Hundreds of AI-powered automated license plate reading cameras paid for by Lowe’s and Home Depot and stationed in the hardware stores’ parking lots are being fed into a massive surveillance system that law enforcement can access, according to records obtained using a public records request. 

The records, obtained from the Johnson County, Texas Sheriff’s Office by the Electronic Frontier Foundation (EFF) and shared with 404 Media, show the sheriff’s office is able to tap into Flock license plate reading cameras at 173 different Lowe’s locations around the U.S. and that it can tap into cameras and gunshot-detecting microphones at dozens of Home Depot stores within Texas. The records are the latest to shed light on how expansive Flock’s surveillance network has become, and highlights that it includes cameras that are operated by both police and private businesses.  

“What we’re learning is that two of the country’s most popular home improvement stores are contributing to the massive surveillance dragnet coordinated by Flock Safety,” Dave Maass, director of investigations at the Electronic Frontier Foundation, told 404 Media. “Do customers know that these stores are collecting their data and sharing indiscriminately? Probably not. Have these companies given thought about how this data might put their customers in danger, whether it’s cops stalking their exes or aggressive ICE agents targeting yard workers? Probably not. If these companies want customers to feel safe in their homes, then they should make sure they’re also safe where they buy their supplies.”

Flock’s automated license plate reader (ALPR) cameras are stationed along roads or at entrances to parking lots around the United States, and constantly scan the license plates of cars that drive by. Because there are Flock cameras around the country, Flock often has a snapshot of people’s movements which police can search, typically without a warrant. 

Government agencies that have Flock cameras can choose to contribute their data to either a statewide or nationwide network, meaning cops around the state or country can access them. Flock told 404 Media that Flock cameras operated by private companies have more restrictive sharing options. 

Flock said data sharing from private businesses to law enforcement is on a one-to-one basis, and that private businesses do not have national or statewide sharing options in the same way a law enforcement agency might. In other words, each business and agency would need to enter a data sharing relationship, according to Flock. Flock said that private businesses do not have access to law enforcement data.

Because the Johnson County Sheriff’s Office has access to Flock device data at hundreds of Lowe’s and Home Depot stores according to the public records, this means that both Home Depot and Lowe’s have some sort of arrangement, or multiple arrangements, with police to share access to their data at scale. Flock said that security teams at companies will sometimes work with law enforcement agencies on a regional basis but did not provide specifics on what those collaborations look like.

Lowe’s did not respond to a request for comment. Neither did the Johnson County Sheriff’s Office.

“We have many initiatives in place to mitigate [retail crime] including human and technology resources to make theft in our stores more difficult, close partnerships with law enforcement and significant efforts working with federal and state task forces to fight this problem,” a Home Depot spokesperson told 404 Media. “We don’t comment on specific security measures which would give criminals a roadmap to our practices.” Home Depot did not respond to follow-up questions about the specifics of any Flock data sharing deal it may have with law enforcement.

Home Depot’s privacy policy notes that it uses ALPR cameras, and says it shares data with third parties “For the purposes of (1) ensuring the safety and security of our customers, associates and third parties, (2) protecting our rights and property and the rights and property of our customers, associates and third parties, (3) complying with legal processes, or (4) satisfying other legal requirements.”

As we have previously reported, police generally do not get a warrant to search Flock cameras, and have a wide latitude to use the system to look up license plates. In June, we reported on a casual interagency law enforcement group in Oregon where police analysts offered to run searches for other agencies that did not have access to Flock. We have also reported that police around the country have done Flock searches for what they claim to be immigration enforcement or to help with specific ICE investigations, even though ICE does not have a contract with Flock. This is particularly notable considering that several high-profile ICE raids have taken place near Home Depot and Lowe’s stores. 

