Full Report
A recent story of a writer who was mistakenly identified, tracked, and arrested using data from Flock cameras has gone viral. The New Jersey plates that were allegedly stolen from the LA dealer were 34 03 DTM, not 34 10 DTM. But when the police report was created and the plate was entered into Flock’s system, it was just recorded as 34 DTM. Just the five large characters, no little number in the middle. And Flock’s AI tech wasn’t registering that non-standard little number when it began picking up the Range Rover around town. It just saw ...
Analysis Summary
# Incident Report: Algorithmic Misidentification and Systemic False Positive Arrest
## Executive Summary
A journalist was mistakenly tracked and arrested by Minnesota police due to a "partial match" logic error in Flock Safety’s Automated License Plate Recognition (ALPR) system. The incident stemmed from the LAPD entering an incomplete plate string into a national "hot list," which caused the AI to flag all vehicles with similar manufacturer plate structures. The incident highlights the risks of automated policing and the lack of human-in-the-loop verification before high-stakes enforcement actions.
## Incident Details
- **Discovery Date:** July 2026 (based on article publication)
- **Incident Date:** Circa July 2026
- **Affected Organization:** Jaguar Land Rover (JLR) Media Fleet / Local Law Enforcement
- **Sector:** Public Safety / Automotive
- **Geography:** Minnesota and Los Angeles, USA
## Timeline of Events
### Initial Access (Data Entry)
- **Date/Time:** Undisclosed (Prior to arrest)
- **Vector:** Manual Data Entry Error / System Design Flaw
- **Details:** The LAPD reported New Jersey plate "34 03 DTM" as stolen but entered it into the system as "34 DTM," omitting the smaller middle digits.
### Lateral Movement (Systemic Propagation)
- **Details:** The incomplete "34 DTM" string was synced across the nationwide Flock Safety network, effectively "poisoning" the list for all Jaguar Land Rover (JLR) manufacturer plates sharing that alphanumeric structure (34 ## DTM).
### Data Exfiltration/Impact (Physical Impact)
- **Details:** Flock cameras in Minnesota identified the writer's vehicle ("34 10 DTM") as a match for the stolen "34 DTM" string. Four other vehicles were being actively tracked simultaneously across the state.
### Detection & Response
- **How discovered:** The victim was "nabbed" (stopped and arrested) by police.
- **Response actions taken:** Officer Ganshyn identified the pattern after the arrest; JLR intervened to contact LAPD to correct the database entry.
## Attack Methodology
*Note: This incident describes a systemic failure/misuse rather than a malicious external attack.*
- **Initial Access:** Inaccurate data ingestion into a national law enforcement database.
- **Defense Evasion:** The AI system bypassed human scrutiny by providing "positive" matches based on partial strings, leading officers to trust the machine output over visual verification.
- **Discovery:** Flock cameras used ML to scan for specific character clusters ("34 DTM") while ignoring non-standard formatting (smaller middle numbers).
- **Impact:** Physical detainment of innocent civilians and potential civil rights violations.
## Impact Assessment
- **Financial:** Likely legal costs for the victim; potential liability for the police departments.
- **Data Breach:** Compromise of location privacy for innocent drivers across multiple states.
- **Operational:** Law enforcement resources diverted to tracking non-suspects.
- **Reputational:** Significant negative press for Flock Safety and local police; CEO forced to walk back inflammatory comments regarding privacy advocates.
## Indicators of Compromise
- **Behavioral indicators:** Systemic flagging of JLR manufacturer plates with the "34 [XX] DTM" format.
- **Systemic indicator:** Flock Safety "Hot List" alerts triggered by 5-character matches on 7-character plates.
## Response Actions
- **Containment:** JLR coordinated with LAPD to update the specific stolen vehicle entry.
- **Recovery:** Release of the wrongly arrested individual.
- **System Adjustment:** Flock Safety clarified that the "partial match" feature is working as intended per law enforcement requests, suggesting no technical patch was applied to the matching logic.
## Lessons Learned
- **Machine Learning Myopia:** The system correctly identified the requested characters but lacked the contextual intelligence to recognize that additional characters (the "10" in 34 10 DTM) invalidated the match.
- **Data Integrity:** "Garbage in, garbage out"—a single incomplete entry in a major metropolitan database can have nationwide repercussions in a networked surveillance environment.
- **Confirmation Bias:** Officers relied on the automated alert rather than performing manual verification of the physical plate against the system's hit report.
## Recommendations
- **Human-in-the-Loop:** Mandatory physical verification prescribed by SOP before initiating high-risk stops based on ALPR hits.
- **String Integrity Constraints:** Implement validation rules in ALPR databases requiring full plate strings or specific manufacturer formats to reduce partial-match false positives.
- **Audit Logging:** Regular audits of "Hot List" entries to ensure accuracy and remove broad identifiers that could trigger mass false positives.