Cameras are watching everyone. Who’s watching the cameras?

John Locke believed government exists to protect life, liberty, and property — not to catalog the daily movements of the people it serves. That principle should guide how North Carolina thinks about the automatic license plate readers now spreading across the state’s roads, because the recent run of misuse cases like those in Charlotte and Mooresville shows exactly what happens when a powerful surveillance tool operates on trust rather than oversight.

This year’s state budget replaced a limited three-year pilot program with permanent statutory authority allowing the State Bureau of Investigation to place automatic license-plate readers, including Flock Safety cameras, on NCDOT rights-of-way. It also opened the door to installation on state-maintained roads statewide. Supporters point, fairly, to real investigative value: recovered stolen vehicles, located missing persons, solved homicides. Nobody disputes that the technology works. The question is what happens once it’s built.

We now have an answer. In Charlotte, an officer stands accused of running an unauthorized search and passing the results to the target of a drug investigation. In Mooresville, an officer was arrested for allegedly using the department’s camera network to track her boyfriend’s ex-wife. An internal audit found 31 allegedly improper accesses. That’s not a hypothetical parade of horribles. That’s what an audit turned up the first time anyone bothered to look.

North Carolina’s statutory safeguards are not nothing, but they aren’t much. Captured data generally can’t be held more than 90 days. It can only be accessed for a “law enforcement purpose.” Misuse is a Class 1 misdemeanor. But the key safeguard governing an officer’s initial search is largely internal and self-certifying. An officer runs a search, types in a justification, and the system takes their word for it. Nothing requires a warrant, a supervisor’s sign-off, or any judicial check before an officer queries months of a person’s movements. The audit trail exists only after the fact — which means the safeguard against abuse is essentially: we’ll catch it eventually, maybe.

That gap matters most where it’s least visible. A single camera catching a single plate is no different, constitutionally, than an officer glancing at a passing car — the US Supreme Court’s reasoning in Carpenter v. United States doesn’t require treating isolated observations as searches. But a statewide network capable of reconstructing months of a vehicle’s movements presents the very kind of aggregated-location problem the Supreme Court confronted in Carpenter. What can a reconstructed travel pattern reveal? Where someone worships. Which doctors they visit. Which political meetings they attend, and how often, and with whom.

That last category deserves particular attention. North Carolina has a long, contentious history of government interest in who shows up to political events. Our nation’s First Amendment tradition and precedents, going back to NAACP v. Alabama, treat the ability to associate and assemble without being tracked as inseparable from the freedom to do it at all. A license plate reader doesn’t need to target a rally or a church parking lot to chill participation in one. It only needs to exist, be queryable without a warrant, and occasionally end up in the hands of someone willing to misuse it. Nobody has to prove a coordinated campaign of political surveillance for the risk to be real. The infrastructure for it is already live, and the only thing standing between routine use and abuse is the professionalism of whoever happens to be logged in. While most police officers are professional in their use of Flock and similar systems, recent cases of abuse in North Carolina and nationwide show that not all are.

None of this requires ripping out the cameras. It requires closing the gap between what the technology can do and what the law requires before someone is allowed to use it that way. A targeted, short-term query tied to a specific investigation is one thing. Using the network to reconstruct a person’s movements over an extended period is another. For those broader historical searches, a warrant — or at minimum a reasonable-suspicion standard with a contemporaneous, reviewable record — should stand between an officer and a detailed history of someone’s movements. Real-time audits, not after-a-scandal audits, should be standard practice, not a reaction to an arrest. And the legislature that made this program permanent and statewide owes the public a serious look at whether the safeguards it wrote in 2023 were built for a pilot program in a handful of counties, not a permanent statewide surveillance network.

Locke’s insight was that a government trusted with power over its citizens’ movements needs more than good intentions to constrain it — it needs institutions. North Carolina built the cameras. It hasn’t yet built the institutions.

Jeanette Doran is the president and general counsel of the North Carolina Institute for Constitutional Law.