CommandEleven Intelligence // Homeland Desk. Dossier, status as of October 31, 2026. Built on two Justice Department Inspector General audits and on civilian-side reporting through October 30. Both audits are public, redacted versions.
Bottom Line Up Front
The Justice Department’s own Inspector General has now audited, twice, how well the government protects its people and operations from ubiquitous technical surveillance (UTS): the collection and analysis of everyday data that connects individuals to people, events and places. The answer both times is the same. The defense is uncoordinated, undertrained and has no single owner.
The June 2025 audit of the FBI (25-065) found a response its own watchdog had called “disjointed and inconsistent” in 2022, a red-team gap analysis that ran one page and covered three of six categories, no single executive in charge of an enterprise-wide incident, and advanced training that funding requests could not expand. The September 2026 audit of the rest of the Department (26-097) found no common definition, no policy, no coordinating office, and 46 reviewed courses with none specific to UTS. Fewer than 1 percent of non-FBI personnel completed the voluntary ones.
These audits are about defense, not about civilian surveillance. They do not mention license plate readers or Flock. But the 2018 cartel case at the center of the FBI audit shows the mechanism: phone data plus access to a city’s camera network let a hired hacker follow an FBI officer and identify the people around him. That is why the civilian record belongs next to the audits. The same kinds of data, cameras and location trails are growing in the open, with access controls that local officials themselves say they could not verify.
Key Judgments
KJ1: The government’s own auditors say the defense against UTS is not coordinated. Two audits, 15 months apart, reach the same finding about two different parts of DOJ. [CONFIRMED]
KJ2: The risk is operational, not theoretical. The audits cite a cartel that hired a hacker to pull an FBI attaché’s call and location data and tap a city camera system, and an organized crime boss who identified an FBI-issued phone from an employee’s call logs. In the first case the cartel allegedly used the result to intimidate and in some cases kill potential sources. [CONFIRMED on the audit’s account; the underlying case details are largely redacted]
KJ3: Agreeing to fix it is not fixing it. The FBI neither agreed nor disagreed with the 2025 recommendations, and OIG’s own report page still listed two of the four as open. DOJ’s security office concurred with all three 2026 recommendations, with no deadlines stated. Both sets are marked resolved, not closed. [CONFIRMED]
KJ4: The audits do not cover the civilian surveillance buildout, and we do not claim they do. The Flock record is a separate body of evidence. It shows weak access controls, cameras that stayed or came back on after cities ordered them off, and fast political reaction in 2026. [CONFIRMED on the reported incidents; ASSESSED on what they imply]
KJ5: Several claims made on air about this topic do not hold as stated. SignalTrace is a Leonardo product, not part of Flock. “Nearly every” canceling city has not been shown to have switched to Axon. We note where. [CONFIRMED]
KJ6: Nothing here is registered on the Foresight Record. The forward claims made on air are either conditional on an event that has not happened or too loose to score. [METHOD]
What UTS Means
The FBI defines UTS as the widespread collection of data, and the application of analytic methods, to connect people to things, events or locations. It identifies five vectors. [CONFIRMED]
- Visual and physical: cameras and physical surveillance used to identify people or objects tied to an operation.
- Electronic signals: phones and other devices.
- Financial: transaction records tied to an account holder. The audit cites a 2015 MIT study in which four anonymized card transactions identified a cardholder 90 percent of the time.
- Travel: hotel stays, border crossings and flight reservations.
- Online: advertising data from browsing and social media use.
FBI and CIA officials told the auditors the threat is “existential” to FBI operations. The audit frames UTS as a defensive problem: how an adversary can use ordinary data trails against the Bureau. That is the framing used here.
Audit One: The FBI (25-065, June 2025)
The audit covers FBI efforts from 2018 through January 2024. It rests on interviews with about 80 FBI officials, visits to seven field offices, and meetings with CIA and DIA officials. Its sequence of findings reads as a case study in institutional slowness. [CONFIRMED]
- The warning, December 2022. OIG wrote to Director Christopher Wray that the FBI’s response to changing operational technology was “disjointed and inconsistent,” and recommended an enterprise-wide threat assessment and baseline training for everyone.
- The designation, January 2023. Wray named UTS a “Tier 1 Enterprise Risk” and set up a red team of senior executives from each division. The kickoff drew 22 officials.
