“You can’t get a breath of fresh air in or out of that place without us knowing, correct?” Columbine Valley Police Sgt. Jamie Milliman told Chrisanna Elser in September 2025 while issuing her a summons at her home in Colorado.
In the exchange, which was captured by Elser’s doorbell camera, Milliman accused her of stealing a package from a porch in the nearby town of Bow Mar.
Police had used Flock license plate readers to identify Elser’s green Rivian after the vehicle was caught driving through Bow Mar around the time of the theft. But the video of the porch theft, which Elser later found herself on Nextdoor, did not show the suspect ever getting into any car. It just showed a woman running off with a package.
Still, Milliman was convinced he had the right person.
“It became my job to prove my innocence,” Elser told CBS News. “And I thought it was supposed to be the other way around.”
Fortunately for Elser, her Rivian was equipped with multiple cameras and had recorded her route that day, helping prove she was not the thief. The charge was subsequently dropped.
In October 2026, Elser filed a federal civil rights lawsuit against Flock Safety, the towns of Columbine Valley and Bow Mar, and two police officials, alleging that the surveillance and wrongful accusation violated her constitutional rights.
But others may not be so lucky.
This is just one example of the many surveillance dragnets that government and law enforcement agencies use to collect information on people without them ever knowing it.
“You know it when you see it,” said Abigail Kunkler, counsel at the Electronic Privacy Information Center (EPIC), when asked to define a surveillance dragnet.
Typically, she explained, they have a few common characteristics, like the breadth of the information they gather and the large number of people captured by them.
The Trouble With Being in the Wrong Place
She cited geofence warrants as a prime example. These occur when law enforcement, in an attempt to identify a suspect of a crime, asks a tech company like Google to provide location data on devices recorded within a specific geographic area during a specified period of time.
It’s worth noting that in 2023, Google announced that it would start storing users’ Google Maps location history data on their devices instead of in its own cloud servers. The change, which began rolling out in 2024, has significantly limited Google’s ability to provide the historical location data previously used to fulfill geofence warrants.
In June 2026, the Supreme Court ruled in a case involving geofence warrants that police conducted a search under the Fourth Amendment when they obtained a suspect’s Google location history, even though the data was held by a third-party company.
The case involved a man named Okello Chatrie, who was charged in connection with the 2019 robbery of a credit union in Virginia after police issued a geofence warrant to Google.
Chatrie sought to suppress evidence stemming from the warrant from his trial, arguing that the warrant violated the Fourth Amendment. The Fourth Amendment protects people from unreasonable searches and seizures and generally requires law enforcement searches to be backed by a warrant and probable cause.
The district court determined that the warrant was unconstitutional because the government lacked “particularized probable cause” for every Google user swept into the geofence. However, the court declined to suppress the evidence, finding that officers had relied on the warrant in good faith.
Chatrie appealed, and the Fourth Circuit upheld the denial of his motion to suppress, though its judges disagreed about whether obtaining the location data constituted a search. The Supreme Court sent the case back to the appeals court to determine whether the warrant met the Fourth Amendment’s requirements for probable cause and specificity.
A lot of these programs can remain secret for years and are often revealed only through investigations by Congress, advocacy groups, or journalists.
A Marketplace for Your Private Life
Another surveillance dragnet came to light in March 2026, when 404 Media obtained internal U.S. Customs and Border Protection records showing that the agency had purchased cellphone location data from the online advertising industry.
The information was tied to mobile advertising IDs, or AdIDs, and CBP was testing its use in the agency’s “targeting, vetting, analysis, and illicit network discovery processes.” It was the first documentary confirmation that CBP had obtained phone-location data through the advertising ecosystem.
And CBP wasn’t alone. Through FOIA litigation, the ACLU obtained records showing that other Department of Homeland Security agencies had purchased large amounts of cellphone location data from brokers—information they would generally need a warrant to obtain directly from phone companies.
And once agencies have access to this kind of information, privacy advocates warn, they can try to expand how it is used.
In 2022, Sen. Ron Wyden revealed that Homeland Security Investigations, the criminal investigative arm of Immigration and Customs Enforcement, had collected records in bulk from international money transfer companies for transactions of $500 or more to and from certain Southwestern states and Mexico. The records were searchable through a database run by the Transaction Record Analysis Center (TRAC), a nonprofit established in 2014 as part of a settlement between the Arizona attorney general’s office and Western Union.
By 2021, TRAC held about 145 million transaction records from 28 companies, with more than 600 law enforcement agencies granted access. The database continued to grow. By July 2024, it contained more than 337 million transaction records, according to a Department of Homeland Security bulletin.
