Stow, Massachusetts, Police Officer Allegedly Used Flock License-Plate Reader System to Track Former Romantic Partner

A Stow, Massachusetts, police officer allegedly used Flock Safety’s automated license plate reader system and other law-enforcement databases to obtain information about a former romantic partner and track her movements. The woman said she had fled an abusive relationship and later obtained a restraining order. An internal investigation found repeated searches without legitimate law-enforcement reasons, and the department ended its Flock contract.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information

The officer used the Flock camera system and other databases to obtain non-public sensitive location and personal data about a private individual without her consent.

Additional risk subdomains

• 1.2 Exposure to toxic content: The victim was subjected to targeted harassment, stalking, and physical intimidation by the officer driving by her home.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The risk and subsequent harm were caused by the intentional decision of a human police officer to misuse a deployed AI database system for personal stalking.

EU AI Act risk tier

• Risk tier: 2 High Risk

High Risk: The system involved is a law enforcement application (Flock camera tracking system), which is explicitly classified as high risk under the EU AI Act.

AI system and alleged parties

• AI system: Flock Safety’s automated license plate reader system (Flock Safety)
• AI purpose: Camera Tracking; License Plate Recognition
• Behaviour type: Tool
• Alleged developer: Surveillance technology developers, Flock Safety, Automated license plate reader (ALPR) developers
• Alleged deployer: Stow Police Department (Massachusetts), Stalkers, Police departments in the United States, Law enforcement, Jason Rogers
• Alleged harmed parties: Women and girls, Women, Victims of stalking, Privacy

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Minor, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Privacy

Reported: The report explicitly describes severe privacy violations where the victim's location and personal data were accessed.

Directly caused: The officer used the Flock camera system and CJIS/CORI databases to illegally obtain the victim's location and personal records.

Inferred additional harm: The ease with which the officer accessed these databases suggests potential systemic gaps in access controls and audit logs for sensitive citizen data.

Psychological

Reported: The report explicitly describes psychological distress and fear experienced by the victim due to the stalking.

Directly caused: The victim experienced severe anxiety and fear, stating she has to look over her shoulder when leaving the house.

Inferred additional harm: The victim likely suffered renewed trauma and acute stress from being tracked by an abusive ex-partner who possesses a badge and a gun.

People affected

• Occurrences reported: 1
• People reportedly harmed: 1
• People reportedly exposed: 1

Potential causes

Management

• Inadequate Access Control Oversight: Management failed to restrict access permissions based on active duty needs.
• Delayed Detection of System Misuse: The abuse was only discovered after the victim checked her license plate history.

Technology

• Flock Camera Query System: The automated license plate reader database allowed targeted location searches.
• Database Interoperability: Integration across Flock, CJIS, and CORI systems facilitated broad tracking.

Data Inputs

• Automated License Plate Data: Real-time location data of citizens was captured and stored in the database.
• Personal Identification Records: CJIS and CORI systems stored sensitive personal records accessible by queries.

Human Factors

• Abuse of Police Authority: The officer intentionally used his database access to stalk a former partner.
• Unauthorized Query Intention: Officer bypasses ethical boundaries to track victim's movements.

Process and Methods

• Lack of Real-Time Query Validation: System did not require active case numbers or validation before running searches.
• Inadequate Proactive Monitoring: The department did not proactively flag repeated searches of a specific civilian.

Regulatory Environment

• Insufficient Privacy Safeguards: State and local regulations failed to restrict database access to active cases.

Information quality

• Classification confidence: High
• Reason for confidence: The report provides clear, factual details regarding the officer's actions, the specific systems used (Flock, CJIS, CORI), the timeline of the investigation, and the direct impact on the victim. There is little to no ambiguity regarding the misuse of the technology.

A local police officer in Stow, Massachusetts, abused his authority by using the Flock AI camera system and state law enforcement databases to stalk an ex-partner. While the incident represents a serious breach of privacy, civil rights, and public trust, its national security impact is minor, localized, and manageable under standard domestic legal and administrative procedures.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: United States
• Alleged perpetrator: Individual

Threat characteristics

• Imminence: Long-term. The immediate threat to the victim has been addressed via a restraining order and administrative suspension, representing an ongoing policy and oversight concern rather than an active national crisis.
• Autonomy: Human-controlled. The AI-enabled Flock camera system acted strictly as a database tool queried directly by the human operator to retrieve specific location data.
• Novelty: Established threat. The unauthorized use of law enforcement databases and surveillance systems by officers for personal reasons is a known, pre-existing insider threat pattern.

Impact by dimension

• Physical security: Negligible. The incident involves a localized stalking case by a police officer and does not target critical infrastructure, physical systems, or present mass casualty potential.
• Information security: Minor. While local police databases (CJIS, CORI) and a private AI-enabled surveillance system (Flock) were compromised for personal misuse, there is no indication of classified intelligence theft or state-level information warfare.
• Sovereignty: Minor. The incident represents a local abuse of police authority and state-authorized surveillance tools, but does not threaten national sovereignty, electoral systems, or core federal government operations.
• Economic security: Negligible. No strategic technology, critical supply chains, or financial systems were targeted or compromised in this localized incident.
• Societal stability: Minor. The incident involves a severe violation of an individual's privacy and civil rights through unauthorized surveillance, but it remains a localized criminal abuse rather than a systematic, population-scale threat.