- The gap analysis. What the red team produced for OIG in January 2024 was one page, covered three of its six categories and had no detail. The FBI later called it an “outline.”
- The Counterintelligence Division’s work was left out. That division had built its own “Anatomy of a Case,” mapping UTS risk across a typical FBI case. The office running the review did not know of it in February 2023. OIG concluded the gap analysis captured only part of the vulnerabilities the division had identified, so the real list is longer.
- The mitigation plan was short-term. A draft shared in September 2023 had items marked complete, no requirement to repeat assessments, and monitoring and auditing sections that OIG found lacked specificity and accountability.
- No one owns it. A UTS strategic plan, in progress since late 2023, did not assign responsibilities to officials with authority to execute it or set a clear line of authority for an incident. The CIA, by contrast, had senior executives directing enterprise-wide coordination.
- A breach followed. A data breach found after fieldwork is almost entirely redacted. OIG said it reflected long-standing poor tradecraft and that neither the gap analysis nor the draft plan gave enough specific guidance to prevent it.
- Training reached the many but not the few who need it most. A mandatory 45-minute awareness course, due by June 2024 and repeated every two years, covers all employees. Advanced HUMINT courses reach few students because of limited resources, and the FBI told OIG that its FY2025 and FY2026 funding enhancement requests to DOJ were denied.
The cartel case. In 2018, the audit says, a person connected to a cartel contacted an FBI case agent and revealed that the cartel had hired a hacker to exploit phones and other devices. The hacker watched people entering and leaving the US Embassy in Mexico City and identified an FBI Assistant Legal Attaché. From the attaché’s phone number he pulled calls made and received plus geolocation data, accessed the city’s camera system, followed the attaché across the city and identified his contacts. The cartel allegedly used this to intimidate and in some cases kill potential sources or cooperating witnesses. [CONFIRMED on the audit’s account]
The FBI’s response. On March 18, 2025, the FBI neither concurred nor disagreed with the four recommendations and said it “will take corrective actions.” On the question of one accountable executive, it said the Deputy Director has the authority and that it has not assigned one executive to lead enterprise-wide UTS incident response. On training, it said funding requests were denied and it would keep requesting. OIG’s report page, as of this assessment, listed recommendations 2 (finalize the strategic plan) and 3 (set a clear line of authority) as open, in “resolved” status, which means agreed but not closed.
Audit Two: The Rest of DOJ (26-097, September 2026)
The second audit left out the FBI, because of the first, and looked at the Department’s other components. It interviewed 16 components and units outside the FBI, including ATF, BOP, DEA and USMS (the four law enforcement components, covering 32 subcomponents) and 12 non-law-enforcement components and subcomponents. [CONFIRMED]
- No policy and no owner. OIG found no DOJ policy specific to UTS and no law or regulation governing the Department’s response. No person or office has explicit responsibility for coordinating UTS across DOJ, and there is no single vehicle for sharing threat information.
- No common definition. Of the 16 non-FBI components and units, only the DEA’s Defensive Counterintelligence Unit had developed one: widespread, continuous collection of data from everyday devices and activities, connected back to an individual.
- A general lack of awareness. OIG found “a general lack of awareness and understanding” of UTS, with law enforcement components more aware than the rest. The data table that would show UTS-related incidents is fully redacted in the public version.
- Recent doxing. In the past year, individuals gathered publicly available but sensitive information and published it about immigration judges overseen by the Executive Office for Immigration Review, in ways that could enable intimidation. EOIR responded with security briefings and a data removal service.
- No dedicated training. DOJ identified 46 courses offered in FY2024 and FY2025 that it believed were related to UTS. None was UTS-specific. None described the threat, how to use UTS to DOJ’s advantage or how to defend against it. Seven of the 46 were mandatory. Voluntary courses were completed by less than 1 percent of non-FBI personnel.
The recommendations and the response. OIG recommended, to the Justice Management Division, a coordinated strategy with a common definition and an owner for the risk portfolio, a risk identification and mitigation plan, and mandatory basic UTS training for all personnel with advanced training for higher-risk jobs. DOJ’s Security and Emergency Planning Staff concurred with all three. It described a governance framework, a risk portfolio and tiered training. The audit states no deadlines. All three are marked resolved. They close when OIG sees the strategy, the plan and the training in place. [CONFIRMED]
What the Audits Do Not Say
- They do not address civilian surveillance, license plate readers, Flock or any commercial vendor.
