The Supreme Court has a message for Kentucky on surveillance: Get a warrant

That case was about cell-phone data. But the reasoning lands squarely on the surveillance network Kentucky’s local governments have spent the last few years building through a single vendor: Flock Safety.

A statewide dragnet, city by city

Flock’s automatic license plate readers now operate in at least three dozen Kentucky law enforcement agencies, by the Electronic Frontier Foundation’s count. It’s almost certainly more, since nobody keeps a complete list and several departments have fought to keep their deployments secret.

Louisville Metro Police run at least 240 of the cameras, the figure a deputy chief gave the Metro Council in February with 54 more awaiting installation, and can tap more than 400 additional shared cameras across Jefferson County. Fifteen departments in Boone, Kenton and Campbell counties operate 101 devices among them. Paducah has 32. Vine Grove, a Hardin County town of about 7,000, signed a 10-year deal last November for 10 more readers and seven other cameras, most of them already installed. Kenton County and other localities are weighing their own contracts. The cameras are not targeted tools trained on suspects. They photograph every passing vehicle, read the plate, log the time and place, and pool it all into a cloud database that agencies far beyond Kentucky can search.

The Court’s own words explain why that should trouble anyone who drives. Drawing on its 2018 decision in Carpenter v. United States, the majority warned against surveillance that lets police reconstruct a person’s movements after the fact, enabling “tireless and absolute surveillance” of anyone, anywhere. A network of Flock cameras does to drivers what location history did to the defendant in Chatrie: it builds what the Court, again quoting Carpenter, called “an intimate window into a person’s life,” capable of showing who visited a doctor, attended a protest or went to church.

The majority also dismantled the government’s favorite fallback claim. The so-called “third party doctrine” states that once you hand information to a private company, you forfeit any privacy claim to it. The Court refused to let that doctrine swallow location data, holding that such records are “not truly shared” in any ordinary sense. Kentucky agencies that route their surveillance through a private camera vendor and then treat the resulting database as fair game should read that passage closely.

At least one Kentucky city has already acted on that reasoning. In July of this year, Newport ended its Flock pilot and ordered the cameras pulled. Assistant City Manager Brian Steffen said the city had reviewed Chatrie with its attorney and concluded that the ruling’s concerns about tracking people’s movements could become a problem for Flock. The technology worked, he said. It “just leaves too many open questions where we’re at right now.”

The gap the new law left open

This is not a hypothetical risk. In early 2025, a federal Drug Enforcement Administration agent used a Louisville Metro Police detective’s login to run roughly 150 immigration-related searches of the city’s Flock system, without the detective’s knowledge. The searches did not become public until that November, and three officers were ultimately disciplined. But that agent was a fraction of the problem. Reporters at the Kentucky Center for Investigative Reporting found Louisville’s Flock network had been queried roughly 1,700 times with immigration-related keywords in the first half of 2025 alone, by agencies in more than a dozen states.

The problem was never one rogue agent. It was a system without guardrails that made the abuse possible. Louisville’s failure was a shared password. Elsewhere the vector has been Flock’s national lookup network, which lets out-of-state and federal agencies query a city’s data without local officials knowing. The result is the same either way, and dozens of cities have now canceled or rejected Flock contracts — 47 cancellations by the count of DeFlock, which tracks the industry — with federal and immigration-agency access a leading driver.

Louisville’s response to all this has not been transparency. Metro Government went to court this year to keep surveillance records secret, and in April the Metro Council voted to keep the cameras’ locations from the public. Residents cannot learn where they are being photographed, much less who has been searching for them.

Kentucky lawmakers took action this year, but new privacy protections are lacking. Some provisions are counterproductive. House Bill 58, from Rep. John Hodgson, was signed into law in April and is now in effect. It caps data retention, limits government use to public safety and a handful of transportation purposes, and bars agencies from selling the data.

Those provisions are worth having. But the law is a weak half-measure that ultimately carved out special exemptions letting insurers, lenders and their agents reach the data — robbing the bill of its status as serious privacy protection. It is one thing to debate whether police should hold a searchable log of every driver’s movements; it is another to route that log to private companies whose interest in it has nothing to do with public safety. That is not a loophole around the edges. It is a channel built into the statute, and it deserves far more scrutiny than it got.

Most importantly, the law stops short of the one protection the Supreme Court has now made unavoidable: it does not require a warrant before law enforcement — or a federal agency piggybacking on a local system — can query historical location data. That is precisely the search the Court just held the Fourth Amendment protects. A 90-day retention limit still leaves 90 days of every Kentuckian’s movements sitting in a searchable database, reachable without a judge’s sign-off.

Chatrie left one question for another day — whether a properly limited warrant can satisfy the Constitution’s demands for probable cause and particularity. The officers in that case, it is worth noting, had at least gone to a magistrate first. What the Court settled is the question Kentucky’s Flock contracts have been dodging: government access to your location is a search. Searches, absent some recognized exception, require a warrant. House Bill 58 does not ask anyone even to try.

Kentucky’s congressional delegation has noticed the problem even if Frankfort has not. Rep. Thomas Massie said in late July that he will soon sponsor a bill to withhold federal money from municipalities and police departments that “deploy Flock (and other style) cameras to surveil law abiding citizens.” The General Assembly should not wait for Washington to move first on a surveillance network Kentucky agencies built themselves.

Used with real oversight, plate readers can help solve crimes and find missing people. Lexington police credited their cameras with recovering 283 stolen vehicles and locating 22 missing people in the program’s first two years. But Kentuckians should not have to choose between public safety and the right to move freely without being tracked, catalogued and made available for inspection by any agency or corporation that asks. Privacy is not a loophole for criminals. It is a precondition for a free society, and the Supreme Court just said so in as many words. The General Assembly took a small, flawed first step. Now it should finish the job.