Twelve Breakpoints
A governance framework designed to stop one uncertain camera or database event from authorizing historical tracking or a high-risk stop.
Perfect sensors are impossible. High-stakes systems therefore need independent checks, uncertainty disclosure, limited privileges, auditable actions, and fail-safe defaults.
The controls below address different stages. Short retention cannot prevent a dangerous real-time stop. Officer verification cannot prevent a historical movement dossier. Audit logs cannot prevent misuse unless independent institutions inspect them and can impose consequences.
New: August 2026 change control. Compare Flock's five announced safeguards against these enforceable controls →
Independent verification
No stop, search, pursuit, or detention based solely on an ALPR alert; verify full plate, issuing state, vehicle make/model, and hot-list currency.
Why: Breaks the sensor-to-force escalation chain
Public reference →High-risk-stop threshold
Treat an alert as an investigative lead rather than probable cause absent corroborating facts.
Why: Reduces automation-bias commission errors
Public reference →Source-data integrity
Require originating agencies to preserve full identifiers, validate unusual plate formats, and promptly remove recovered vehicles.
Why: Prevents local entry defects from becoming national alerts
Public reference →Short retention
Delete non-hit observations on a short statutory schedule unless tied to a documented investigation.
Why: Limits retrospective movement dossiers
Public reference →Warrant for historical search
Require probable-cause warrants for historical movement searches and pattern-of-life analysis.
Why: Applies mosaic privacy principles to network scale
Public reference →Purpose limitation
Enumerate permissible serious-crime and emergency purposes; prohibit immigration, reproductive-health, protest, religion, and generalized identity searches.
Why: Constrains function creep and interstate conflict
Public reference →Network sharing control
Default to no national sharing; require named bilateral agreements, legal review, and recurring reauthorization.
Why: Prevents indirect access that defeats local law and public commitments
Public reference →Tamper-evident audit
Log query, user, case number, purpose, scope, results viewed, export, and downstream action; prevent users from editing reasons after the fact.
Why: Makes misuse investigations possible without treating vague logs as self-policing
Public reference →Independent audit
Publish quarterly aggregate use and error reports; sample queries and resulting stops; investigate outliers and complaints.
Why: Tests actual practice rather than policy text
Public reference →Meaningful remedy
Provide notice, correction, complaint, preservation, exclusion, civil remedy, and discipline pathways.
Why: Converts policy violations into enforceable accountability
Public reference →Procurement transparency
Publicly disclose contracts, camera counts, locations at safe granularity, retention, sharing relationships, training, efficacy claims, and renewals before purchase.
Why: Allows democratic review before infrastructure becomes sunk cost
Public reference →Effectiveness evaluation
Pre-register outcomes and compare against a matched or randomized baseline rather than counting raw alerts or anecdotes.
Why: Separates investigative utility from causal crime-reduction claims
Public reference →Minimum viable chain of corroboration
Before an ALPR alert justifies a stop, an officer should be able to answer:
- Does the complete plate match, including state and plate type?
- Does the vehicle's make, model, color, and body type match?
- Is the hot-list record current, and did the originating agency preserve the full identifier?
- Does the interface disclose omitted characters, confidence, and multiple candidates?
- Is there independent evidence supporting the level of force contemplated?
If the answer is unavailable, uncertainty should slow escalation—not disappear behind a red alert banner.