The Shively case is the clearest argument yet that internal controls don’t work.
Between January and May of this year, a police officer in Shively, Kentucky, allegedly ran 2,048 searches in his department’s Flock license plate reader system. According to court records, the searches targeted two vehicles belonging to one woman, the officer’s former partner and the mother of his child. Over those same months, police say, he harassed and threatened her, and she went to an Indiana court for a protective order. The department later determined that 241 of the searches happened while the protective order was in effect.
The officer, Asad Zahir, faces ten misdemeanor counts of official misconduct and unlawful computer access. He has pleaded not guilty and is presumed innocent. But the facts his own department has laid out tell us a great deal about how these systems are policed.
The system worked. That’s the problem.
Defenders of the status quo will point out that the misuse was caught. Flock’s new AI audit tool flagged the searches, the department cut off his access, and he was arrested in less than a day.
Now look at the timeline. The alleged searches began January 1. The flag came in late August, nearly eight months after the first search and more than three months after the last. A court had already decided this woman needed protection from this man. The system he used to find her had no idea.
And the audit that finally caught him wasn’t a safeguard anyone wrote into law. It was a product feature, rolled out by a vendor under public pressure. Here’s the thing: with a warrant requirement, Zahir wouldn’t have been able to run these searches.
The fix that already failed
After the arrest, Shively announced a new safeguard: officers must now list a case number to search Flock.
But according to the University of Louisville’s police chief, describing the case publicly, Zahir had attached a case code to his searches. The justification field was never empty, but rather he listed his searches under “drug/narcotic investigation”. This justification box was filled in by the one person with every motive to lie.
That is the pattern the Institute for Justice has documented across dozens of cases. Most abuses surface through victim complaints or reporters’ questions, not internal review, and officers routinely enter vague or false reasons to avoid detection. A case-number requirement asks the officer to vouch for themself. The honor system is great if you’re leaving money in a rural campsite, not for law enforcement procedures. The officers who abuse these systems are, by definition, the ones whose word we can’t take.
Why this matters in Utah
Salt Lake City is weighing an ordinance built around exactly that fix: a case number for every plate reader search. State law has required an incident number for every search since 2023.
Case numbers, audit logs, and AI flags all happen after the search, inside the department, on the department’s timeline. A warrant happens before the search, in front of a judge who has never met the officer and has no stake in the officer’s personal life. But perhaps most importantly, most judges are not afraid to say “no” if there is not enough to justify a warrant.
Shively didn’t need a better text box. It needed someone outside the building with the power to say no.
