Flock, and other pro-mass surveillance parties, will present Chatrie as reaffirming the one cited line from Knotts. I don’t doubt that they have a blog post in the making highlighting this paragraph from Chatrie:

… another feature of Knotts makes it inapt here: that the surveillance there was confined to public roads. That fact was crucial to the Court’s decision: “A person traveling in an automobile on public thoroughfares has no reasonable expectation of privacy,” Knotts explained, because the car is always “in plain view.” 460 U. S., at 281. By contrast, the movements that Location History reveals are not limited to public streets. Recall what Carpenter observed: A “cell phone faithfully follows its owner beyond public thoroughfares and into private residences, doctor’s offices, [and] political headquarters.”

This line of reasoning is somewhat similar to the District Court’s finding in Schmidt v. Norfolk, based on Carpenter, and it’s pretty much what informed Flock’s oft-repeated “we don’t track people” line.

The argument by itself is persuasive enough, but it can only work if you disregard the rest of the Chatrie opinion as well as Beautiful Struggle.

As yesterday’s post also conceded, Knotts is not wrong, per se. Nobody is making the argument that a single observation of a vehicle on a public road does not pass constitutional muster. But that’s not what the search in Chatrie is about — in Chatrie, nobody argues that the observation and collection of the location history data (by Google) was unconstitutional. The Supreme Court never asks, let alone answers, that question. Both Chatrie and Carpenter found a search occurred when the government accessed a pre-compiled, retrospective database containing location history data.

Both Google and Flock are private companies. A private company collecting a user’s location or taking a picture of a vehicle on a public street is not by definition unconstitutional, nor is aggregating that information in a national database. To be clear: I believe Flock deployments generally aren’t legal, but my objections to the cameras themselves are largely statutory, not constitutional.

In Carpenter, the court examined the government’s access to a historical database: the phone company may have collected years worth of data, but the government’s act of looking at 7 days of CSLI records triggered the Fourth Amendment. In Chatrie, the court works through the reasons why location history is private and not voluntarily disclosed (in any real sense), before writing: “we hold that police officers invade a cell-phone user’s reasonable expectation of privacy when they access his Location History.” (emphasis added)

It then restates the same holding: “When the government ‘accesses historical cell phone’ location information—Location History as much as CSLI—it ‘conducts a search under the Fourth Amendment.’”

Access, not collection. Even if the collection — the observation and recording of a vehicle traveling on a public street — would be legal under Knotts, it’s the government’s access of the retrospective database that creates the search under both Carpenter and Chatrie.

That distinction holds even if we were to assume that Flock’s retrospective database contains only observations permissible under Knotts — which is something we know not to be true, because deployments on private property exist, but is a fact that plaintiffs in Schmidt may have conceded.

But, for the sake of argument, let’s say when the Supreme Court wrote about “access” they really meant to include something about the location where the data was collected.

Beautiful Struggle^[1] held that the compilation of retrospective data itself “is enough to yield ‘a wealth of detail,’ greater than the sum of the individual trips”, and “because people’s movements are so unique and habitual, it is almost always possible to identify people by observing even just a few points of their location history.” The court in Beautiful Struggle agreed you can infer a lot of information from a historical database; those inferences fall outside of what is exposed to the public and would be observable under Knotts.

The Fourth Circuit did not treat that conclusion as its own intuition; it drew the principle from the Supreme Court itself, quoting Justice Sotomayor’s observation in Jones that people do not expect “that their movements will be recorded and aggregated in a manner that enables the government to ascertain” the details of their private lives.^[2]

It’s also an argument plaintiffs made in Schmidt, and the one Flock attempted to rebut on a redacted page with (only) the heading “The Flock Camera Data Does Not Enable an Individual to ‘Infer’”. But the District Court found that the data does allow inference of certain aspects of life. The District Court also found that the inference was not enough to trigger a search, but Chatrie now rejects that quantitative test:

… this Court has never understood Fourth Amendment protections as kicking in only once an intrusion “goes too far,” Where the Fourth Amendment applies, it applies regardless of “the quality or quantity of information” the government obtains. That approach makes all the more sense when, as with Location History, law enforcement officials can select the time-limited set of materials they want from an all-encompassing database.

The record in Schmidt shows that capacity to infer exists: plaintiffs’ expert found Flock captured 78.7% of modeled routes, most of them reconstructable because they pass two or more cameras — exactly the ability to rebuild a person’s movements that, under Beautiful Struggle, makes those inferences possible.

Flock’s headline takeaway will be that the 1983 Knotts case about tracking a beeper in a car still stands. The Fourth Circuit should conclude, as they did in 2021 in Beautiful Struggle, and as the Supreme Court did yesterday in Chatrie, that the correct answer to that is: “so what?”

Flock’s best argument has always been that all it does is photograph the back of a car. But under Chatrie, data collection is not the search. The search happens when the government delves into the database built from the photographs — and into everything it lets them deduce.

Forty years ago, Knotts was about watching a car’s location on a road; now, Chatrie and Beautiful Struggle are about accessing location histories. The fight is moving into the 21^st century: from cars and cameras to databases and computer analysis. That’s the seismic wave Alito fears. Flock should too.

@Brief for Amicus Curiae

For the most part, the brief follows Flock’s primary argumentative strategy: if a single observation in public is legal, then all observations in public must be legal. It is a simplistic argument that falls apart under any scrutiny — after all, crimes like stalking and harassment exist. It’s legal to follow a car on the highway, but that doesn’t automatically mean it’s legal to follow your ex’s car to the office, soccer practice, and their therapy appointments.

There’s misdirected effort here, too. The brief’s first argument — pages 6 through 11 — labors to prove that a driver has no privacy interest in a license plate sitting in plain view. No one said otherwise. The plaintiffs concede the point, and the brief quotes the concession on page 12: they “don’t challenge the isolated use of ALPRs for capturing license plate numbers,” only Norfolk’s aggregated, city-wide use.

The fact that Flock has created a nationwide database is barely discussed. That is not so much an omission in the brief, but a result of the plaintiff barely raising it in the petition. The Institute for Justice’s case in San Jose, CA, takes a similar approach. The Supreme Court places weight on the scope of the tracking; it’s a test that might be easier to satisfy with the nationwide network, but the IJ rightly argues even a city-wide network exceeds the Constitution’s limits.

Regardless, the amici states raise the nationwide network. The article cited in the brief’s third footnote is even headlined “For the Most Part, We Can Track You All Over the Country.” That piece is generally critical of LPR deployments in South Carolina, and, beyond its headline, contains lines like “[Flock] does not explain how the data is deleted.” and “Merely by driving a car with a license plate, people are often unwittingly entered into massive databases that are then shared, Bowers said.”

But the nationwide network is not the only point the “one scan is legal” argument glosses over. Another point the brief references in a citation but skips is the one made in Beautiful Struggle: that of data retention. The brief concedes 21-days of data retention, the maximum under Virginia law^[2]. To understand why this is so relevant, we have to look at the states’ and Flock’s talking point, lifted from Carpenter, about “the whole of an individual’s movements.”

In Carpenter, which was about cell phone (“CSLI”) records, the Supreme Court looked at how much information could be obtained from cell phone records and found that it was the whole of a person’s movements. The District Court in Schmidt found that tracking by ALPR didn’t go quite as far as cell phone or ankle monitor tracking would have, and therefore it did not meet that definition.

But that ignores Leaders of a Beautiful Struggle v. Baltimore Police Department, a case the states do cite in their brief, where the court held that because of the 45 day retention, BPD created a “detailed, encyclopedic” record of movements (emphasis added):

Carpenter applies squarely to this case. More like the CSLI in Carpenter and GPS-data in Jones than the radio-beeper in Knotts, the AIR program “tracks every movement” of every person outside in Baltimore. Because the data is retained for 45 days—at least—it is a “detailed, encyclopedic,” record of where everyone came and went within the city during daylight hours over the prior month-and-a-half. … AIR data is more like “attach[ing] an ankle monitor” to every person in the city. “Whoever the suspect turns out to be,” they have “effectively been tailed” for the prior six weeks. (“[P]olice need not even know in advance whether they want to follow a particular individual, or when.”). Thus, the “retrospective quality of the data” enables police to “retrace a person’s whereabouts,” granting access to otherwise “unknowable” information.^[3]

We do not suggest that the AIR program allows perfect tracking of all individuals it captures across all the time it covers. … Still, the program enables photographic, retrospective location tracking in multi-hour blocks, often over consecutive days, with a month and a half of daytimes for analysts to work with. That is enough to yield “a wealth of detail,” greater than the sum of the individual trips. It enables deductions about “what a person does repeatedly, what he does not do, and what he does ensemble,” which “reveal[s] more about a person than does any individual trip viewed in isolation.” Carpenter held those deductions go to the privacies of life, the epitome of information expected to be beyond the warrantless reach of the government. And here, as there, the government can deduce such information only because it recorded everyone’s movements.

— Leaders of a Beautiful Struggle v. Baltimore Police Dep’t, 2 F.4th 330, 341–42 (4th Cir. 2021)

The Carpenter Court found seven days sufficient history to bring it into the territory of a constitutional search: “It is sufficient for our purposes today to hold that accessing seven days of CSLI constitutes a Fourth Amendment search …”. Beautiful Struggle said 45 days, even without perfect tracking of individuals, was sufficient, and that the picture was “greater than the sum of the individual trips”. Norfolk’s tracking of individual trips over multiple weeks and the 21 day retention period falls neatly in between Carpenter and Beautiful Struggle.^[4] The District Court’s finding that this would not be a search is plainly the outlier in the series.

The brief also contains an interesting technical wrinkle: its citation of United States v. Chatrie, 107 F.4th 319 (4th Cir. 2024). That’s a citation to the panel opinion, which was vacated in November of 2024, when the 4th Circuit (where this brief was filed) granted an en banc rehearing. The proposition they cited the case for (that geofence searches are not “searches” under the Fourth Amendment) does not exist in the April 2025 en banc opinion at all.

Even worse for the states and their brief, that en banc opinion in Chatrie was vacated by the Supreme Court today (June 29, 2026). Chatrie is a cell-phone case, so it does not decide the ALPR question directly but the reasoning leaves the states no room. The Court held:

Police officers conducted a Fourth Amendment search when they acquired Chatrie’s location data from Google because an individual has a reasonable expectation of privacy in his cell-phone location information.

And, in the line that lands hardest on this brief’s “it’s only a few data points” arithmetic:

… this Court has never understood Fourth Amendment protections as kicking in only once an intrusion “goes too far” … Where the Fourth Amendment applies, it applies regardless of “the quality or quantity of information” the government obtains. That approach makes all the more sense when, as with Location History, law enforcement officials can select the time-limited set of materials they want from an all-encompassing database.

The brief also cites Knotts^[5] throughout — this is a 1983 case which directly undercuts the brief’s main argument. The quote given is “A person travelling in an automobile on public thoroughfares has no reasonable expectation of privacy in his movements from one place to another.” The more relevant quote from the next paragraph is omitted:

Respondent does not actually quarrel with this analysis, though he expresses the generalized view that the result of the holding sought by the government would be that “twenty-four hour surveillance of any citizen of this country will be possible, without judicial knowledge or supervision.” But the fact is that the “reality hardly suggests abuse,” Zurcher v. Stanford Daily; if such dragnet type law enforcement practices as respondent envisions should eventually occur, there will be time enough then to determine whether different constitutional principles may be applicable. Insofar as respondent’s complaint appears to be simply that scientific devices such as the beeper enabled the police to be more effective in detecting crime, it simply has no constitutional foundation. We have never equated police efficiency with unconstitutionality, and we decline to do so now. — United States v. Knotts, 460 U.S. 276, 283–84, 103 S. Ct. 1081, 1086, 75 L. Ed. 2d 55 (1983)

The Court found that the existence of tracking technology did not violate the Constitution — and it expressly reserved the question of whether deploying that technology as a “dragnet” would.

