Guardrails After the Crash: Why Michigan Built Rules for LEIN and Not for Flock

Michigan made LEIN misuse a crime, audits it on a schedule, and makes every user sign for it, and officers still run people they know. Flock went up on poles without even that much. Now a former Oakland County deputy is accused of getting into the data after he no longer worked there.

Let me tell you which sentence in this story stopped me. It was not the word “unauthorized.” It was the sheriff’s office saying the person was no longer employed by Oakland County in any capacity when the access happened.

A deputy who misuses a system while on the payroll is a misconduct problem. A former deputy who gets into the system after leaving is a design problem. Somebody’s access outlived their employment, or somebody else’s credentials were in reach, or the system was open in a way it should not have been. Every one of those possibilities describes a control that was supposed to exist before the first camera went up on a pole.

Michigan police agencies know what those controls look like, because they already live under them for LEIN. Those rules have not stopped every officer from running someone they know. Nobody should pretend otherwise. But they make misuse a crime, they put a signature on the line, and they send an auditor to look. Flock got none of it.

What Oakland County Announced

The Oakland County Sheriff’s Office announced the week of Sept. 28, 2026 that it is investigating a former deputy who allegedly misused Flock license plate reader data without authorization, WXYZ reported on Oct. 4. According to the sheriff’s office, the person was no longer employed by the county in any capacity at the time of the access. The office has not named the former deputy, and Commissioner Kristen Nelson described it to WXYZ as an active criminal investigation.

The obvious next question is how. WXYZ reported that questions remain about how a former deputy gained access, and the sheriff’s office has not said. That gap is the center of this story, and it is answerable. Account creation and deactivation logs, the Flock audit trail for the account used, and the office’s written policy on removing system access at separation are all records the office keeps.

Two Weeks Earlier, Commissioners Were Told It Was Locked Down

On Sept. 17, the Oakland County Board of Commissioners took up the sheriff’s office’s FY 2027 Auto Theft Prevention Grant, and Flock came with it. Sheriff’s office staff presented the technology and told commissioners the data was securely stored. The office’s chief technology officer, Capt. Steve Schneider, described the county’s Flock data as its own encrypted instance. “It is not a database that anybody else can just look into,” he said.

Commissioner Kristen Nelson had been raising privacy and oversight concerns about Flock before the announcement. After it, she told WXYZ that the sheriff’s office does have policies, but they are internal, and nobody yet knows whether they are enough.

That is the problem in one sentence. Encryption protects data from outsiders. It does nothing about an insider, or a former insider, who still has a working login. The question commissioners needed answered on Sept. 17 was not whether the database was encrypted. It was who could get in, how that list was maintained, and who checked it.

Every Way This Could Happen Is a Control That Should Already Exist

The sheriff’s office has not said how the access happened, and the investigation will have to establish it. But the possibilities are finite, and each one maps to a basic safeguard.

If the former deputy’s own account stayed active after separation, that is a deprovisioning failure. Shutting off access the day someone leaves is the most basic rule in information security. If the access ran through another person’s login, that is a credential-sharing failure, and it implicates whoever handed it over. If the access came through a partner agency or a shared network connection, that is a data-sharing failure, the same concern Eastpointe’s mayor raised when he said the city could not adequately control how other agencies use information shared through Flock’s network.

None of these require new technology to prevent. They require someone to write the rule down, assign a person to enforce it, and check it on a schedule. Michigan did that for LEIN. The LEIN record also shows what happens next: the rules catch people, and people keep testing them anyway.

Michigan Already Wrote a Rulebook. It Still Leaks.

The Law Enforcement Information Network is the Michigan State Police system officers use to run plates, driver records, warrants, and criminal histories. It holds sensitive personal information, and Michigan built a legal structure around it on purpose.

Misusing LEIN is a crime. Under MCL 28.214, a section of the Criminal Justice Information Systems Policy Council Act, a first offense is a misdemeanor punishable by up to 93 days in jail and a $500 fine. A second or subsequent offense is a felony punishable by up to four years and a $2,000 fine. Using driver information from LEIN for an impermissible purpose is a separate felony under MCL 257.903, and the federal Driver’s Privacy Protection Act adds civil liability.

Access is tied to the job. MSP’s executive training materials state that LEIN operators and people who request LEIN information must be employees of a criminal justice agency unless a statute or LEIN policy authorizes otherwise. A former deputy, by definition, does not qualify.

Users sign for it. MSP’s Notice of Criminal Penalties and Civil Action spells out the state and federal penalties, and users acknowledge in writing that they have read it and will comply.

And it gets checked. Every agency with direct LEIN access must submit to an MSP on-site audit once during each three-year cycle. Agencies must maintain written policies on awareness training, discipline, media protection, monthly validation, and physical protection. Each agency’s Terminal Agency Coordinator is responsible for reporting known misuse. If misuse is confirmed, administrative rule R 28.14607 directs MCOLES to suspend a licensed officer from using LEIN information.

None of that is exotic. It is a criminal penalty, an eligibility rule, a signature, an audit, and a license consequence. The same agencies that live under it bought Flock, and Michigan never required any of it to come along.

And Officers Misuse LEIN Anyway

Here is the part the LEIN comparison cannot skip. Every one of those guardrails is in place, and Michigan officers still use LEIN for personal reasons.

