Savannah officer fired after sharing Flock login with ICE husband

A former Savannah Police Department officer was fired after an internal investigation found that she shared her Flock Safety login with her husband, an Immigration and Customs Enforcement agent. The account was then used to run 983 searches involving 97 licence plates, according to reporting by The Verge and Savannah broadcaster WJCL. ¹²

The case is a sharp example of how access controls can fail even when a platform keeps an audit trail. Flock Safety provides automated licence-plate recognition and related investigative tools to law-enforcement agencies. In Savannah, the department said it does not share its Flock data with ICE, making the shared credentials a breach of the department’s security rules rather than an authorised extension of access.

What happened

The officer, Amber Harpe, gave her department-issued username and password to her husband, Tyler Harpe, who worked for ICE and did not have his own Flock account. While he had access, the system recorded searches under her credentials. The searches covered 97 plates and were overwhelmingly associated with Hispanic drivers, with activity spanning multiple US states. ¹²

The couple defended the searches as law-enforcement work rather than personal use. That explanation did not resolve the central security problem: a shared password made it difficult to establish who was responsible for each query and allowed an employee of another agency to use a system that Savannah said it had not opened to ICE.

An interim major initially recommended an eight-hour suspension, but senior department officials rejected that recommendation and removed Harpe from the force. She was fired alongside five other Savannah officers after the department’s wider investigation into Flock misuse. Four of those officers were later arrested; Harpe was not among them.

The wider technology issue

Flock’s own materials describe a platform built to help organisations investigate incidents and share information around public-safety operations. That makes account-level controls especially important. A plate search can be technically logged while still being operationally difficult to audit if several people use one identity. Stronger safeguards would include individual accounts, multi-factor authentication, narrowly defined agency permissions and alerts for unusual search patterns.

The reported 983 searches also show why retention and access policies matter beyond the software interface. A system can make searching fast, but the accountability layer depends on agencies deciding who can search, what can be searched, and how quickly suspicious activity is reviewed. Those decisions sit with the department and its data-sharing agreements, not just with the vendor.

Our opinion

The important lesson is not simply that one officer broke a rule. It is that a security platform can become a cross-agency surveillance tool when an organisation treats a password as a transferable key. Individual identities, explicit data-sharing boundaries and automatic escalation for abnormal search volumes should be baseline requirements for systems that expose sensitive location-linked records. Flock’s audit logs helped reveal the scale of the activity, but prevention would have been better than reconstructing it after the fact.