As Flock cameras have quietly multiplied across the country in recent years, public concern about privacy, surveillance, and abuse of the technology by law enforcement has sparked nationwide backlash. This led to a number of cities pausing, not renewing, or canceling their contracts with Flock Safety, the leading company behind the controversial AI-enabled automated license plate readers, this year. 

And now, citizens have voted on the issue. 

Towns in two states, Texas and Maine, voted on midterm ballot measures concerning Flock. And in both cases, the people ruled against the tech. 

While these are just two communities out of the thousands that use the cameras — hardly enough to dismantle the nationwide surveillance network — these results show the real possibility of taking on mass surveillance and winning.

But one issue remains: Even if the initiatives that passed on Tuesday inspire similar civic resistance in future elections, the fight against the problem that Flock represents is just beginning for those who don’t want their every move tracked. 

Nongovernmental entities — such as college campuses, homeowners associations, even supermarkets — have started purchasing and deploying Flock cameras of their own and sharing the data with law enforcement. 

Now, the fight will need to go beyond the ballot box. 

An end to the status quo?

While some advocates for Flock systems argue that the company’s AI-enabled automated license plate readers (ALPRs) may make solving certain crimes easier, public attention has been drawn to overt misuse of the technology by current and former law-enforcement officers. Even some police leaders have expressed concerns about Flock’s ability to target people who have not been accused of a crime, potentially raising serious constitutional issues. 

Both York, Maine, a small city of about 14,000, and the midsize League City, Texas, took the issue to the ballot box. 

In York, residents were asked to consider a citizen initiative called the “Stop ALPRs Ordinance” that made the ballot after receiving over 100 residents’ signatures. Its residents decisively rejected the surveillance cameras, with 5,386 votes (73 percent of the vote) in favor of the ordinance and only 2,043 votes (27 percent) against. Effective immediately, the measure bans ALPRs in the town of more than 14,000 and requires voter approval before the town installs any such tech in the future.

Meanwhile, in League City, Texas, voters decided on an advisory question, Proposition A, which asked: “As a nonbinding statement of voter preference, should the League City Police Department continue using automated license plate reader cameras at fixed locations on public roadways for law enforcement purposes?”

Voting “yes” on the measure meant approving the use of ALPRs at fixed locations on public roadways for law enforcement purposes, while a “no” vote would oppose such uses. Though the ballot question was technically non-binding, League City’s City Council committed to act on the vote’s outcome. The measure passed with 54 percent of the vote. 

In response to a request for comment about these two measures, a Flock spokesperson told Vox, “We’re grateful to both York and League City elected leaders and community members who engaged in this conversation. Flock technology has had a real impact helping to solve crime in those cities and across the country.” The company added, “While we’re disappointed in the outcome, we respect the decision voters made and will work directly with the city on next steps.”

To privacy advocates working in the surveillance space, these wins signify a shift.

“The status quo for the longest time has been that cities and law enforcement agencies have been able to approve and award massive contracts for surveillance tech and rarely have any sort of trouble passing them,” said Reem Suleiman of the digital rights group Fight for the Future, which advocates against mass surveillance and hosts the site StopALPRs.com. “In 2026, this isn’t the case.”

“People feel and understand that they do actually have a stake when it comes to surveillance tech and how it’s used.”

Reem Suleiman, Fight for the Future

The backlash has been building for some time, Suleiman said, pointing to the nonprofit Secure Justice’s tracker of nearly 500 actions by cities over the past year to pause or terminate Flock contracts. She also noted that the fight has moved beyond city councils — a Senate Judiciary hearing in late September showed bipartisan interest in reining in license plate readers, and federal and state proposals are multiplying.

Because these decisions to employ ALPRs and other surveillance technologies have typically been made without public input, Suleiman said, putting the question to voters reflects a meaningful change: “People feel and understand that they do actually have a stake when it comes to surveillance tech and how it’s used.”

Voting against local city use of Flock cameras, however, may be just the tip of the iceberg. 

Where the fight goes next

The uptake of Flock cameras by nongovernment actors presents a separate accountability challenge that may complicate the efforts of anti-surveillance activists. Homeowners associations, hospitals, schools, and big retailers are contracting for the same technology, with no council meetings for citizens to pack and no ballots to vote on. 

According to reporting by Inc., of the approximately 12,000 customers using Flock cameras, 5,000 are private-sector entities. These private buyers can opt to have the data generated by their cameras automatically shared with law enforcement. Many of them do just that, including commercial chains such as Home Depot and Lowe’s, and Simon Properties, the US’s largest network of shopping malls.

According to Flock’s website, if these private customers choose to share data with local law enforcement, they can allow the system “to notify authorities when a flagged license plate is detected, without requiring action from the camera owner.”

