Eugene auditor finds widespread Flock searches, urges oversight and technical auditability

The Eugene independent police auditor presented a detailed review of public complaints about the city's Flock automatic license-plate reader (ALPR) program, reporting large query volumes and recommending stronger civilian oversight and technical audit features.

In a prepared presentation to the Civilian Review Board, interim auditor Lindsay Folultz said the auditor's office consolidated complaints into nine case clusters and found five recurring themes: program implementation without public notice, data-sharing and search access questions, privacy concerns, funding-allocation worries and searches after cameras were deactivated. "Between activation and the end of May there were 369,662 searches conducted of Eugene data," Folultz said, citing the agency search logs the office reviewed.

Why it matters: Board members and community members raised concerns that distant federal and out-of-state local agencies could query Eugene camera data through the vendor's nationwide lookup feature. Folultz told the board the logs show who searched and the stated reason but do not record what results, if any, were returned to those agencies. "What is not logged," she said, "is what was returned to those agencies," a limitation she said complicates detecting misuse.

Key findings and evidence: The auditor showed a timeline in which the contract was signed in March, cameras were installed and began collecting data in early May, and nationwide lookup was disabled July 2. Folultz reported searches by multiple federal bodies in the early phase (Homeland Security Investigations, U.S. Border Patrol, Postal Inspection Service and ATF were cited in the logs) and thousands of searches by local agencies across the country while nationwide lookup was enabled.

Folultz also acknowledged internal handling problems. She said her office initially classified many contacts as "policy complaints" because no explicit policy violation was obvious on intake; later review showed that the department did have an "emerging technologies" policy (Policy 1206) that, if applied earlier, might have prompted a different intake path. "In retrospect," she said, "community concerns related to the rollout of the program may have been proactively addressed by following the policy."

Board reaction and next steps: Board members pressed the auditor on intake classification and whether policy review cycles are regular. Several members urged clearer, proactive community engagement for any future pilot and recommended requiring audit-friendly logging (for example, searchable cross-references to police report numbers) and more restrictive, locally defined search reasons.

Recommendations: The auditor recommended that the office be consulted prior to any future ALPR program implementation so civilian oversight can be designed into the system; that search logs be enhanced to make misuse auditable; and that searchable access and allowable search reasons be limited by local policy where appropriate.

The board discussed policy revisions, intake monitoring and training; no formal vote on additional policy was taken during the meeting. The auditor said the contractor's contract was later canceled and cameras were removed, but the office noted several episodes in which cameras were reactivated and required deactivation requests.

The board will consider policy and oversight lessons for future technologies and flagged the need for clearer procedures to surface relevant policies at intake and to make logs more useful to auditors and the public.