If an employee uses a police system for something they aren’t authorized to do, that employee owns the decision. I’m not interested in watering that down by blaming the software, the supervisor, the policy manual, or anybody else for a choice the employee made.

But when it happens more than 2,700 times over about a year, I’m going to start asking questions about more than the employee. That’s what caught my attention about what happened at the Colleton County Sheriff’s Office in South Carolina. According to the sheriff’s office, an internal audit found that a lieutenant had made more than 2,700 unauthorized searches in the Flock license plate reader system involving 14 people, including himself, other deputies, friends, and former associates.

The lieutenant was fired, and the South Carolina Law Enforcement Division was asked to investigate possible criminal conduct. That’s the employee-accountability side of it. The number is what raises the other question for me: how does somebody misuse a system thousands of times before the organization catches it?

That question became harder to dismiss when the same sheriff’s office announced that a second lieutenant had been fired after an audit found 62 unauthorized Flock searches over six months. Two employees don’t tell me exactly where every safeguard failed, but they give me more reason to look at the safeguards instead of treating the first case as one person finding one way to break the rules.

Police employees have access to information most people don’t. Depending on the job and the systems involved, that can include criminal histories, driver information, vehicle registrations, license plate reader data, reports, addresses, photographs, and investigative files. We give people that access because they need it to do the job, which also means we have some responsibility for knowing how it’s being used.

A policy saying, “Only use this for official law enforcement purposes,” is necessary. Training is necessary too. But neither one replaces oversight. If my entire safeguard is that I told everybody not to misuse the system, then I don’t have much of a safeguard.

I have to trust the people working for me. Supervisors can’t stand behind every employee every minute of every shift, and I wouldn’t want to run an organization that way. Trust still doesn’t relieve me of the responsibility to check the things that can be checked.

If a system keeps an audit trail, somebody should be reviewing it. If an employee’s usage suddenly looks nothing like everyone else’s, I want that to be visible. If access can be limited by role or purpose, I want to know whether everybody who has access actually needs it. That’s basic supervision, not an accusation that every employee is waiting for an opportunity to do something wrong.

We already apply that thinking to plenty of other things in policing. We count money because money can be stolen. We inventory evidence because evidence can disappear. We account for controlled substances because they can be abused. None of that means I distrust every officer who handles them. It means some things carry enough risk that trust alone isn’t the control.

The technology should help with that too. Flock says every search is logged and available for review, and its Audit Assistance tool is designed to surface atypical activity for an administrator to examine. A system powerful enough to make police more capable should also make unusual use easier for supervisors to see.

That doesn’t mean software can make the judgment for us. An alert still has to be reviewed, and an employee determined to misuse a system may find a way around good safeguards. There may be cases where leadership had reasonable controls in place and still had no realistic way to catch the conduct sooner. But that’s something I want to determine after I look, not assume because the employee has already been fired.

The sheriff’s office did make changes after the first audit. According to the agency, individual deputies would no longer have direct Flock access, routine searches would be handled through the communications division, and auditing would continue. That’s the part of the response that interests me from the management side. The employee’s misconduct still belonged to the employee, but the agency also looked at what the misconduct exposed.

That’s how I think it has to work when something happens in my own operation. I deal with the employee first. Then I look at how it happened, how long it continued, what should have caught it, whether somebody missed something they should have seen, whether access was broader than it needed to be, and whether the same opportunity is still sitting there for the next person.

Firing somebody can solve the employee problem.

It doesn’t automatically solve the problem the employee found.