Key Takeaways

  • Shift from Reactive to Proactive Audits: Flock Safety moved beyond standard audit logs to a system that actively identifies suspicious patterns in user behavior, like repeated searches on the same license plate.
  • Pattern Recognition for Abuse Detection: Their 'Audit Assistance' tool leverages a dataset of "normal usage" from solving “a million crimes last year” to spot deviations that indicate potential misuse or "stalking."
  • Mandatory Accountability Features: Flock Safety now requires all customers to enable this proactive audit tool, taking direct responsibility for detecting and stopping police misuse of their data.
  • Significant Impact: The tool has already led to the detection and firing of "a ton" of "bad cops," highlighting the effectiveness of integrating ethical guardrails directly into product design.

The Method

Garret Langley, CEO of Flock Safety, revealed a critical evolution in how they tackle misuse of their sensitive license plate reader data. Initially, the company relied on basic audit logs, a standard practice for tracking who accessed what. But as Jason Calacanis probed the risk of "dirty cops" abusing the system for illicit purposes—"to give the mob or somebody like a bunch of license plate data from flock, what's to stop the dirty cop?"—Langley acknowledged a deeper responsibility.

Four months prior to this podcast, Flock Safety rolled out what they call "Audit Assistance." The 'Audit Assistance' tool functions as a proactive detection engine. It moves far beyond simply logging actions. Langley explained, "We solved a million crimes last year. So we have a pretty good pretty good sense for what normal usage looks like." This vast dataset of legitimate interactions formed the baseline. Against this, they programmed the system to flag "what abuse looks like."

At the core of the method is pattern recognition. “If you're stalking me,” Langley said, “you don't want anyone else to know what's happening. And so that's maybe that's the easiest one we can flag.” The tool looks for anomalous behavior: an officer repeatedly searching the same license plate, often outside their jurisdiction or normal work patterns, suggests a personal motive rather than an investigative one. This behavioral fingerprinting allows Flock to identify potential misuse, even when individual searches might appear legitimate in isolation.

The results have been stark. Langley admitted, “We've caught a lot of bad cops and and a ton. Yeah. And it's it's a ton. It's it's more than I ever would hoped.” The company now views this tool not as an optional add-on, but as a core requirement. “We now are requiring that as a mandatory. It's not even a default. It's a mandatory feature. You have to have turned on,” Langley stated. This move signals a strong stance: Flock Safety is taking direct responsibility for the ethical conduct of its users, building accountability directly into the product itself. They believe, “We have to find these bad cops and get rid of them. They shouldn't have a badge.”

Where This Breaks Down

Flock Safety's proactive auditing method is powerful when user behavior generates clear, quantifiable patterns over time. It relies on a large enough dataset of "normal usage" to effectively distinguish it from "abnormal" or malicious activity. This approach could struggle in nascent products or systems with sparse user data, where establishing a reliable baseline for "normal" is difficult. Early-stage startups might not have the volume of interactions to train such a sophisticated pattern recognition system, making it prone to false positives or blind to subtle abuses.

Furthermore, this method is most effective against recurring, identifiable patterns of misuse, such as repeated stalking. It might be less effective against one-off, highly targeted data exfiltrations or abuses that mimic legitimate activity too closely and don't involve a repetitive "stalking" pattern. If a "dirty cop" sells a single, specific license plate lookup to the mob and never repeats that pattern, the system might not flag it as easily as a persistent stalker. The overhead of building and maintaining such an advanced auditing system also requires significant engineering resources, which might be a barrier for smaller teams.

What to Do With This

Audit your internal tools or product features that handle sensitive data. Don't just log actions; analyze user behavior patterns. Pick one critical data point and brainstorm 3-5 ways an employee or customer could misuse it, then design a simple pattern-detection rule (e.g., "if X user accesses Y data more than N times in T period without a clear work justification, flag it"). Implement this basic behavioral audit system in your own product this week to proactively catch internal or external misuse before it escalates.