In the Santa Cruz data import post, I noted a precipitous drop in search volume starting in August 2025. The data showed a 75% decline that month, with further decreases immediately following.

Looking into this further raises more questions than it answers.

The Setup

On August 8, 2025, Santa Cruz PD search traffic plummeted, yet the number of agencies conducting searches remained roughly the same.

As a quick refresher, according to Flock documentation, the primary tools in the system are:

• Lookup: A state- or nationwide “text-only” full license plate query to obtain a 1, 7, or 30-day history.
• Search: A query to find full or partial plates, filter by car model/make, or spot bumper stickers on networks with reciprocal footage sharing enabled.

Agencies that shared footage with Santa Cruz continued searching via “portal” queries, but statewide reciprocal access via “network” queries stopped abruptly (or appeared to).

The new, much shorter list of agencies Santa Cruz shares data with is seemingly standard.^[1]

The Missing Searches

The weekly view shows the longer-term trend across nearly a year of data:

At the beginning of the year, as discussed in the previous post, Santa Cruz—like many other agencies—still permitted the national free-for-all. When Santa Cruz restricted nationwide sharing, ‘Lookup’ tool usage dropped, and ‘Search’ became dominant.

In July, however, ‘Lookup’ tool usage briefly returned to approximately pre-March levels. Before July 11, search queries sat at 7k–15k/day. Then, ‘Lookup’ queries spiked dramatically up to 20k/day, while ‘Search’ plummeted.

On August 8, ‘Lookup’ queries crashed to near-zero while ‘Search’ continued at its reduced level.

The number of organizations with access and the number of devices searched remained stable throughout this period. Yet, ‘Lookup’ searches across all organizations spiked by ~400–500% in July, while the overall volume of searches remained stable.

I compared the numbers from 81 California agencies publishing logs via transparency portals.

One of these things is not like the others. The chart above shows all queries of >10,000 devices (i.e., those that are presumably statewide searches). It shows that the number of organizations shown in Santa Cruz’s log files drops from approximately 250 to 200, but remains largely stable at a number consistent with California.

The number of searches from the 81 transparency portals remains stable at around 5,000. This stands in stark contrast to the 4–5x decrease in “traffic” that simultaneously occurs in Santa Cruz’s network logs.

Update: Capitola, CA

For my fellow Midwesterners: Capitola is a suburb of Santa Cruz and, apparently, California’s oldest beach resort town.

Although the complete import is still running (sadly without reasons), a preliminary analysis of the raw data shows a pattern that’s strikingly similar^[2] to Santa Cruz’s:

It shows the same high (out-of-state) volume prior to February, then a drop, an inversion of Lookup and Search in July 2025, and then a cliff, with nearly identical volumes across the board.

Because the cities are so close, it’s theoretically possible that there is some degree of coordination or even collusion regarding log file release, but that seems highly unlikely for a number of reasons.

The July Timeframe Anomaly

The “Lookup” tool is documented as supporting only 1, 7, or 30-day timeframes via a dropdown selector. Non-California data confirms this: in Lynnwood, WA, 98.8% of lookups use standard timeframes. The remaining variance comes from undocumented options^[3] (6h, 12h, 14d) and sketchy “month ago” logic that seems to sometimes yield 31 days instead of 30.

The chart above shows the weekly timeframe compliance rate. Before July, 96–98% of lookups use standard timeframes (green).^[4] Starting July 7, compliance drops to ~75% as ~25% of “Lookups” suddenly have impossible timeframes: 105 days, 121 days, even 365+ days.^[5]

This strongly suggests the July “inversion” (where Lookup suddenly spiked and Search dropped) is actually a misclassification: searches that should be labeled “Search” (1:1, flexible timeframes) were incorrectly labeled as “Lookup” (statewide, 1/7/30-day only).^[6]

The August Cliff as Correction Attempt

If the July inversion was a misclassification bug, the August 8 cliff may have been a botched attempt to fix it.

If the fix had been surgical—un-“flipping” the classifications—we’d expect the charts above to continue showing the same ~100–120k weekly overall volume, but with the blue and orange bars flipped back to their pre-July configuration.

Instead, “Search” volume remained roughly on par with the pre-July “Lookup” volume, while Lookups dropped by 98%^[4:1]. The top Lookup users (CHP, Riverside County, and Orange County) essentially stopped appearing in the network audit logs.

In fact, 175 organizations disappeared from the “Lookup” logs completely, even though most of them remained in the “Search” logs.

What This Means

The pattern is consistent with a ham-fisted correction attempt that, instead of fixing July’s Search–Lookup inversion, dropped all real Lookup tool usage from the network audit log.

We don’t have the most recent data, but given that the original problem started 4–5 months ago, it’s entirely possible that this situation persists today, and the state of California is not logging statewide searches.

This tracks with previous observations: Flock does not invest in QA, and police don’t audit the logs.

Based on my years in the tech industry, I would classify this as a legit five-alarm fire. Once an issue this serious—with the potential for liability and severe effects on the criminal justice system and civil liberties—is discovered, nobody is going home until it’s fixed.^[7]

That’s not what happened with Flock in California.

Either Flock has ignored reports of this problem, or, in the entire state of California, not a single police officer responsible for overseeing these systems has noticed that “their” logs got 187’d by their own vendor.

Neither situation is a great look.

Think of that next time you hear “we control the data” and “we audit the system.”