One of Fight for the Future’s current targets is Lowe’s, which Suleiman described as one of the largest commercial buyers of Flock cameras. “I don’t want anybody to live under a false sense of security because, unfortunately, there are so many different ways we are exposed to surveillance and to these cameras,” she said.

Critics of license plate readers also fear that cities are swapping out one vendor for another without addressing underlying concerns about data privacy and surveillance. For instance, Axon, a $48 billion company that produces a slew of law enforcement technology, has capitalized on Flock’s recent PR challenges by swooping in to replace its competitor in at least seven municipalities across five states.

In that context, even more ballot measures might not be enough to address the concerns of privacy advocates. Suleiman still has thoughts about what ordinary people can do to push back against increasingly privatized networks of surveillance technology. 

“Get involved in those fights,” Suleiman said. “There is a lot of power that consumers have in terms of voicing their values and insisting from the places they shop and the brands that they love that they’re not going to be complicit in the surveillance network.”

This story appeared in Today, Explained, a daily newsletter that helps you understand the most compelling news and stories of the day. Subscribe here.

Are we living through “Black October”? Maybe, according to cybersecurity experts who are raising the alarm about AI’s increasingly sophisticated and far-reaching hacking abilities. 

This week alone has seen a string of alarming incidents where AI uncovered previously unknown security flaws deep in the infrastructure of the internet. The most concerning involves something called PHP —  a programming language that, according to The Atlantic, is used by “as much as 70 percent of websites.” Cybersecurity researchers used AI to locate a major security breach in the technology.

It’s the kind of thing that, when it’s working, is practically invisible. When it stops, though, you really notice it: Government websites in the UK and Europe briefly went down earlier this week after the PHP vulnerability was discovered, as did some sites in the Wikipedia family, the Internet Archive, and many others.

The outages weren’t actually the result of a hack, but rather preventative action as web engineers took sites down to fix the vulnerability before it was exploited. But not every PHP-like issue will necessarily be uncovered before it can be exploited by someone using AI tools less ethically, and older websites relying on PHP might go unpatched. 

The problem doesn’t stop there, either: Concern is also rising around AI cybersecurity risks to ubiquitous conveniences like online banking. As Axios reported on Thursday, banks are detecting more and more “unauthorized third-party AI agents” operating inside of their systems. 

Those agents are mostly unauthorized by the banks, Axios explains — the holders of the bank account might have given them permission — but it still creates a security risk that executives described as “horrifying,” in part because banks can’t necessarily tell if an agent doesn’t have permission. 

It’s a lot to take in, all of it moving extremely quickly, and it’s hard to tell what any of us can do about it as AI labs continue to forge ahead with ever more competent AI models and agents. Luckily, my colleague Adam Clark Estes has some simple recommendations to shore up your own cybersecurity.

How do I respond right now?

One problem with hackers — even those that happen to be AI agents — is that they can be unpredictable. You won’t know to, say, lock down your Quest Diagnostics records before a breach happens. But whenever you find yourself wondering if your data is safe, that’s a good time to double check that you’ve at least covered your bases.

The National Cybersecurity Alliance, a nonprofit dedicated to the safe use of technology, maintains a list of basic online safety practices that everyone should follow. In no particular order, here’s what to pay attention to now:

1. Keep your guard up. AI makes it difficult to know the difference between humans and robots. It’s a fact of life in the year 2026. So be extra careful to avoid engaging in potential phishing scams. Don’t reply to unknown texts, and do due diligence on texts or emails that look like they’re from people you know but just seem off. Don’t click weird links. Don’t give out personal info over the phone, even if it sounds like it’s someone you know. They might be scammers using AI to clone a loved one’s voice.
2. Update your software. Yes, it’s annoying to pause your phone or computer use for a few minutes to update your software, but this is one of the best ways to get rid of vulnerabilities. Companies like Apple and Google employ huge teams of security experts to spot these in their software and fix them with software updates. Do the updates.
3. Use a password manager or, even better, passkeys. Each of your online accounts should have a unique password that’s at least 16 characters. Yes, it’s impossible to remember that many passwords, so you should also use a password manager like 1Password or the app built into your iPhone or Android device.
4. Turn on multifactor authentication. Just in case you don’t already do it, make sure you use multifactor or two-step authentication for all your accounts, including email and social media. It can be annoying to type in a code or check your email while logging in, but hackers, including AI agents, will have a much harder time getting into your accounts if you take this step.

Taking all these measures is not a one-time affair. You have to be vigilant in keeping yourself safe online. Security experts have a term for this that’s almost too specific: cyber hygiene. Like brushing your teeth or taking a shower, take good care of your online life, and do it often.

