Flock cut default camera-data retention from 30 days to 7 — and its own numbers say the other 23 days were never doing any work

Flock Safety has reduced its default retention period for license-plate-reader data from 30 days to just seven, demanding mandatory misuse detection for all law enforcement customers and necessitating a case code on every search by year-end. This move came after a Washington Post investigation revealed nearly 50 instances of officers charged or accused of unauthorized searches.

The company's own analysis shows that over 90% of searches without a full plate are conducted within a week. While seven days might seem like a long time in the digital age, for Flock's network spanning over 120,000 cameras, it equates to 23 days during which data was retained but rarely queried. This retention period, set nine years ago, was once considered a balance, but when viewed through an engineering lens, it reveals that 23 of the 30 days were essentially unused.

This situation is not solely a privacy issue, but rather a capacity problem that went unexamined. Retention is a critical security control, preventing misuse, breaches, and exfiltration, while access controls are probabilistic, and deletion is deterministic. Therefore, distinguishing between shrinking the blast radius and watching the blast radius becomes crucial.

All other controls, such as detection, response, or hardening, are geared towards addressing misuse after it occurs. However, the retention period itself still remains a setting on someone else's dashboard, emphasizing the need for sustained democratic engagement, judicial checks, and clear retention policies.