- They do not say how often UTS has compromised an FBI or DOJ operation. The FBI audit is partly classified, the breach section is nearly all redacted, and the DOJ audit’s incident table is blacked out.
- They do not show that anything was lost beyond the cases described. The cartel case alleges deaths and intimidation, but the audit’s account of the outcome is general.
- They do not tell us whether the 2025 and 2026 fixes have since been delivered. Closure status is the thing to watch.
The Civilian Side: The Same Data, With Weaker Locks
The reason the audits matter outside the Bureau is that the data they warn about is being gathered at scale by private firms and local agencies. Flock Safety is the largest example. It is reported to operate more than 120,000 license plate cameras nationwide, up from about 90,000 in a December 2025 report, though the two counts come from different outlets. What follows is the documented record, with each item labeled. [REPORTED unless noted]
- Pflugerville, Texas. On August 25 the city council voted unanimously not to renew a $87,500-a-year Flock lease. A resident’s records request showed outside agencies had searched the city’s camera data almost 1.6 million times between February 16 and August 15. The city said it found a flaw that let nonpartner agencies access its data. Flock said the city had joined Texas’s statewide sharing network, enabled from 2024, that two out-of-state agencies were mistakenly classified as Texas agencies, and that the error was fixed months ago. Both accounts are on the record.
- Cameras that stayed on or came back. Cambridge, Massachusetts, ordered 16 cameras deactivated in 2025, found Flock technicians had installed two new ones in late November, called it a “material breach of our trust,” and ended its contract on December 9. Eugene, Oregon, ordered 57 cameras off in October 2025, and a resident found data still being collected on December 3. Evanston, Illinois, reportedly saw cameras reinstalled after it asked for them to be switched off. Mother Jones reports at least three towns have described Flock reinstalling or reactivating cameras after contracts ended. Flock’s only reported explanation, in Cambridge, was an outstanding work order that should have been canceled.
- Exposed cameras. Security researchers reported in December 2025 and January 2026 that dozens of Flock cameras, about 60 according to one headline, were streaming to the open internet without password protection. We have not read the primary research.
- Insider misuse. Mother Jones reports officers disciplined or charged for abuses such as searching an ex-girlfriend’s plates about 2,000 times.
- Cancellations. Secure Justice counts 214 cities that have dropped Flock since 2021, 90 of them in August 2026, the highest month on record.
- States. Florida announced it would revoke law enforcement license plate camera permits on state highways, with removal due by the end of September. Texas ordered state agencies to stop funding Flock cameras. Connecticut passed new restrictions, which critics say are thin.
- Congress. Senators Sanders and Merkley and Representative Ocasio-Cortez introduced the Ban Flock Act on October 5. It would cut federal funding to governments that use plate readers and bar federal agencies from using them or their data. It has not advanced beyond introduction in anything we could read.
[ASSESSED] This is not proof that Flock data has been used against an agent or source. It is evidence that the control problem the audits describe inside DOJ, no single owner, uneven training and unclear lines of access, is also what local officials describe when they cannot say who was searching their data or whether their cameras were on. The cartel case needed two things: a data trail and access to a camera system. Both exist in the open today, and the people responsible for guarding them say they cannot always tell who is looking.
Claims From the Surveillance Debate, Checked
The August 29 Survival Dispatch broadcast, which opened with a CommandEleven brief on this topic, made several claims. Here is how each stands.
