For years, enterprise computer vision and public-safety surveillance vendors have relied on a carefully curated defense: our systems are passive tools, not proactive panopticons. Flock Safety, the automated license plate recognition (ALPR) giant installed across more than 6,000 communities, has repeatedly insisted that its technology “cannot recognize, identify, or track individuals.” That narrative just collapsed.
A technical investigation by WIRED reveals that Flock Safety has engineered an AI-powered surveillance suite designed specifically to identify drivers and track vehicle travel patterns without requiring a suspect's plate or description. Operating under the internal moniker Nightshift and rebranded as OS Investigate, the system turns passive ALPR capture into an active behavioral search engine.
Uncovering the Prompts
The full architecture was exposed after WIRED uncovered over 450 system files sitting unprotected on Flock Safety’s own login infrastructure. The codebase exposes 45 distinct back-end tools that feed the AI model a continuous stream of license plate scans, camera metadata, police case records, arrest files, 911 dispatch logs, ballistics data, and commercial databases.
The code describes 45 tools at the AI's disposal, giving it access to plate scans and camera metadata, arrest records, case files, dispatch logs, ballistics results, and commercial databases.
By stitching automated plate hits to external identity vendors, the platform extracts Social Security numbers, dates of birth, phone records, emails, and networks of relatives. Flock Safety attempted to downplay the leak to WIRED, claiming the software is an experimental preview tested with select law enforcement partners that may not reflect a final product. That distinction will offer little comfort to enterprise risk officers or municipal procurement boards.
Mechanics of Pattern Surveillance
OS Investigate equips operators with 69 pre-engineered prompts via a chat interface, alongside custom query generation. Rather than querying a known plate associated with a felony warrant, these canned routines allow operators to search purely by geographic bounding boxes, timestamps, and observed driving routines.
One system prompt instructs the AI to identify potential witnesses by isolating vehicles most frequently observed in a given neighborhood over time. The platform generates matching plate candidates and immediately runs them through secondary commercial identity resolvers to output full legal names and residential addresses. This is not passive ALPR; it is automated deanonymization at scale.
Regulatory Pressure and Operational Realities
The yawning chasm between Flock Safety’s public marketing and its technical back-end lands amid escalating operational pushback: bipartisan legislative scrutiny, documented platform abuse by law enforcement personnel, and direct physical vandalism of roadside cameras. Legal scholars cited by WIRED point out that granting warrantless, AI-driven queries across longitudinal transit records creates immediate constitutional and civil-liberties liabilities, effectively manufacturing criminal suspicion out of ordinary commuting patterns.
For enterprise tech leaders and public-sector vendors, the fallout is clear: undisclosed feature creep and scope-expansion in AI computer vision pipelines destroy municipal trust, invite punitive compliance audits, and threaten millions in B2B/B2G contracts. Enterprise buyers must immediately audit third-party vision integrations to verify that back-end data ingestion strictly mirrors formal contractual representations and statutory retention limits.