Every surveillance system in this record came with safeguards: written policies, logged search reasons, audit trails, training requirements. This page documents what those safeguards actually caught, and who actually caught the abuse instead. It exists because Asheville’s RTIC rests on the same promises. The record is kept deliberately conservative: charges are called charges, not convictions; anything not verified against primary reporting is marked.
North Carolina’s own cases: summer 2026
Charlotte: caught by accident. On June 16, 2026, CMPD officer Seth Daniel Elliott allegedly ran a plate through Flock and CJLEADS at the request of the target of a Watauga County drug investigation (the plate belonged to an undercover officer’s vehicle) and handed the information to the suspect. No audit caught it. The SBI discovered it by coincidence, from the other end of its own drug investigation, and notified CMPD two days later. Elliott was arrested July 29, the first NC officer criminally charged over a Flock search (Class 1 misdemeanor; case pending). (WBTV · WRAL)
Mooresville: the audit worked, after 31 searches, because the reasons were lies. Officer Elizabeth Anne Snowman allegedly used Flock 31 times to track her boyfriend’s ex-wife, logging 29 of the searches as “motor vehicle infractions” and 2 as burglary investigations, fabricated justifications that sailed through, because the safeguard was a free-text field. Mooresville’s monthly audit eventually flagged the pattern; she was arrested Aug 5 (misdemeanor computer-access charge; case pending). Only after the arrest did Mooresville start requiring an active case number per search. (WBTV · WSOC · QC News on the policy change)
And then the part that matters most: the same audit flagged ten more Mooresville officers. The department’s review, closed August 11, found “several policy violations”, and produced zero new charges and an internal personnel process the department will not publicly discuss. (WBTV) Under NC’s personnel-records law (G.S. 160A-168), the public will never learn what, if anything, happened to them. In North Carolina the cycle ends there: violations found, consequences sealed.
How abuse actually gets discovered
The Washington Post’s August 2026 investigation found at least 50 officers charged with or accused of misusing plate readers against intimate partners, exes, and women they wanted to meet, 46 of the 50 involving Flock. Its key finding: in most cases, the victims discovered the surveillance themselves; audit logs were “usually reviewed only after receiving complaints.” (Poynter on the WaPo investigation · Tech Times summary)
Across the documented cases, the discovery mechanisms were: victims noticing and filing complaints or protective orders; a civilian-built website (Milwaukee officer Josue Ayala’s ~180 searches surfaced via HaveIBeenFlocked.com); journalists’ records requests (the Jerome County, Idaho sheriff’s 700+ searches for his wife’s vehicle came out via KMVT’s document requests; the state AG found no crime, and the sheriff retired early); 404 Media’s bulk audit-log FOIAs (the ICE and abortion searches); and, in Charlotte, blind luck. Proactive internal audits started catching cases in numbers only in 2026, after the national scandal made auditing reputationally necessary.
Selected named cases, each linked to primary reporting: Lt. Victor Heiar, Kechi KS: tracked his estranged wife via a neighboring department’s Flock, texted her “You were spotted”; pleaded guilty; 18 months probation (KSN). Officer Emily Pacheco, New Bedford MA: accused of tracking an ex-girlfriend; a judge found “substantial likelihood of immediate danger of abuse”; the city suspended its entire Flock program (New Bedford Light). In Georgia, 13+ officers across four agencies were arrested or fired in June–July 2026 for personal use of Flock, in audits conducted only after the national scrutiny. And the pattern predates Flock: the AP’s 2016 investigation documented officers disciplined 325+ times in two years for misusing confidential law-enforcement databases, with no national tracking then or now. (CBS/AP)
When it’s the institution, not a rogue officer
- The abortion search. A Johnson County, TX deputy searched 83,000 cameras across 6,809 networks (including states where abortion is legal), logged as “had an abortion, search for female.” The sheriff called it a welfare check; court records obtained by EFF showed deputies had discussed criminal charges with prosecutors. (404 Media · EFF)
