The nondescript black cameras are mounted near each entrance of the Las Americas Premium Outlets, capturing the license plate, make and model of every car that enters the mall parking lot.
“As soon as you come in, it's in the system,” said a former worker with Simon Property Group. The company is the largest owner of shopping malls in the country, including Las Americas, the sprawling complex next to the San Ysidro border crossing.
At first, he embraced the automated license plate reader (ALPR) cameras from Flock Safety, an Atlanta-based surveillance technology company. The former employee believed the ALPR system would help address shoplifting and solve serious crimes that occasionally happened around the mall, like robberies and vehicle theft.
And then he realized the power — and scope — of the license plate surveillance system. Flock can help users analyze patterns of movement and potential associations between drivers. And Simon Property Group gave several law enforcement agencies open access to search and receive notifications from its ALPR system.
“If people knew more about it, I would say people will obviously be pissed off,” he said. “Nobody wants big brother watching you on every single little thing.”
The former employee agreed to speak with KPBS on the condition of anonymity, fearing professional consequences for discussing company policies. A spokesperson for Simon Property Group did not respond to multiple requests for comment.
The use of license plate reader technology has long been a flashpoint between law enforcement and privacy advocates.
In recent years, California has established certain guardrails for ALPR networks owned by police departments and other public entities, including restrictions on how the data can be shared. The systems are also subject to public records requests.
But those safeguards don’t apply to the many private businesses — including Home Depot, Lowe's, the Southwestern Yacht Club, Fashion Valley mall and homeowners associations — that give police access to their license plate readers.
These private systems effectively serve as a wide-ranging extension of law enforcement's surveillance apparatus — even though the private businesses are not subject to the same public scrutiny and transparency requirements.
A KPBS review of more than 1,500 pages of police records reveals law enforcement agencies in San Diego County have access to dozens of local private Flock camera networks, which include over 150 previously undisclosed license plate readers.
Have a tip? 📨
The Investigations Team at KPBS holds powerful people and institutions accountable. But we can’t do it alone — we depend on tips from the public to point us in the right direction. There are two ways to contact the I-Team.
For general tips, you can send an email to investigations@kpbs.org.
If you need more security, you can send anonymous tips or share documents via our secure Signal account at 619-594-8177.
To learn more about how we use Signal and other privacy protections, click here.
Police officials say license plate readers help them investigate crimes.
“We've been able to solve multiple murders, several kidnappings, several rape cases,” said Commander Christopher Lawrence with the San Diego County Sheriff’s Office. “But the vast majority have been narcotic cases and stolen vehicle cases.”
Privacy advocates and civil liberties experts, on the other hand, say access to private ALPR networks creates a shadowy expansion of law enforcement’s surveillance capabilities. The lack of oversight — or awareness — of these systems, they argue, could give rise to misuse.
“In the case of a private party, there's very little (transparency),” said Rachel Levinson-Waldman, director of the Liberty and National Security Program at the Brennan Center for Justice, a nonpartisan policy institute. “It really often leaves people in the dark about these incredibly powerful surveillance technologies.”
Flock users can search a license plate number, partial plate information or general description of a vehicle (such as “black pickup truck.”) Users can also conduct a “convoy search” that identifies cars “that often travel alongside the vehicle of interest,” according to a 2023 Flock user guide.
Searches can also identify vehicles that frequent specific locations.
The company says its cameras only capture information about vehicles and do not use facial recognition software.
Despite such assurances, the ALPR networks installed today, privacy experts warn, will likely become much more powerful in the coming years as companies like Flock develop more sophisticated, interconnected products.
Consider that Flock recently announced a new drone that can pair with customers’ existing ALPR systems, read license plates from 2,000 feet away and reach speeds of up to 60 mph.
And then there’s Nova, Flock’s new data-compiling platform. Starting with something as simple as a license plate hit, departments can use Nova to quickly build an individual profile based on information from property records, body-worn camera transcripts, social media accounts, jail phone call recordings and other data sources, according to promotional materials.
El Cajon Police Chief Jeremiah Larson said Flock is giving his department early demo access to Nova as an add-on to the department’s ALPR cameras.
"We look forward to trying it out,” he said.
Flock’s boom and recent scrutiny
Flock is a relatively young company. Founded in 2017, it initially focused on selling license plate readers to homeowner associations. But as more communities adopted the technology, law enforcement wanted their own systems, said Flock spokesperson Holly Beilin.