Although TRAC was initially established to support investigations into money laundering and other financial crimes, its records have also been used in immigration enforcement investigations.
In August 2025, Honolulu Civil Beat reported that Homeland Security Investigations had used money-transfer records to track down a Mexican man living in Hawaii who had sent money to relatives in Mexico. He was charged with illegally reentering the United States, an offense unrelated to the financial crimes the database was originally intended to help investigate.
In September 2025, Arizona Attorney General Kris Mayes’s office confirmed that it had cut off access to TRAC for agents in ICE’s Enforcement and Removal Operations division in late June and imposed additional restrictions on database searches. But the changes did not eliminate access for Homeland Security Investigations, the ICE division involved in the Hawaii case.
The Fourth Amendment’s Blind Spot
One reason agencies are able to collect or access so much information without necessarily violating the Fourth Amendment is what privacy advocates call the data-broker loophole, which is tied to a legal concept known as the third-party doctrine.
Under the traditional third-party doctrine, people generally have a diminished expectation of privacy in certain information they voluntarily share with third parties, such as banks or telecommunications providers. That can allow law enforcement to obtain some information from those companies without a warrant.
“And that’s not considered a search because they are not specifically coming to you, the person under investigation and trying to get information from you,” said Kunkler.
But the doctrine has important exceptions. In 2018, the Supreme Court ruled that police generally need a warrant to obtain historical cellphone location records from wireless carriers. Its June 2026 ruling in the Chatrie case similarly recognized Fourth Amendment protections for location data collected by Google.
The data-broker loophole raises a related question: whether government agencies can avoid restrictions on obtaining sensitive personal information by purchasing it from commercial data brokers rather than demanding it directly from the companies that originally collected it.
Lawmakers have introduced legislation aimed at closing that loophole, including a bill called the Fourth Amendment Is Not For Sale Act.
The bill passed the House in 2024 but failed to become law before that Congress ended. Similar protections were included in the Protect Liberty and End Warrantless Surveillance Act of 2026 and the Government Surveillance Reform Act of 2026, though neither proposal has advanced out of committee.
Meanwhile, legal challenges to the technology that ensnared Elser are multiplying. As Reuters reported Monday, proposed class-action lawsuits in Georgia, California, and Colorado are challenging Flock Safety’s sprawling license plate reader network, which numbers about 120,000 cameras across 49 states. The lawsuits raise questions about whether tracking motorists’ movements amounts to an unconstitutional search, violates state privacy laws, or reflects inadequate safeguards against misuse. Courts have reached conflicting conclusions so far. A federal judge in Virginia upheld the warrantless use of Flock cameras earlier this year, while a judge in Oklahoma ruled in October that a warrantless search of Flock data violated the Fourth Amendment.
A Pew Research Center analysis published Monday offers a glimpse of just how extensive—and opaque—the surveillance network has become. Among 1,517 law enforcement agencies with public Flock transparency portals, only half disclosed information about individual searches of the database. Of the agencies that disclosed their data-sharing practices, the median agency reported sharing its data with 217 other organizations, primarily other law enforcement agencies. And those figures only account for agencies with public transparency portals, not every agency using Flock’s technology.
Still, Kunkler said there is reason for hope. She said people should make clear to their representatives that they support legislation restricting government purchases of personal data, as well as broader oversight and limits on government surveillance.
She pointed to the public outcry earlier this year over a planned partnership between Ring and Flock Safety. The partnership would have allowed Ring users to voluntarily share video footage requested by law enforcement during active investigations, with Flock serving as a third-party evidence management provider. The companies later canceled the planned integration before it launched.
The cancellation did not end Ring’s existing Community Requests program, which continues to allow police to request footage that users can voluntarily share through a separate partnership with Axon.
Often, when these issues come up, some people argue that they have nothing to hide and that these programs would not affect them.
Kunkler said she wants people to remember that privacy is a collective right. Even if someone thinks a surveillance program will not affect them personally, these systems can disproportionately put vulnerable populations at risk, including immigrant communities, people of color, and domestic violence survivors. For example, a 2026 study examining 614 Flock cameras in Virginia’s Hampton Roads region found that license plate readers were disproportionately deployed in predominantly Black and high-poverty neighborhoods.
There is also the risk that these systems get things wrong, as in the case of the Colorado woman wrongly accused after police relied on evidence obtained from a license plate reader.
“When you take a piece of data, and you pluck it out of the context in which it looks rational and reasonable and makes sense, it might not look that way anymore,” said Kunkler.
That risk may grow as law enforcement increasingly uses AI and data analysis tools to surface possible signs of criminal activity.
“It’s not necessarily about whether you have anything to hide,” said Kunkler. “It’s about what happens when we are boiled down to data points.”