- The ICE favors. 4,000+ Flock lookups by local police for immigration purposes, against both Illinois law and Flock’s own policy: officers typed “ICE” and “ICE WARRANT” in the reason field. When audits drew attention, the ACLU documented officers coaching each other to stop typing honest reasons: scrutiny didn’t stop the searches; it just made the logged reasons vaguer. (404 Media · ACLU on audit logs)
- Ignoring the law for years. California banned out-of-state ALPR sharing in 2015; agencies violated it for eight years before the DOJ said so in a bulletin; El Cajon kept sharing with 100+ out-of-state agencies after the Attorney General personally told them to stop, forcing a lawsuit. (CA AG) The 2020 California State Auditor found major agencies did “little to no auditing” of ALPR searches at all. (Report 2019-118)
- Against protesters and activists, the Asheville-relevant scenario. San Francisco police tapped a private business district’s 300+ camera network for eight days of live monitoring during the 2020 George Floyd protests, without the approval its own surveillance ordinance required (EFF, Williams v. San Francisco). Memphis police ran fake social-media accounts to spy on Black Lives Matter activists, violating a federal consent decree that had stood since 1978; it took an ACLU lawsuit and a trial to establish it (ACLU-TN). The NYPD used facial recognition on an Instagram photo to identify a protest organizer, then besieged his apartment for five hours without producing a warrant (Gothamist). A federal consent decree is the strongest safeguard American law offers, and Memphis violated it anyway.
The audit log is not what you think it is
- EFF’s analysis of 11.4 million Flock searches found more than 14% logged with the single word “investigation” as the entire justification. (ACLU)
- Snowman’s falsified “motor vehicle infraction” entries passed review 29 times. Sen. Ron Wyden’s verdict on Flock’s technical filters: “meaningless… easy to circumvent.”
- Flock’s own reforms (mandatory case numbers, automatic anomaly-flagging, 7-day retention) take effect January 1, 2027. Those reforms are the company’s own list of what was missing during every case above. (CNN)
Asheville’s own accountability record
The local grounding for why “trust our policies” earns skepticism here specifically:
- Johnnie Rush, 2017. APD officer Chris Hickman beat, tased, and choked a Black pedestrian stopped for jaywalking. Six months of internal handling produced nothing; the case became public only when someone leaked the bodycam video to the Citizen Times; NC’s bodycam law (G.S. 132-1.4A) had kept it sealed. Hickman pleaded guilty to felony assault; the sentence was 12 months probation, after which the charges were dismissed and expunged. The city paid Rush $650,000. Net permanent criminal consequence for a recorded felony assault by an officer: none. (WLOS timeline · BPR)
- The medic station, June 2020. APD officers in riot gear destroyed a volunteer medic station: stabbing water bottles, stomping supplies. The chief first defended it, then apologized; the mayor called it “senseless.” Council directed an investigation. No public record exists of any officer being disciplined for it, and under NC personnel law, none has to exist publicly. (WFAE · Carolina Public Press)
- The response to scrutiny. After 2020, APD’s institutional answer included hiring a California PR firm as “transparency engagement advisers” ($125,900 through 2023, renewed at $162,000 over Roney’s objection), whose output a Citizen Times records review found to be conventional social-media PR. (The Appeal · Citizen Times via Yahoo)
What this record establishes
- Abuse is discovered by victims, journalists, civilians, and luck, rarely by the promised audits, and when audits do find violations (Mooresville’s ten officers, Austin’s undocumented searches, a sheriff’s 700+ self-serving queries), the documented consequence is usually nothing the public can see.
- The audit trail depends on officers honestly incriminating themselves in a text box. They don’t, and when watched, they learn to lie better.
- Institutions violate their own rules at scale: for years, past direct orders from attorneys general, past federal consent decrees.
- North Carolina’s secrecy laws make the accountability loop unfinishable: personnel outcomes sealed, bodycam footage sealed absent a court order, audit logs already refused to Asheville requesters (see the refusal).
This is why the Promise Tracker treats every APD commitment as untested until proven, and why the strongest local position is the simplest one: a system that can only be policed by self-report cannot be policed, and what cannot be policed should not be deployed.
Related: Promise Tracker · The National Wave · WNC and NC · Claims Library