A report about a home-built license plate reader drew 502 Hacker News points and 279 comments in just over four hours. Its creator says the device recognized only two of five police cars during a one-hour test. The response centered on the question raised when two officers later visited his home. If plate, time, and location data can put police at risk, what rules should apply when police collect the same kind of data from the public?
Anthony Sistilli, a software engineer and video creator in Brampton, Ontario, says he built the prototype to make automated license plate recognition, or ALPR, easier to picture. In a Straight Arrow interview, he described a consumer camera and laptop that first classified a police vehicle, then tried to read its plate and store a successful sighting with its time and location.
That is enough to demonstrate the core risk without pretending the project matched a commercial network. The experiment gathered little data, missed most of the police cars that passed, and did not publish officers' plate numbers. Its value is narrower and more useful: a rough prototype made the consequences of location tracking legible to the people normally operating such systems.
A limited prototype with a pointed target
Sistilli told Straight Arrow that he assembled the software with AI assistance in about 20 minutes. That is his account, not an independent benchmark of the model or the development work.
The field test also showed how far it was from a dependable ALPR installation. At a Brampton station, five police cars passed in an hour and the system recorded two. Sistilli blamed the low camera position, distance, and blocked views for some of the misses.
The project had a tighter capture rule than a conventional plate reader. It was designed to attempt optical character recognition only after the classifier identified a likely police vehicle. Commercial ALPR systems generally photograph passing plates and compare the results with a watchlist. Peel Regional Police describes its own readers that way in its 2025 to 2028 business plan: high-speed cameras and software check plates against lists that include stolen vehicles, expired permits, suspended drivers, people with warrants, and vehicles involved in Amber Alerts.
Calling Sistilli's device a personal Flock camera made the point quickly, but it can also blur an important distinction. The prototype was not a Flock Safety product, and the public documents reviewed for this story do not establish that Peel Regional Police uses Flock's network. This was a small Canadian ALPR experiment inspired by the debate around Flock in the United States.
The visit made data governance concrete
Sistilli says two Peel Regional Police officers came to his home on September 20 after he posted videos about the project. He said the roughly 30-minute conversation focused on his intentions and a possible map of police movements. He told the outlet that he had collected little information, released no actual plates, and rejected comments about targeting individual officers.
The officers' position is available only through Sistilli's account. Gizmodo reported that Peel Regional Police did not respond to its request for comment before publication. There is no reported charge or arrest. That gap matters because an unconfirmed doorstep conversation should not be inflated into an official police policy or legal ruling.
Even with that qualification, the concern Sistilli attributes to the officers is technically sound. A database that joins a plate to a time and coordinates can reveal shift patterns, frequently visited places, and repeated associations. Ontario's Information and Privacy Commissioner makes the same point in its ALPR guidance for police services. Scans can accumulate into a granular record of movement, and the registered owner may not be the person driving when a camera records the vehicle.
The experiment therefore did more than reverse the camera. It moved the discussion away from whether a plate is visible on a public road and toward what a searchable history can reveal after many observations are joined. One sighting says where a car was. A retained series begins to say where its user works, visits, protests, seeks medical care, or spends the night. Ontario's privacy commissioner warns that this capacity can chill lawful activity and association.
Collection is only the first design decision
ALPR debates often become arguments about whether cameras help recover stolen cars. Peel's business plan names several public-safety uses, including Amber Alerts and plates connected to warrants. Those uses do not settle how every scan should be handled. The harder questions concern non-hits: cars that passed a reader without matching any active list.
Ontario's commissioner recommends a privacy impact assessment before deployment, public notice about camera locations, consultation with affected communities, accurate hotlists, and immediate destruction of non-hit data. It also says police remain accountable when a vendor supplies the system. Those recommendations turn privacy into system behavior: which records enter the database, how long they remain, who can search them, and what an auditor can reconstruct later.
Flock's own product changes show that search controls are a live design issue. In July, the company said every ALPR search would require an offense type selected from a standard menu. Its description of the control says free-text search reasons remain optional unless an agency requires them, while offense type, case number, and any supplied reason can appear in organization and network audits. Agencies can also include those fields in public audit exports.
A dropdown cannot determine whether a search is justified. It can make the user's stated purpose consistent enough to review, provided supervisors examine the logs and the public can see useful audit data. The same principle applies to a homemade system. A developer choosing to save every observation indefinitely creates a different risk from one that discards failed classifications and deletes confirmed records after a short test. The camera may be identical; the data model is not.
Defaults turn policy into system behavior
Sistilli's claimed 20-minute build should be read as a warning about assembly costs, not proof that anyone can reproduce a reliable citywide reader in one sitting. Object detection, plate recognition, phone location, and a map database are available building blocks. Making them accurate across weather, angles, motion, and different plate formats takes considerably more work. Operating them lawfully and safely introduces another set of decisions.
Those decisions start before the first image is stored. A restrained design can separate hits from non-hits, restrict accounts by role, log every search, attach a declared purpose, and enforce deletion automatically. Public agencies also need procurement terms that preserve audit access and prevent a vendor contract from becoming a black box. These are concrete controls drawn from the Ontario guidance, rather than a promise that policy alone will prevent misuse.
The prototype also shows why accuracy is only one part of an ALPR review. A system that misses three of five target vehicles is poor at detection, yet the two successful records can still be sensitive. Better accuracy increases utility and expands the amount of movement data available for search. Evaluation needs to ask what the system records when it works, what it does when it is wrong, and who can query the result.
Sistilli says he never intended to publish a giant map of police officers, and no such release is documented in the reporting. The next facts to watch are practical ones: whether Peel Regional Police gives its own account of the visit, whether Sistilli releases code or data, and whether the local service publishes retention and audit details beyond the hotlist uses in its business plan. The weak prototype already answered the easiest question. Two of five cars were enough to create a movement record. The unresolved issue is who must explain what happens to that record next.