“We work with roughly 5,000 law enforcement agencies,” Beilin said. “That ranges from very small agencies in rural or suburban areas to state law enforcement agencies.”
Flock also has approximately 1,000 private customers, according to Beilin.
Flock has faced scrutiny in recent months for the way some of its customers used the license plate readers.
A number of law enforcement agencies gave so-called “side-door access” to U.S. Immigration and Customs Enforcement (ICE) by conducting searches for the federal agency. Illinois Secretary of State Alexi Giannoulias claimed Flock broke state law by allowing U.S. Customs and Border Protection (CBP) to search its ALPR data. And the Electronic Frontier Foundation found Flock’s cameras were used to search for a Texas woman who had an abortion.
Flock has acknowledged wrongdoing by some law enforcement and said it revoked access to dozens of agencies that improperly searched its ALPR networks and introduced safeguards, such as the ability to block searches containing certain keywords. The company has pushed back on the Electronic Frontier Foundation’s findings, though the privacy group has stood by its reporting.
In an interview, Beilin said Flock does “not have any contracts with any sub-agencies” under the U.S. Department of Homeland Security (DHS), which would include ICE and CBP. The Associated Press reported in August that the company halted a pilot program with CBP and Homeland Security Investigations.
Beilin said she does not believe federal agencies have access to any private networks, but did not provide confirmation in response to follow up inquiries. The company also did not provide a list of federal agencies that use Flock.
Cities around the country — in Massachusetts, North Carolina, Illinois and beyond — have canceled their Flock contracts in light of the recent concerns. San Diego’s Privacy Advisory Board recently recommended the city only continue its Flock program if certain changes were made to data storage and access.
In a letter last month, Sen. Ron Wyden (D-OR) called on Oregon communities to cut ties with Flock due to the “inevitable abuses” of the company’s ALPRs. In response, Flock said the senator “poses a series of hypotheticals, and posits, without support, that future abuses of our technologies are ‘inevitable.’”
Sprawling private networks
In its user guide, Flock encourages businesses to share access to their license plate cameras with local law enforcement, though it’s not a requirement.
KPBS obtained Flock system records from 10 law enforcement agencies in San Diego County that list all of the license plate readers they can access. The numbers vary widely from department to department.
At the higher end, the El Cajon Police Department owns about 80 ALPR cameras but has access to thousands of networks nationwide, which include more than 50,000 cameras.
In San Diego County, malls, big box stores and other private businesses give law enforcement departments access to their ALPR feeds, the KPBS analysis shows.
These businesses either declined or did not respond to interview requests from KPBS.
Over a dozen homeowner associations and private communities — from Carlsbad to Chula Vista — also share access to their cameras.
Malabar Ranch, a gated community in Fallbrook, allows the San Diego County Sheriff’s Office to search its two Flock cameras and monitor for license plates of interest.
“I can't see a reason any HOA would not share the data feed with the local sheriff if the intent of putting the camera system in is for security,” said Robert Lin. He’s a board member with the Malabar Ranch homeowner association but spoke to KPBS in his capacity as a resident of the community.
Since the gated community’s roads are private, Lin said the public shouldn’t be concerned about law enforcement having access.
Signs posted outside the community’s gates read “24/7 recording” and “Flock Safety.” Lin said Malabar Ranch residents strongly supported installing the Flock cameras, though he acknowledged they may not know about the extent of law enforcement’s access.
“God, we can't even get people to show up to the HOA meetings to talk about our streets that are cracked or the water system that's costing us a fortune,” Lin said.
Law enforcement touts ALPRs
Law enforcement agencies across San Diego County emphasized the effectiveness of ALPRs and the importance of having access to private camera networks.
“The more vast the network, then the more cameras that might capture that plate in a crime,” said Larson, the El Cajon police chief.
Larson said he understood some people’s concerns. But he stressed that his officers use surveillance tools responsibly and abide by state law.
The California Department of Justice filed a lawsuit against the El Cajon Police Department in October for sharing its ALPR data with out-of-state agencies, which the department claims is against the law. KPBS found outside agencies searched El Cajon’s data for immigration purposes over 550 times this year.
San Diego Police Department (SDPD) Captain Charles Lara said private ALPR networks give SDPD an “additional sets of eyes” in the city.