The efficiency line is interesting, because the states argue it backwards here. In Knotts, it was the defendant who argued that efficient, technology-driven surveillance was unconstitutional. The Court turned that down flat: it has “never equated police efficiency with unconstitutionality.” Efficiency isn’t the test. The states now run the mirror image — uphold our surveillance because it works — and Knotts disposes of that just as fast. Effectiveness doesn’t decide the question in either direction.

The states’ strongest appellate authority has its own fit problem. They lean on United States v. Gregory, an Eleventh Circuit case, for the idea that automatic, nonstop cameras raise no Fourth Amendment concern. But Gregory is a pole-camera case: fixed cameras pointed at the outside of one house during a drug investigation. Trying to apply it to the 176-camera grid wired into a nationwide database asks a case about a single stationary camera to answer the dragnet question Knotts left open.

The Gregory panel wasn’t even fully sold — a concurring judge cautioned against assuming the public-view doctrine “immunizes pole cameras regardless of the length of time they record,” and noted that the Eleventh Circuit’s parallel reasoning about cell-site data was exactly what the Supreme Court threw out in Carpenter.

The Justices rejected that efficiency rationale head-on, in another case the states cite:

We cannot deny that our decision today will have an impact on the ability of law enforcement to combat crime. Cell phones have become important tools in facilitating coordination and communication among members of criminal enterprises, and can provide valuable incriminating information about dangerous criminals. Privacy comes at a cost. … Our cases have historically recognized that the warrant requirement is “an important working part of our machinery of government,” not merely “an inconvenience to be somehow ‘weighed’ against the claims of police efficiency.” Coolidge v. New Hampshire, 403 U.S. 443, 481, 91 S.Ct. 2022, 29 L.Ed.2d 564 (1971). — Riley v. California, 573 U.S. 373, 401, 134 S. Ct. 2473, 2493, 189 L. Ed. 2d 430 (2014)

In all, the states’ two arguments are: (1) a single capture is legal, therefore all captures are legal; and (2) Flock’s LPR network makes police more “efficient.”

Neither argument actively engages with the facts of the case, which are about a city-wide mass surveillance dragnet with long-term historic data collection and warrantless searches of that data. If these are the best arguments the Attorneys General for sixteen states and DC can muster, and with the Chatrie decision in the bank, Schmidt may continue to be an interesting case.

@Eldridge plaintiffs’ response (consolidation, leadership, and the preservation record)

The line comes from an April letter by Flock’s lawyers, written to fend off the suggestion that Flock had let evidence slip away. To justify keeping a smaller slice of data going forward, Flock told the plaintiffs that most of what it collects doesn’t matter:

… Flock’s ALPR system captures over 130 data fields, the overwhelming majority of which—fields relating to bumper stickers, roof racks, window stickers, vehicle pose, and the like—are wholly irrelevant to a lawsuit that concerns whether Flock posted an adequate usage and privacy policy and whether federal or out-of-state law enforcement agencies had unauthorized access to the ALPR data of California public entities.

@Flock’s April 8, 2026, letter

California doesn’t carve out a “doesn’t matter” exception. Its ALPR law defines the regulated information about as broadly as language allows:

(b) “Automated license plate recognition information,” or “ALPR information” means information or data collected through the use of an ALPR system. — Cal. Civ. Code § 1798.90.5

If Flock’s system collects it, it’s ALPR information — plates, colors, the contents of bumper stickers, and whatever the other hundred-odd fields hold. And California requires every ALPR operator to publish a usage-and-privacy policy spelling out what it collects, why, how it keeps that data accurate, and how it secures it. (Cal. Civ. Code § 1798.90.51.)

In February, a California appeals court held in Bartholomew v. Parking Concepts that running ALPRs without a compliant policy is itself the harm — no need to prove your data was ever misused or shared. Flock’s exposure doesn’t hinge on catching it red-handed but on whether its published policy completely and accurately describes what the system does.

It doesn’t. Flock’s published License Plate Reader Policy (last updated November 2025) lists eight kinds of data: a plate image, a vehicle image, vehicle characteristics like color and make, the plate number and state, and the date, time, and camera location. In court, Flock admits to more than 130 — and in its settlement proposal it agreed it “would not deny that it collects other information, such as bumper stickers and roof racks.” Flock admits collecting this ALPR information that appears nowhere in its policy.

@Flock’s April 14, 2026, email

That gap is enough to establish the violation, but it still can’t measure it. The plaintiffs also bring privacy claims, including the tort of intrusion upon seclusion, and those turn on how offensive the surveillance is. Offensiveness is judged by the manner, scope, and aggregation of what’s collected, not by whether any single detail was visible from the street.

Which is exactly why “wholly irrelevant” is posturing. Flock wants the court to agree these fields don’t belong in the case, so it only has to keep and hand over a narrow set. One group of plaintiffs’ lawyers, trying to save some data, has been willing to take that deal. If the deal goes through, Flock gets to produce tidy “samples” that will almost certainly leave out the “offensive” parts.

We know Flock users have run searches for things like “star of david” and “red corvette with cross sticker on rear window”. If I were a court considering “offensiveness”, I’d want to hear about a database of religious expressions being built by snapping pictures of people headed to the grocery store and subsequently sold to the government.

Flock says preserving what it collects on Californians would mean “petabytes of data that no one could use.” Petabytes is the scale of a system that photographs ordinary people running errands and records a hundred-some attributes of each car, over and over, across the state. Flock wields the amount of data it collects as a defense. But the bigger the amount of data collected, the more offensive the surveillance, and the more it’s worth, in real judgment dollars.

But that offensive defense is a misdirect. Flock won’t produce even a plain account of what the fields are and how the search tools work. It brushes off requests for “data dictionaries and data maps” as pointless. Most of the decade of data Flock collected is already rotated out on a thirty-day-to-one-year clock; transient petabytes continue to cycle through Flock’s system, but that doesn’t preclude the question of how much and what types of data have already been collected, sold, and deleted.

Looking at the policy itself, it is conspicuously selective about accuracy — another element required by California law. The policy promises that low-confidence plate reads aren’t passed along, and concedes plate translation “may be incomplete or inaccurate” but says nothing about the accuracy of the other fields — including color, which it collects and sells.

In October 2025, a Volusia County, Florida woman spent more than two weeks in jail after Flock got the color of her car wrong. (For what it’s worth, Flock boasts that its system can tell a motorcycle from a semitruck about 92.3% of the time.)

The plaintiffs, for their part, are still trying to figure out who runs the case; the competing motions go before the court on June 25. The split is basically the one above: triage down to the data that identifies class members and move fast, or fight for the broader fields that show how far the system actually reaches.

The firm pushing hardest to let the broader fields go is, as it happens, the same one whose signature courtroom win helped establish that personal data has real value as data. Reasonable people can disagree about what to save when the clock (and the legal bill) is running. But trading away the most revealing evidence to lock in a quicker, smaller win may not be the best play.

The disclosure failure has always done double duty for Flock: hide what the system collects, and dodge enforcement when no one knows to ask. Now Flock wants it to pull a third shift — wall the undisclosed fields off from the one proceeding built to drag them into the light.

It’s genuinely a bold strategy, Cotton. Let’s see if it pays off for them.

On May 1, 2026, law firms Emery | Reddy and Milberg filed a class action suit in the Northern District of California against The Home Depot, alleging violations of California’s ALPR privacy act and invasion of privacy. It’s the second class action against Home Depot in two months — Bursor & Fisher beat them to it with McGinity back in March. The two suits divide the timeline: McGinity covers shoppers caught before Home Depot quietly updated its ALPR policy in late December; Schmierer covers everyone since. And it lands the same week three separate Flock suits (Eldridge, Dutcher, and Javorsky) move to consolidate in the same court.

The new lawsuit challenges the common assumption that private corporations can surveil their customers and others without limitation. As it should, because that assumption is plainly incorrect. States can and do regulate the use of video and audio recording devices on private property, and California’s ALPR law doesn’t distinguish between private and public operators.

The other component — invasion of privacy — is an interesting tack. The suit alleges two slightly different violations: a violation of the right to privacy under the California Constitution, and the tort of “intrusion upon seclusion.” The complaint writes:

A reasonable person visiting a hardware store does not expect that their license plate data will be automatically captured, timestamped, stored in a national database, and made accessible to hundreds of law enforcement agencies, including federal immigration enforcement, all while the operator maintains a policy that omits mandatory disclosure elements and provides no meaningful restriction on who can access the data.

It also anticipates the obvious argument from Home Depot / Flock:

The California Supreme Court has recognized that the relevant question in an intrusion claim is not whether any single piece of information was publicly observable, but whether the manner, scope, and aggregation of the intrusion would be offensive to a reasonable person.

The complaint then lays out why a private corporation collecting data at its 233 locations in the state, storing that data with its private vendor, and sharing it in real-time with hundreds of police agencies, without Home Depot telling anyone about it, is offensive to Californians believing they’re just shopping for a new toilet seat.

The complaint has a point, and I’m excited to see where it goes. The statutory violations alone give a sense that Home Depot will end up out of pocket on this one, especially after Bartholomew v. Parking Concepts — the February California Court of Appeal decision that held operating ALPRs without a compliant policy is itself the harm.

Other private companies should take note. Flock can hammer its claims about “no reasonable expectation of privacy” and “30+ courts have consistently affirmed that ALPR devices perform lawful actions” all it wants; courts don’t typically look to marketing materials to find what the law is, and neither should anyone else.

The Flock Suits

Home Depot will be defending itself in the same district where Flock is already in court. And the Flock side is getting interesting. Plaintiffs’ lawyers in three existing California class action suits are getting into a consolidation scrap. The firms handling Eldridge and Dutcher don’t like the Javorsky team’s preservation strategy. The motion to consolidate puts it like this:

[Javorsky’s] difference [in approach] has already resulted in a prolonged disagreement with Flock regarding its retention protocols, which has likely resulted in the loss of hundreds of thousands of data points pertaining to putative class members.

But the more interesting bit is technical:

Flock has represented that capturing the broader set (including the ancillary “Identifier” tags) slows its preservation rate by roughly ten times.

The filing does not specify what these “‘identifier’ tags” are, but dollars to donuts that we’re talking about the searchable vectors that power FreeForm, Flock’s natural-language vehicle and person search tool. I have discussed these before in both the FreeForm context, where searches for “Star of David” were performed, and the ReId context, where persons can be tracked across devices through soft biometric data. The math mostly holds there; simple tags stored with the data would be fairly small, plausibly ~200 bytes, so if a vector is ~2kB, that would be about 10x larger and therefore 10x “slower.”

The part that doesn’t make sense in the filing is the preservation rate. It implies that preservation can’t happen in real-time on the backend. Why not? What prevents Flock from setting up an additional replica node? Does it not routinely keep replica copies of its data? If it doesn’t, how does it guarantee data integrity (and thereby both completeness and accuracy)?

I’ve raised these questions before in the context of changing log files:

A distributed explanation is not any better than deleting and adding records in a centralized database. In fact, it would be a very fundamental, very fatal, flaw for records that are supposed to be immutable \— like audit records \— to have multiple copies in multiple places without a single authoritative copy.

Apparently log entries can go missing without Flock’s system throwing an error. If you can’t be sure that your log is complete, you can’t rely on it to show whatever it is you’re auditing for \— it may have been deleted.

If a similar distributed pattern holds for the “identifiers” or vectors — which Flock’s protestations in this new court filing seem to suggest — it would extend the integrity problem from the audit logs to the ALPR data itself.

