Four police agencies, one state law, four different sets of rules for license plate cameras

ALEXANDRIA, Va. - Three law enforcement agencies operate automatic license plate readers in Alexandria. A fourth, whose police department covers a campus in the city, can search the Police Department's cameras. All four answer to the same state law. All four wrote policies governing the technology, and no two are alike.

The Alexandria Sheriff's Office and the Northern Virginia Community College Police Department each adopted the model policy the Virginia State Police posted in July 2025. The Alexandria Police Department and the Virginia Tech Police Department each wrote their own.

City Council spent Tuesday night asking for several of the controls that appear in some of these policies and not others.

What the law requires

The 2025 General Assembly created § 2.2-5517, which took effect July 1, 2025. It requires every agency using the technology to adopt a policy containing nine elements, among them training requirements, an internal audit at least every 30 days, and procedures for retaining and destroying both system data and audit trail data. A separate provision requires agencies to publicly post that policy.

The same law directed State Police to write a model policy and post it publicly, which the agency did on July 9, 2025. Adopting that model is not mandatory. Agencies may write their own, and may be more restrictive than the statute, but not less.

Police Chief Tarrick McGuire signed Directive 10.40 on Oct. 28, 2025. Virginia Tech Chief William Babb signed policy E-10.0 on Nov. 21, 2025. Sheriff Sean Casey's General Order ADM-24 took effect Jan. 1, 2026. NOVA adopted the model this year.

Where the policies diverge

The audit question

The clearest difference is how much gets checked.

The model policy sets minimums: at least 5% of a month's queries, at least 5% of downloads, at least 5% of traffic stops that followed an alert, and a monthly verification that data-sharing settings comply with state law. The Sheriff's Office and NOVA adopted those thresholds. The Sheriff's Office added that audit records be kept three years and that anything egregious be reported immediately to the Sheriff and the office's oversight section.

Virginia Tech set no percentage but listed what its monthly audit covers: training logs, operator accounts and permissions, queries including hot lists, downloads, traffic stops and agency sharing.

Directive 10.40 assigns the audit to the Mobile Computer Unit Sergeant every 30 days and does not say how many searches are reviewed. The dashboard APD published Tuesday describes what the review examines — who accessed the system, when, and the documented purpose — but also sets no threshold. The Alexandria Brief asked the department on Aug. 14 whether every search is audited or a sample. It has not answered.

The question is not academic. The Alexandria Times reported this month that APD's own audit reports documented at least 56 apparent instances of improper use, most involving officers who did not supply a case number or adequate explanation. McGuire told council Tuesday those were clerical, occurred over multiple years, and that no malicious misuse has been found.

One element the directive does not address

The statute requires each agency's policy to include procedures for retaining and destroying both system data and audit trail data, and to post that policy publicly. It sets both deadlines: 21 days for system data, two years for the audit trail that records who searched and why. Directive 10.40 addresses the 21-day purge and does not mention the two-year deadline. The other three policies state or reference it.

APD does disclose the rule elsewhere. The dashboard published Tuesday says audit trails are purged after two years unless tied to an ongoing investigation, prosecution or civil action. Whether the directive itself will be amended to include it is a question for the department.

What each department covers that the others don't

APD's directive is the only one addressing a parking license plate reader system, which the department maintains separately from its investigative database. State law exempts parking and traffic systems from § 2.2-5517 entirely. Under 10.40, a query of the parking database for a non-parking matter may be approved by a captain, a lieutenant or a sergeant, with the results saved to a department network drive and provided to State Police on request.

The Sheriff's Office reports to State Police quarterly rather than annually, and requires that camera placement be approved by the Sheriff, that changes be documented, and that cameras not be aimed where people have a reasonable expectation of privacy.

NOVA requires that the chief or a designee verify a requesting officer's identity and purpose before releasing data to another agency — close to the query-by-query control Councilwoman Sandy Marks asked about Tuesday.

The state model also requires officers to report any access they personally have to non-agency or private camera networks, and defines those to include homeowners associations, shopping malls, businesses and places of worship. The Sheriff's Office and NOVA adopted that requirement. Directive 10.40 does not address it. Councilman Canek Aguirre asked Tuesday whether APD has agreements with private businesses or the community college for direct camera feeds; the question was not answered at the meeting. State law does not reach private systems used for non-criminal-justice purposes, though officers remain bound by the statute's limits whenever they search one.

Virginia Tech set retention at 15 days, below the maximum. Its policy also tells people they can find out what the system holds about them: while the data is exempt from the Virginia Freedom of Information Act, it notes that the Government Data Collection and Dissemination Practices Act entitles an individual who verifies their identity to review the LPR information the department has collected about them. No other policy here mentions that route. Virginia Tech also requires a quarterly documented test of every camera, and authorization from both its Records Manager and its Administrative Division Captain before any images are released or reviewed.

All four policies describe hot lists that may draw on federal watch lists — Department of Homeland Security lists in three, the Terrorist Screening Center list in APD's. The statute permits notifications only for missing or endangered persons, outstanding warrants, human trafficking, stolen vehicles and stolen plates. Alexandria's Flock portal lists two hot list sources in use: NCMEC Amber Alert and NCIC through State Police.

The comparison has limits

The four systems are not the same size, and they are not all in Alexandria. APD operates 61 fixed cameras in the city and reported 327 search sessions over the past 30 days as of Wednesday. The Sheriff's Office operates two, at the jail entrances, and reported none. NOVA operates four on its Alexandria campus, according to an Alexandria Times count. Virginia Tech reports 15; WFXR reported in March that all of them are on the Blacksburg campus, and no Virginia Tech cameras appeared in an Alexandria Times survey of readers in the city. Virginia Tech's police department has jurisdiction over the university's Alexandria campus and appears on the list of agencies that can search APD's cameras. A campus force faces a different problem than a department covering a city of more than 160,000.