One link for later

➨ Is it still possible to ban gerrymandering? The current US Supreme Court is very, very hostile to getting politics out of congressional map-making. But if Democrats win back power, that doesn’t mean they shouldn’t try. My colleague Ian Millhiser gamed out how they could do it in a way that survives the Court — as well as some approaches that almost certainly wouldn’t fly. But, he writes, the real trick will be finding a solution that functions the way Congress wants it to and can’t be exploited by mapmakers.

Before you go…

• Did you know…that the disease multiple sclerosis is misdiagnosed with surprising frequency? As many as 15 percent of diagnoses could be false positives — including that of Christina Applegate, who found out this week that she does not have MS despite a 2021 diagnosis.
• Today’s trivia: Which noble gas is radioactive and has the chemical symbol Rn? (You can find this and other brain puzzles in Vox’s daily crossword. Look for the answer in Monday’s edition.)
• Yesterday’s trivia: We asked what the plural was for multiple Toyota hybrids. That would be Prii, which Toyota officially confirmed in 2011 after holding a vote.

This story appeared in Today, Explained, a daily newsletter that helps you understand the most compelling news and stories of the day. Subscribe here.

The last US troops in Iraq formally withdrew today, 23 years after the United States first invaded Iraq and 12 years after it returned to take on the Islamic State. It’s a historic occasion, by many accounts — but also a pretty low-key one: The US has steadily scaled back its presence in Iraq for years as part of a phased drawdown inked by the Biden administration. 

That drawdown represents the end of a long (and often, ugly) chapter in US military history. The US and its allies deployed tens of thousands of troops to Iraq as part of the larger war on terror that started in 2003. 

Those troops left Iraq in 2011. But a smaller contingent returned three years later to stamp out the Islamic State, a violent jihadist group that had gained a major foothold after Western forces left the country. 

Neither campaign was particularly popular with the American public in the end, and more than 4,500 Americans have died in Iraq in the past 20 years. Large numbers of civilian casualties, as well as drone strikes that were seen as violations of Iraq’s sovereignty, have also fueled periodic Iraqi protests against American intervention. 

As the US withdraws, however, it’s leaving behind some very loose ends. Loose ends that, as we’ll see in a minute, ultimately benefit…Iran.

Go a little deeper

Don’t quite believe me? Just look at how Iran’s allies are celebrating today’s news. The commander of one Iranian-backed militia in Iraq called the withdrawal “a crushing defeat for the American project.”

Both Iran and the United States have spent the past 23 years attempting to shape the new Iraq. Historically, Iran and Iraq were bitter rivals — an enmity probably best demonstrated by Saddam Hussein’s 1980 invasion of Iran. 

After the US toppled Hussein in 2003, however, Tehran redoubled its efforts to build political and military clout in the new Iraqi state. It strengthened ties with figures like Hadi al-Amiri, whose Iran-backed Badr Organization has become a major force in Iraqi politics. It poured hundreds of millions of dollars into soft-power projects, like expanding Shiite pilgrimage sites in Iraq. And it funded, equipped, and trained a number of powerful paramilitary groups.

Some analysts have warned that the final withdrawal of US troops could embolden Iranian-linked groups in Iraq. That also seems to be a concern on the ground, where ordinary Iraqis have told reporters they fear their country “could be swallowed up” by groups linked to Iran.  

Already, the Iraqi government has pushed back the deadline for Iranian-backed militia groups to disarm. It was originally supposed to happen on the official date of the US withdrawal — today.

It’s an inglorious ending, all told — and a sobering lesson on the limits of American power. The US may have the resources to handily win any military spat it gets itself into. But securing a desired political outcome is a different and more time-consuming project altogether.

It doesn’t help that US rivals like Iran seem very willing to play the long game. By dipping in and out of places like Iraq, the US may risk giving Tehran more openings. 

One link for later

➨ Don’t throw out that old receipt! It — along with the political mailers, ticket stubs, business cards, product packaging, and other printed ephemera you encounter in your day — is perfectly suited to the newly viral hobby of junk journaling. It can be a powerful creative practice and the ideal antidote to doomscrolling.

Before you go…

• Did you know…that your sense of touch peaks in your late teenage years, and declines gradually from there? It might be one of the reasons that elderly people are prone to falls.
• Today’s trivia: Where was Napoleon exiled to after his forced abdication? (You can find this and other brain puzzles in Vox’s daily crossword. Look for the answer in tomorrow’s edition.)
• Yesterday’s trivia: We asked you for the origin story of civil rights icon Ruby Bridges. She was the first Black child in the American South to attend an all-white elementary school, and she went on to start a foundation devoted to tolerance.