The motion takes Flock’s “10x slower” claim at face value and uses it to triage: preserve the narrow set that identifies the class, drop the fight over ancillary fields. As a practical call under time pressure, it makes sense. But Flock’s underlying claim is the part that should not have gone unchallenged.

In particular, it’s worth considering that “ALPR information” under California law means “information or data collected through the use of an ALPR system” — not “license plate characters.” Whatever Flock’s cameras capture and feed into its searchable database is ALPR information, with all the operator duties that attach. Flock stating that the broader field set slows preservation by 10x is, in effect, telling the court those fields exist and are part of what the system collects. They’re covered. The plates are just one column in the table.

The more data collected, the more there is for Bartholomew’s harm analysis to work on, and the more there is for the privacy torts’ offensiveness analysis to grade as offensive. In re Facebook — Edelson’s signature win — established that biometric data has value as data. None of that argues for letting Flock walk away from the broader fields just because its architecture allegedly can’t keep up.

Even a narrow set — license plates and locations, a few bytes — is apparently more than Flock can copy or preserve at scale without slowing things down. It implies the live system runs on single copies without the kind of redundancy that would let it verify its own data — and its distributed database likely uses computers sitting unattended on the side of the road, intermittently accessible through spotty mobile connections, storing unencrypted video and images, for the express purpose of directing traffic stops, conducting searches, and providing evidence.

The disclosure failure has always done double duty for Flock: hide what the system collects, then escape enforcement when nobody asks. Now Flock wants it to do triple duty: wall off the undisclosed fields from the lawsuit, too.

In 2021, the Riverside County Transportation Department issued the first of three encroachment permits to the Riverside County Sheriff’s Department for the installation of Flock Safety cameras on county roads. By October 2023, the Board of Supervisors had unanimously approved a $6.9 million contract to expand the program to 538 cameras.

Four and a half years later, the Riverside County Sheriff’s Department’s Flock Transparency Portal shows the sheriff uses 1,718 “LPR and other cameras.”

A CPRA request to the Transportation Department produced three permits, a handful of emails, and a sworn declaration that may be more interesting than the permits themselves.

The Permits

Riverside County Ordinance 499 governs encroachments within county highway right-of-way. Any structure placed in the road right-of-way — including 13-foot surveillance poles with cameras and solar panels — requires a written permit from the Director of Transportation.

@Riverside County Ordinance 499 (as amended through 499.16)

Three such permits were issued:

ENC21120546 (December 10, 2021 – September 1, 2023)

Originally authorized two cameras. Expanded through riders to cover 33 named locations and a blanket permission to add more via individual location notifications (RD Form 136).

@ENC21120546 — Original Permit

@ENC21120546 — Rider 1

@ENC21120546 — Rider 2

ENC23110539 (November 14, 2023 – November 14, 2024)

An annual blanket permit covering “various county road rights of way.” This permit was explicitly styled as an extension of the first.

@ENC23110539 — Second Blanket Permit

ENC25061408 (December 5, 2025 – December 5, 2026)

Another annual blanket permit, the current one. It was issued with a single RD Form 136 notification on file — one camera, in Anza — and four total documents in the folder.

@ENC25061408 — Current Blanket Permit

No Permit, No Problem

The second permit expired on November 14, 2024. The third was not issued until December 5, 2025.^[1]

During those 13 months, the cameras did not come down. The $6.9 million contract continued and Flock’s operations apparently continued without interruption under Riverside County Sheriff and Republican gubernatorial candidate Chad Bianco’s watch.

Ordinance 499 Section 6 prohibits anyone from “constructing, installing, operating, or maintaining” any structure in the county right-of-way without a permit. That’s not limited to construction — it covers the cameras just sitting there running.

The permits themselves reinforce this. The authorized work is not just installation — each permit grants permission to “install, operate and maintain” the cameras. Each is “to be strictly construed and no work other than that specifically mentioned above authorized hereby.”

When the permit expires, so does the authorization to operate and maintain. The first permit’s void date was extended twice via riders — acts that only make sense if the date is an operative constraint. And in December 2025, the county issued a replacement permit with identical scope and authorization language. If the prior permit was still valid, the replacement was redundant.

The second permit’s own conditions made the obligation explicit. Condition M12 on ENC23110539 states: “Upon expiration of this permit, the permittee shall remove the temporary poles and cable.”^[2] The current permit repeats this language and adds: “It is the Permittees responsibility to maintain a valid permit.” The permittee did neither.

Nothing was removed. No extension was obtained. No replacement was issued for thirteen months.

The CPRA request covered all encroachment permits issued between January 2020 and March 2026. The county produced exactly three. The county certified under oath that no other encroachment permit, extension, or authorization exists.

No Application, No Problem

The county requires each permit application to be “in the name of the person, agency, entity, or authorized agent owning the encroachment and controlling the construction of the work.” It adds that the county “would require documentation of the Utility Owner’s authorization of a third party seeking a Permit on behalf of the Utility Owner.”

The applications list “Flock Safety” as applicant and owner — correctly, since Flock owns and installs the cameras. Three different Flock employees signed applications over the life of the program: Danny Campos, Will Warren, and Derek Porcella.

But the permits were not issued to Flock. They were issued to “Riverside County Sheriff Department C/O FLOCK SAFETY.” The Sheriff’s Department is the permittee on all three permits — holding the obligations, the liability, the strict construction clause — despite never having applied for them. There is no application from the Sheriff’s Department on file. No one at the Sheriff’s Department signed anything.

Flock applied. The Sheriff’s Department got the permits. And no authorization exists connecting the two. The county certified under oath that there are no letters of agency, powers of attorney, or similar documents from Flock authorizing the Sheriff’s Department — or anyone — to hold encroachment permits on Flock’s behalf. Nor are there any documents from the Sheriff’s Department authorizing Flock to apply on its behalf.

The county seemingly decided on its own that a permit applied for by “Applicant/Owner: Flock Safety” should be issued to the Sheriff’s Department. And Flock apparently decided that it could treat that permit as its own and forge ahead with installation.

And this didn’t happen once. The third permit application was byte-for-byte identical to the second one. The exact same PDF was filed under both permit numbers. Same date (November 7, 2023), same agent (Derek Porcella), same Flock Safety mailing address in Atlanta, same description of work, same signature.

And the same outcome: the new permit was also issued to the Sheriff’s Department, not the applicant.

@Permit Application — ENC23110539 / ENC25061408 (dated 11/7/2023)

No Authority, No Problem

This is the part that likely matters most, legally.

Riverside County Ordinance 499 Section 6 states that permits “will be issued for only Utility purposes” on county highways. The ordinance defines “Utility” as water, sewer, irrigation, gas, petroleum, cable TV, electric, and communications facilities. Surveillance cameras are none of these.

For non-utility encroachments, the Director of Transportation may issue a permit if satisfied of three things: (1) the use is in the public interest, (2) there will be no substantial injury to the county highway or impairment of its use, and (3) the use is reasonably necessary for the functions of the applicant.

Flock’s cameras are commercial surveillance products owned and operated by a private company. The Sheriff’s Department has a software service contract to access Flock’s data — both inside and outside Riverside County.

The Director’s finding that these cameras satisfy the three-prong test in Section 6 would be the legal prerequisite for every permit in the chain. Without it, the Director had no authority to issue any of them.

No such finding accompanied any permit application.

Whether such a finding could survive scrutiny is a separate question. Is a private company’s occupation of public right-of-way to operate a for-profit surveillance network “in the public interest”? Is it “reasonably necessary” for Flock’s functions that its cameras sit on county roads rather than, say, private property with the owner’s consent?

No Locations, No Problem

Riverside County has contracted for over 500 Flock cameras. Not all of those are on county roads. Some are on city streets, some on Caltrans state highway right-of-way, some on private property. The permit documents include handwritten annotations identifying specific cameras as “NON COUNTY/city,” “CALTRANS,” and “City St/Grand Terrace.”

Someone at the Transportation Department reviewed the camera deployment list, saw cameras on roads the county doesn’t control, and marked them accordingly. But no formal record of that analysis was ever created.

I asked for any records reflecting which of the 500+ cameras are within county highway right-of-way, or any determination that specific cameras did not require a permit. Again, the county certifies that no such records exist.

When the county’s records custodian was asked about the gap between 500+ contracted cameras and the roughly 80 installations documented in the permits, the only response was informal and vague: “some locations may not have been permitted as they could be private or non county maintained roads.”

That’s it. No spreadsheet, no memo, no analysis. The county issued blanket permits for “various county roads” — possibly subject to the typical Flock “deployment plan” — but never really determined which roads it was talking about.

No Traffic Plans, No Problem

Every encroachment permit in the production requires a traffic control plan under Condition C05 — a safety document showing how workers and traffic will be protected when someone is installing equipment in a roadway. The current permit, ENC25061408, goes further and requires the TCP to be signed by a Professional Engineer.

The county produced one set of traffic control plans: for the Spencer’s Crossing project, eight cameras, prepared in February 2023 under the first permit.

No other traffic control plans exist.

That’s a 98% noncompliance rate.

No Fees, No Problem

Section 15 of the ordinance requires that permit fees be paid “at or after the time application is filed, but in any event before the Permit is issued.” The fee fields on every application in the entire production — all three permits, every application, every rider — are blank.

Section 16 exempts public agencies from permit processing fees if they have “lawful authority” to use the right-of-way for the permitted purpose.

Flock applied in its own name. But the permits were issued to the Sheriff’s Department — a public agency — triggering the fee exemption. A private surveillance company applied, a public agency was listed as permittee, no fees were charged, and no one documented why.

No Records, No Problem

None of the above rests on inference or supposition. Each point traces back to a single document: a Declaration of Custodian of Records executed March 23, 2026, signed under penalty of perjury by the county’s records custodian.

The Declaration addresses each follow-up item individually and certifies that the county has no responsive records. This is not a case where documents might exist but were missed. This is the county’s official position, under oath, that these records do not exist.

This is not some isolated paperwork hiccup in Riverside County from a well-meaning county official unable to find records that really exist. Across the country, Flock cameras go up on public roads under permits that no one reviews, with safety standards no one enforces, issued to applicants that no one verifies. Flock routinely operates cameras with expired permits or without an active contract. Riverside County is one of many.

@Declaration of Custodian of Records — March 23, 2026

The Law in “Law & Order”

Riverside County’s surveillance camera program operated for over four years under three encroachment permits issued to an agency that never applied for them, based on applications from a company that never received them, without the legally required public interest determination, without traffic control plans for the vast majority of installations, without fees, and — for 13 months — without a permit at all.

Each of these permits was issued to the Riverside County Sheriff’s Department. Flock — the owner/operator listed on the permit applications — never received a permit but still installed and continues to operate hundreds of surveillance cameras without a valid permit.

The $6.9 million contract belongs to Sheriff Chad Bianco’s office. The entire Flock deployment — from the first two cameras in 2021 to the 1,718 “LPRs and other cameras” now in Flock’s system under the sheriff’s name — occurred during his tenure.

Ordinance 499 Section 18 provides that any person who operates without a required permit, or who violates permit conditions in a way that jeopardizes person or property, is guilty of a misdemeanor punishable by fine, imprisonment, or both.

The wrong permittee is not a technicality. A 13-month gap is not a technicality. Not paying the fees is not a technicality. These are all separate material flaws resulting in unpermitted occupation of public right-of-way by a corporation, based on a permit issued to a sheriff tasked with enforcing the county ordinance that makes it a crime.

The Order in “Law & Order”

The county does not know, from its own records, which cameras needed permits. It has no mechanism to determine which cameras are on county roads, which are on state highways, and which are on someone else’s property.

