Deflock Lebanon
Lebanon, Ohio · Warren County

Lebanon, Ohio · A Free American City

We did not consent to be watched. We do not intend to start now.

"They who can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety."

Benjamin Franklin wrote that in 1755. It is not a decoration. It is the actual choice on the table. Lebanon's mayor sent Flock Safety 54 written questions on August 17, copied to the City Manager, the Law Director, the Chief of Police, the Warren County Prosecutor, and every member of Council. That letter deserves credit. But no free city should have to interrogate a vendor to find out whether its own residents are being watched lawfully. Flock's written answers are due September 7.

Flock's 21-day deadline

Monday, September 7

Written answers requested from an officer authorized to speak for the company

Watch what they answer. Watch harder for what they don't.

The best case

This is what a tightly run program looks like.

Lebanon has contracted with Flock since March 2024 and operates twenty Falcon license plate reader units. By the mayor's own account, the Division of Police has run it about as carefully as a department can.

State Network and Nationwide Network license plate lookup are disabled at the Department's direction. Multi-factor authentication is enforced. Every query requires an associated case number. Periodic audits are conducted. No Lebanon officer has ever been the subject of a misuse investigation. The ALPR policy itself, General Order 41.3.9, was adopted by City Council under Resolution 2024-021, which requires Council review of any future edits.

Read that list again, because it matters: most cities running Flock have not done these things. Lebanon turned off the sharing networks that other departments leave on.

  • 20 Falcon LPR units, operating since March 2024
  • OFF State and Nationwide network lookups, disabled by the Department
  • 0 Lebanon officers ever investigated for misuse

And it still isn't enough

Every one of those safeguards runs on software the City cannot inspect.

That is the entire point of the mayor's letter. The Department did everything within its control. What remains outside its control is the platform itself.

Each safeguard listed above is ultimately executed by Flock's software. The City cannot independently verify that network lookups are still off, that the case-number requirement cannot be bypassed, or that a settings change hasn't happened without anyone being told.

This is not a theoretical worry. The letter cites three specific municipalities where exactly that happened:

Mountain View, California

The city has stated a nationwide search setting was enabled without its police department's permission or knowledge.

Oxnard, California

Reported that a vendor-side issue re-enabled nationwide query capability despite its access being restricted to California.

Ventura County Sheriff's Office

Reported to have identified a substantial volume of unauthorized accesses after a setting disabled in 2023 was reactivated.

Lebanon made the same configuration choice those agencies made. As the letter puts it, the concern is not the choice but its durability and observability.

Evidentiary integrity

If firmware can be modified without detection, what makes a plate read authentic?

This section of the letter was flagged as being of particular importance to the Warren County Prosecutor, who was copied on it. It concerns whether evidence generated by this equipment will hold up in court.

Independent security research published in November 2025 documented that certain Flock devices shipped with Secure Boot disabled, bootloaders unlocked, storage unencrypted and debug interfaces active. Twenty-two of those findings carry CVE identifiers issued through MITRE and catalogued in the National Vulnerability Database.

Flock has responded publicly that exploitation would require physical access and detailed knowledge of internal hardware, and that no customer action was required. Notably, Flock registered the vulnerabilities with MITRE itself.

The City took no position on exploitability, and neither does this page. The narrower question is the one that matters in a courtroom: the letter asks Flock to identify, by serial number, which published CVEs apply to each of Lebanon's twenty units, whether each is remediated, and whether Secure Boot is enabled and storage encrypted on those units today.

Question 54

The last question is about the exit.

Buried at the end of the letter, the mayor asks Flock to confirm in writing the exact end date of the current term and the last calendar day on which the City may deliver notice of non-renewal.

Invoice INV-94209 describes the present period as "Year 2 of 24 Month Term, 2026 – 2027," and the City wants that reconciled against the renewal provisions of the Order Form. The letter also asks Flock to produce the termination provisions in full, noting that the executed Order Form incorporates those terms by reference to a web address and does not actually contain them.

A city does not ask for its non-renewal deadline in writing unless it wants that option available.

Already happening

Elsewhere, the platform has already failed.

None of these happened in Lebanon. All of them happened on the platform Lebanon relies on.

Shively, Kentucky · August 26, 2026

A police officer was arrested after running 2,048 searches on two vehicles belonging to the mother of his child — including 241 searches while she had an active protective order against him. He logged them as drug investigations. Flock's own audit tool caught it, but only after five months.

Dayton, Ohio

More than 7,000 immigration-related searches of the city's Flock data by outside agencies were found to violate Dayton's own stated policy for the system.

San Francisco, California

A pending lawsuit alleges outside agencies searched the city's plate database more than 1.6 million times in six months.

Flock Safety, on the record

The company's CEO has acknowledged Flock had not built the permissions needed to stop federal Customs and Border Protection from reaching state camera data in violation of a state law restricting immigration enforcement use.

The two things people say

Both deserve a real answer.

My phone already tracks me. What's the difference?

