Flock cut default camera-data retention from 30 days to 7 — and its own numbers say the other 23 days were never doing any work

On August 13, Flock Safety CEO Garrett Langley announced that the company is cutting its default retention period for license-plate-reader data from 30 days to seven, making misuse detection mandatory for every law-enforcement customer, and requiring a case code on every search by the end of the year. The Next Web has the fullest write-up. The announcement followed a Washington Post investigation that documented nearly 50 instances of officers charged with or accused of running unauthorized searches. The politics of automated license plate readers are being covered thoroughly elsewhere, and by people closer to it than me. I want to pull out one line from the announcement that anyone who stores other people's data should read twice. The line "Our analysis shows that over 90% of searches without a full plate are done within a week." Flock set the 30-day default nine years ago, and by its own account believed it struck a balance. Fine. But read the sentence again as an engineer rather than as a civil-liberties question: for nine years, a network now spanning more than 120,000 cameras kept a rolling record of vehicle movements for 30 days, and the company's own telemetry says roughly 23 of those days were serving under 10% of the queries. That is not primarily a privacy finding. It is a capacity finding that happens to also be a privacy finding — which is exactly the shape most retention problems have. Nobody sat down and decided to keep three extra weeks of national movement data. Someone typed a number into a config in year one, it was defensible, and it never got revisited against usage. Retention is a security control, not a storage setting The thing worth internalizing: every day of retained data is a day it can be subpoenaed, breached, exfiltrated by a compromised account, misused by an insider, inherited by an acquirer, or shared with a partner under a policy that hasn't been written yet. Access controls are probabilistic. Deletion is deterministic. They are not substitutes, and it's worth sorting the Flock package by which is which: Change What it actually does 7-day default retention Reduces the data that exists Evidence Mode (preserve for active cases) Carve-out so the reduction is survivable Audit Assistance, mandatory by end of year Detects misuse after it happens Proactive lockout on abnormal behavior Contains misuse after it starts Case code required on every search Deters and attributes Mandatory MFA (shipped start of August) Prevents credential compromise Bishop Fox review + vulnerability disclosure program Finds defects Six of those seven are detection, response, or hardening. They are genuinely useful — Savannah PD fired six employees this month after finding the searches through Flock's own voluntary audit feature, which is detection doing its job. But only the first row changes how much data is sitting there to be misused in the first place. When you're reviewing your own system, sorting your controls into "shrinks the blast radius" and "watches the blast radius" is a five-minute exercise that tends to be uncomfortable. What the critics said, because it matters The response was not warm. The ACLU called the measures retreads of safeguards that were already inadequate, while allowing that a shorter retention window may be a step in the right direction. Robert Frommer of the Institute for Justice told the AP it was "window dressing that doesn't address the fundamental problem" — his objection being that police still decide who gets searched, a decision he argues belongs to judges and warrants. The Center for Democracy and Technology described it as the same "Just Trust Us" policy with a fresh coat of paint. Andrew Guthrie Ferguson of GWU Law was the most measured, calling the shifts better than the opposite while asking for sustained democratic engagement and judicial checks. Strip out the disagreement and there's one structural point underneath all of it: the retention number is still a setting on someone else's dashboard. For scale, the closest comparison is the UK's National ANPR Service — roughly 12,700 cameras collecting about 60 million reads a day, retained for 12 months. That's twelve times Flock's old default. The interesting difference isn't the number. It's that the UK figure sits under the Protection of Freedoms Act 2012 and published national standards, while the American one is a product default announced by a vendor, which means it can be announced differently later. Three questions for your own retention config What's your p90 read age? Flock had this number and it was seven days. Most teams have never measured it. Log the age-at-access distribution for a month before anyone argues about policy — the argument usually evaporates. Is your retention a decision or an inheritance? If you can't name the person who chose it and the reason, it's an inheritance. Which of your controls shrink the data and which only watch it? Both are necessary. Only the first keeps working when the audit log is the thing that's compromised. Where I'm coming from Full disclosure: I work on Background Camera RemoteStream, an Android app that turns a phone into a camera. So read the rest as positioning, not neutrality. We're not an ALPR network and the stakes aren't comparable — nobody's civil liberties hinge on a phone pointed at a back door. But the architectural question is the same one, and we answered it by not having the dial at all. Background Camera RemoteStream writes video to the phone's own storage. There's no account to create and no vendor cloud holding your clips, so there's no retention default for us to get right or wrong: the retention policy is however long you leave the file on the device. When you want to watch live, the phone serves its own feed over your LAN, or you push an unlisted YouTube Live stream you control. It records with the screen off, which is the part people actually came for. That isn't a moral achievement, it's a constraint we picked, and it costs real things. No cross-device sync. No server-side motion AI. No "recover the footage from the cloud after the phone is stolen." Local-only means local-only, and if those features matter more to you than the architecture, a cloud camera is the honest answer. What it buys is narrow but durable: no announcement we make in year nine can shorten or lengthen a retention window you never set. Flock cutting its default is a real improvement and worth crediting — the 90%-in-seven-days number is the kind of thing most vendors would never publish. What's worth remembering is that a default someone can lower is a default someone can raise. More on the same architectural question: Four Android Ad SDKs Leak Precise Location by Default — the Fix Isn't a Toggle, It's Not Collecting the Data at All The Vatican Prayer App Leak: How One Incrementing Number Exposed 700,000 Users — and Why "Collect Nothing" Beats "Secure Everything" A local-only home security camera from an old Android phone: setup and how the free apps compare Background Camera RemoteStream — Google Play · superfunicular.com