The Director of Transportation issued permits to the Sheriff, who had never applied for any, without the required public interest finding, and without traffic control plans for all but one installation. When the second permit expired, no one acted. When a replacement was finally applied for thirteen months later it was with the same application — literally the same file — Flock had used for the prior permit. The new permit was also issued to the Sheriff.

That permit process was handled by a Permitting Manager at Flock with over a decade of experience in right-of-way permitting. None of these issues were discovered when processing the permits or through any audit or investigation in three years. Neither Flock’s permit expert, the Sheriff’s Department, nor the Transportation Department raised a flag.

That process — namedrop Chad Bianco, skip the fees, ignore the regulations — is the law and order he now offers California.

The Iowa Legislature created IPIB in 2012 to give Iowans “an efficient, informal, and cost-effective process for resolving disputes” about open records and open meetings laws — without resorting to litigation. Nine governor-appointed members were meant to mediate and, where necessary, adjudicate complaints about governments withholding public records or holding secret meetings. For this purpose, the board was authorized to act as a prosecutor on the public’s behalf.

That is not what the board does, or what it has ever done. IPIB keeps complaints away from courts — not to adjudicate them, but as a black hole that attracts complaints and prevents them ever escaping to meaningful review. The board should be dismantled and Chapter 23 repealed.

The Legislature’s Double-Tap

It is immediately evident from the chart above^[1] that since 2018 the number of cases IPIB has received has remained more or less stable, but if you have attended any of the board’s meetings, you probably heard complaints about increasing workloads.

The workload statement is true to an extent, but the increased workload does not stem from complaints. In part, it stems from a law enacted in July, 2025 (HF 706), which “created a requirement that all newly elected and appointed officials of a government body attend training on Iowa’s Sunshine laws”.

Iowa has 99 counties and close to 1,000 incorporated cities, in addition to myriad state and other agencies. That’s a lot of “elected and appointed officials” who will require training.

IPIB is not required to actually deliver the trainings to officials, but it is required to ensure that one approved course is available at no cost. Unfortunately for everyone involved, IPIB pays its staff attorneys in Des Moines the same rate Iowa DOT pays its Highway Technicians (a position that requires a GED and a CDL permit rather than a JD) in rural Washington County.

When any third party would need to charge more, IPIB staff providing the trainings is the only fiscally responsible choice.

IPIB’s (hourly) Administrative Assistant 2 retired in 2024, taking home $68,494.34 that year.

In a February 2025 budget presentation, then-director Eckley listed “Turnover” as a “challenge,” noting that “Only 1 out of 3 staff has tenure over 1 year.”

That presentation was published in between the board getting sued for violating open meetings law when Eckley gave herself a 6% raise, and before Eckley resigned and the board offered her replacement, Charlotte Miller, the pre-raise salary.

In this context, it would be hard to fault IPIB’s attorney for considering “Lunch and Learn” sessions as more of a networking opportunity than a job responsibility.

By passing HF 706 the legislature ensured IPIB remains ineffective, even if it ever decided to change course. It redirected citizen complaint resolution time to government official training. The board teaches a law it has no time to enforce.

IPIB’s budget has not meaningfully changed between 2018 and 2025, but for FY2026 it estimates a sudden $91,259 (24%) increase, with most of that increase allocated “for hiring of contractor to implement mandatory training per approp language and/or to help with backlog”, confirming that training and complaint-handling time are competing for the same funds.

According to the figures presented at the February board meeting, that backlog is growing fast: between November 2025 and January 2026, 95 cases were opened while only 55 cases were closed. The figures only reflect those two states: “opened” and “closed.” The director omitting case disposition in the presentation to the board suggests her focus is purely quantitative, not qualitative.

At that same meeting, staff said, “we’re no longer drowning as much … we’re treading water” and suggested potential efficiency improvements by pointing out “we’re doing all our own copy editing.” Institutional pressure to reduce backlogs may explain why quality of the work-product isn’t a priority, but professional responsibility still attaches to the individual licensed attorneys drafting deficient orders.

With IPIB’s entire budget swallowed by its personnel costs only to leave them treading water, there is neither time nor money for IPIB to actually do its job of prosecuting violations.

If the board gives its staff nothing to do but take the government on Lunch & Learn dates, can we really expect fair outcomes? The answer is in the chart above: the number of complaints that are actually investigated and handled is low. Very low.

Complaints and Procedural Smokescreens

The process IPIB must follow is outlined in Iowa Code Chapter 23. It is relatively straightforward and probably what you would expect from a process like this.

The screening stage is intended to act as a filter for obviously deficient complaints. IPIB’s inbox may be filled with complaints from people caring loudly about issues well outside its purview. Initial screening is a necessary escape-hatch to allow staff to recommend directly discarding such complaints.

After that initial review, “informal assistance” should be IPIB’s bread and butter. The board’s raison d’être is to be an informal alternative to slow, costly litigation. Informal resolution is step one after the initial review.^[2]

After informal assistance, if the complaint is not resolved, staff investigate the complaint to determine if there is probable cause to believe a violation has occurred. During this process, IPIB can issue and enforce subpoenas to obtain necessary evidence; it can also hear witnesses.

This isn’t a full investigation, but an investigation of probable cause. If a complainant says a document was not produced, this would be the step in the process where IPIB might obtain a copy of an email from the city showing that the record was produced.

Finally, if probable cause is found, the case proceeds to a contested case, and IPIB is to engage in fact-finding and analysis of law. A contested case requires gathering evidence, hearing witnesses, and analyzing legal frameworks.

All of that is what the law requires. The diagram below illustrates what actually happens.

IPIB changed its primary process in November 2024. The new process is described in its 2024 annual report as a “new process [that] better aligns with the requirements outlined in Iowa Code chapter 23.” In other words, the process it used before was “less aligned”, or, in regular English: non-compliant.

That non-compliance was the basis for two separate district courts reversing IPIB complaints a day apart — November 29, 2024, was a remand in van Pelt v. IPIB, and Swarm v. IPIB remanded on November 30, 2024. In both cases, the district court agreed the dismissal was improper, reversed IPIB’s dismissal, and remanded the complaint to IPIB for processing.

In Swarm, IPIB accepted the complaint and almost immediately dismissed it again — this time, “as an exercise of administrative discretion.” Swarm petitioned for review of the new dismissal order and the case is currently pending in Henry County. For van Pelt, IPIB appealed and lost at the Iowa Court of Appeals. It has not yet accepted the complaint.

In 2023, before IPIB’s “more aligned” process, it dismissed 69% of complaints at initial screening. In 2025, after the “alignment,” that number became 47%, but 42% were dismissed for lack of probable cause immediately after screening, but still before investigation, and 2% were dismissed for administrative discretion.

Even without additional context the numbers would be a red flag—the board is telling the public that 90% of their complaints are unfounded or not even worth looking at.

Reviewing a small sampling of “insufficient” complaints confirms that they were not being reviewed for sufficiency at all.

Take, for example, 23FC:0026. Here, the complainant “alleged that she requested a copy of a 911 call concerning the report of a deceased body. She alleged that the CCSO denied the request.” This alone already constitutes a valid complaint: a record was requested, it was withheld. Was it lawfully withheld? Maybe, maybe not. That requires an investigation.

However, rather than investigate, IPIB immediately dismisses the complaint for lack of sufficiency because “it is difficult to see a public interest that is met by releasing the 911 phone call under what would be a traumatic situation for all individuals involved.”

Following its determination of trauma, IPIB then decides that the “value of confidentiality” is greater than the public interest. IPIB does not specify what that value is, or what public interests it outweighs. It applied a balancing test to a factual record consisting of a single sentence about the incident: “the 911 call involves an incident in which the caller found a dead body”.^[3]

IPIB never looked at whether the complaint was legally sufficient on its face. It instead applied the Iowa Supreme Court’s Hawk Eye balancing test,^[4] which weighs confidentiality interests against public interest in disclosure. Like most balancing tests, it can only be applied when a developed factual record is available. IPIB applied it at screening, to a single, unverified sentence.

In late 2024 and throughout 2025, after the introduction of the “more aligned” process, these types of dismissals are partly supplanted by “dismissed, no probable cause.” This sounds like an improvement, but on closer inspection it becomes clear that it is a procedural smokescreen and a mislabeling of what actually occurs.

Take, for example, complaint 25FC:0046. This complaint survived initial screening and was accepted by the board. The next step is informal assistance, but no informal assistance was given, and no informal resolution was ever proposed or rejected.

IPIB proceeded anyway. Rather than examine “books, papers, records, electronic records and other real evidence”, or talk to any witnesses, IPIB simply summarized the original complaint and the school district’s response and slapped an “investigative report” label on it. It closed its eyes and saw no probable cause.

The new “more aligned” process fails to see that the most significant alignment issue was never procedural labeling, but a complete lack of informal assistance — the reason for IPIB’s existence. Neither the old “dismiss for insufficiency” process, nor the new “dismiss for lack of probable cause” process includes that critical step.

Finally, 25FC:0042 illustrates what happens when a board takes discretion beyond what the law provides. It is a clearcut case where a college (ICCC) admits that “its Board agendas were posted online without a physical posting”. That violates Iowa’s open meetings law. However, because “ICCC has unilaterally taken measures to ensure all future agendas are physically posted”, IPIB still dismissed the complaint “as an exercise in administrative discretion”.^[5]

Iowa Code Chapter 23 does not provide for administrative discretion. It authorizes IPIB to dismiss a complaint for lack of jurisdiction, find no probable cause after investigation, or proceed to a contested case upon finding probable cause. Dismissing an already-admitted violation appears nowhere in the statute. IPIB relies on its Rule 497-2.2(4)©, which it was never authorized to write.^[6]

What Chapter 23 does provide for is informal assistance, which would have consisted of IPIB discussing the proposed—and already implemented—resolution with the complainant. It might have tried to convince the complainant that there wasn’t much more that could be gained from the complaint. Instead, IPIB decided it was done and dismissed the case.

Rather than provide informal assistance, which is the reason the board exists, an increasing majority of IPIB’s decisions fall within those three categories of dismissal.

IPIB at the Court of Appeals

In its appellate brief in van Pelt v. IPIB, the board rejected its job out loud:

Van Pelt wistfully opines that IPIB’s failure to conduct a formal investigation of his complaint rendered unavailable discovery methods that would have otherwise been accessible to him had he directly filed an enforcement petition in the district court against WDM under Iowa Code section 22.10. Yet, “Iowa Code section 23.5 offers a choice to persons seeking to enforce the open records law.”Van Pelt voluntarily chose to file a complaint with IPIB against WDM in lieu of directly pursuing judicial enforcement of his records request in the district court.By electing this particular remedy, van Pelt subjected himself and his complaint to the framework IPIB implemented through its administrative rules to review and adjudicate public records complaints.

IPIB shamelessly used the word “wistfully” to describe a valid legal argument about its flawed case-handling resulting in a loss of statutory rights. That word choice tells you everything about how the board views the people it was created to serve: not as parties with enforceable rights, but as nuisances who should have known better.

That same contempt surfaced when IPIB asked the District Court to stay its order:

. . . any perceived delay in processing van Pelt’s complaint would not constitute a violation of any applicable statutory or administrative requirement as neither Iowa Code chapter 23 nor IPIB’s administrative rules place any deadlines upon the Board’s complaint intake and investigative functions.

In so many words: “even if you make us look at the complaint, we’ll take as long as we want, and there’s nothing you can do about it.” Never mind that IPIB’s own rules require it to “promptly work with the parties” toward an “expeditious resolution.” Following the rules it wrote does not appear to be IPIB’s strong point.

The van Pelt v. IPIB case began life as IPIB complaint 23FC:0104. The short version^[7] is that the complainant — me — had requested a “deployment plan” for a company’s surveillance cameras from the City of West Des Moines. That plan was incorporated by reference into its contract with its vendor. West Des Moines responded “we didn’t download it from the vendor website” and IPIB dismissed the complaint without further investigation.

