Savannah officer fired after sharing her Flock login with her ICE-agent husband — 983 plate searches
Savannah officer Amber Harpe lent her Flock login to her ICE-agent husband; audits logged 983 searches of 97 plates. Her firing took effect September 26.
On October 15, 2026, Savannah’s ABC affiliate WJCL published the Savannah Police Department’s internal investigation records and interview audio: officer Amber Harpe lent her Flock license-plate-reader account to her husband, ICE agent Tyler Harpe, between January and July 2026. Internal audits counted 983 search entries covering 97 identifiable plates across six states — and because every query ran under her credentials, the audit trail names her as the operator on all 983. Her termination took effect September 26.
Key points
- Audits flagged 983 searches of 97 plates across Georgia, New Jersey, Maryland, Florida, South Carolina and North Carolina; 48 South Carolina plates account for 788 of the searches, and most registered owners in that group were Hispanic (WJCL).
- Investigators found no violation of Georgia’s ALPR law (O.C.G.A. § 35-1-22), which allows data sharing between law-enforcement agencies; the firing rests on a department policy restricting city software to credentialed staff.
- Harpe was one of six SPD employees fired in August amid a Flock-misuse investigation; four of the others were arrested by the Georgia Bureau of Investigation on August 21. Harpe was not charged, and ICE confirmed it is investigating the agent.
Background
Savannah PD sits inside Flock Safety’s plate-reader sharing network, interoperating with more than 1,700 agencies — and ICE is not on that list. When an investigator expressed surprise that ICE didn’t have its own Flock access, Amber Harpe said, “No one really wants to work with them, sir.” Her husband’s name was redacted in the documents; WJCL confirmed it from the audio. Tyler Harpe told investigators he had no Flock access through DHS and simply asked his wife for hers — “I asked her if I could have her Flock login, and she asked what I was going to be using it for” — used it for about four months, and said every search targeted an ICE objective: a person with an active arrest warrant. The firing fits a pattern we have followed from another angle: Elgin Community College spent most of a year trying to cancel its Flock contract (our October 12 digest) while Flock insisted the cameras stayed; and when data flows go wrong, regulators now put a price on it — Norway just fined Microsoft’s Xandr 92 million kroner over Grindr data.
The audit trail
The makeup of the 983 searches comes from internal audit records obtained by WJCL; Gizmodo’s figures match exactly.
| Item | Figures | Notes |
|---|---|---|
| Search entries | 983 | January–July 2026 |
| Distinct plates | 97 | All identifiable to registered owners |
| States | 6 | GA, NJ, MD, FL, SC, NC |
| South Carolina | 48 plates, 788 entries | About 80% of all searches; owners mostly Hispanic |
Georgia’s ALPR statute, O.C.G.A. § 35-1-22, treats federal agencies as law enforcement and permits data exchange between agencies for legitimate purposes, so investigators found no state-law violation. The disciplinary basis is narrower: SPD policy bars unauthorized people from city and police software. The chain of command split over the penalty — Interim Maj. Max Nowinsky recommended an eight-hour suspension, while Maj. Michelle Halford and Assistant Chief Robert Gavin pushed for termination. Halford wrote that SPD “does not participate in federal immigration enforcement,” and the Hispanic pattern in the searched plates shaped her concern that department resources were advancing immigration enforcement.
The timeline, per WJCL: Amber Harpe’s administrative interview on July 27; Tyler Harpe’s on August 3, with consistent statements from both; Gavin denied the appeal August 11; the chief’s office approved the firing August 13; it took effect September 26; Harpe withdrew her Civil Service Board hearing — set for October 13 — around September 28, without explanation. Note the discrepancy: The Verge’s writeup says Harpe was “fired in August,” while WJCL’s and Gizmodo’s records show August 13 approval and a September 26 effective date. We use the effective date.
What others say
Gavin’s stated rationale: “Credentials are assigned to one authorized user to ensure accountability, audit integrity, and system security.” Flock CEO Garrett Langley has previously treated cases like this as proof the mechanism works, writing that “it is because of Flock’s built-in, permanent audit logs that these officers are held accountable.” The city and department said in a joint statement that “unauthorized access to police technology by anyone is a breach of Savannah Police Department policy and public trust,” adding that “an outside law enforcement agency’s investigative purpose does not, by itself, authorize access to SPD’s system.” ICE confirmed it is investigating its agent. And the advocacy group Secure Justice counts 446 actions by localities to terminate, suspend or not renew Flock contracts — 138 in August and 141 in September alone (via Gizmodo; we did not check the group’s tracker directly).
Our take
Gavin’s sentence could drop into any engineering team’s access policy: a shared credential makes the lender the operator of record, and the lender endorses every query the borrower runs. The rule is old; what this case shows is the gap around it — 983 searches across January to July before the audit flagged the account, which says the detection threshold matters more than the logs’ existence. Teams building agents and automation face the same question: who initiated, who authorized, who answers for it — and audit identity must land on a person. CSO Online’s analysis of four agent overreach incidents reaches the same conclusion from the other direction: the failures were access control, not runaway technology. Harpe’s defense — “no malicious intent, no personal gain” — does not help her, and that is the point of access governance: it does not ask what you did with the data, only whether you were authorized. Two things remain open: the transparency portal listing credentialed agencies — WTOC previously reported it was planned to open by the end of September, and as of the October 15 report SPD’s statement only said the list would go public when the portal launches, with no launch shown — and whether Harpe pursues any further remedy after withdrawing her hearing is unknown.