Every claim on this page is sourced from government documents, court filings, the federal cybersecurity database, vendor patents, the El Paso Flock Safety contract, or named investigative reporting. No anonymous sources. No speculation. Click any source link to verify for yourself.
On April 28, 2026, El Paso City Council voted on agenda item 23: an MVCPA grant application to fund Flock Safety for another year. What the community discovered in the lead-up to that meeting revealed how the contract operates — and how accountability was avoided at every step.
In late March 2026, a community member submitted a Texas Public Information Act request to El Paso PD for the Flock Safety contract. The request (Open Records Request #W200992-032526, received 03/26/2026) was for "Contract between the City of El Paso and Flock Group Inc., doing business under the name Flock Safety."
EPPD's response, signed by Police Records Specialist Antonio Flores (C2039): "Please be advised that I have been informed that there are no responsive documents pertaining to your request. As no responsive documents have been located, there is no charge associated with this response and your request is now considered closed."
The contract was later produced — approximately two hours before the April 28 council vote. EPPD attributed the failure to locate it to a clerical error. The contract is now on file at deflockelpaso.org.
The Flock contract (Section 7.1) automatically renews for successive one-year terms unless either party gives written notice of non-renewal at least 30 days before the end of the current term. The April 28 council meeting was about the MVCPA grant application to fund the contract — not whether to renew it. Whether the contract had already auto-renewed before that meeting was raised during public comment and was never addressed in council discussion.
EPPD requested $693,334 from the Motor Vehicle Crime Prevention Authority plus $138,666 in city tax dollars to fund Flock for another year. The council voted on this grant application — agenda item 23 — without a standalone vote on whether to continue the Flock contract itself. An amendment to agenda item 23 passed, requiring EPPD to write the next MVCPA grant application without naming Flock as the exclusive vendor. EPPD reassured council that if acceptable terms that protect privacy and safety cannot be negotiated, a different vendor will be chosen.
The April 28 vote did not patch the Android 8.1 vulnerabilities. It did not explain the Harris County commissioner data access. It did not restore the deleted data-sale prohibition. It did not provide a written prohibition on ICE access. It did not resolve the Texas DPS licensing investigation. It did not require an independent security audit. It did not require Flock to notify El Paso of data breaches. The contract's irrevocable data license — which survives contract termination — was not addressed.
Before examining specific failures, understand what Flock Safety actually is — because the business model explains everything else.
Flock Safety's valuation — a Georgia startup with $950 million in venture capital funding
What El Paso paid per camera per year — 150 cameras, $702,500 total grant, 24/7 surveillance of a major city
Ask the question any Texan should ask: how does a company justify a $7.5 billion valuation by charging less than $5,000 per camera per year? The hardware is not the product. The network is. Every city Flock enters adds to a massive, interconnected database of vehicle movements across America. That database — your routes, your patterns, your life — is what investors are valuing at $7.5 billion.
El Paso didn't buy a public safety tool. El Paso gave a private company free access to photograph every vehicle in our city, 24 hours a day, in exchange for hardware that costs less than a used car per year. That price only makes sense if the data has far greater value than what the city is paying for it.
In February 2026, Flock Safety rewrote its Terms of Service with 147 documented changes. The most significant: deletion of the clause that previously stated "Flock does not own and shall not sell Customer Data." That language no longer exists in the current terms — the terms under which the April 28 renewal was signed.
When a surveillance company quietly removes the promise not to sell your data from its contract, that is not an administrative update. That is a signal about business intent.
In May 2025, 404 Media reported that Flock was developing "Nova" — described internally as a "public safety data platform" that supplements ALPR data with commercial data sources to build profiles on and track specific individuals without a warrant. The Electronic Frontier Foundation called it a "dystopian panopticon." Nova was already in use by law enforcement in an Early Access program before the reporting surfaced.
The Flock Safety Master Agreement governing El Paso's contract is on file. A section-by-section reading reveals terms that should have been disclosed before any council vote — and weren't.
Section 4.1 grants Flock a "limited, non-exclusive, royalty-free, irrevocable, worldwide license" to use El Paso's camera data. The word irrevocable means El Paso cannot take back this license even if it cancels the contract or switches vendors. Data collected from El Paso's 150 cameras is licensed to Flock permanently.
Section 4.3 gives Flock a "non-exclusive, worldwide, perpetual, royalty-free right to use and distribute" data it classifies as "anonymized" — for AI training, new product development, and "other Flock offerings." Flock defines what meets the anonymization standard. El Paso has no consent or notification rights over this use, which survives contract termination.