I filed a case for judicial review, originally as a direct challenge to IPIB’s procedural misstep. The trial attorney chose to go in a different, needlessly complex direction.^[8] Nevertheless, the District Court found that IPIB had not done its job and sent the complaint back to IPIB for processing.

IPIB chose to appeal and lost on the grounds that the complaint was legally sufficient. But even with an appellate opinion on the books, the board refuses to entertain even the possibility that its process or its interpretation of law may be flawed.

The Iowa Court of Appeals opinion explained that when a government body’s contract expressly incorporates a document, that document “belongs to” the government body under Iowa Code § 22.1(3)(a) — even if the body never retained a physical copy.

The Court also held that the City, as a party to the contract “always has a right to” the entire contract — including what is incorporated into that contract — and that under binding precedent,^[9] the City had a duty to produce it from readily available sources.

The opinion then closed two common defenses: first, a claim that a vendor “owns” the document.^[10] This defense fails where the government body has contractual approval rights and ongoing obligations. Second, the claim of “I don’t have it.”^[11] This defense does not work when an ongoing contractual relationship gives the body ready access.

But perhaps most significantly for future IPIB complaints: the court defined the review standard for IPIB’s initial screening. It describes it as equivalent to a motion-to-dismiss standard where all facts are taken as true and the only question is whether the complaint is legally plausible on its face — meaning “does this complaint allege anything that could be a violation?”

As long as the complaint alleges that a government body withheld a record or did not provide notice for a meeting, the answer is almost always “yes.” IPIB cannot resolve legal or factual disputes at the threshold stage and must investigate complaints that clear that bar.

At least that’s what the court says.

Business as Usual

In a meeting on March 12, 2026,^[12] deciding on whether to seek further review by the Iowa Supreme Court, IPIB’s AG-supplied attorney and its board members brushed the decision off as though it contained nothing of substance, commenting “this is not like we’re going to set precedent — it’s [not] going to change the way we do business.”

To find out what “the way we do business” is, you only have to look at the February 2026 meeting agenda. Nine cases were dismissed via the consent agenda. Some appear appropriate, like dismissals for abandonment or lack of jurisdiction, but others, like 25FC:0184, make determinations of fact and law at initial review (“Because there are no records responsive to the complainant’s request, the Department did not violate Chapter 22 when it closed the request.”)

Most insidiously, one complaint was dismissed via the consent agenda through an order drafted by executive director Miller because “complainant does not argue” a specific enough violation of Chapter 22. The complaint itself wasn’t deficient, but the complainant didn’t do IPIB’s job making its legal argument for it.^[13]

At that same February meeting, board member Luke Martz commented to a complainant:

you’re not the first person who’s come to this board frustrated with what we expect our public officials to keep as records that they don’t… you’re not alone.

He then voted to dismiss the complaint for lack of probable cause. IPIB had not held an evidentiary hearing, or engaged in any real fact-finding. It did not subpoena the records to definitively answer whether they exist. The lack of probable cause was wholly based on a passively-voiced “[no] evidence was presented to IPIB that indicated the county was not honest about the existence of the records.”

The remanded van Pelt complaint may be on the agenda for the board’s March 19 meeting; as of March 17, IPIB has not yet confirmed the meeting date or posted the agenda on its website.

The Board’s Legacy

Of all the complaints IPIB has received since its founding in 2012, it lists only four as contested cases on its website. One resulted in a $1,000 fine, one was settled, one was dismissed, and one was appealed all the way to the Iowa Supreme Court. None of them resulted from complaints dated 2018 or later.

The contested case that reached the Iowa Supreme Court ultimately returned to IPIB’s complaint sink, never to be seen again. In Ripperger v. IPIB,^[14] the board found that the Polk County Assessor violated chapter 22. The Supreme Court reversed in part and remanded for IPIB to resolve whether the property owners who requested removal qualified as “persons outside of government” — a factual question the board was specifically instructed to answer. No published order on remand appears to exist. The case entered IPIB’s complaint process and, like the rest, simply stopped.

In addition to handling complaints, IPIB is also authorized to issue “declaratory orders with the force of law determining the applicability of chapter 21 or 22 to specified fact situations”. This allows IPIB to, for example, declare that posting a meeting notice only on a city’s TikTok-account is not sufficient notice, even if nobody has complained about that yet.

IPIB has issued a declaratory order only once, back in 2013. It has, however, produced a number of informal advisory opinions, which are similar to declaratory orders in many ways, but are non-binding informal advice.

In thirteen years, IPIB’s entire record is a single $1,000 fine and one formal opinion. Even worse, IPIB completely neglects the most powerful tool the legislature gave it: the subpoena.^[15]

That’s not a result of underfunding, staff training, or resource limitations. That’s an institution that isn’t even trying. Even when IPIB itself determines there is probable cause that a violation occurred, it does not act. Even when a court tells it to handle a complaint, it would rather appeal and spend years in litigation than do its job.

IPIB in its entirety is perfunctory. Its board members and staff would rather “align” procedures in ways that present the appearance of efficiency rather than address the substance of its work—or the lack thereof.

The agency serves only one purpose, and it’s for the state, not the people: to serve as a complaint-sink for Iowans who believe that access to government is a right, not a privilege to be granted at the government’s discretion.

Connecticut Makes it Work

Connecticut — which has 3.7M residents compared to Iowa’s 3.2M — has had a very similar board since 1975: the Freedom of Information Commission (FOIC). The FOIC has been able to use the same tools IPIB has to mediate two-thirds of its complaints, hold evidentiary hearings, and produce numerous declaratory orders and contested cases each year.

In 2024, the FOIC handled 855 complaints, compared to IPIB’s 134.^[16] Those numbers predate IPIB’s 2025 training mandate. That’s important, because Connecticut abolished county governments and currently has only 169 municipal governments — a fraction of Iowa’s.

With similar populations, you might expect more complaints in Iowa. More government bodies could violate the law, and smaller cities and counties might not have dedicated legal staff, or even full-time staff. The exact opposite is true.

Either Connecticut’s agencies are a lot worse at open records compliance than Iowa’s, Iowans have less interest in local government, or — most likely — Nutmeggers have more faith in FOIC than Iowans have in IPIB. For good reason.

FOIC has eight staff attorneys versus IPIB’s two. Each FOIC attorney handled 107 cases, compared to IPIB’s 67, assuming IPIB’s director does not handle complaints. (45 if she does). FOIC’s 2024 orders aren’t a list of procedural and discretionary dismissals either; in fact, contested case hearings are so common in Connecticut that they’re published via weekly agendas. Iowa has not seen one since 2017.

Colleen Murphy joined FOIC in 1990. She became its executive director in 2005. She retired in February of 2026. Connecticut retains staff and builds deep institutional knowledge while IPIB greases the gears of its revolving door.

IPIB’s Future

IPIB could have been Connecticut. The concept was sound. The incentive structure that has been in place for years has undone the concept and replaced it with an executive bureaucracy wholly divorced from the institution’s original purpose.

For years, IPIB’s budget was flat. The recent bump was accompanied by more work. Its staff turns over faster than it can develop institutional knowledge. Its board members are appointees with no particular accountability to the public it supposedly serves. And the legislature, which created IPIB as a cheap alternative to litigation, has just handed it a training mandate to fully crowd out the complaint work it already wasn’t doing.

IPIB can’t stop and think about what it’s doing while it’s treading water. The legislature has shown the opposite of an appetite for reform. The solution is to dismantle the board entirely and repeal chapter 23.

We could replace it with a new agency, but there is no reason to think it would fare any better. The statute gave IPIB everything it needed. IPIB chose not to use it.

Instead, training functions can be assigned to the Attorney General’s office, where they belong. The AG knows — or should know — open records law well enough to be able to either put together a curriculum, or to approve one to be delivered by a vendor or one of Iowa’s 15 community colleges (at least seven of which have existing legal programs).

Advisory Opinions should not be handled by the AG because of its conflict of interest when defending state agencies. If they are needed, the Office of Ombudsman, which reports to the legislature, could take up the task as it did before IPIB. Alternatively, advisory opinions could be assigned from a lawyer pool, similar to criminal defense appointments.

Adjudication can still happen through the courts. For Iowa Open Records Act (chapter 22) cases, discovery is often unnecessary due to the reversed burden of proof. The Iowa Supreme Court has rule-making authority to create an expedited procedural track for Chapter 21/22 enforcement without new legislation. The small claims process shows that courts have ample leeway in setting expectations for plaintiffs.

IPIB’s declaratory orders — of which only one exists — are covered under the courts’ general declaratory powers.

An informal complaints process is mostly unnecessary. Informal resolution is baked into the general concept of settlement negotiations when a case is reviewed by a court. Governments only settle when it hurts less than the alternative. Taxpayer-funded attorney fees keep that threshold high regardless of forum. Fee-shifting and court-enforced fines for individuals — recently raised to $12,500 for open meetings violations^[17] — can provide pressure where IPIB won’t.

But resources spent on mediation would likely be better redirected to free or low-cost legal aid for citizens, and potentially, if it can be kept sufficiently conflict-free, a general “open government helpline” at the Attorney General’s office for both citizens and governments.

Dismantling the board would remove citizens’ temptation to fall into the § 23.5 false election-of-remedies trap. Complainants already need to go to court to get IPIB to investigate. Staying there is the more efficient option.

Swarm v. IPIB illustrates the trap: Swarm’s case stems from an open meetings violation he alleges happened in January 2022. After IPIB dismissed his complaint, Swarm sued the city for the violation, but amended to put IPIB’s name on the suit. When he did, the city joined IPIB. Sixteen months after Swarm filed the case, the district court heard it. It then sat on it for another ten to decide what to do.

It took a full twenty-six months and going toe-to-toe with both the city and IPIB — who filed a combined five attacks on the case before even filing an answer^[18] — as a self-represented litigant, but Swarm ultimately prevailed.^[19] The complaint was then sent back to IPIB’s “efficient, informal, and cost-effective process for resolving disputes” to finally be looked at. IPIB instead made a near-immediate determination: “probable cause exists to believe a violation has occurred, but, as an exercise of administrative discretion, [we] dismiss the matter.”

Today, more than four years since the alleged violation happened, Swarm is back in court fighting IPIB.^[20] He has made no progress whatsoever on the original complaint — Mount Pleasant and IPIB have been spending scarce judicial resources and taxpayer money for years so that one can avoid slapping the other’s wrist.

In January of 2026, Eulando Hayes also filed a lawsuit against IPIB, seemingly because of further improper “probable cause” dismissals in 25FC:0141^[21] and 25FC:0142.^[22]

When the board is dismantled, Chapter 23 should be repealed in its entirety and any pending complaints should be dismissed without prejudice or triggering the election-of-remedies statute, to be refiled in court.

It’s been more than thirteen years. The board has issued only non-binding advisory opinions, one fine, and one declaratory order. At least two separate litigants have spent years in court in their efforts to get IPIB to look at their complaints — so far unsuccessfully. A third just started.

Even if IPIB survives, the “election of remedies” in § 23.5 must go. Iowans should be able to trust a government agency to do what it says on the tin. But when that fails — when appointees decide doing their job is discretionary — citizens should not be left wistful, longing for a state that believes in the laws it creates.

Don’t confuse it with the other proposed ALPR bill, House File 2161, a bill that was amended to give the insurance industry access to surveillance data.

H.F. 2701 doesn’t do that. At least not out loud. Its central accomplishment is eliminating oversight.

Virginia, but less transparent

H.F. 2701 closely tracks Virginia’s HB2724 law, which came into effect in July, 2025. Much of the language in Iowa’s bill was lifted verbatim from Virginia’s.