In Clinton Township, former officer John Hreno ran a license plate through LEIN with no law enforcement reason to do it. A Michigan State Police audit flagged the search, the township fired him, and in May 2024 he was sentenced to two years of probation on a misdemeanor. In Richmond, Police Chief Thomas Costello was charged with unauthorized disclosure of LEIN information after prosecutors said he looked up a woman’s information in June 2022 to help a dispatcher’s son in a custody dispute. He pleaded no contest and was sentenced to five days in jail, withdrew the plea the same day, and was acquitted by a jury in November 2023. In 2017, Lowell’s police chief, Steven Bukala, was charged with five misdemeanor counts of unauthorized LEIN use.

The national picture is worse. A 2016 Associated Press investigation found that between 2013 and 2015, more than 325 officers nationwide resigned, were fired, or were suspended for misusing law enforcement databases, and roughly 250 more received lesser discipline. One case it documented was a Michigan State Police dispatcher who sold confidential data to lawyers for more than a decade. The AP also found that incomplete tracking made the full scope impossible to count.

That last line is the point. The LEIN rules are a floor, and a leaky one. A first offense is a 93-day misdemeanor. Audits come once every three years. Cases end in probation, plea withdrawals, and acquittals. But because the floor exists, Hreno’s search was flagged by an auditor, a chief could be charged, and misuse had a statute number. Flock users in Michigan are standing on nothing at all, and the cases surfacing now were found by reporters and vendor software, not by any state requirement.

Eastpointe and the Pattern of Policy by Headline

Eastpointe is the cleanest Michigan example of how this has been going. According to Axios, USA Today reporters examining Flock audit logs identified unusual searches by two Eastpointe police employees and alerted the department. The department locked both employees out and opened investigations. Within 24 hours of learning about the searches, Police Chief Corey Haines told Axios, the department adopted a stricter policy, set up new administrative review procedures, and turned on a Flock feature designed to flag suspicious searches.

All three of those things were available before reporters called. The flagging feature was a setting. The review procedure was a decision. The policy was a document. City Council voted 4-1 to end the contract anyway, and Eastpointe’s 18 cameras went dark.

Across Metro Detroit, the retreat is spreading. Independence Township became at least the sixth Metro Detroit community to cancel a Flock contract, according to the Detroit News as cited by Axios. St. Clair Shores voted to cover its cameras for six months while officials reevaluate. Sterling Heights is weighing whether to renew.

The National Version Has the Same Plot

The same sequence repeats in sheriff’s offices across the country. Hall County, Georgia, lost seven employees over Flock misuse after an internal review of 758 searches, then cut the number of users with access from 124 to 24 and shortened data retention from 30 days to seven. Albany County, New York, arrested a senior investigator accused of more than 4,000 unauthorized searches, including about 3,000 on a former girlfriend’s car, and only then restricted searches to supervisors. Colleton County, South Carolina, fired a lieutenant after new audit tools surfaced more than 2,700 unauthorized searches and then moved all Flock searches to its communications division.

USA Today’s reporting on Flock misuse has led to at least 22 police and sheriff’s officials being arrested, fired, placed on leave, or put under investigation. In each of those cases, the restriction, the shorter retention window, and the supervisor sign-off came after the arrest.

Lansing Is Catching Up, Slowly

Michigan lawmakers have three proposals on the table. House Bills 5492 and 5493, bipartisan bills pending in the House Judiciary Committee since early 2026, would require agencies to post policies on use and data deletion and would limit retention. Senate Bill 1131, introduced by Sen. Jim Runestad in August, would require a warrant for most access to plate reader databases, with exceptions for active criminal investigations, missing persons, and stolen vehicles, and would require deletion after 14 days.

In late September, Rep. Alicia St. Germaine introduced a bill with Reps. Ron Robinson and Mike Mueller that would require deletion after 30 days and impose fines and prison time on anyone who misuses the data for personal purposes. She told WXYZ the request came from law enforcement. “The police chiefs in my district, they asked for this,” she said. The Police Officers Association of Michigan responded that any law with criminal penalties must give officers clear standards for access, use, retention, and sharing. That is a fair ask, and LEIN already shows what those standards look like.

Flock itself has said it supports regulation with privacy and accountability guardrails. Every party in the room now says it wants rules. Nobody required them before the cameras went up. And if the bills simply copy LEIN, Michigan will get LEIN’s results: a statute, some audits, and officers who still run people they know.

What Fixing It Would Actually Require

LEIN’s framework is the starting point, not the finish line. Michigan should give Flock data at least what LEIN has, before deployment, and then fix the parts LEIN never solved: audits too rare to catch a pattern, penalties too light to deter, and misuse findings that stay inside the agency. Six pieces would close the gaps this case and the LEIN record expose.

Local boards do not have to wait for Lansing to do any of it. A county board or city council approving a grant or a contract can make every one of these a condition of the vote.

Before December

Oakland County commissioners have a vote on the calendar. Before they extend the Flock drone program, they can ask the sheriff’s office for its written Flock policy, the date the former deputy’s access was revoked, how many active accounts exist and how many belong to people who are no longer employed, how often the office audits searches and who reviews the results, and which outside agencies can query county data. Those are records, not opinions, and the answers will show whether the September assurances held up.

I am not arguing about whether plate readers help solve crimes. Agencies say they do, and some of them have the case files to show it. My point is simpler. Michigan already learned with LEIN that guardrails do not end misuse. They are the minimum that makes it a crime, gets it caught, and puts a name in a report. Flock was handed to agencies below that minimum, and now the state is waiting for the crash to decide where the rails go.