Scott Conway

Information Security Researcher

The Automotive Surveillance Hellscape of Buffalo, NY

Jul 28, 2025

Several months ago, I heard that my local police department was proposing the purchase of a number of Flock license plate reader surveillance cameras. They had in fact been trialing these cameras for two and half years (for free), but that’s a story for another day. I did what I could to oppose it - I showed up to board meetings, said my piece, and watched as the town board unanimously voted to approve an agenda item for which they did not understand the implications, without any discussion or debate.

After that, I decided that it was worth documenting just how many municipalities in the Buffalo metropolitan area were using ALPR cameras, Flock or otherwise - this is a summary of my journey. If you’re just interested in the raw data I’ve gathered, you can download it here. It includes FOIL responses including police departments’ ALPR policies, Flock camera locations, search logs, and data sharing configuration. Some are missing information and contain legally questionable denials for such requests.

Discovery

One of my largest issues with Flock and similar networked ALPR systems is just how easy sharing access is between organizations. Some organizations appear to share access with just about every other Flock organization! As abhorrent as that is, it can be useful for our purposes. Less than 10% of Flock organizations have “transparency” pages enabled (and fewer have all of the possible details included on their pages), but Temple University has a page, and it shows a great list of Flock organizations. Just don’t worry about why this organization feels the need to share their data with everyone.

From this single transparency page, it’s easy to make a simple program to move throughout the shared organizations, discovering new organizations from transparency pages of other organizations. But from my tests, Temple University really shares with most of them, so I’ll avoid further technical discussion of discovering Flock organizations for now.

Checking out the list from Temple University, I discovered the following organizations from the Buffalo metro area:

With a list of municipal organizations in hand, I started sending NY FOIL (similar to FOIA) requests to them.

Making FOIL Requests

Just about every municipality has their own form and process of receiving information under FOIL. Some e-mail responses with attachments or dropbox sites for file-hosting. Others mail paper correspondence, with spreadsheets contorted into text that fits on an 8.5”x11”. Others will mail you a CD with response data on it.

That said, most municipalities (unless they used GovQA or NextRequest) required the submission of a PDF form to make a request. I used okular to make a template request PDF with all of my personal information pre-filled, so that the request text could be easily added, if I needed to make multiple requests.

Some municipalities indicated that FOIL requests must be presented via mail or in-person, though I never had issues with E-mailing the municipal clerk instead.

It took me a few requests to really figure out what I wanted, but I settled on these points of data:

Getting FOIL Responses

According to NY’s Committee on Open Government, FOIL requests must be acknowledged within 5 business days, with a response 20 business days after acknowledgement. If they can’t provide a response within 20 business days after the acknowledgement, they must provide a reason for delay and an estimated response date.

These provisions do not matter whatsoever. Agencies will respond when they feel like it, and you have little recourse if they simply don’t acknowledge your request at all. That said, most of my requests were responded to within 20-30 business days. Some never received a response. Your mileage may vary.

Making Appeals

My requests were in large part responded to, but most of them did not provide all of the information I was asking for, often citing “investigative sensitivity” in the case of ALPR locations, or “violations of privacy” when requesting ALPR query logs. Fun fact - if the release of a record may constitute an invasion of privacy, the responding department is required to redact all sensitive information before releasing it. They can’t just deny releasing the document. Of course, that doesn’t stop organizations from trying not to release them.

My appeals were informed in part by a legal representative from the NYCLU who I had the pleasure of speaking with during this journey.

Findings

As I linked above, here is all of the raw data that I obtained from these requests.

From this data, I’ve drawn the following conclusions:

Several local police departments violate their ALPR policies by not mapping case numbers to ALPR searches

For example, the Town of Tonawanda has such a requirement. Their search CSVs show that they both do not use Flock’s built in case-mapping field. Additionally, a majority of searches in the examined period didn’t have case numbers in the “reason” field. Better yet, it’s extremely common to see police shorthand such as “inv” as the sole reason for an ALPR search.

Some local PDs do not have policies to cover fixed-location ALPR, but use it anyway

Hamburg PD’s policy, for example, refers to their LPRs as “Mobile License Plate Reading System” and does not reference the use of fixed LPR installations, even though they have several.

The city of Buffalo likes to surveil the economically disadvantaged

The automotive surveillance state has been in place in the City of Buffalo for quite some time, and others have already gone over its targetting of specific communities. Please, Buffalo PD, explain this ALPR camera that specifically targets the only driveway of this municipal housing apartment complex.

Shaming Section

The city of Batavia, NY Police Department deserves to be at the top of this section. After a back-and-forth with the appeals process, they released their ALPR query logs. The query logs (which originate as a CSV or Excel document) were provided as a PDF document and printed on several sheets of paper at an almost unreadable font size. The “license plate” field - the only field that has legitimate privacy concerns - was “redacted” with a black bar over the text field. The text was simply not removed from the PDF. The City of Batavia PD clearly can’t be trusted with this data if they don’t know how to properly redact information from PDFs! I have not included this information in my results, as I myself am having an impossible time of properly redacted it, due to the complexity of the PDF.

The town of Cheektowaga PD denied my request for camera locations due to “investigative sensitivity”. The town attorney responded to me once, but never answered my repeated e-mails and calls thereafter. Thus, I was unable to make an appeal.