The Richmond Times Dispatch published an article today, titled to tell Iowans in no uncertain turns what the proposed bill really holds: “State won’t say which law enforcement agencies are breaking surveillance camera laws.”

Under the new laws, agencies can’t share their databases with other states or federal agencies. But at least nine self-reported that they were still allowing federal agencies continuous access to their databases, and another 20 were still allowing out-of-state agencies that same access, the crime commission said in it’s*[sic]* January report.

The commission won’t, however, identify which agencies are violating state law – and it is not required to release records to the public due to a longstanding exemption from public records law.

Iowa’s proposed bill does not restrict sharing with out of state agencies, but Virginia’s outcome for finding violations is better than the one Iowa can expect; the Iowa bill is significantly worse for transparency.

Like Virginia, it would remove ALPR system audit trails, which provide information on what the system is being used for, from oversight. Virginia requires that agencies record data about when the system is being used for stops, and demographic data on who is being stopped. Iowa does not. Iowa requires annual reporting too, but only of self-reported aggregates nobody can verify.

Where some might find it shocking that Virginia’s commission won’t answer the question “who abused the system?”, Iowa took that same bill and surgically removed any possibility of that question being asked.

The only report goes to the Department of Public Safety. This is problematic, given DPS’ history of inaction on surveillance, and its readily-apparent conflict of interest when it comes to oversight of local police.

Any reports would contain aggregates of data that isn’t required to be collected according to any standard, or at all — like the number of stops. But even if the numbers were there, nobody could verify them: the underlying log files are completely inaccessible to anyone except the agency reporting, including DPS.

Make no mistake: Iowa police don’t want you to know about ALPRs. The ACLU of Iowa/University of Iowa’s report showed widespread violations of existing open records law;^[1] the Iowa Public Information Board unlawfully refused to look into non-disclosure of ALPR contracts; and the Wapello County Sheriff and Altoona Police Department adopted policies on concealing ALPR use.

This bill allows them to hide everything. And they will.

The Warrant Red Herring

The Iowa bill also does away with Virginia’s “reasonable suspicion” standard, in favor of a warrant requirement. That warrant requirement, however, is a red herring for two main reasons.

First, it only applies to data older than 24 hours. The first 24 hours are a free-for-all, requiring only self-certification (in a secret log) of a vague approved purpose. During this period, data can be accessed and copied without a warrant. If the data is copied to a location outside the ALPR system, the bill’s protections evaporate. Agencies across the country already use this mechanism to bypass existing retention requirements.

Second, the bill sets no bounds on who can issue a warrant. Any magistrate can. The magistrate does not have to be in the same county, nor does he need to have jurisdiction over the alleged offense. Magistrates appointed before 2009 are not even required to be lawyers—there’s no incentive to push back on a warrant 200 miles away when you’ve been doing the same part time job for 17+ years. The setup enables the worst kinds of forum shopping.

The electronic warrants system compounds the problem—it creates a system where search warrants are, or at least can be, handled similarly to your Amazon Shopping customer service complaints.

The judiciary’s oversight of magistrates is voluntary. That means that unless the chief judge in the county where the warrant was granted — which can differ from the county where it was requested — is actively monitoring the search warrants granted in the county there is no oversight.

Who can complain when the use of ALPR remains hidden? Who can even find warrants when it takes visiting all 99 county courthouses?^[2] And, critically, who could ever find out if the system was queried without a warrant?

Police don’t Police Police

As the outcome in more-transparent Virginia shows, these aren’t hypothetical concerns. We can’t trust police to “do the right thing” when it comes to oversight.

This bill does not aim to solve any problems, it aims to hide them. Virtually all abuses of ALPR systems that have been uncovered have been found by journalists and members of the public; immigration searches in Illinois uncovered by a community group, stalking in Joplin, MO, discovered by DeFlock Joplin, a Kansas police chief was only found to be stalking after admitting it, KCUR in Lenexa found police investigating a column author, and just two weeks ago in Milwaukee, a stalking victim found out by looking up their plate on haveibeenflocked.com.

Because nobody actively monitors how these systems are being used, these abuses are not discovered in real-time. It takes drawn-out open records processes, complex analyses, and lengthy investigations. The bill requires logs to be destroyed within two years — or sooner, at the agency’s discretion.

Of course, whether the existence of evidence in a locked filing cabinet in the basement of the police station actually matters is another question.

Iowa’s bill would sweep this type of evidence of abuse under the rug. It undermines Iowa’s public records law and tacitly blesses the current complete non-enforcement of Iowa’s existing laws on surveillance.

The ACLU/UI report revealed that over a third of Iowa agencies grant access to non-sworn support staff, like administrative staff and clerks. The bill doesn’t address this, nor does it set minimum security standards in statute — it delegates them to the same agency policies nobody audits.

The bill is silent on how Iowa enforces its restrictions on out-of-state agencies that access the data — or on what happens when out-of-state agencies don’t comply with, for example, the requirement to send annual audit reports to DPS.

If this bill passes, some will claim it as a victory. Neither the ACLU, nor the legislature, nor DPS will have any way to verify if it was.

The ACLU of Iowa, Institute for Justice, and Americans for Prosperity should withdraw their support for H.F. 2701. Virginia has proven that it places incident screens where guardrails are needed. Let’s learn from their mistake.

I recently received a copy of Flock’s response to a CDPA request. The response was predictable: obfuscate, misdirect, and deny.

In this article, we’ll pick Flock’s response apart, because the Attorney General hasn’t. Yet.

CDPA 101: It’s GDPR Lite

The CDPAs adopted by the various states broadly follow a pattern inspired by Europe’s General Data Protection Regulation (GDPR). What they protect varies a little from state to state, but the general idea is “information that is linked, or linkable, to persons.”

In equally broad terms, whenever a “person” (government, business, natural person, etc.) collects or maintains protected data, they are a “controller” and someone merely handling the data is a “processor.”

In states with a CDPA, you typically can do things like request your data from the controller, opt out of certain data collection, find out how it’s being shared, and correct incorrect information.

Corporations in general, but mass surveillance corporations in particular, enjoy existing in liminal spaces. Even though various state laws require the separation to be clearly defined in contracts, the terms are often purposely left out, or, if included, left ambiguous.

That problem is compounded for government-funded corporate surveillance because the surveillance devices (cameras, microphones, what have you) and software are often said to be private, while the funding and operational infrastructure (permits, land use, and so on) is provided by the government.

A fun fact — and we’ll get to why it’s “fun” in a minute — is that the government itself is exempt from the CDPA.

A Response, Annotated

With respect to any systems over which Flock is a controller, we did not locate any data in such systems that matched the information provided in your request

It is unclear what systems Flock refers to, but clearly it admits it is a controller of some systems.

But let’s gloss over that really, really quickly.

With respect to any data which may temporarily be stored on Flock Safety devices, such data is consistently written over on a rolling basis due to limited memory space on the devices and is not stored or maintained on such devices in a manner that allows Flock Safety to directly identify, link, or associate the data with an identifiable person. This can only be done via the Flock Safety software systems, where, as described further below, all data is owned and managed by Flock Safety’s customers.

This sounds sort of meaningful, but isn’t. At least not in the way Flock would like you to believe. Ownership and management are not factors, nor is whether Flock “identifies, links, or associates” the data with an identifiable person. Whether the data is stored “temporarily” or whether it’s overwritten on a rolling basis are all technical implementation detail that neither the CDPA, nor the requester cares about.

What they do care about is the admission in the middle of the technobabble: Flock stores or maintains “such data.”

With respect to any systems where Flock Safety processes data on behalf of our customers, please note that Flock Safety’s customers are owners and controllers of the data Flock Safety processes on their behalf. Flock Safety is a service provider and processor for our customers and as a result, we are unable to directly fulfill your request. We recommend contacting the organization that engaged Flock Safety’s services to submit your request, as they are responsible for assessing and responding to it.

This paragraph is Flock’s key assertion. It is boilerplate crafted to dismiss requests under many states’ CDPAs, which share the “processor” language. But it’s lazy boilerplate, because it also uses “service provider” from California’s CCPA/CPRA.

If it’s too much work to craft a form letter specific to California — the most populous state in the nation — it’s probably a safe assumption that it’s too much work to actually look for the data requested.

Here are a few additional points about Flock Safety’s data collection and privacy practices:

Okay, let’s hear 'em.

Customer Contracts: Flock Safety’s processing activity as a service provider and processor is governed by the contract we have with our customers, which captures their instructions and the limitations on how Flock Safety may process their data. Flock Safety’s customers own the data and make all decisions around how such data is used and shared.

The same boilerplate “California-plus” language: “service provider and processor.”

The paragraph itself — its activity is governed by the contract it has with its customers — is meaningful. Hang on to that tidbit, we’ll come back to it.

No Sale of Data: Because Flock Safety’s customers own the data, Flock Safety may only process the data in accordance with our customer’s instructions, as outlined in our contracts with customers. Flock Safety is not permitted to sell, publish, or exchange such data for our own commercial purposes.

Again, the causal link Flock suggests here does not exist. The CDPA places restrictions on the sale of data, but it does not consider “ownership.” That’s deliberate, because it’s not how data sales work in practice: people rarely sell data, they license it.

And while “for our own commercial purposes” is technically correct, it is misleading. As a processor, Flock would not be permitted to “sell, publish, or exchange such data” for any reason. It can follow the express instructions of the controller. That’s it.

Instead, its business model requires it to schlep around buckets full of data between customers, and between its own systems to offer a Surveillance-as-a-Service product.

Information Collected: Where Flock Safety’s customers leverage License Plate Reader (LPR) technology, the LPRs do not process sensitive information like names or addresses. Instead, LPRs only capture images taken in the public view of publicly available and visible vehicle characteristics

Flock’s response focuses on “LPR” cameras. Which is the most well-known of its products, but still only a subset. Its other products, like Condor PTZ cameras, Raven microphones, and even Nova (which “combin[es] CAD, RMS, video footage, LPR data, and even open-source intelligence [which includes things like consumer credit reports, and, according to independent security research, SSNs and other dark web data] in one unified experience”) go unmentioned.

That its roadside cameras don’t process “sensitive information” is false. That term is defined by the CDPA; in Delaware, it includes “precise geolocation data”, in Minnesota it includes “specific geolocation data.” Both are statutorily defined terms describing a type of data captured by Flock’s roadside cameras.

To make the claim true, Flock attempts to substitute its own definition of “sensitive data” for the one provided by the statute.

But what matters more for the response is not whether a specific Flock product handles a specific type of information, but whether Flock, as a company, has protected data.

The answer to that is “yes.”

Purpose: Flock Safety customers use data for security purposes, including managing public safety or responding to safety concerns and reports. Additionally, such data may be used to help solve crimes and provide objective evidence.

Close, but not quite. Flock’s standard contract says: “‘Permitted Purpose’ means a legitimate public safety and/or business purpose, including the awareness, prevention, and prosecution of crime; investigations; and prevention of commercial harm, to the extent permitted by law.”

The purpose itself is mostly irrelevant. The point is that the “Permitted purpose” is defined by Flock, in its standard terms and conditions, which it can unilaterally modify. Determining the purpose makes Flock the controller.

Retention: By default, Flock Safety’s systems only retain data for 30 days, which means that any data collected on behalf of customers is permanently hard deleted on a rolling 30-day basis. Flock Safety customers may shorten or lengthen this retention period based on their local laws or policies.

This is an equally relevant admission: Flock sets the default retention period, and it determines that it “permanently hard deletes” the data. Its customers can influence those terms later, but it is, again, Flock making controller decisions.

Processors vs. Controllers

From Flock’s lazy boilerplate, it’s already sufficiently clear that the company (a) has the data requested, and (b) is the controller of that data. Its response does not survive. But let’s double-tap.

