Ventura County Sheriff | License plate readers

The number

In June 2023 the Ventura County Sheriff’s Office turned off a feature in its plate reader system called National Lookup, which let police departments anywhere in the country search its data. It did so, in its own words, “to comply with state law”. California prohibits sharing this data with out-of-state and federal agencies.

On 11 February 2026 the office audited its own data to check that the switch had held.

The audit revealed that despite the Ventura County Sheriff’s Office disabling “National Lookup” in June of 2023 to comply with state law, from February 19, 2025, through March 19, 2025, Flock’s error allowed law enforcement agencies from outside the state of California to query our data without our knowledge or approval just over 364,000 times.

Three hundred and sixty-four thousand queries, over one month, from agencies that were not supposed to be able to reach this data at all, against a switch that had been off for twenty months.

The office found out eleven months after the window closed, and not from the company. It learned that other California agencies had discovered the error, and went looking.

Two hundred and ninety-nine

The audit found something else:

The audit further revealed that 299 search justifications entered into the system referenced immigration enforcement. This was done by both federal and local agencies outside California, accounting for a total of 0.08%, or less than 1/10 of 1 percent of all searches.

The Sheriff gives the count and the proportion together, and both belong here. Two hundred and ninety-nine is a very small share of 364,000. It is also two hundred and ninety-nine searches, run against a California county’s plate data, by agencies outside California, with immigration enforcement written in the box where the searcher explains why.

A search justification is text somebody typed. It tells you what the searcher said they were doing. It does not tell you what they got.

What the company could not say

The office asked Flock what had happened.

Flock further advised that due to limitations in technical logging, it was impossible to determine the specific cause.

The company offered three possibilities. That someone at the Sheriff’s Office had turned the feature on. That a Flock employee had. That a bug had.

The Sheriff’s Office investigated the first one and reported the result:

Regarding bullet point one, we conducted an internal investigation and determined that no one from our agency activated the national lookup feature.

That leaves two explanations, both belonging to the company, and no way to choose between them. Nobody knows which happened, because the logs that would say do not exist.

The exposure appears to have ended for a reason unconnected to anybody noticing it:

We learned that on or about March 19, 2025, Flock made a company-wide decision to remove the ability for any California law enforcement agency to activate the national lookup feature, which potentially explains why our data was shared for only one month.

A month of exposure closed by an unrelated corporate policy change, not by detection.

The sentence that matters most

Everything above is about access. The question underneath it is whether anything was actually taken, and here is the answer, in the Sheriff’s own words:

Flock was unable to determine if any of the out of state queries matched images captured by our ALPRs, but only stated that our data was accessible to out of state or federal agencies and not specifically targeted by out of state or federal agencies. To be clear, we do not know if any out of state law enforcement agencies or federal law enforcement agencies received any images or information captured by our license plate readers.

We do not know. Nobody does. The plate data of everyone who drove past a camera in Ventura County was reachable, for a month, by agencies barred from reaching it, and the system kept no record adequate to say whether any of it moved.

Credit where it is due

Every fact on this page comes from a document the Ventura County Sheriff’s Office wrote and published about its own system. It ran the audit. It published the number. It published the immigration figure. It published the sentence saying it could not tell you whether your data left. It said its own investigation had ruled out its own staff, and it named the two remaining explanations, both of which point at its vendor.

Then it instituted daily audits of its own settings and access logs, and said it would look at other vendors.

An agency that wanted this quiet had every opportunity. This one wrote it down and put its name on it, and this page exists because it did.

What the county still cannot show is its own decision. The Board of Supervisors publishes its agendas on a system this project has no tooling to read, so we have no record of when the county’s elected board approved this, what it cost, or whether the public was ever given the hearing that state law contemplates before an agency starts reading plates. That is a gap in what we can reach, not a finding about the board.