Flock Safety License Plate Readers Used to Stalk a Woman

A Cop Liked a Woman He Met on a TV Set. So He Weaponized a Surveillance Network Built to Catch Car Thieves.

TL;DR: Florida police officer Lamar Roman used DMV databases and an automated license plate reader (ALPR) “hot list” to track down and pull over a woman he met on the set of Apple TV’s Bad Monkey. Body camera footage obtained by 404 Media shows him explaining his motive as “I saw a shiny thing,” while investigators reportedly downplayed the misconduct and urged the victim to stay quiet. It is not an isolated incident: Flock Safety has acknowledged 15 abuse cases, and the Washington Post has documented more than 50, according to 404 Media’s reporting.

There is a specific kind of dread in learning the traffic camera at the end of your street isn’t only watching for stolen cars. It’s watching for you, specifically, because someone with a badge decided it should.

This happened to a woman in Florida. She met officer Lamar Roman on the set of Apple TV’s Bad Monkey. He liked her. So he pulled her name and address out of DMV records he had no legitimate reason to access, added her license plate to a police “hot list,” and let a statewide network of automated license plate reader (ALPR) cameras do the stalking for him. Every time she drove past a networked camera, the system pinged him. He used one of those pings to intercept her at speed, nearly causing a head-on collision.

His own explanation, captured on body camera footage and reported by 404 Media: “I saw a shiny thing, teasing and all that… I knew that when I put that into the system, I was like ‘Fuck.’”

What Did Officer Lamar Roman Do?

Direct answer: Roman illegally searched DMV databases for a woman he met socially, added her license plate to a police alert “hot list,” and used automated license plate reader alerts to track and pull her over, nearly causing a collision in the process.

According to the body camera footage 404 Media obtained, Roman didn’t stumble into her location by accident. He built a surveillance pipeline for one target: a government records lookup to confirm her identity, a plate entered into a real-time alert system, and a marked patrol car positioned to intercept her the moment a camera flagged her. This is not a lapse in judgment made in the field. It’s a workflow, the same kind of workflow the system was designed to support for catching an actual carjacker, aimed instead at a woman he had a crush on.

What Is a License Plate Reader “Hot List”?

Direct answer: A hot list is a database of flagged plates triggering a real-time alert to officers whenever a networked ALPR camera reads a matching plate. It is a feature built for stolen vehicles and Amber Alerts, not personal surveillance.

Automated license plate readers, often built on platforms like Flock Safety’s Guardian system, scan every plate passing a fixed or mobile camera and log the time, location, and direction of travel. Adding a plate to a hot list turns the passive log into an active tripwire: the instant a match hits, an alert lands on an officer’s phone or terminal. It’s a genuinely useful feature for finding a stolen car in real time. It’s also, functionally, a stalking tool with a badge attached, because the system has no way to distinguish “this plate belongs to a wanted felon” from “this plate belongs to someone I like.” This distinction depends entirely on the judgment and the honesty of whoever has login access. This is the same underlying tension we covered when Amazon’s Ring quietly ended its own surveillance-camera partnership with Flock Safety after public backlash: networked camera systems built for “public safety” keep turning out to have far fewer guardrails than the marketing implies.

How Did Investigators Respond to the Misconduct?

Direct answer: A detective reportedly told Roman “you’ll get past this bro,” and the victim was urged not to discuss the incident on social media, according to 404 Media’s review of the footage.

This is arguably the more disturbing half of the story. The abuse itself is one officer’s decision. The response is institutional. If the reporting is accurate, the message the victim received from the people investigating her stalker was not “this is a serious violation.” It was “please don’t make this a problem.” This is not an isolated communication failure. It is the exact pattern letting misuse of surveillance systems go unreported, because the people with the most incentive to stay quiet about it are the ones running point on the investigation.

How Many License Plate Reader Abuse Cases Has Flock Safety Admitted?

Direct answer: Flock Safety has acknowledged 15 abuse incidents. The Washington Post has documented more than 50, according to 404 Media’s investigation and case tracking compiled by the Institute for Justice. This is not an isolated case.

What makes this case worth writing about instead of shrugging off as one bad cop is the scale behind it. 404 Media’s reporting shows Flock Safety, the company behind the most widely deployed ALPR network in the country, initially acknowledged 15 known abuse incidents. The Washington Post’s own investigation, per the same reporting, found more than 50. The Institute for Justice has separately compiled additional documented cases. None of this is theoretical. Officers running plates for personal reasons (checking on an ex, an estranged spouse, someone they’re attracted to) is a recurring failure mode, not a freak event, in a system with tens of thousands of individual users and comparatively little independent auditing of who queries what and why.

Can You Opt Out of Automated License Plate Readers?

Direct answer: No. Individuals have no way to opt out of ALPR cameras on public roads. The realistic move is pushing for transparency: request your local department’s public ALPR/Flock audit log and ask your city council to require regular usage reporting.

This story’s biggest weakness, from a “here’s what to do about it” standpoint, is the lack of an individual opt-out. There is no way to decline having your plate photographed on a public road, and no privacy setting changes it. What is realistic is pushing on the accountability layer instead of the technology layer: many departments deploying Flock or similar systems are required, or are able to be pressured, to publish transparency portals showing lookup volume and audit activity. Asking your local council whether such reporting exists, and demanding it if it doesn’t, is a more realistic lever than trying to dodge the cameras. It’s the same “the tech itself is the given, the governance is the variable” logic behind why we’ve pointed readers toward tools like California’s DROP data-broker opt-out platform: your data will keep existing in these systems, but you are able to fight for rules about who’s allowed to touch it.

Why Does This Matter for Security and Privacy Professionals?

Direct answer: This is a live case study in insider-threat controls failing to scale: logging access to sensitive location and identity data is worthless if nobody reviews the logs until a victim reports abuse.

If you work in security, GRC, or identity and access management, strip the law-enforcement specifics out and this becomes a familiar failure pattern: privileged access to sensitive data (location, PII, real-time alerting), logged but not proactively audited, misused by an authorized user for a personal reason, and only caught after the fact because a victim complained. This is the same root cause behind countless internal-data-misuse incidents in healthcare records systems, customer databases, and HR systems. “We log everything” is not a control. A control is someone reviewing anomalous access patterns, such as an officer running one plate repeatedly with no case number attached, before the misuse becomes a police-blotter story.

License plate reader networks were sold to city councils as a tool to catch car thieves and find missing kids. This mission is real, and the tech does the job well. But every access-controlled system built for a good reason inherits the same open question: who’s watching the watchers? In this case, per 404 Media’s reporting, the answer was a detective telling the offending officer he’d “get past this.” This answer is worse than no oversight at all, because it tells everyone else with access exactly what the real consequences are.

Have thoughts on ALPR transparency in your city, or seen a local Flock audit portal worth pointing people toward? Reach out. ByteSizedSecurity covers surveillance accountability as part of our privacy beat.