All the States, None of the Work

The response above was from Minnesota, but we’ll use the CDPA from Flock’s state of incorporation — the Delaware’s Personal Data Privacy Act (DPDPA) — to walk through it. DPDPA is not only the most fun to say, it is also functionally identical to Minnesota’s MCDPA in every way that matters here.

If Flock gets to write a California-plus denial, I get to write a Minnesota-plus indictment of it.

Flock’s California-plus language is telling in its laziness. If Flock were a processor, it would have an obligation, under the MCDPA or DPDPA, or some other CDPA, to assist the controller with the request. If it were a service provider, it would have that same obligation, but to the business.

What Flock does instead is punt, without even identifying who it claims the controller is or are — presumably all of its Minnesota clients.

Minnesota gives consumers the right to a list of every third party who received their data. Flock’s response does not even mention it. As a processor, Flock has the duty to assist the controller to locate the list and provide it as a response.

That Flock’s response is lazy is unsurprising when the contact information listed on its CDPA form is “Generitech Privacy 123 Main Street Capital City, ST, USA 10001 +1-800-000-0000 emailprivacy@generitech.com”

The laziness shows that it does not even attempt the bare minimum to fulfill the role it claims for itself. The only thing it does is send out form letters as generic as 123 Main Street.

The Missing Contract

Remember the relevant contract claim. Flock claims there is one, which is good. But the DPDPA and MCDPA (and others) not only require that there be a contract between a controller and a processor, they require it to have specific content.

Flock’s contracts, as we have reviewed them, do not contemplate this. Here is an example of such a missing requirement — you can look for it in the terms Flock publishes on its website:

A contract between a controller and a processor must govern the processor’s data processing procedures with respect to processing performed on behalf of the controller. . . . The contract must also require that the processor to do all of the following: . . . Allow, and cooperate with, reasonable assessments by the controller or the controller’s designated assessor, or the processor may arrange for a qualified and independent assessor to conduct an assessment

Flock’s contracts do not contemplate this at all. Not even close.

The DPDPA requires that the division of labor between a controller and processor is laid out in the contract to avoid exactly the type of shell game Flock attempts to play.

That requirement is not without teeth — the law spells out the consequence of omission:

Determining whether a person is acting as a controller or processor with respect to a specific processing of data is a fact-based determination that depends upon the context in which personal data is to be processed. A person who is not limited in such person’s processing of personal data pursuant to a controller’s instructions, or who fails to adhere to such instructions, is a controller and not a processor with respect to a specific processing of data.

Flock’s prize for failing to have an adequate contract in place is that it becomes the controller.

The Government as Controller

Even if Flock’s contracts were perfect, its position would still fail. As stated earlier, the CDPA does not apply to the government. That doesn’t mean that it is optional for the government, it means that the statute, as a whole, does not apply to the government.

This chapter does not apply to any of the following entities: Any regulatory, administrative, advisory, executive, appointive, legislative, or judicial body of the State or a political subdivision of the State, including any board, bureau, commission, agency of the State or a political subdivision of the State, but excluding any institution of higher education.

Even if a police department were to want to assume the role of the controller, which it doesn’t, it could not. That’s why the language is not in the contract.

“A person who is not limited in such person’s processing of personal data pursuant to a controller’s instructions . . . is a controller and not a processor”.

Someone who is not the controller can’t provide “a controller’s instructions.” Without those instructions, Flock is not “limited” by them.

And because Flock is not limited, it is the controller, as a matter of fact as well as law.

Minnesota’s cure period expired January 31, 2026.

File your requests. Collect your California-plus denial. Encourage your AG to act.

Cross-posted from Footnote 4A, where I cover Flock, privacy, and public-private surveillance infrastructure more broadly. Flock-specific posts live on haveibeenflocked.com.

The Policy

Coralville’s ALPR policy,^[1] is a typical Lexipol-generated exercise in legal copy-pastery, virtually identical to neighboring North Liberty’s policy,^[2] but with the following, largely inoffensive, section:

That section was copy-pasted from Cedar Rapids’ policy, but it adds the non-sensical “protected characteristic” of infringing on the First Amendment, and a prohibition on use “[s]olely for immigration purposes”.

That “immigration purposes” clause was added in response to pressure from the public against the backdrop of increasingly aggressive ICE raids in Operation Midway Blitz in Chicago.

Coralville’s policy was always performative. Its prohibitions were unenforceable, and various aspects made no sense or made specific reference to the laws they facially clashed with. The Chief’s proposed policy only provided for secret oversight done exclusively within the police department with no mandatory reporting or penalties for violations—a fact specifically called out at the council meeting where the policy was adopted.

To dispel any notion that this was bad policy made in good faith: once the policy was adopted, the city almost immediately violated its own directive not to automatically share data with agencies outside Johnson County.

Residents noticed on the Coralville Flock transparency portal that Coralville PD had given Cedar Rapids (in neighboring Linn County) access. When asked about this by the public and the media—who all interpreted 427.7 as a ban on granting this type of unfettered, indefinite automated access to agencies outside Johnson County—the PD justified its actions by stating that Flock’s automatic sharing was fine because the request for automatic sharing had been made manually.^[3]

The Coralville Police Chief clearly has no qualms about sharing data. The Chief had already signed a two-year deal for mass surveillance after only talking to the City Administrator and without involving the city council, the city attorney, or finance; if he had been approached by state or federal agencies for access to Flock, there is no doubt in my mind that he would have granted it.

More so if the AG would follow the state playbook of mildly threatening sanctions, up to withholding all of a city’s state funding, for violating Iowa Code Chapter § 27A.4(1):

A local entity shall not adopt or enforce a policy or take any other action under which the local entity prohibits or discourages the enforcement of immigration laws.

Granting access for immigration purposes would be the path of least resistance for Coralville PD and its city administrator: the policy prevents oversight, and as long as the feds have access they won’t complain.

AG Bird has so far declined to enforce Iowa’s laws prohibiting surveillance data, or its laws on data security, consumer protection, or privacy, but she has threatened to use Chapter 27A to revoke funding for an entire county because its Sheriff dared distinguish between administrative and judicial warrants on Facebook.

The Gambit

For us folks who like their privacy, the gambit was clear then: file a complaint with the Iowa Attorney General about Coralville’s unlawful policy on the theory that if the AG acted, Coralville would have a choice:

1. Amend the policy. They’d need another public meeting, where the City Council, its Chief of Police, and its City Administrator, would have to face an increasingly disgruntled public’s "I told you so"s. They would have to tell the public they would be stripping the core protection they had emphatically promised only a few months earlier, after ICE had ratcheted up Operation Metro Surge in Minneapolis.
2. Defy the Attorney General and risk being in an indefensible position in a legal battle that would put state funding on the line for a city of 22,000 that’s already $340M in debt, due to questionable financial decisions involving funding a private hotel and a video game arena.
3. Cancel the contract.

The violation in Coralville was much more direct than the Facebook post in rural Winneshiek County.

The Republican-led Capitol also has a long history of conflict with dark-blue Johnson County and its cities—including Coralville.

@October 2, 2025, AG Complaint Re: Coralville

I submitted the complaint by email as a PDF attachment. When I followed up a month later, I received a response:

Thank you for contacting the Iowa Attorney General’s Office. We have reviewed your concerns. The attachments referenced were not included with your email. Please forward those to our office so we can have them reviewed.

How the AG managed to review the complaint without receiving the attachments remains a mystery.

By January, after repeated attempts to deliver the complaint,^[4] I was ready to chalk it up to more inaction rather than lack of transparency, when I unexpectedly got word Coralville had been in contact with the Attorney General.

The AG had directed Coralville to “remov[e] Section 427.4.1(d) from Policy 427 [to] resolve the pending complaint in full.”^[5]

@December 16, 2025 letter from Attorney General to Coralville

Coralville city staff immediately acted to make changes to the city’s website and recommended that the offending language be removed from the PD’s policy. The AG considered this an acceptable solution.

@January 20, 2026 letter from Attorney General to Coralville

The Fallout: A Cancelled Contract and Transparency

Amending city policy requires council action. The Coralville City Council scheduled a work session following its next regular council meeting to discuss the AG’s letter. The Coralville community once again showed up and spoke out. It was effective: the council placed “Cancel the contract” on the agenda for its next meeting.

The $36,000 surveillance system that Chief Nicholson smuggled past his own city council, that the council spent months defending with contradictory and increasingly desperate arguments, that Flock’s own representative admitted was ungovernable by local policy — will be coming down.

But AG Bird did something else deserving mention: she placed my name in the opening sentence of the letter to Coralville. It is a choice to so readily disclose the identity of a complainant against a police department on a topic as politically charged as immigration enforcement.

It’s an especially unexpected level of transparency for an AG currently appealing a district court’s order that the Iowa Public Information Board (IPIB) must do its job and handle (not validate, handle) an open records complaint concerning Flock camera locations.^[6]

The Court of Appeals has been weighing that case since early last summer, which could mean the AG is not going to get a one-page order with an easy procedural win against a pro se appellee. That would be embarrassing (Update 2/25: Not 12 hours after posting this, the Court of Appeals affirmed the trial court decision—i.e., I prevailed).

The kicker is that, in the Coralville case, the original complaint is almost certainly a confidential public record under Iowa Code § 22.7(18). This is the “whistleblower protection” clause cities have used to hide community camera registries they have integrated with Axon’s Fusus (a “fusion center” software product similar to Flock’s “FlockOS”).

Communications not required by law … to the extent that the government body … could reasonably believe that those persons would be discouraged from making them to that government body if they were available for general public examination.

But, as I’ve noted while arguing with various state and local officials: the Iowa Open Records Act does not require agencies to withhold confidential public records, it merely permits it. The complaint was likely protected; the AG chose to disclose it anyway—while simultaneously litigating to prevent disclosure of public records in the IPIB case.

She exercises discretionary transparency when it serves her, rather than the public. She fights it when the roles are reversed.

The Cancellation

The gambit worked: on February 24, Coralville voted to end its contract with Flock. Within a span of weeks, both Iowa City and Coralville have instructed Flock to remove its AI surveillance cameras from public roadways. Although Iowa City is its own island within the state, this is a major victory in a state whose legislature is staunchly uncritical of police.

AG Bird got the outcome she wanted: the immigration clause is gone. But the community got the outcome it wanted: the cameras are coming down.

The AG’s selective transparency—naming a complainant against a police department while fighting to keep surveillance records secret—tells you everything you need to know about which side of the one-way mirror she prefers to stand on.

First, to temper expectations: an after-the-fact justification is much easier than identifying and validating findings regarding ongoing misconduct. These incidents demonstrate that the tools here could be useful in some way, not that they are fool-proof. Second, to my knowledge, neither Braselton’s Chief nor the Echols County Deputy have been convicted of any crime. So far, wrongdoing has been alleged, not proven.

With that out of the way, let’s examine the stories and the recently-added operator insights pages.

Braselton’s Chief of Police

On Wednesday evening, Braselton Police Chief Michael Steffman announced he was retiring and resigned from the department for personal reasons. He was booked and charged, accused of using police cameras to stalk and harass people.

…

[Flock’s Josh] Thomas says Flock handed over a log that is built into the system that allows them to see how, when and why the tech was used.

As a sidenote: this is an interesting play from Flock—inserting themselves into the narrative rather than relying on the “local oversight” they typically claim is effective.

Opening Braselton’s operator list, it is not immediately evident that the arrested person was Michael Steffman. Another officer’s behavior raises more red flags in the system. You will have to draw your own conclusions based on the information available.

