Deputy Searches Woman 300 TIMES

October 1, 2026

Multi-sensor surveillance turret with cameras and optics — Photo: MakDill / Shutterstock

When police misuse investigative databases, it is not a “tech glitch”; it is a predictable failure of controls that turns powerful public-safety tools into instruments of private curiosity and harassment—and the audit trails that catch it are the same levers that can prevent it.

The Short Version

Pinellas County charged two former deputies after internal audits showed repeated, unauthorized lookups: one allegedly ran a 17-year-old and her family; another queried a woman more than 300 times across multiple systems.
The case spotlights a structural risk with law-enforcement databases and license plate reader systems: broad access plus weak purpose controls yields “private-use” searches that audits later uncover.
Automated license plate readers (ALPRs) are not the problem alone; governance is. Logging, case-coding, and proactive review are the difference between an investigative asset and a surveillance free-for-all.
Clear policy, narrow role-based access, and routine cross-system audits are the durable fixes—far more effective than after-the-fact discipline alone.

What the Pinellas cases show, and what they don’t

The Pinellas County Sheriff’s Office says two former deputies, Travis Stanton and Karl Gwynne, used restricted systems for personal reasons. According to the agency, Stanton ran a 17-year-old and her family through multiple databases after meeting her on duty; he was arrested on counts including accessing a computer device without authority and official misconduct. Separately, internal audits concluded Gwynne queried a woman he hoped to date 381 times across five databases between January 2025 and July 2026, including via the agency’s automated license plate reader (ALPR) platform; he was arrested on multiple computer misuse counts. Local reporting aligns with those specifics and adds that more than 200 of Gwynne’s queries occurred while he was off duty, a red flag in any access review.

Stanton reportedly told supervisors there was no official reason for his searches—“curiosity got the better of him”—and initially coded at least one lookup as an “identity verification,” which investigators rejected as pretext. The Sheriff publicly stated the searches were not tied to legitimate law enforcement purposes. For Gwynne, the agency’s audit logic appears straightforward: high volume queries about the same person, spanning systems, for no assigned case, many off shift. These are precisely the patterns that mature audit programs are designed to surface.

How these systems work—and how misuse happens

Law-enforcement data environments are mosaics. Local records management systems, state driver and vehicle files, criminal justice information networks, and vendor platforms like ALPRs each expose search interfaces to sworn personnel. Access is “authorized” in the sense that a user has valid credentials; it becomes improper when the query purpose is unrelated to official duties. The Supreme Court, in refining the Computer Fraud and Abuse Act, drew a line between exceeding authorized access to off-limits areas and misusing information one is allowed to access; most agencies police the latter through policy and state law rather than the CFAA alone. The operational lesson is constant: controls must address not only who can log in, but why, how often, and with what documented predicate.

ALPRs intensify the stakes because they passively collect plate sightings at scale, generating travel histories previously out of reach without human surveillance. That makes them potent for stolen cars and violent felonies—and tempting for private curiosity. Best-practice frameworks recommend detailed logging linked to officer IDs, mandatory reason codes, automatic alerts for anomalous query patterns, and periodic external audits to validate that “official use only” is more than a banner on a login screen.

This is not an anomaly; it’s a governance pattern

The Pinellas arrests echo a documented, nationwide problem: authorized users making unauthorized-purpose queries. An Associated Press review identified hundreds of officers and staff disciplined over three years for abusing confidential databases, often to look up ex-partners or romantic prospects. Legislative audits and civil litigation have pried open similar patterns elsewhere, prompting states to tighten credentials, logging, and supervisory review. The throughline is not hacking; it is policy drift, permissive access defaults, and oversight that reacts after a complaint rather than flagging risk upstream.

ALPR oversight has attracted special scrutiny because deployments have expanded quickly while governance lagged. Policy analyses and civil-liberties reviews have urged limits on retention periods, strict sharing agreements, and passive-use prohibitions that bar fishing expeditions. The most effective safeguards are boring and bureaucratic: standardized case numbers attached to every query, short audit cycles that examine outlier behavior, and command staff empowered to suspend access first and ask questions second when patterns trip defined thresholds.

Where the real disagreement lives

Debate rarely centers on whether an officer may check a case-related plate or driver file; it centers on scope and accountability. Advocates of ALPRs and broader data access emphasize clear crime-control benefits when time is short and leads are thin. Skeptics focus on mission creep: data collected for one purpose quietly repurposed for convenience, curiosity, or retaliation. The Pinellas facts—as presented by the Sheriff’s Office and corroborated in local coverage—do not present a close call on purpose; both matters were, by the Sheriff’s account, non-investigative lookups. The open policy question is how to design systems so those lookups are prevented or instantly flagged, not discovered months later after a complaint or a journalist’s inquiry.

That question is practical, not philosophical. If an internal audit can reconstruct 381 queries tied to one target, a real-time rules engine can also stop the 20th or require supervisory justification on the 21st. If off-duty queries correlate with misuse, access can simply be restricted outside active shifts absent an incident number. If “identity verification” is the most abused purpose code, lock it to specific roles and mandate narrative fields that supervisors actually read. None of this impedes a legitimate search; it merely makes legitimate work legible.

What durable fixes look like

Agencies that take database misuse seriously converge on the same toolkit. First, role-based access that narrows who can touch which systems—and which features—by assignment and case load. Second, mandatory case linkage for every query, with immutable logs that include user, time, target, and narrative justification. Third, automated anomaly detection tuned to local risk signals: repeated lookups of the same subject, spikes during off-duty hours, cross-system searches without a matching incident record. Fourth, short-cycle audits that feed real consequences: instant access suspension pending review for defined thresholds, and documented findings that inform training and discipline. Finally, external accountability—auditor access to logs and periodic public reporting of aggregate metrics—to counter the natural erosion that follows personnel changes and shifting priorities.

Why this matters beyond one county

Public trust in modern policing rests on a bargain: the community authorizes powerful tools in exchange for disciplined use bounded by mission and law. When officers use those tools to pursue personal interests, the breach is larger than an HR problem—it chills victims, jeopardizes prosecutions, and invites legislative backlash that can strip away genuinely useful capabilities. Pinellas did what many agencies promise but fail to execute: use audit trails to surface misuse and bring charges when policy becomes pretext. The next step—the one that makes the story rarer a year from now—is to engineer misuse out of routine practice so that “curiosity” never has a chance to log in.