North Carolina already wrote the use policy

1Where North Carolina stands

Two decisions were made this summer. The state budget signed on 7 July 2026 (Session Law 2026-53) authorized the State Bureau of Investigation to continue placing automated plate readers in NCDOT rights-of-way on a permanent basis, replacing the pilot created in 2023 [2, 3]. As of March the program had 140 camera locations operated by 17 agencies, 152.7 million scans recorded, and 75 additional locations in approval or installation [2]. Separately, on 21 August Asheville's council took up a resolution to terminate its contract with the dominant municipal vendor and remove eleven cameras, with the mayor saying there were "legitimate concerns" sufficient to end it, the interim police chief's memo defending the program's value in specific cases and citing tightened search authorization and stricter auditing, and several council members open to a replacement from the city's existing body-camera vendor [4].

Those two decisions point in opposite directions — expand the state program, retreat from a city program — but they share a premise: the cameras are useful and the controls are the problem. That is the premise this note takes seriously.

2What the statute requires, and where it stops

Article 3D of Chapter 20 is more specific than most state law on this subject [1]. Captured data may be used only by criminal justice officers for enumerated law-enforcement purposes — criminal investigations, felony warrants, missing or endangered persons, stolen vehicles — and expressly not for traffic enforcement (§ 20-183.30(5), § 20-183.31(b)). Data may not be preserved beyond ninety days except by written preservation request or search warrant (§ 20-183.32(a)–(b)). It is confidential, not a public record, and may be disclosed only to a criminal justice officer for a legitimate purpose on written request (§ 20-183.32(e)). Every agency must adopt a written policy that includes annual or more frequent auditing and reporting to the head of the agency (§ 20-183.31(a)(7)). Since 2023, violating the article is a Class 1 misdemeanor (§ 20-183.33).

Three things the statute does not do. It does not require that the purpose be checked before a search runs; an officer can query without stating a case and the audit finds out later, if it looks. It does not say who audits: the requirement is reporting to the head of the agency, so the agency reviews itself. And it does not address the vendor network through which most municipal data is actually searched — the nationwide database in which an out-of-state agency can query a North Carolina city's cameras without a written request to anyone in North Carolina, which is the mechanism behind most of the documented misuse elsewhere [5]. The statute wrote a use policy; it did not build the control that enforces it or the evidence that proves it.

3Mapping the statute to a gate

The technical report describes a gate that sits between requesters and the plate-reader database, enforces a use policy the jurisdiction owns, spends validation effort in proportion to the consequence of each request, and emits a signed, hash-chained attestation for every decision [6]. The North Carolina statute maps onto that gate almost clause by clause.

Purpose (§ 20-183.30(5), § 20-183.31(b)). Every query carries a purpose category from the statute's list and a case identifier that must resolve in the agency's records system. A query with no case, or with a purpose outside the list, does not run. Traffic enforcement is not a selectable purpose. This turns the statute's purpose limitation from a training point into a precondition.

Requester (§ 20-183.30, "criminal justice officer"). The requester's identity is bound to a current certification record. Analysts and automated systems act under a named officer's authority, recorded in the attestation.

Scope (implicit in "legitimate law enforcement purpose"). The statute limits purpose but not breadth. The gate assigns each request a blast-radius tier from its parameters: a single plate over 48 hours is a low tier; every vehicle near an address over thirty days, or a bulk export, is a high tier that requires a supervisor's approval before it runs. The agency sets the thresholds in its § 20-183.31 written policy, where they belong.

Retention (§ 20-183.32(a)–(b)). Ninety days is enforced by the gate, not by a vendor setting: a request for data older than ninety days runs only against a preservation request or warrant identifier that the gate verifies, and the gate emits a proof of purge at the boundary so that the statute's limit is checkable rather than asserted.

Sharing (§ 20-183.32(e)). The written-request requirement becomes a registry. A query from another agency — including through the vendor's network — runs only if the requesting agency has a written request or agreement on file with the North Carolina agency that owns the cameras, for a purpose that agreement permits. Agencies that have adopted purpose exclusions can enforce them here rather than by asking the vendor to configure them.

