{"resourceId":"savannah-officer-fired-flock-credential-sharing-ice-20261016","versions":[{"version":"external-feef4fa4457b8a8792e3668889c4317c57ded0485ddfdc588dd784acbc0ef0bb","resource":{"id":"savannah-officer-fired-flock-credential-sharing-ice-20261016","title":"Savannah police fired an officer after an internal audit showed her ICE-officer husband ran nearly 1,000 Flock ALPR searches across six states on her account","organization":"Savannah Police Department (reported by Police1, citing WJCL records)","sector":"Policing / ALPR access control and audit","geography":"Savannah, Georgia, United States (searches across six states)","publishedAt":"Oct. 16, 2026","publicationDate":"2026-10-16","eventDate":"2026-08-13","sourceName":"Police1","sourceLabel":"Ga. officer fired for sharing ALPR access with ICE officer husband, disciplinary docs allege","sourceUrl":"https://www.police1.com/officer-misconduct-internal-affairs/ga-officer-fired-for-sharing-alpr-access-with-ice-officer-husband-disciplinary-docs-allege","evidenceClass":"independent-reporting","outcomeClass":"cautionary","topics":["data-security","governance-procurement","operating-model"],"finding":"Police1 reported on Oct. 16, 2026, citing department files obtained by WJCL, that Savannah PD fired an officer after an internal audit flagged unusually high Flock use; her ICE-officer husband, who had no Flock account through DHS, ran nearly 1,000 searches across six states for ICE investigations between January and July 2026 using her credentials. Supervisors split between an eight-hour suspension and termination; the chief’s office agreed with termination on Aug. 13. The investigation did not find a violation of Georgia ALPR law.","sledRelevance":"Shows credential sharing as a route for federal immigration use of a local ALPR network, and that usage-anomaly audits can detect it, but only months later. Directly relevant to agencies telling councils that ALPR data is not shared for immigration enforcement.","evidence":"Opened the Police1 article summarizing disciplinary documents obtained by WJCL. Secondary account of records; the ICE officer’s statement that every search involved an active arrest warrant is unverified.","architectureImplications":"Account-level audit trails attributed searches to the officer, not the actual user; detection relied on volume anomalies rather than strong authentication or device binding.","governanceImplications":"State law allowing plate-data sharing for legitimate purposes did not authorize sharing a personal login; discipline standards for credential sharing were contested internally.","securityPrivacyImplications":"Shared credentials defeated use-tracking safeguards for months (the ICE officer estimated about four), enabling out-of-agency searches across six states.","caveats":"Based on reporting of disciplinary files; the officer appealed; search purposes not independently confirmed.","streamIds":["public-safety"],"roles":{"sales":"Sales framing: a Savannah audit found a federal immigration officer running nearly 1,000 Flock searches through his wife’s local account, undermining the sharing limits councils are told exist. Buyers are chiefs, city attorneys and councils with immigration-sharing restrictions. A bounded offer is an ALPR access-control and anomaly-audit assessment. This source does not show that the vendor platform was breached or that individual searches were unlawful, and the officer appealed.","engineering":"Engineering framing: the audit trail recorded the account holder, not the person searching, so attribution failed until volume anomalies surfaced. Pre-sales should ask whether ALPR accounts require phishing-resistant MFA, device binding and real-time alerts on unusual volume or geographic spread. Proof work should simulate credential sharing and measure time to detection, since detection here took months and attribution pointed to the wrong person.","delivery":"Delivery framing: implement stronger authentication, automated anomaly alerting and a clear disciplinary standard for credential sharing. Dependencies include vendor feature support and union consultation on discipline. The ALPR administrator owns monitoring, with internal affairs owning investigations. Acceptance should be measured by MFA coverage, alert response times and completed periodic audits, not by policy text alone, with results reported to council annually."},"roleDetails":{"sales":{"customerProblem":"Agencies promise ALPR data will not be used for immigration enforcement, but shared credentials can bypass sharing controls undetected for months.","stakeholders":["Police chief","City attorney","City council","Internal affairs","ALPR administrator"],"discoveryQuestions":["Do ALPR accounts require MFA and device binding?","How quickly are unusual search volumes flagged?","What discipline applies to credential sharing?","How are out-of-state search patterns reviewed?"],"valueHypothesis":"Targeted access-control and anomaly-alerting work can shorten detection of credential misuse and support sharing commitments.","potentialEngagement":"3–4 week ALPR access-control, audit and discipline-standard review.","unsupportedClaims":["That the vendor platform was compromised","That the searches lacked warrants","That MFA alone prevents all credential sharing"]},"engineering":{"fit":"Agencies with networked ALPR accounts accessible from personal or shared devices.","architectureIntegration":"SSO with phishing-resistant MFA, device binding, and automated alerts on search volume and geography routed to internal affairs.","prerequisites":["Identity provider integration","Baseline usage profiles","Alert routing"],"constraints":["Georgia law permits legitimate data sharing","Vendor feature availability","Field usability needs"],"security":"Bind sessions to individuals and devices so audit trails identify the actual searcher.","proofOfValue":["Proposed: simulate credential sharing and measure detection time","Proposed: verify MFA enforcement on all ALPR accounts","Proposed: test alerting on cross-state search spikes"]},"delivery":{"work":"Enforce MFA and device binding, configure anomaly alerts, codify credential-sharing discipline and run periodic audits.","dependencies":["Vendor configuration support","Union consultation","IT identity team"],"ownership":"ALPR system administrator with internal affairs","skillsAdoption":"Annual training stating that credential sharing is prohibited and auditable.","governanceCheckpoints":["MFA rollout sign-off","Monthly anomaly review","Annual council report on audits"],"acceptanceCriteria":["Proposed: 100% of ALPR accounts on MFA within 60 days","Proposed: anomaly alerts reviewed within 5 business days","Proposed: monthly audit completed and documented"],"risks":["Officer resistance to stronger authentication","Alert fatigue","Inconsistent discipline"]}},"retrievedAt":"2026-10-18T02:50:24Z","enrichedAt":"2026-10-18T03:00:35Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Officers need explicit training that credential sharing is a serious policy violation regardless of intent.","procurementImplications":"Interpretation: ALPR contracts should require MFA, device binding and automated anomaly alerting rather than relying on periodic manual audits.","operatingModelImplications":"Operational owner: ALPR system administrator, with internal affairs for anomaly investigations.","sourceVerification":{"openedUrl":"https://www.police1.com/officer-misconduct-internal-affairs/ga-officer-fired-for-sharing-alpr-access-with-ice-officer-husband-disciplinary-docs-allege","referenceExcerpt":"he was able to conduct nearly 1,000 searches across six states related to ICE investigations between January and July 2026, according to the audit.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}