A former Savannah police officer was fired in August after a department investigation concluded she had handed her login credentials for the city's Flock Safety license plate reader network to her husband, an agent with U.S. Immigration and Customs Enforcement — who then used that access to run nearly a thousand searches, the vast majority of them tied to Hispanic drivers.

The officer, Amber Harpe, was terminated following an internal Savannah Police Department review that found sharing access to the camera system violated the department's security protocols. SPD does not share its Flock data with ICE, and officials said the arrangement with her husband, Tyler Harpe, was never authorized.

The case, first detailed in local reporting by ABC affiliate WJCL and amplified nationally by The Verge, has become a flashpoint in the broader debate over how automated license plate readers — now deployed in thousands of communities — handle sensitive location data, and who gets to query it.

What the records show

According to the investigation and documents obtained by WJCL, Tyler Harpe conducted 983 searches covering 97 distinct license plates while logged in under his wife's credentials. That works out to roughly ten queries per plate, a pattern that suggests repeated monitoring rather than one-off checks.

The plates were overwhelmingly registered to Hispanic drivers, according to the local reporting — a detail that has drawn particular scrutiny from privacy advocates and civil rights groups, who argue it points to immigration-related targeting conducted through a system that was never supposed to be an immigration tool.

SPD officials characterized the matter as a straightforward breach of internal rules. The department said it does not provide Flock data to federal immigration authorities and that granting an outside individual — even a spouse who is a federal agent — access to the system undermined both policy and public trust.

The couple's defense

The Harpes have pushed back on the characterization of their conduct, maintaining that the access was not misused for personal reasons and rejecting the implication that the searches were improper.

"They didn't use access for personal reasons."
— The Harpes' defense, as reported by WJCL

That argument has not persuaded Savannah police leadership, which moved to termination rather than discipline short of firing. The department has not publicly detailed whether any of the queries resulted in enforcement action, or whether any of the information gathered was passed to ICE in a way that would compound the original policy violation.

Why Flock matters

Flock Safety is one of the largest providers of automated license plate recognition technology to U.S. law enforcement, supplying fixed cameras that photograph passing vehicles and log their plates, timestamps, and locations. Departments use the data to trace stolen cars, build evidence in violent crimes, and — critics argue — to reconstruct the movements of people who have never been accused of anything.

The company's contracts with local agencies typically restrict how data can be shared and for what purposes, and most police departments have policies barring access by people outside the agency. In practice, enforcement depends on individual officers protecting their credentials.

The Savannah case illustrates how brittle that model can be. A single shared password gave an outside federal agent the ability to query a municipal surveillance network at scale, apparently without any automatic alert until the activity was discovered.

Two framings of one story

Coverage of the firing has diverged along familiar lines. Local reporting from WJCL led with the documentary record — the internal affairs findings, the search counts, the demographic breakdown of the plates — treating it as a story about a specific officer, a specific violation, and a specific community's relationship with its police department.

National technology coverage from The Verge framed the same facts as a surveillance-governance story: what happens when powerful, networked camera systems are governed mainly by password hygiene and after-the-fact investigations. In that framing, the Harpe case is less an anomaly than an illustration of a structural vulnerability shared by many agencies.

Both readings converge on a common point: the safeguards that are supposed to keep immigration enforcement out of local camera networks are largely procedural, not technical.

The wider immigration context

The episode lands amid heightened national attention to how local and federal agencies share data. Some jurisdictions have moved to wall off their systems from immigration enforcement, citing so-called sanctuary policies and concerns about chilling effects on immigrant communities' willingness to cooperate with police. Others have leaned in the opposite direction, entering into agreements that expand federal access.

Savannah's policy sits on the restrictive side — SPD does not share Flock data with ICE — which is precisely why the breach has resonated. When a policy is clear but the technical controls are thin, the rule holds only as long as every credentialed user chooses to honor it.

Advocates say the incident strengthens the case for audit trails, purpose-based access controls, and automatic flagging when a single account runs unusually large volumes of queries. Departments, meanwhile, face a harder question: whether the value of the camera network outweighs the risk that it becomes a de facto immigration database through individual misuse.

What happens next

Amber Harpe's termination closes the internal disciplinary matter, but several questions remain open. It is not clear whether Tyler Harpe or ICE has faced any review over accessing a system he was not authorized to use, nor whether the searches produced any enforcement outcomes.

For Savannah residents, the case raises a more immediate concern: whether the 97 plates — and the people who drove the vehicles — were ever notified that their movements had been logged by someone outside the police department, or whether the only record of that surveillance is an internal affairs file and a termination letter.

The department has not said whether it has changed credentialing practices since the firing. That silence, privacy analysts note, is where the story of individual misconduct turns into a story about institutional design.