Your phone's tracking is tied to apps you chose to install, with settings, opt-outs, and companies you can stop using. Flock asks for none of that. It captures you for the act of driving on a public road, and it's the government holding the record — not a company you picked. If phone tracking bothers you, that's an argument for regulating it harder. It isn't a reason to build a second system with no consent at all.

If you have nothing to hide, you have nothing to fear.

This asks innocent people to justify their privacy, instead of asking government to justify surveillance. It also assumes the system will only ever be used on people who deserve it — which is exactly the assumption that failed in Shively, in Dayton, in San Francisco. Nobody actually lives this way. You close doors. You don't publish your medical records. Privacy isn't evidence of guilt.

The region is already leaving

Five cities near us ended it in six weeks.

  1. July

    Newport, Kentucky

    Ended its pilot and removed its cameras.

  2. Aug 18

    Oxford, Ohio

    Council voted 6–1 to terminate — overriding its own review commission, which had recommended keeping the cameras with added safeguards.

  3. Aug 18

    Fort Mitchell, Kentucky

    Ended its program the same night.

  4. Aug 24

    Independence, Kentucky

    The mayor ordered all cameras physically removed — while saying he still personally believes the technology works. He pulled them because residents asked him to.

  5. Aug 28

    Fort Thomas, Kentucky

    Announced it is discontinuing Flock, citing privacy concerns and the network shrinking as neighbors drop out.

  6. Ongoing

    Monroe, Ohio

    Residents are actively pushing council to end their contract. See deflockmonroe.com.

  7. Now

    Lebanon, Ohio

    Undecided. This is the part you're in.

What actually moves this

Read it. Then watch the clock.

The mayor did the hard part. What happens next depends on whether anyone is paying attention when the answers come back.

  1. Read the letter yourself

    All 54 questions were posted publicly by Mayor Messer. Do not take anyone's summary of it, including this page. It is specific, technical and worth your time.

  2. Mark September 7

    That is 21 days from the letter. Flock was asked for written answers signed by an officer authorized to speak for the company, and asked to flag anything it considers confidential and why. A non-answer is an answer.

  3. Be in the room September 8

    Lebanon's next regular City Council meeting falls the day after Flock's deadline, not by anyone's design, just the calendar. If the response is weak, incomplete, or doesn't arrive at all, this is the first public meeting where that can be raised.

    Lebanon City Council Meeting

    Tuesday, September 8 · 7:00 PM

    Council Chambers
    50 South Broadway, Lebanon, OH 45036

    You don't have to speak. Sitting in the room the day after a 21-day deadline says something on its own.

  4. Tell Council you're watching

    Resolution 2024-021 already gives Council review authority over the ALPR policy. Council members are the ones who decide what happens if Flock cannot answer.

    Contact council

    Mayor Mark Messer ·Vice Mayor Scott Norris. Councilmembers Mike Cope, Kristen Eggers, Brad Lamoreaux, Matt Sellers, Jen Harper. Email links for each are on the city site: lebanonohio.gov

  5. See where the cameras are

    DeFlock is an independent, crowdsourced map of license plate readers across Lebanon and Warren County. It includes cameras from multiple vendors and agencies, not only Lebanon's twenty.

    Open the map

    If the button doesn't open: deflock.me

Check everything

Don't take our word for any of it.

Every claim on this page traces to a public document or named reporting. If something here is wrong, we want to correct it.

  • Mayor Mark Messer, letter to Flock Group Inc., August 17, 2026 — 54 questions, copied to the City Manager, Law Director, Chief of Police, Warren County Prosecutor and City Council. Posted publicly by the Mayor.
  • Lebanon Resolution No. 2024-021, adopted March 26, 2024, approving ALPR policy General Order 41.3.9 with Council review of future edits
  • Flock Safety CVEs in the National Vulnerability Database, including CVE-2025-59404 (bootloader unlocked) and CVE-2025-59408 (Secure Boot disabled) — nvd.nist.gov
  • GainSec, "Examining the Security Posture of an Anti-Crime Ecosystem," November 2025 — 51 findings, 22 assigned CVEs
  • Flock Safety's own published response to the security research, November 2025 and January 2026 — the company states the findings required physical access and that it registered the CVEs with MITRE itself
  • Lebanon City Council members and contact information — lebanonohio.gov
  • Carpenter v. United States, 585 U.S. ___ (2018) — the Supreme Court held 5–4 that tracking a person's movements over time is a search requiring a warrant
Where this page stands. This site supports the questions the Mayor asked and takes no position on the competence of the Lebanon Division of Police, which by every public account has run this program carefully. The argument here is narrower and it is the Mayor's own: safeguards that cannot be independently verified are promises, not controls. Separately, on the law — Carpenter concerned cell-site records, not license plate readers, and lower courts remain split on whether its reasoning extends to ALPR networks. Ohio has passed no statute limiting ALPR retention or restricting data sharing with federal agencies. That leaves the decision with City Council and the people who elect it. Corrections are welcome and will be made.