Deputies in Cherokee County, Georgia, Allegedly Misused Automated License Plate Reader Data for Non-Law-Enforcement Purposes

An internal audit by the Cherokee County Sheriff's Office in Georgia reportedly found that deputies Cynthia Jodesty, Chris Bryant, and Mike Creeden used the agency's automated license plate reader database for non-law-enforcement purposes in violation of policy and state law.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information

The deputies unlawfully accessed the ALPR database to track vehicle locations and obtain sensitive personal data of individuals without authorization or legal cause.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was caused by the intentional decisions of human deputies to misuse an authorized database for personal, non-law enforcement reasons.

EU AI Act risk tier

• Risk tier: 2 High Risk

High Risk: The system is used in law enforcement applications, specifically for tracking and surveillance ('automated license plate reader (ALPR) system that can help track vehicles by scanning and logging license plates'), which has significant implications for fundamental rights and privacy.

AI system and alleged parties

• AI system: Flock Safety ALPR
• AI purpose: License Plate Recognition; Smart Surveillance
• Behaviour type: Tool
• Alleged developer: Surveillance technology developers, Flock Safety
• Alleged deployer: Mike Creeden, Law enforcement, Cynthia Jodesty, Chris Bryant, Cherokee County Sheriff’s Office (Georgia)
• Alleged harmed parties: Unnamed employee of the Cherokee County Sheriff's Office in Georgia, Privacy, Law enforcement, Individuals whose license plate data were accessed for non-law-enforcement purposes, Cherokee County Sheriff’s Office (Georgia)

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Privacy

Reported: The report explicitly describes privacy violations where deputies unlawfully accessed restricted license plate data.

Directly caused: Deputy Jodesty unlawfully accessed the database multiple times over a month to locate the vehicle of another sheriff's office employee without a legal or investigative purpose.

Inferred additional harm: It is likely that the other two arrested deputies also violated the privacy of multiple unnamed individuals by running their license plates for personal reasons.

People affected

• Occurrences reported: 3
• People reportedly harmed: 1
• People reportedly exposed: 1

Potential causes

Management

• Inadequate Access Safeguards: Management failed to implement proactive barriers against internal data misuse.

Technology

• Permissive Access Controls: The ALPR system allowed broad query access to all authorized users.
• Lack of Real-time Query Blocking: The system allowed unauthorized searches to proceed without real-time blocks.

Data Inputs

• Unrestricted Query Inputs: System accepted license plate inputs without requiring active case verification.
• Unlawful Retention of Plate Data: Retention of scanned plate data enabled unauthorized historical tracking.

Human Factors

• Intentional Misuse by Deputies: Deputies knowingly searched plate data for personal, non-work purposes.
• Violation of Oath of Office: Employees ignored their professional ethics and legal obligations.

Process and Methods

• Retrospective Auditing: Audits detected misuse after it occurred rather than preventing it.
• No Pre-Query Justification: The search process did not require inputting a valid case file number.

Regulatory Environment

• State Law Violations: Inadequate compliance mechanisms led to violations of Georgia privacy laws.

Information quality

• Classification confidence: High
• Reason for confidence: The reports clearly outline the facts of the incident, including the names of the deputies, the nature of the database misused (ALPR), the developer (Flock Safety), the discovery mechanism (internal audit), and the consequences (arrests and terminations). There is little ambiguity regarding what occurred.
• Ambiguities identified: The specific personal motivations of the deputies and the exact identities/number of all individuals whose plates were run remain unconfirmed.

Three local sheriff's deputies in Georgia were arrested and terminated for unlawfully using a Flock Safety license plate reader database to track individuals for personal reasons. While representing a breach of public trust and local police policy, the incident has negligible national security implications and was resolved through standard internal accountability procedures.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: United States
• Alleged perpetrator: Cherokee County sheriff's deputies

Threat characteristics

• Imminence: Long-term. The active incident has been resolved with the arrests and terminations, leaving only long-term policy and oversight considerations.
• Autonomy: Human-controlled. The ALPR system acts as a tool queried manually by human operators who made the decisions to unlawfully search the database.
• Novelty: Established threat. Misuse of law enforcement databases and tracking tools by personnel is an established and recurring insider threat.

Impact by dimension

• Physical security: Negligible. No physical threat or critical infrastructure manipulation occurred during this local database misuse incident.
• Information security: Negligible. No state-level intelligence compromise or information warfare operations occurred; the incident involved local law enforcement database misuse.
• Sovereignty: Minor. Local government employees violated their oath of office by misusing a database, but the issue was managed locally through standard internal audits and arrests.
• Economic security: Negligible. No strategic technology theft, economic manipulation, or national economic threats were associated with this incident.
• Societal stability: Minor. Unlawful tracking violated the privacy and civil liberties of a few individuals, representing localized abuse of surveillance tech rather than population-scale impact.