Whether any other agency operates readers here is not established. The Virginia State Police, which can search APD's cameras, has not published a transparency portal, and whether it operates any readers in or adjacent to Alexandria is unclear.

What the public can see

APD discloses more about its operations than the others. It publishes a Flock transparency portal, the list of agencies that can search its cameras, which stood at 152 on Wednesday, and, since Tuesday, a dashboard breaking 1,348 searches out by offense type — something no other agency here publishes.

The two Alexandria agencies made opposite choices about access. As of Wednesday, 152 law enforcement agencies could search APD's cameras. None can search the Sheriff's Office's. Neither appears on the other's list, so the city's police department and its sheriff do not share with each other.

The missions differ. The Sheriff's two cameras watch the entrances to the jail and returned no searches in the past 30 days; APD's 61 are deployed across the city for investigations, and sharing broadly is what gives its detectives reciprocal access to other jurisdictions' cameras when a vehicle leaves Alexandria. Fairfax County's list includes Alexandria, and access there runs both ways.

Seven campus police forces appear on Alexandria's sharing list — Virginia Tech, George Mason, Virginia Commonwealth, Old Dominion, Hampden-Sydney, Hampton University and NOVA. Under state law they are law-enforcement agencies subject to the same restrictions as any other, and their presence on the list is unremarkable as a legal matter. It does mean a university police department can search where Alexandria drivers have been. Nothing published says whether APD can search theirs.

Placement is also disclosed differently. Of the four policies, only the Sheriff's Office requires that camera placement be approved and that any change be documented. Virginia Tech limits cameras to plain public view but requires no approval or record when they move, and reports a system-wide count rather than a per-campus one. Directive 10.40 does not address placement. Camera locations are not public in Alexandria; the city attorney's office has cited state law in declining to release APD's. The first mandatory camera counts are due to State Police in April 2027.

Disclosure varies as much as policy. The Sheriff's Office publishes that it shares with no one. Virginia Tech's portal reports plate reads and hot list hits, figures Alexandria does not display, but no sharing list. NOVA publishes its policy and has no portal. On the portals themselves, the Sheriff's Office rewrote the "Access Policy" field to describe its 5% sampling; Alexandria's carries the vendor's default language, as does Virginia Tech's.

What happens next

McGuire told council Tuesday the department is evaluating other vendors and working to bring in an outside auditor. Mayor Alyia Gaskins asked staff to report back on what it would take to remove the Flock cameras. Any vendor change would likely require revising the directive, which lists a subject-matter review date of 2028.

Flock has set its own deadlines in the meantime. In an Aug. 13 post announcing the changes, chief executive Garrett Langley wrote that by the end of this year the company will require all law enforcement customers to adopt Audit Assistance, its abnormal-activity detection feature; require case codes for every search, with emergency bypasses flagged for administrator review; and add automatic lockout suspending a user's access pending review when activity meets defined criteria. Langley also urged agencies without a transparency portal to publish one. APD has not said whether it has adopted Audit Assistance, and NOVA has no portal.

What the department has not answered

Several of the differences between these policies match questions The Alexandria Brief put to APD on Aug. 14, the day after Flock announced its changes. The department answered three of seven on Sept. 6. The rest remain open, and Tuesday's council discussion raised most of them again.

McGuire addressed two of them from the dais. He said every search requires an offense type, a case or computer-aided dispatch number and a stated reason, and that all fields must be completed before a search will run. He said audits have turned up clerical errors but no malicious misuse, that officers who make them are contacted and coached, and that a third error locks a user out pending retraining.

Still unanswered: who decides whether Alexandria moves to a shorter retention period; whether the department will enable the offense filter that would let it block other agencies from searching its cameras for particular categories of crime; whether it has adopted Audit Assistance or will comply by Flock's year-end deadline; and how many searches of Alexandria's cameras outside agencies ran in the past year.

-

Ryan Belmore is an Alexandria resident and the founder and publisher of The Alexandria Brief. Send tips, feedback, and story ideas to ryan@alexandriabrief.com.

Related stories

Gaskins: ‘I do not think there’s a role for Flock in this community’

Councilman Elnoubi and Councilwoman Marks said the same. The police chief said he’s meeting with other vendors but has no timeline. The contract can be canceled at any time.

The Alexandria BriefRyan Belmore

Police won’t publish Flock camera locations and have no plans to shorten data retention

APD answered three questions from the Brief on Saturday, three days before council receives an update on the license plate reader program

The Alexandria BriefRyan Belmore

Inside Virginia’s city halls, concerns, confusion rise with Flock surveillance protests

A VCIJ review of thousands of public records shows widespread misunderstanding and mistrust of Flock Safety – even inside city halls and police headquarters.

The Alexandria BriefVirginia Mercury

Alexandria’s Flock page now lists the 161 Virginia agencies that can search its cameras

The disclosure follows a week of movement: Flock changed its recommended policies Thursday, the mayor said Sunday she had asked the city to publish more, and two new fields appeared Tuesday. No federal or out-of-state agency is on the list.

The Alexandria BriefRyan Belmore

Gaskins says Alexandria police won’t share license plate data in immigration cases

The mayor answered resident questions about the city’s Flock cameras Tuesday.

The Alexandria BriefRyan Belmore