Most license plate reader abuse isn’t caught by audits, but rather by the people under surveillance.
In the spring of 2025, Milwaukee police officer Josue Ayala ran 179 searches in his department’s Flock license plate reader system: 55 on the plate of a woman he was dating and 124 on her ex. Department policy required officers to document a reason for every search in an empty text box, and Ayala simply entered “investigation.”
The Milwaukee Police Department didn’t catch it. One of the people he was tracking did, by typing her own plate into a website called HaveIBeenFlocked.com and seeing the search history. Then she complained.
A website did what the audit didn’t
HaveIBeenFlocked is an independent project backed by a nonprofit that supports watchdog journalism. It compiles Flock audit logs, the records of who searched which plate and why, that journalists and citizens pry loose through public records requests. It now covers roughly 242 million searches involving 4.6 million plates.
It is also, by its own admission, incomplete. Most agencies don’t publish their logs, many redact them, and records requests can take months or years. Each state governs their own auditing, publishing, and public records laws on a state by state basis, allowing for potentially drastic differences in how state agencies publish and report data. Since December 2025, Flock no longer requires agencies to enter a specific reason for each search. The best accountability tool in the country is a volunteer project assembling scraps — this needs to change.
What Milwaukee did next
Once the case surfaced, MPD revoked Flock access for all of its roughly 600 users and made officers get a captain’s approval to regain it, then narrowed access mainly to its Criminal Investigations Bureau. Milwaukee’s Fire and Police Commission announced random audits of Flock searches. Then a detective connected to the department’s internal review of Flock misuse was himself accused of misusing the system.
Ayala resigned under a plea deal, pleaded guilty to a misdemeanor, and was sentenced to a year of probation and a $500 fine.
Milwaukee isn’t the exception
The Institute for Justice has now cataloged more than 200 cases of plate reader abuse nationwide, more than 60 involving stalking. Its review keeps finding the same thing: only a handful of cases were uncovered by internal investigation. Most came to light because a victim complained or a reporter asked. Many of these departments had search-reason requirements. Officers beat them by typing “investigation,” or nonsense, into the field.
In Utah, there haven’t been many reports of misuse and abuse yet, but unfortunately it’s only a matter of time. The same “best practices” used by Utah law enforcement are remarkably similar to the same “guardrails” and circumstances under which law enforcement elsewhere operates, resulting in police misuse and abuse. By not providing a front-end guardrail–a warrant–the Utah legislature can protect Utahan’s data initially, rather than just allowing for misuse and an “oopsie” afterward….if the misuse is identified.
The people most likely to discover the abuse are the people with the least access to the data. A victim finds out only if the logs are public, only if someone requested them, only if the agency didn’t redact them, and only if she thinks to look.
Utah’s Takeaways
Utah’s answer can’t be another “justification box” or faith in a vendor’s audit tool that has never been independently evaluated. It should be:
- A warrant before any officer searches stored plate data, so the check happens before the search, not after a victim stumbles onto it.
- Search logs published on a regular schedule in one public registry, with penalties for agencies that don’t comply.
- Independent audits, not departments grading their own work.
A system that relies on its victims to police it isn’t being policed.
