Unauthorized Access Raises Legal and Policy Concerns
A Drug Enforcement Administration (DEA) agent used the login credentials of a Palos Heights, Illinois police officer to run a Flock automated license plate reader (ALPR) search for a person suspected of an immigration violation, according to internal documents. The search took place without the officer’s knowledge, and the password has since been changed. Illinois law prohibits the use of ALPR systems for immigration enforcement, and Flock’s own terms of service ban password sharing among users.
The details emerged after investigative outlet Unraveled obtained group chat messages through a public records request, later supplemented by additional documents obtained by a 404 Media reader. These records show that in January 2025, an account assigned to Officer Todd Hutchinson of the Palos Heights Police Department was used to perform the search. Hutchinson was part of a DEA task force but was reportedly the only member with Flock access.
Palos Heights Police Chief Mike Yott previously told reporters that officers in his department have no immigration enforcement authority and do not pursue immigration cases. At the time, he suggested the search may have been related to narcotics or fugitive investigations, though the newly released documents indicate the specific purpose was labeled “immigration violation.”
Internal Investigation Reveals Password Sharing
An internal report from the Palos Heights Police Department confirms that Hutchinson allowed other task force members to use his Flock login for drug investigations. However, the report states that one DEA agent used his credentials in late January 2025 without his consent to run the immigration-related search. The name of the DEA agent was redacted in the investigation files.
Text messages between task force members show Hutchinson later changed his password to prevent further unauthorized use. In one exchange, another officer asked for the new password, to which Hutchinson replied that “keys had to be taken away.” The conversation also includes joking remarks from the DEA agent who admitted to using the account, with Hutchinson reiterating that any future searches must not involve immigration cases.
The police department’s investigation concluded that no Palos Heights officer personally ran the immigration search. It also acknowledged that the incident highlighted weaknesses in security protocols for Flock system access. In response, the department implemented two-factor authentication and restricted Flock searches to agencies within Illinois.
Broader Implications for Flock Oversight
Flock’s terms of service explicitly prohibit account and password sharing, stating that authorized users must protect their credentials. This incident underscores broader concerns about the lack of operational safeguards for the surveillance network. Flock has not commented on the matter, and the DEA referred all inquiries to the Palos Heights Police Department, which did not respond to a request for comment.
The situation also illustrates how federal agencies can gain indirect access to Flock systems even when they do not have their own contracts with the company. Previous investigations by 404 Media have documented cases of officers in other jurisdictions offering to run plates or provide login credentials to outside agencies without formal authorization or warrants.
The House Oversight Committee recently announced an investigation into how Flock technology is used in immigration enforcement. Civil liberties advocates argue that this latest case demonstrates the urgent need for clear legal boundaries and stronger oversight mechanisms to prevent misuse of surveillance tools intended for local policing.