The Home Depot spokesperson said “We aren’t notified that ICE activities are going to happen, we’re not involved in them, and in many cases, we don’t know that arrests have taken place until after they’re over. We’re required to follow all federal and local rules and regulations in every market where we operate. In addition, I can confirm that ICE has no access to Flock data.” The spokesperson did not respond to follow up questions about ICE’s side-door access to Flock.

Both Home Depot and Lowe’s have been using Flock cameras for years, but specifics about the extent to which they contribute to Flock’s larger surveillance system has not been reported. Forbes previously reported that companies such as FedEx, Lowes, and the country’s biggest mall owner Simon Property are Flock customers. Reporters at several local media outlets have noticed Flock’s license plate reading cameras in store parking lots and Flock has published case studies about crimes targeting Lowe’s and Home Depot that its cameras were used to solve. In March, Flock said that police arrested seven men accused of a $20 million Home Depot and Lowe’s gift card scam “partly due to evidence provided through video cameras set up throughout these Lowe’s and Home Depot locations.”

The EFF’s public records requests are focused on trying to obtain a list of all of the Flock cameras that different police departments have access to. In this case, the organization received a 173-page document that lists thousands of different entities that are searchable by the Johnson County Sheriff’s Office. 

While this is just a snapshot of the cameras that a single law enforcement office in Texas can search, it reveals quite a lot about Flock’s larger presence, and the entities that provide data to Flock’s law enforcement users. Flock allows its customers to customize their camera sharing options. For example, police departments can choose to contribute to a statewide network meaning that other police departments in the state can search records of cars that drive by their cameras, or they can contribute to a nationwide network, meaning police departments around the country can search these records.   

Therefore, it is notable that Johnson County has access to Lowe’s Flock cameras from outside of Texas, which means that many Lowe’s stores are sharing access to their cameras to law enforcement across state lines. For example, it has access to cameras from Lowe’s store #0052, which is located in Danville, Illinois; Lowe’s store #0215 in Terre Haute, Indiana; Lowe’s store #0245 in Forsyth, Illinois; Lowe’s store #2305 in Rochester Hills, Michigan; and hundreds of others. 

Johnson County only has access to Home Depot stores from within Texas, suggesting that the company may only be sharing to agencies within the state that a store operates. 

The documents obtained by the EFF also show that Home Depot has enabled the company’s “Hotlist Tool,” which allows police to add specific “wanted” license plates to a list. When a car on this list drives past a Flock Camera, the system can send an alert: “Flock Safety’s HotList alerts law enforcement in real time when a wanted vehicle is detected,” a blog post about the feature states. 

“Privately-owned cameras can be added to the LPR network, provided the private customer opts in and has an MOU agreement signed with their local law enforcement agency,” the post adds. “This partnership is a critical piece of our mission to shape a safer future—not just by solving crime, but preventing it.” 

None of the Lowe’s cameras listed in the documents the EFF obtained have the Hotlist feature enabled, while all of the Home Depot ones do. Several Home Depot stores have also connected Flock’s gunshot detection technology, called Raven, to the system, the documents show. 

On the lossprevention subreddit, people claiming to be employees of Lowe’s and Home Depot have discussed using them at their stores: “fucking love flock,” one poster claiming to be a Home Depot employee said in a thread last year. “Lowes APA [asset protection associate] here,” another poster said. “It’s fun technology. Love getting alerts to my phone when I’m walking the floor that a plate that’s been flagged has entered the parking lot.”

Lowe’s and Home Depot’s contributions to Flock’s surveillance system shows how private entities are increasingly sharing automated surveillance with law enforcement at scale. It also shows that Flock’s own network does not only encompass cameras from police departments, but can at times be a public-private partnership between police and retail stores. This model, where retail stores proactively give surveillance footage or other surveillance data to police, is becoming more common. For example, a series of shopping malls provide access to their Vigilant ALPR cameras (a Flock competitor) to police.

Joseph Cox contributed reporting.

About the author

Jason is a cofounder of 404 Media. He was previously the editor-in-chief of Motherboard. He loves the Freedom of Information Act and surfing.