Section 5.3 permits Flock to disclose footage to "law enforcement authorities, government officials, and/or third parties" if Flock has a "good faith belief" that disclosure is necessary. This is Flock's judgment call — El Paso is not required to be notified. This is the contractual mechanism Rep. Limón identified on March 3 as "the back door."
Section 7.1 states the contract "will automatically renew for successive renewal terms of the greater of one year" unless either party gives written notice of non-renewal at least 30 days before the end of the current term. There is no public record that El Paso gave this notice. The question of when exactly the contract auto-renewed — and whether it happened before the April 28 council meeting — was raised at public comment and never addressed.
Section 9.1 caps Flock's total liability at the fees paid in the twelve months prior to any claim — approximately $702,500. Against a company valued at $7.5 billion, this means El Paso's legal recourse for any data breach, misuse, or harm caused by Flock's failures is capped at less than 0.01% of the company's valuation.
Section 11.4 establishes that Flock's Terms and Conditions govern the agreement — and the final line of those Terms states: "These Terms and Conditions are subject to change." Flock has already rewritten these terms twice since January 2025, including the February 2026 rewrite that removed the data-sale prohibition. El Paso is not required to be notified of changes, and the contract does not require consent.
The Flock Safety Master Agreement contains no provision requiring Flock to notify El Paso if El Paso's data is compromised, accessed without authorization, or leaked. Flock is not contractually obligated to tell the city if its residents' data is breached. In 2025, security researchers found 67 Flock cameras streaming live footage to the open internet without passwords — under a contract with no breach notification clause.
The product El Paso contracted for is described in the purchase order as "Flock Group Falcon Infrastructure — License Plate Recognition Camera with Vehicle Fingerprint™ + Machine Learning Software." The transparency portal visible to the public lists capabilities as "License Plates and Vehicles." The product name in El Paso's own signed contract includes Vehicle Fingerprint™ — a capability not disclosed in public-facing transparency materials.
Flock cameras are not simple cameras. They are networked computers mounted on public poles, running an operating system that will never receive another security update.
Flock Falcon cameras run Android 8.1 (Oreo) — an operating system Google discontinued in 2021. This is not a temporary gap. Android 8.1 will never receive another security update. Ever. The hundreds of known vulnerabilities in that operating system are permanent, unpatched attack surfaces.
This is not a camera with a software problem that can be fixed. It is a system built on a foundation that the manufacturer abandoned years ago. Every Flock camera in El Paso is running an operating system with permanently unpatched holes — photographing your vehicle, your passengers, and your movements 24 hours a day.
Security researchers demonstrated on video that Flock cameras can be fully compromised by anyone who can physically reach them. A specific button sequence on the back of the camera activates a Wi-Fi access point (SSID: "flock-54E823", password: "security"). Once connected, Android Debug Bridge is enabled by default — giving the attacker full root access without authentication.
"The longest part, actually, is waiting for the hotspot to turn on," said the researcher who discovered the vulnerability. Most Flock cameras are mounted on public utility poles at street level. Anyone can reach them.
Flock cameras store hard-coded Wi-Fi network names and transmit credentials in cleartext — meaning anyone who creates a Wi-Fi hotspot with the right name can intercept traffic from nearby cameras. The bootloader ships unlocked, allowing unrestricted firmware modification. Officer login credentials for Flock's system have been found for sale on dark web marketplaces.
The National Vulnerability Database (nvd.nist.gov) — the U.S. government's official registry of cybersecurity flaws — lists 22 confirmed CVEs specifically affecting Flock Safety hardware. These are not allegations or opinions. They are formally registered security flaws, acknowledged and entered into the federal database.
Senator Ron Wyden's federal investigation found Flock did not require multi-factor authentication for officer accounts. At least 35 customer account passwords were stolen by hackers. At one point, Flock cameras and admin dashboards could be accessed publicly without any login. Flock only began requiring MFA by default for new users in November 2024 — years after deploying cameras in thousands of cities.
Flock uses YOLO — a powerful neural network object detection system — to analyze every frame captured by its cameras. Here is the full documented list of what it detects and classifies, drawn from Flock's own patent and independent security research.
From the patent (US11416545B1) and independent forensic analysis of the camera hardware:
The ACLU of Oregon confirmed: "Even a pedestrian, bicyclist, or animal who happens to be caught in the frame of a Flock camera can be swept up in the vast and unregulated Flock surveillance network."
