{"resourceId":"chicago-pd-23000-flock-searches-no-contract-20261007","versions":[{"version":"external-0ea8afa86fd006c13a9ae66287e29e5af94be7717a97d657e788258e60666135","resource":{"id":"chicago-pd-23000-flock-searches-no-contract-20261007","title":"Chicago police ran 23,000+ Flock searches in three months without a Flock contract, via an MOU and paid access through CDW-G, outside local oversight rules","organization":"Chicago Police Department / Office of Public Safety Administration (reported by FOX 32 Chicago)","sector":"Municipal policing / ALPR data access","geography":"Chicago, Illinois, United States","publishedAt":"Oct. 7, 2026, 6:56 AM CDT","publicationDate":"2026-10-07","eventDate":null,"sourceName":"FOX 32 Chicago","sourceLabel":"FOX 32 exclusive on CPD Flock audit logs","sourceUrl":"https://www.fox32chicago.com/news/chicago-police-flock-searches-audit-logs","evidenceClass":"independent-reporting","outcomeClass":"cautionary","topics":["data-security","governance-procurement","operating-model"],"finding":"FOX 32 reported that Flock audit logs obtained after months of requests show Chicago police ran more than 23,000 searches of the Flock Safety network from May through July 2026, for reasons including traffic stops, robberies, welfare checks and homicides, even though Chicago has no active contract with Flock. The cameras searched are privately owned or belong to other agencies that share access. The city said a memorandum of understanding signed by OEMC and OPSA lets CPD log in to Flock's portal to view data shared by other municipalities and private entities; access was initially free, and OPSA now pays for it through a CDW-G service contract. FOX 32 notes that without a direct contract there are no local rules or oversight requirements governing how officers search, access or retain the data. Questions about internal authorization and arrests were referred back to CPD.","sledRelevance":"Shows that a city without a procurement decision can still be a heavy ALPR user through MOUs and reseller contracts, which bypasses the council and policy review that contract votes trigger.","evidence":"Investigative local TV reporting based on CPD Flock audit logs obtained through records requests, plus written responses from the city. The logs themselves were not published in full; arrest outcomes and per-search justification quality were not reported.","architectureImplications":"Access runs through Flock's hosted portal and aggregates data from private and other-agency cameras, so Chicago does not control camera placement, retention or the network it queries.","governanceImplications":"An MOU plus a reseller service contract created paid access without a Flock contract vote, leaving no local search, access or retention rules.","securityPrivacyImplications":"Thousands of searches of private-camera data with no city-specific audit standard; the city says Flock gets no access to city cameras.","caveats":"Single-outlet report; audit logs not public; no data on outcomes or misuse; CPD internal oversight not described. Search counts are for May-July 2026 only.","streamIds":["public-safety"],"roles":{"sales":"Sales framing: Chicago shows that the real exposure can be data access the city never formally bought. Discovery should inventory MOUs, reseller subscriptions and portal accounts that touch ALPR or camera networks, and ask who audits searches. A bounded engagement is a surveillance-access inventory and policy gap review; do not suggest misuse occurred, since the report shows volume, not abuse.","engineering":"Engineering framing: CPD queries a vendor-hosted network spanning private and other-agency cameras, so local controls must sit at the account and query layer. Engineers should map every account, require case numbers and reasons on each search, export audit logs regularly and test whether shared networks expose data beyond policy. Proof should come from log analysis, not vendor dashboards.","delivery":"Delivery framing: the city needs a written policy for non-contract data access, an account inventory and a regular audit cadence. Ownership sits with OPSA and CPD, with council oversight. Risks are unlogged reasons, accounts nobody owns, and policy that covers purchased systems but not shared ones."},"roleDetails":{"sales":{"customerProblem":"Police can search large private and multi-agency ALPR networks through MOUs or reseller subscriptions that escape contract review and local rules.","stakeholders":["Office of Public Safety Administration","CPD command staff","City Council public safety committee","Inspector general or police oversight body","Procurement office"],"discoveryQuestions":["Which MOUs or reseller subscriptions give officers access to vendor-hosted camera networks?","Who issues and revokes portal accounts?","Are search reasons and case numbers required and audited?","Does any local ordinance cover data the city queries but does not own?"],"valueHypothesis":"An inventory and policy for non-contract data access can close an oversight gap before misuse cases surface.","potentialEngagement":"Surveillance data-access inventory, policy drafting for shared-network searches, and an audit-log review of a sample period.","unsupportedClaims":["That CPD searches were improper","Crime-solving value of the searches","That Flock accessed city data","That a contract would have prevented the access"]},"engineering":{"fit":"Relevant to any agency with vendor-portal access to shared ALPR or camera networks, contracted or not.","architectureIntegration":"Vendor-hosted portal with per-user accounts querying cameras owned by private parties and other agencies; integration of Flock alerts noted in statements of work.","prerequisites":["Account inventory","Audit-log export from the vendor","Written search policy","Records of MOUs and reseller agreements"],"constraints":["City does not control camera owners' sharing settings","Illinois state ALPR and data-sharing laws","Vendor controls log format","Private owners' retention practices"],"security":"Require MFA and named accounts, mandatory reason and case fields, periodic log exports and anomaly review for high-volume or off-hours searching.","proofOfValue":["Reconcile account list with active personnel","Measure share of searches with a case number and valid reason","Identify searches outside approved purposes","Verify no federal immigration-related sharing occurs through shared networks"]},"delivery":{"work":"Inventory non-contract data access, write a shared-network search policy, and stand up recurring audit-log review.","dependencies":["Vendor cooperation on log exports","CPD and OPSA records","Council direction","Legal review of MOUs"],"ownership":"Office of Public Safety Administration with CPD, under City Council oversight.","skillsAdoption":"Officers need training on required search fields; auditors need log-analysis capacity.","governanceCheckpoints":["Inventory reported to council","Policy adoption","First quarterly audit report","Annual review of MOUs and reseller access"],"acceptanceCriteria":["Proposed: 100% of portal accounts mapped to named, active personnel","Proposed: searches without reason or case number fall below 5% within two quarters","Proposed: quarterly audit report published","Proposed: all MOUs and reseller access listed in a public surveillance inventory"],"risks":["Access continues without rules","Vendor log limits hinder audits","Political backlash if misuse is later found","Shared networks expose data to other agencies"]}},"retrievedAt":"2026-10-08T02:56:07Z","enrichedAt":"2026-10-08T02:59:04Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Officer-level portal accounts mean training and accountability depend on CPD internal practice, which the city declined to describe.","procurementImplications":"Reseller vehicles such as CDW-G can carry surveillance data access that never appears as a vendor contract, so procurement inventories should include data-access subscriptions.","operatingModelImplications":"City leaders now face whether to set rules for police access to privately owned networks they do not buy.","sourceVerification":{"openedUrl":"https://www.fox32chicago.com/news/chicago-police-flock-searches-audit-logs","referenceExcerpt":"Chicago police conducted more than 23,000 Flock searches from May through July 2026.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}