Savannah SPD dismisses officer for credentialed compromise of Flock ALPR system

Savannah Police Department officer Amber Harpe was dismissed from her post after an internal investigation determined she had provided her automated license plate reader credentials to her husband, Tyler Harpe, who is an agent with Immigration and Customs Enforcement. This incident highlights a significant gap in access control protocols for sensitive surveillance data.

Root cause

The primary vulnerability was the sharing of authentication credentials. According to internal records obtained by local news outlet WJCL, Amber Harpe handed her username and password to Tyler Harpe because he lacked a Flock account through the Department of Homeland Security. This action violated department security protocols, as the Savannah Police Department does not formally share its Flock data with ICE.

Attack path

Tyler Harpe used the stolen credentials to access the Flock system. Between January and July, he conducted 983 search entries covering 97 license plates from multiple states, including Georgia, New Jersey, and South Carolina. Investigators noted that South Carolina accounted for 788 of those searches, with most registered owners being Hispanic. Harpe stated he only targeted individuals with arrest warrants.

Affected versions

The incident involved the Flock ALPR platform used by the Savannah Police Department. No specific software version or CVE identifier was cited in the reports. The system allows data sharing with over 1,700 agencies, but ICE was not on the approved list. The compromise relied on human error rather than a software flaw in the Flock application itself.

Mitigation

• Enforce strict credential management policies prohibiting the sharing of logins.
• Implement multi-factor authentication for all ALPR system access.
• Conduct regular audits of user activity to detect anomalous search patterns.
• Review data-sharing agreements to ensure no unauthorized agencies have access.

Why it matters

Organisations must treat credentials as high-value assets. When users share accounts, they bypass technical controls, making it impossible to attribute actions to specific individuals. Security teams should monitor for unusual query volumes or geographic anomalies that do not match normal operational patterns. Regular access reviews help ensure that only authorised personnel retain system privileges. This reduces the risk of internal misuse or external compromise via stolen credentials.

What to do and how to stay safe: Flock

• Audit all active user sessions and terminate any that deviate from standard operational hours or locations.
• Review recent search logs for spikes in activity or queries outside your jurisdiction’s typical scope.
• Enforce mandatory password resets and enable multi-factor authentication for all personnel with access to surveillance databases.
• Verify that all inter-agency data sharing is governed by signed, current agreements and that no informal access is granted.

Step-by-step guide: Password Policies Examples That Reduce Password Fatigue

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Was the Savannah Police Department aware that ICE did not have formal access?

Yes, records show the department shares data with over 1,700 agencies, but ICE is not on that list.

Did the officer face criminal charges for sharing her login?

No, Amber Harpe was fired but was not among the five other employees arrested following the investigation.

How many searches did the ICE agent perform?

Internal auditors counted 983 search entries covering 97 license plates between January and July.