“Having access to those Flock cameras helps us to tie into networks of thieves, networks of criminality,” Lara said.
(SDPD stopped searching all outside ALPR networks this spring. The department is working toward lifting the pause once it provides the city with more detailed disclosures about how it uses outside networks.)
Lawrence, with the Sheriff’s Office, suggested the average consumer probably isn’t thinking about surveillance issues when they go shopping.
“I don't think too many people are concerned, if we're honest,” the commander said. “I think people go about their days just trying to get their own lives handled and they're not always worried about some of the periphery that goes on.”
When asked to elaborate on “periphery,” Lawrence said: “Everything else outside of their control.”
Some shoppers supportive, others weary
KPBS spoke to four patrons at the Fashion Valley mall on a recent afternoon to gauge their response to the shopping center sharing its ALPR network with law enforcement.
None of the shoppers knew about the mall’s Flock system, although all were keenly interested in learning more about it.
Gilberto Kornemann, 55, said he supports the mall’s use of ALPRs and law enforcement’s access to it.
“I appreciate what they are doing. Why? Because of safety,” he said. “This country is founded on rules and regulations.”
Others were on the fence. Alexa Sandoval, 29, used to work at the mall and saw shoplifting firsthand. She believes law enforcement’s access to the Flock cameras could help address retail crime.
But now, as a consumer, that notion gives her pause.
“If we’re not really doing anything wrong here, do they really need to have all of our information?” she said.
Phil Rivas, 46, expressed grave concerns about the ALPR system.
“Here in the United States, we want privacy as much as possible — and transparency,” he said. “It seems like companies or corporations are going out of their way to not give us that privacy.”
Rivas said he supports helping law enforcement solve crimes — but adds private businesses should inform customers about the technology being used and what happens with their data.
KPBS did not observe signs at Fashion Valley describing the mall’s ALPR system or law enforcement’s access to it.
Lara, the SDPD captain, suggested people can shop elsewhere if they’re uncomfortable.
“If I'm being surveilled, I can vote with my feet or my car,” he said. “I can solicit another mall or I can use Amazon. You have any number of choices if you feel put upon.”
Transparency and disclosures
Lara encouraged residents to do their homework to determine where private license plate readers are located. But finding that information is difficult. And requesting the necessary records from police departments can be challenging — especially from SDPD.
The department has an online map showing where city-owned ALPRs are located, but it doesn’t include the private license plate networks that granted access to SDPD.
To find this information, KPBS requested the “device list” stored in the Flock system’s admin profile.
SDPD initially declined to release the document. At first, a records custodian said the document didn’t exist; later, they claimed the document was exempt from disclosure. After weeks of pushback from KPBS, SDPD provided the 82-page device list.
Levinson-Waldman, with the Brennan Center, said this scenario illustrates the concerns around transparency and private ALPR cameras.
“I think that's really the nub of it — the difficulty in finding out how they're being used,” she said.
Without that baseline information, she said important next steps — “actually having some input and being able to build protections around that data” — are virtually impossible.
A state law passed in 2015 requires all ALPR operators in California to post a privacy and usage policy online that details how the license plate data is used and who has access to the system.
KPBS could not locate these policies for many private entities. And those that are available online are light on details.
The policy from Lowe’s states the company “may use” ALPRs, but doesn’t specify which store locations. The company acknowledges that it may share data with law enforcement “upon appropriate request and solely in connection with criminal investigations.” But it does not state that certain law enforcement departments can search its ALPR databases whenever they want. Home Depot’s policy is very similar.
Las Americas and Fashion Valley mall owner Simon Property Group’s policy states the company “may collect your vehicle license plate information” when you visit one of its malls, but does not mention its use of ALPRs or provide details on how the data is used.
Beilin, the Flock spokesperson, said the company “builds the tools and the guardrails to offer transparency and accountability to every customer.” But Flock does not push its private customers to meet certain transparency benchmarks, beyond what’s required by law.
“It is up to the customer to determine, on the private side, how transparent they want to be,” she said.
- 'We need warriors': Immigration lawyers get help from unlikely allies in fight to free clients
- Lawyers using habeas corpus in last-ditch efforts to free immigrants from detention
- Grossmont schools already feeling impacts of library cuts
- Records: El Cajon license plate data used in nationwide immigration searches
