras can track people and zoom in on phones. There was a separate note about “adversarial pattern work”—work on ways to defeat or resist this kind of tracking—but the specifics weren’t clear from what I captured, so I’m flagging that as a possible follow-up rather than claiming anything about how it works.
Why this isn’t abstract to me
I spent years running GDPR compliance enforcement for Windows and Internet Explorer at Microsoft, ahead of the 2018 enforcement deadline. The single hardest part of that work was never the obvious stuff. Everyone understood that a customer’s name and address was personal data. What took real effort was mapping the data that had been collected for one purpose and had quietly started getting used for another—log files, diagnostic telemetry, usage patterns that nobody had originally classified as “personal data” but that, in aggregate, absolutely were.
The driver’s license photo is that same pattern, just in a different context. You gave that photo to your state’s DMV so they could verify your identity and issue you a license to drive. That was the purpose. It was not “so this photo can be run against a facial-recognition search when a police department across the network wants to check it.” Whether that second use is legitimate or not is a real policy question—but it’s a different question from the one you answered when you sat for that DMV photo. That’s the same purpose-drift I spent years chasing down in enterprise systems, just showing up in a much more consequential place.
The other pattern that carries straight over from GDPR work: the asymmetry. Getting into a database is fast, often automatic, and requires no action from you—your license photo lands there because you did something completely ordinary. Getting out, or even finding out you’re in there in the first place, is a different order of difficulty entirely. That asymmetry is exactly what data protection frameworks like GDPR were built to address on the commercial side. It’s worth asking who’s addressing it here.
What you can actually do with this
I’m not going to tell you what to think about facial recognition policy—that’s a bigger conversation than one blog post, and it’s genuinely contested. But if you want to know whether this is happening near you, that part is checkable, not abstract.
deflock.org is a public tracker of Flock camera locations. It was the source cited on the slide, and it’s built for exactly this—so you can look up your own area instead of wondering.
That’s the whole ask this week: go look. Whatever you conclude from what you find is up to you, but “I don’t know if this applies to me” is an easy thing to fix.
Related Posts
- Data Privacy in AI Projects—What You Can and Can’t Share — the purpose-limitation principle behind this post, applied to enterprise AI tools instead of police databases
Data collected for one reason doesn’t stay there on its own. Someone has to decide to keep it in its lane—and someone has to be watching when it doesn’t.