Flock Safety states publicly on their own website: "Flock's ALPR cameras do not use facial recognition. Flock's ALPR system cannot be used to search for human characteristics, like race or gender."
The patent explicitly describes the capability to "identify the face… query for any footage having a person with matching face recognition data points." It also describes classifying individuals by race, gender, height, weight, and clothing.
This is not a gray area. This is a company making a public claim that directly contradicts their own federal patent filing. Flock avoids the term "facial recognition" in their marketing to prevent backlash. The functionality is patented and documented in a public federal record.
El Paso residents should ask: which Flock capabilities are active in El Paso's deployment? Which are disabled? Is there anything in the contract that contractually prohibits these capabilities from being activated?
These are issues documented in El Paso's own public records and transparency portal. They deserve direct public answers before any contract renewal.
A community member has filed a public records request with the City of El Paso seeking detailed data on how El Paso's Flock system has been accessed, by whom, and for what purpose. We are awaiting the city's response. This page will be updated when records are received. Transparency is not a favor — it is a legal right.
El Paso PD's own Flock transparency portal — a public document — lists a Harris County Precinct 3 Commissioner's office as an entity with access to El Paso's camera data. A commissioner's office is not a law enforcement agency. No public explanation has been provided for why a political office in Harris County, hundreds of miles from El Paso, has access to our surveillance data.
We are not asserting wrongdoing. We are asserting that El Paso residents deserve a clear, public answer: why does this office have access, under what authority, and what data has it accessed?
The Texas Department of Public Safety launched an investigation into whether Flock Safety holds the private security license required to legally operate surveillance systems in Texas. Operating without that license raises questions about the legal standing of El Paso's existing contract and any renewal. The status of that investigation has not been publicly resolved.
Texas has no state law governing how license plate reader data must be stored, who can access it, or how long it can be retained. Multiple bills have been introduced in Austin — all died in committee. El Paso residents' only protection is the contract itself — the same contract Flock rewrote with 147 changes in February 2026, including removing the data-sale prohibition.
For a border city with a large immigrant community, operating in a legal vacuum with a vendor that has repeatedly enabled unauthorized federal access in other jurisdictions, this gap is not theoretical. It is an active risk.
DHS/ICE/PIA-039 — ICE's own Privacy Impact Assessment — requires vendors to maintain audit logs of all ALPR queries. Those logs are available to "ICE personnel charged with ensuring proper use." They are not required to be shared with the local police departments whose camera networks are being queried, or with the cities those departments serve.
This means El Paso PD cannot independently verify who has searched El Paso's Flock data. When EPPD says "ICE does not have access," they are relying on the vendor's word — not on an audit log they can see. The audit log that would prove or disprove it goes to ICE, not to El Paso.
Documented cases where Flock Safety cameras intersected with federal immigration enforcement against U.S. citizens.
Marimar Martinez, a 30-year-old Chicago teacher and U.S. citizen, was shot five times by a Customs and Border Protection agent in October 2025. Federal charges against her were later dismissed after the government's case fell apart.
When Martinez's attorneys sought to release evidence from the case, federal prosecutors specifically sought to block the release of Flock Safety camera footage — described in court documents as cameras that "log details including license plate, make, model and other information about cars into a database accessible to law enforcement agencies, prosecutors and private companies."
A federal judge ruled against the government and ordered the evidence released. Flock cameras had been tracking Martinez's vehicle. That footage became evidence in a federal shooting case involving a U.S. citizen — and the government tried to suppress it.
404 Media documented that ICE agents asked state and local police to run searches through Flock cameras on their behalf — giving federal immigration enforcement "side-door access" to a tool they had no formal contract for. More than 4,000 lookups were conducted for immigration purposes, logged with reasons including "ICE," "immigration," and "deportee."
This is the mechanism. ICE doesn't need to contract directly with Flock. They ask a local officer to run the search. The local officer's name goes on the log. ICE gets the data. El Paso is part of this network.
Alvin ISD in Texas — a district south of Houston — had its Flock cameras searched 733,000 times in a single month. Thirty law enforcement agencies from other states, including Florida, Georgia, Indiana, and Tennessee, searched those school cameras for immigration purposes. Civil immigration searches outnumbered criminal immigration searches two to one.
Cameras at a school in Texas were being used by law enforcement in Tennessee to search for undocumented immigrants. El Paso has schools. El Paso is in Texas. El Paso is on the border.