Audit (§ 20-183.31(a)(7)). The annual audit stops being a sample of logs held by the vendor. Every decision, permitted or not, already exists as a signed record chained to the one before it; the audit is a verification of that chain, and it can be performed by the agency head, the county, a council, or the General Assembly's oversight staff with the same open tool, without trusting the vendor or the department.

Penalty (§ 20-183.33). A misdemeanor is only enforceable if the violation is discoverable. A personal-purpose lookup that is blocked before it runs produces an attestation of the attempt; one that would have slipped through a self-audit becomes a record a district attorney can act on.

4The reporting the permanent law dropped

The pilot program required public disclosure of the total number of plate captures and the number of instances in which data was retained beyond ninety days. The permanent provision keeps annual reports to the legislature by 1 March — each agency's written policy, its number of data requests, its camera count — but removes those two figures [2]. Whatever the reason, the effect is that the two numbers most directly tied to the statute's own limits are no longer public.

Both are aggregates of the attestation log. Total captures is the count of ingest records; retention beyond ninety days is the count of preservation-request and warrant identifiers the gate honored. A gate produces them as a by-product, together with the figures the report still requires and several the statute never contemplated: queries by purpose category, queries by tier, requests from outside agencies by agreement, blocked attempts by reason. Publishing them with digests that anyone can verify against the log costs the agencies nothing and would answer the objection privacy advocates raised about the permanent program [3] with evidence rather than assurance. A legislature that wanted the two dropped figures back could require them and know they would be accurate.

5For a city deciding this fall

Asheville's situation will recur in other North Carolina cities, and the choice as framed — keep the vendor, switch vendors, or end the program — leaves out the option that addresses the actual concern. The concern was never the camera at the intersection; it was who could search it, for what, and whether the city would know. Switching vendors moves the data to a different company's network with a different company's controls. What a council can do instead is adopt, in its § 20-183.31 written policy, the requirements in Section 3 — purpose and case before query, tiered approval by breadth, a sharing registry the city controls, a public quarterly report with verifiable figures — and require any vendor, current or replacement, to route queries through a gate that enforces them. That policy is vendor-neutral, it is within the city's authority today, and it converts a debate about trust in a company into a check the city can run itself.

The same policy answers the police chief's case for the cameras. A jewelry robbery, a hit-and-run and a shooting are exactly the enumerated purposes the statute permits; a gate does not slow those queries, it records that they were the queries that ran.

6What we are offering

Sentinel Labs will work with one North Carolina jurisdiction — a city writing a replacement policy, or an agency in the SBI program — to encode its § 20-183.31 policy as a gate, run it in monitor mode against its query stream for a quarter without blocking anything, and publish the resulting transparency report with the jurisdiction's consent. The reference implementation is public in the Sentinel Console; the evaluation plan is in the technical report [6]. We will publish the protocol before the results and the results whatever they are. Corrections to this note, including on the statute, are welcome at labs@sentinelpot.ai.

—Sources

1. [1] N.C. Gen. Stat. §§ 20-183.30–20-183.33 (Article 3D, "Automatic License Plate Reader Systems"), enacted 2015, amended 2021 and 2023; summarized with section references by DeFlock ILM, "NC License Plate Reader Law: Warrant & Limits." deflockilm.org
2. [2] Carolina Journal, "NC budget makes license plate readers permanent amid privacy concerns," 2026. Program figures as of March 2026; reporting changes. carolinajournal.com
3. [3] WRAL, "NC moves to lock in highway license plate reader program permanently," June 2026. Pilot history, ACLU of North Carolina statement. wral.com
4. [4] Blue Ridge Public Radio, "Asheville considers early termination of Flock, but leaves door open for other license plate readers," 21 Aug 2026. bpr.org
5. [5] See SL-TR-2026-01, Section 1 and references [1]–[5] therein, for the documented failure classes and the out-of-state search pattern.
6. [6] Sentinel Labs, "Verifiable use policies for vehicle surveillance data," Technical Report SL-TR-2026-01, September 2026. sentinelpot.ai/labs/plate-reader-governance