Anyway, Steffman’s Insights Page shows multiple red flags on the first page:

• Days Active: 101
• Total Searches: 2,707
• Unique Plates: 42
• Unique Reasons: 4
• Account Sharing Candidate (Temporal entropy 2.710)^[1]

This already looks like someone looking up the same plates over and over at all hours of the day without providing a valid reason.

But, who knows, maybe Braselton was conducting long-term surveillance for operation “005”^[2] and the Chief personally saw to it that any movement was logged, 24/7.

As a reminder: the “Target” column uses identifiers which represent license plates.

We don’t have to get into the complexity of SAI: looking up the same license plate 411 times should be a red flag.^[3]

Zooming in, we can see that we have records of searches for this plate, by Steffman, spanning October 2024 – August 2025; those dates more likely indicate the end of the records period on haveibeenflocked.com than the end of the searches.

20% of those searches were flagged as made outside of what the system flagged as typical hours for Steffman (12pm – 12am).

Looking at the isolated sessions, Steffman did further lookups in between extended periods of non-use; suggesting he was not on-shift at the time.

What makes this case exceptionally unusual, besides how rare arrests for these cases are, is that Steffman’s employee record, which is also listed on the page, indicates that he spent the last twenty years in Braselton.

In the world of policing, a twenty-year veteran and Chief is usually afforded every benefit of the doubt. Not in this case, in Flock’s home state.

For a department to bypass internal discipline and move straight to handcuffs and a media circus suggests toxic politics, at best. Especially when considering the red flags for other users in the department.

Echols County Deputy

This one is more straightforward. Echols County’s page shows “A. Ant” and “A.” without overlapping time periods, suggesting that some time in June or July, Anna Altobello shortened her name in the system. This appears to be a departmental policy that tracks Flock’s desire to obfuscate.

The Georgia Bureau of Investigation said Anna Altobello, 33, misused Flock Safety accounts belonging to the Echols County Sheriff’s Office to search for tag information on people she knew personally, outside of law enforcement purposes.

The GBI said it happened multiple times and Echols County Sheriff Randy Courson asked the state agency to investigate in December.

Looking at “A.”'s Operator Insights page reveals a similar pattern as Steffman’s:

• Days Active: 91
• Total Searches: 691
• Unique Plates: 36
• Unique Reasons: 3
• Account Sharing Candidate (Temporal entropy: 2.794)

Her favorite reason to use is “Case”.

The Surveillance Target List looks eerily similar too, with the location history for one plate being pulled 205 times over 124 days.

The data on the insights page, even at a glance, is suggestive of improper use.

The Null Hypothesis: A System Feature?

When analyzing this much data, one must consider the Null Hypothesis: that these patterns are not evidence of stalking, but “noise” or software artifacts.

Perhaps “Temporal Entropy” indicates a disorganized shift schedule, or maybe “411 searches of one plate” is how a specific investigative workflow functions.

However, the nature of the data makes that difficult to accept.

Hundreds of searches for vague reasons is by its nature suspicious. While it’s conceivable that a few officers would be tracking someone 24/7 for legitimate investigative purposes, logic dictates that police work in shifts more than the data suggests.

Is 400 searches for a single plate for the reason “sus” hard evidence of anything? No. Should it be investigated? Yes.

Flock’s Fix

In addition to analytical tools and blog posts, this website also exists to give stalking victims a way to discover they’re being targeted: if you enter your license plate on the main page and your ex’s name comes up 411 times for “inv”, odds are you are a victim of criminal stalking.

So what does Flock do in response?

It has removed names and license plates from network audit logs.

By redacting this information, Flock is making it impossible for external auditors, including other police departments and stalking victims, to flag suspicious behavior.

That, the company argues, would jeopardize “officer safety.”

The transition from public oversight to private operation has created a “surveillance black box” where the legal safeguards promised by officials simply fail to materialize.

Denver goes Private

After a series of CORA requests, in which the Denver City Attorney bizarrely claimed not to be the custodian of his own records, Denver Public Safety provided a stack of non-responsive documents, Denver Technical Services claimed not to have a copy, and the Mayor outright ignored the request, the City Auditor’s office finally wrote: “The city and county of Denver does not release contracts that are being negotiated. If the contract does become final, it then can be released.”

The City Attorney’s Office, meanwhile, claimed it is “not the ‘custodian’” of the contract—despite the Denver City Charter requiring that office to prepare and approve all city contracts. The Department of Public Safety provided only the expired agreement, which terminated October 30, 2025, and declined to produce the extension the mayor announced three weeks earlier.

The various creative denials appear to agree on one thing: the contract is not final and effective, despite previous announcements from the mayor’s office heavily implying that it is.

This of course comes after the city subscribed to Flock’s drone service without telling its own surveillance task force.

Although substantial public funds were used to install more than a hundred cameras, Flock still owns them, and now appears to be operating them entirely outside of any active government contract.

This stands in stark contrast to the mayor’s statement, which claimed Flock would be subject to penalties if the company shared data with federal authorities, in violation of Colorado law.

Although there are restrictions on what and how Colorado state and local agencies can share information with the federal government, there appear to be no laws that prohibit Flock, a private corporation, from disseminating that same data. Without a contract, there is nothing to stop the company from selling the data to ICE or other interested third parties.

Denver residents are now in the worst of both positions: taxpayer funds paid for the infrastructure, but no taxpayer-enforceable agreement governs how it operates. The city has outsourced surveillance to a private company and then removed itself from the chain of accountability entirely.

If Flock shares data with federal agencies tomorrow, Denver has no contractual remedy. If the mayor’s promised penalties exist anywhere, they aren’t in a signed document the city is willing to produce.

Boulder Abandons Oversight

Meanwhile in Boulder, in response to a request for a month of network audit logs, BPD puts a couple of interesting statements together:

Given the scope of your request, we cannot, and will not, contact each individual agency listed to inquire as to the status of their investigation as that would cause “unnecessary interference with the regular discharge of the duties of the custodian or their office” (C.R.S. §24-72-304(1)). … We are providing the requested records, but the names of the law enforcement personnel, associated license plate numbers, case numbers, and reasons for the request are redacted as the release of this information would be contrary to public interest.

BPD admits here that it doesn’t know what’s in the search logs and it has no intention of auditing them.

None of this lines up with statements on its public website:

The Boulder Police Department uses Flock solely for legitimate law enforcement purposes, including criminal investigations, finding missing or endangered persons, Amber Alerts, and tracking stolen vehicles. Officers must have a clear justification for any search they run.

BPD does not know if this is how the cameras in Boulder are being used by other departments.

All requests to share access to our data must be approved by a supervisor, logged, and tracked through strict audit trails.

But BPD will never look at these audit trails.

Each user must have a unique login, and there is a complete audit trail of all searches conducted in the system.

Either BPD did not intend this statement to apply to users with access from outside BPD, or it shows why BPD should examine its “complete audit trail.” Account sharing is rampant.

Multiple safeguards protect against misuse: supervisory approval is required for external data sharing and all searches are logged.

This is not much of a safeguard when nobody looks at the logs.

Flock’s focus on legitimate law enforcement purposes, combined with their willingness to implement features like automatic blocking of immigration-related searches and enhanced audit controls, aligns with Boulder’s commitment to responsible policing and community values.

This “blocking” is a keyword-based warning notice that isn’t logged. A user can enter a different reason, or enter no meaningful reason at all, and try again. BPD will never use the “enhanced audit controls” (whatever those may be) to question whether “inv” is an immigration search.

There is no oversight.

Colorado’s Open Records Laws are Broken

As an Iowan, my experience with the Colorado Open Record Act (CORA) is limited. I find Iowa’s open records act frustrating, because it is widely ignored and not enforced by state agencies, but CORA turns out to be fundamentally broken.

In a bizarre twist, whether a public record should be released depends more on who holds the record than on what the record is or contains. In addition to Denver’s outlandish ideas on custodianship, which I doubt would survive a court hearing if challenged, there is a brokenness to CORA in that records held by police are not governed by CORA, but by the Colorado Criminal Justice Records Act (CCJRA).

The CCJRA sets no deadlines and allows a high level of discretion for agencies on whether to release records. As you can tell from Boulder’s response, which took nearly two months, we can’t trust police with that type of discretion.

The Colorado Freedom of Information Council is pushing for changes to the law.

Read Colorado FOIC’s Guide to the Criminal Justice Records Act

If you’re in Colorado, or even if you’re not, please consider making a donation to the Colorado FOIC or supporting their work to get this flawed piece of legislation fixed.

Without transparency, BPD and Flock have to perform their own audits.

They have already said they “cannot and will not.”

Flock has never been hacked. Ever. … It’s tough every day waking up to stories online that are misleading and only represent one side of the story, — Emails to Staunton, VA, Garrett Langley, Flock CEO, December 8–10, 2025.

Flock cameras are open for live viewing and footage downloading to anyone on the Internet. No hacking required, just type in the address; it’s one way to protect your “never been hacked” track record. Benn Jordan brings the receipts in his video titled "This Flock Camera Leak is like Netflix For Stalkers".

But, this post is about a smaller, but still significant, post on Flock’s own blog. It’s a screenshot included in Josh Thomas’ December 10, 2025, post titled “Offense Type Dropdown: A Simpler, More Accurate Audit.”

In the blog post, Flock announces “a new, required step in every ALPR Search: Offense Type Dropdowns,” noting “The existing Search Reason field will still be available as an optional place to add extra detail.”

With this modification, Flock has materially altered its service. Cities and the public were told “we require users to enter a reason for every search.” Even where contracts which were signed following a democratic process, which excludes quite a few contracts, Flock has thrown that democratic authorization in the dumpster and substituted its own judgment.

Of course, the “reason” field was always compliance theater, and there is no evidence to suggest that agencies regularly audit any search logs. Flock implemented warning popups to suggest users select another reason when they enter terms like “immigration,” but it’s safer to simply not to even offer the option.

The screenshot, however, shows a more direct violation of Flock’s prior terms of service. Although the terms vary based on the contract (at least, for now), the older contracts prohibit use of the system other than for a “permitted purpose”:

The purpose for usage of the equipment, the Services and support, and the Flock IP is solely to facilitate gathering evidence that could be used in a criminal investigation by the appropriate government agency and not for tracking activities that the system is not designed to capture (“Permitted Purpose”) — July 2023.

This language also appears to be what Flock CEO Garrett Langley references in a December 22 interview with Politico, when responding to the question “Do you worry about flock being used for dragnet surveillance? For example, police identifying all the cars in the vicinity of a protest?”

Langley falsely claims:

Our contracts mandate that our products can only be used for criminal investigations. What you’re describing, would be based on an issue that you might not trust your local police department. […] The police chief reports to a city council, a mayor, a city manager. My expectation is that if a police department was violating the Constitution or local legislation, that those individuals would be held accountable.

Aside from misplaced optimism about accountability without transparency, the language he references no longer appears in newer contracts. Flock has cut the “investigative purpose” language entirely:

“Permitted Purpose” means for legitimate public safety and/or business purpose, including but not limited to the awareness, prevention, and prosecution of crime; investigations; and prevention of commercial harm, to the extent permitted by law. — May 2025.

“Investigations” by itself, without further context, is now a permitted purpose.

It’s a loophole so big you could park a truck in it, but even then, it’s difficult to reconcile “City Planning/Traffic Analysis,” with public safety, business, or investigation.

Yet, it is an option in Flock’s “investigative purpose” dropdown.

Flock is quick to claim “local decisions” whenever misuse is documented, or to offload its own responsibility onto public oversight that its own products actively prevents.

This latest feature is yet more evidence that the company is not passive: it actively facilitates improper use of its systems, for purposes no city council approved.

This is the same company now asking cities to sign contracts it can rewrite at will.

The dropdown is the tell: Flock decides what the system is for. Your city council just pays for it.

5