A former Wrightsville Beach police officer has been indicted on a misdemeanor charge alleging she used an automated license-plate-reader system to obtain information on two vehicles without a legitimate law-enforcement purpose.
Tonya Baker was arrested Sept. 9 after a New Hanover County grand jury returned an indictment on one count of misuse of an automated license plate reader. The charge followed an internal audit by the Wrightsville Beach Police Department, an internal investigation and a referral to the North Carolina State Bureau of Investigation and the district attorney.
Baker is no longer employed by the town. The charge is an accusation, not a conviction, and she is presumed innocent.
What the indictment alleges
According to court-record reporting by Port City Daily, the indictment alleges Baker accessed information connected to two North Carolina vehicle registrations between Feb. 10 and May 12, 2026, without a legitimate law-enforcement purpose.
The SBI investigation began July 16 after Wrightsville Beach Police Chief Jason Bishop and the New Hanover County district attorney requested assistance. WECT reported that the department’s internal audit uncovered the alleged misuse and that the SBI investigation remains open.
Baker received a $500 unsecured bond and is scheduled to appear in court Oct. 12, according to Port City Daily. The public sources reviewed by Killjoy Media did not include a statement from Baker or her attorney.
The law is unusually direct
North Carolina does not leave the permitted use of license-plate-reader data entirely to local policy.
Under G.S. 20-183.31, data from an automated license plate reader may be obtained, accessed, preserved or disclosed only for law-enforcement purposes. The statute also requires agencies operating the systems to maintain written policies addressing training, internal security, access, data sharing, supervisory oversight and audits.
G.S. 20-183.33 makes unauthorized obtaining, accessing, preserving or disclosing of that data a Class 1 misdemeanor.
That is the charge Baker faces. Prosecutors will still have to prove it.
Wrightsville Beach’s own policy required a case-related reason
The Wrightsville Beach Police Department’s ALPR policy says employees may use license-plate-reader data only for official and legitimate law-enforcement purposes. It defines those purposes around criminal investigations, arrests, prosecutions, locating people with felony warrants, finding missing or endangered people, and locating stolen vehicles.
The policy also says the system must record who accessed information, along with the date and time. Personnel may search stored data only when they reasonably believe it relates to a specific official action or investigation.
Those logs are what make an audit possible.
The policy requires the department’s ALPR manager to conduct and retain audits twice a year. Those audits are supposed to include a listing of server access, searches and additions so supervisors can verify compliance.
State law requires annual or more frequent auditing. Wrightsville Beach chose a stricter schedule, then conducted an early audit after launching its town system in March. That audit found the discrepancy that ultimately reached the SBI.
The audit worked—after the searches occurred
The department deserves credit for checking its own system, referring the matter outside the agency and announcing that the employee was no longer employed. Those are meaningful accountability steps.
They also expose the limit of audit-based oversight.
An audit can show who searched, what was searched and when. It cannot prevent an authorized user from entering an allegedly improper query in the first place. It is detection after access, not permission before access.
That difference matters because an ALPR search is not limited to whatever camera happens to be closest to the officer. Wrightsville Beach’s agreement with Flock Safety includes access to statewide and nationwide license-plate lookup networks, along with searches by plate, time, location and vehicle characteristics.
Port City Daily reported that an SBI spokesperson said Baker accessed New Hanover County’s Flock system—not merely Wrightsville Beach’s four-camera network—to obtain the information described in the indictment.
That is the practical meaning of a shared surveillance network: an officer’s login can reach beyond the cameras owned by the officer’s employer.
New Hanover County canceled its Flock contract the same day
On Sept. 8, the day the grand jury returned the indictment, the New Hanover County Board of Commissioners voted 4–0 to terminate the county’s Flock contract.
The county contract included 20 automated license-plate readers and eight pan-and-zoom cameras, according to Port City Daily’s account of the vote. The sheriff’s office disabled national data sharing and removed employee access while the cancellation process began.
The county decision does not shut down systems operated separately by Wrightsville Beach, Carolina Beach or Kure Beach. Each municipal government controls its own contract and cameras.
Wrightsville Beach still promotes its system as a tool for locating stolen vehicles, developing investigative leads and finding vehicles connected to crimes. The town’s public ALPR page says the cameras do not use facial recognition, collect cellular-device information or photograph people inside vehicles.
The cameras nevertheless create time- and location-stamped records tied to license plates. That is why authorized access and a documented investigative purpose are not minor paperwork requirements. They are the boundary between a law-enforcement search and a personal lookup.
Questions the town still needs to answer
The indictment answers one question: the state alleges two registrations were accessed without a legitimate law-enforcement purpose. Several others remain open.
- What prompted the searches?
- How did the early audit identify them?
- How long after the queries did supervisors review the activity?
- Did the audit examine every search by the same account?
- Were the registered vehicle owners notified?
- What changes, if any, did the department make to permissions, supervisory review or audit frequency?
- Will the town release a redacted audit summary that explains the failure without exposing confidential plate data?
The SBI’s investigation is ongoing, and personnel laws may limit what the town can disclose about employment action. Those constraints do not prevent officials from explaining how the control system worked, where it failed and what changed afterward.
This is not only a Wrightsville Beach issue
Killjoy Media previously reported on Flock cameras around Jacksonville and the basic oversight questions they raise: who can search, how agencies document a valid purpose, how long data remains available and who checks the logs.
The Wrightsville Beach case supplies a concrete answer to one of those questions. Misuse is not merely theoretical. North Carolina wrote a criminal penalty for it, a local audit allegedly found it, and a grand jury has now put the accusation into a court case.
The audit trail did its job. The public still deserves to know how much access occurred before anyone looked at it.