Ousted Savannah police officer gave ICE agent husband access to Flock system

TL;DR Highlight

A police officer shared her Flock login with her ICE-agent husband; an audit found 983 searches and she was fired

Who Should Read

Backend and security developers responsible for account sharing and audit-log design in internal SaaS tools

Core Mechanics

One shared login led to 983 searches
- An internal audit flagged unusually high search volume on one account between January and July 2026.
- The audit found 983 search entries on 97 license plates from Georgia, New Jersey, Maryland, Florida, South Carolina and North Carolina.
The husband had no account of his own
- He is an ICE agent but had no Flock access through his federal job.
- He said he used his wife's username and password for about four months.
The audit log named only the wife
- Searches were recorded under her account, so the system identified her as the user.
- The department concluded this undermined its ability to oversee use of sensitive information.
Discipline rested on internal policy, not law
- The investigation did not find a violation of Georgia's automated license plate reader law.
- The case centered on a department information-management policy that bars unauthorized people from accessing software.

Community Reactions

Opinion: shared logins are riskier on SaaS
- Commenters questioned why the system is standard SaaS rather than locked to department devices.
- Another comment guessed the system lacked 2FA.
Suggestion to restrict access physically
- One commenter said such systems should only be accessible inside secured facilities with badge entry.
- The argument is that this would reduce avenues for abuse.
Opinion: authorized users still abuse access
- Commenters argued that people with approved access abuse surveillance tools again and again.
- One cited Snowden saying NSA workers used surveillance systems to peep on partners and exes.
Opinion: blame the vendor too
- One commenter found it odd that officers get blamed but Flock, the supplier, does not.
- They argued Flock is built to do more than read plates.

How to Apply

Find shared logins in your internal tools
- Today, run a log query for accounts seen from many IPs, devices or regions in a short window.
- Confirm with each owner and issue individual accounts.
Add 2FA and device limits to sensitive systems
- Require SSO and 2FA on internal tools that can look up or track people.
- Where possible, restrict logins to managed devices or allowed IPs.
Create a separate account process for outside agencies
- Make other teams or agencies request an account in their own name.
- When someone searches on another's behalf, log the requester and purpose.
Add alerts for abnormal search volume
- Set per-user daily and weekly search baselines and notify an auditor when exceeded.
- Include the lookup target and a purpose field in the alert.

Try It

copy & run

# Paste into Claude or ChatGPT (account-sharing audit prompt based on the article's case)

I'm a backend developer reviewing access logs of an internal lookup system.
Find patterns in the logs below that suggest one account is shared by multiple people.

Logs:
{{access log sample (user_id, timestamp, IP, User-Agent, search target, count)}}

Please do the following.
1. Tabulate accounts with varied IPs, devices or regions in a short period.
2. Flag accounts whose search count spiked versus their usual volume.
3. Write 3 questions to verify for each suspicious account.

Next, try asking: what checks become easier if I add a 'purpose of search' field to the logs?

Terminology

FlockA license plate reader (ALPR) system using roadside cameras to record and search vehicle locations.

Audit trailA record of who did what and when. If accounts are shared, it names the wrong person, like lending out a badge for someone else to enter.

Credential sharingHanding your username and password to someone else to use.

Target packageIn the article, a bundle of material ICE prepared in advance on a person it was seeking to arrest.