- “A private company operates a national vehicle tracking network used by thousands of agencies.” Supported. Flock is reported at over 120,000 cameras feeding a searchable network. The agency count comes from the company and was not independently checked. [CONFIRMED on structure]
- “Searched across jurisdictions without a warrant.” The Pflugerville record shows outside agencies searching the city’s data at scale. Whether a warrant was required varies by state and use, and we did not find a blanket rule. [PARTLY CONFIRMED]
- “Cities are cancelling, but replacing Flock with Axon.” Cancellations are documented. Mother Jones says cancelling cities will likely turn to other vendors such as Motorola, Rekor and Axon, and reports an Axon executive’s remark that some customers want cameras that look different from Flock’s. It does not show that most or all did so. [CANCELLATIONS CONFIRMED; AXON SWITCH PARTLY SUPPORTED]
- “SignalTrace is tied into Flock.” Not supported. SignalTrace is a Leonardo product that works beside plate readers, collects Bluetooth and Wi-Fi broadcasts and, as of an August report, may be live in only one or two US locations. The reporting we read does not say it is a Flock product or integrated with it. [NOT CONFIRMED]
- “Flock can turn cameras back on after a city shuts them off.” Cameras staying or coming back on after cancellation is documented in Cambridge, Eugene and elsewhere. A deliberate back door is an inference, not a finding. Flock attributes Cambridge to a work order. [REACTIVATIONS CONFIRMED; BACK DOOR UNVERIFIED]
- Forward claims on air: gait recognition next, a data dump from Flock, and a “Patriot Act 2.0” after a mass attack. The first two are not dated or measurable. The third is conditional on a multi-city attack that has not happened. [NOT YET TESTABLE]
What to Watch
- OIG closure notices. Whether recommendations 2 and 3 of the FBI audit close, and whether the DOJ strategy, risk plan and baseline training in 26-097 get dates.
- A named owner. A policy or strategy document that makes one executive responsible for enterprise-wide UTS incident response.
- Florida and Texas follow-through. Whether the highway camera removals were completed and whether other states copy them.
- The Ban Flock Act. Whether it gets a committee hearing or any Republican co-sponsor.
- Device tracking. Whether SignalTrace-type systems move beyond a pilot, and whether vendors link plate reads to phone signals at scale.
- A documented incident. The single event that would change this assessment: a public case in which commercial plate or camera data was used to identify an agent, source or witness.
What This Dossier Does and Doesn’t Establish
It establishes what two Inspector General audits found, what DOJ and the FBI said in response, and what is documented about Flock-related incidents and political reaction through October 30. It does not establish that civilian plate-reader data has been used against law enforcement, how many FBI operations UTS has compromised, whether the audit fixes have been delivered, or the motives of any vendor. It does not rely on social-media posts. Where a number comes from a vendor or an advocacy count, we say so. The public audit texts are redacted, and the findings here are limited to what is visible.
Frequently Asked Questions
What is ubiquitous technical surveillance?
The FBI’s term for collecting widespread data and analyzing it to connect people to things, events or locations. It names five vectors: visual and physical, electronic signals, financial, travel and online.
What did the FBI audit find?
That the FBI lacked a coordinated, authoritative plan against UTS, that its red-team gap analysis was one page, that no single official owned enterprise-wide incident response, and that advanced training was too limited. It made four recommendations in June 2025.
What did the DOJ audit find?
That outside the FBI, DOJ had no common UTS definition, policy or coordinating office, and that none of 46 reviewed courses was UTS-specific. DOJ agreed to all three recommendations.
Do the audits mention Flock?
No. They are about defending DOJ’s own people. The Flock record is separate evidence about the civilian side.
Will CommandEleven Intelligence score this?
Not yet. No dated calls are set here, and nothing is counted on the Foresight Record. We are currently in the process of reviewing all on-air calls from Survival Dispatch episodes, once that process is complete, the record will be updated.
Sources
- DOJ Office of the Inspector General, Audit of the FBI’s Efforts to Mitigate the Effects of Ubiquitous Technical Surveillance (25-065)
- DOJ Office of the Inspector General, Report page for 25-065, with recommendation status
- DOJ Office of the Inspector General, Audit of the DOJ’s Efforts to Mitigate Ubiquitous Technical Surveillance (26-097)
- Community Impact, Pflugerville City Council votes to end Flock Safety contract
- Mother Jones, Flock Is Canceled, and Its Competitors Are Profiting
- The Record, Flock Safety cameras remained active after cities asked to turn them off
- Slashdot, Flock Accused of Reactivating Its Cameras Without Notifying a Town
- Slashdot, What Happened After Security Researchers Found 60 Flock Cameras Livestreaming to the Internet
- Schneier on Security, Flock Exposes Its AI-Enabled Surveillance Cameras
- TechRadar, Think Flock is bad? This new tech is coming to link license plates with your phone
- StateScoop, Lawmakers introduce Ban Flock Act to block federal funding for governments that use ALPRs
- Reason, Connecticut’s new restrictions on Flock cameras highlight the dearth of meaningful privacy protections
- Survival Dispatch News, broadcast of August 28, 2026, “The Surveillance State Is Already Here“