In April 2026, a Dunwoody, Georgia resident obtained Flock's access logs through a public records request and discovered that eight Flock sales employees had accessed the city's camera network more than 480 times. The cameras accessed included a children's gymnastics room, a pool, parks, playgrounds, and fitness studios at the Marcus Jewish Community Center — used as live demonstrations for potential police department customers in other cities.
Flock's own public FAQ had stated: "Nobody from Flock Safety is accessing or monitoring your footage." Dunwoody's mayor acknowledged Flock had been in "places they should not be." Flock apologized to the JCC. The Dunwoody City Council renewed its contract anyway.
El Paso's contract (Section 5.3) permits Flock to access footage based on its own judgment. There is no contractual requirement for Flock to notify El Paso when its employees access El Paso's camera feeds.
The Electronic Frontier Foundation found that more than 50 law enforcement agencies ran hundreds of searches through Flock's national ALPR network in connection with protest activity. In some cases, agencies specifically targeted known activist groups by name. The searches were conducted through the same interconnected national database that El Paso's cameras feed into — meaning El Paso's footage is part of the network being searched for political activity nationwide.
El Paso city officials have cited Flock's assurances in council testimony. Here is how those assurances compare to the documented record.
| The claim | What the record shows | Status |
|---|---|---|
| "Data will not be shared with federal agencies" | ICE gained side-door access through local officers in multiple cities without formal contracts. In other cities, Flock enabled federal access for months without local police knowledge. El Paso PD cannot independently verify access — the audit log goes to ICE, not to EPPD. | ⚠ Disputed by record |
| "Cameras only capture the back of vehicles and license plates" | Flock's own patent describes classifying pedestrians, bicyclists, and animals. It describes face recognition query capability. It describes classifying people by race, gender, height, weight, and clothing. Independent forensic analysis confirmed YOLO object detection running on the hardware. | ⚠ Contradicted by patent |
| "We do not use facial recognition" | US Patent 11416545B1 explicitly describes the capability to "identify the face… query for any footage having a person with matching face recognition data points." Flock avoids the term in marketing — the functionality is patented. | ⚠ Contradicted by patent |
| "We have 30-day data retention" | 30-day retention is a dashboard setting — not a contractual guarantee written into the agreement by ordinance. Settings can be changed by the vendor. The contract and the dashboard setting are two different things. | ⚠ Not contractually guaranteed |
| "Multi-factor authentication protects the system" | Flock did not require MFA system-wide until November 2024. EPPD states MFA is in use. Independent verification of El Paso's specific configuration has not been made public. Officer credentials have been found for sale on dark web markets. | ⏳ Unverified independently |
| "Customer data is never sold" | The clause "Flock does not own and shall not sell Customer Data" was deleted in the February 2026 Terms rewrite. Any renewal would be signed under terms that no longer contain this protection. | ⚠ Protection removed from contract |
The contract was renewed — but none of the accountability questions were answered before that happened. We are calling on El Paso City Council to hold EPPD accountable to the vendor-selection amendment, and to demand the following conditions before the next grant application is submitted or any contract extension is signed. We oppose this vendor and any similar private, venture-backed surveillance company that profits from the data of El Paso residents.
Every claim on this page is independently verifiable. See our full resources page for annotated descriptions of each source.
Flock Safety Master Agreement — City of El Paso, obtained via TPIA Open Records Request #W200992-032526 (produced April 28, 2026, two hours before the council vote)
Download the contract (PDF) →TPIA Open Records Request #W200992-032526 — EPPD initially responded "no responsive documents." Contract produced two hours before the April 28 council vote. EPPD: clerical error.
Demand accountability →404 Media — Flock sales employees accessed Dunwoody children's gymnastics room 480+ times as sales demo; Flock confirmed access
404media.co →IPVM — Dunwoody mayor confirms Flock in "places they should not be"; Flock apologized to JCC; FOIA logs analyzed by Jason Hunyar
ipvm.com →US Patent 11416545B1 — Flock's object detection and facial recognition capability
patents.google.com →El Paso Matters — March 3 council vote, contract details, Rep. Limón quotes
elpasomatters.org →El Paso PD Flock Transparency Portal — data sharing, usage statistics
transparency.flocksafety.com →Capitol News Illinois — Marimar Martinez case, Flock footage suppression attempt
capitolnewsillinois.com →404 Media — ICE side-door access, 4,000+ immigration lookups through Flock
404media.co →DeflockYourCity — sourced research, legal analysis, council briefing templates
github.com/DeflockYourCity →