LAST UPDATED
ONGOING INVESTIGATION
New evidence, contract changes, and institutional responses documented since the original investigation published in January 2026.
FEB 16
Flock rewrites contract
FEB 26
Penn State confirms cameras
FEB 27
5,773-network search logged
EVIDENCE ARCHIVE
Penn State University Police are fully exempt from Pennsylvania's Right-to-Know Law. No public records requests. No oversight. No one they have to answer to. Yet they have the power to search license plates across thousands of law enforcement networks nationwide. These videos show what their internal dashboards actually look like.
WPSU reports what this investigation documented in January.
WPSU, February 26, 2026:
Sara Thorndike, Penn State's chief financial officer, confirmed the use of the license plate readers in response to a question during a Faculty Senate meeting.
Penn State's official claims (via unnamed spokesman):
The pilot is "limited in scope and duration, with no contract or cost during the testing period."
Flock's standard model gives cameras away free during pilots. The cost starts when the pilot ends and the cameras are embedded in police workflows. The original investigation described this as the sustainability trap.
"Camera locations and counts are not published for security reasons."
The cameras are solar-powered units mounted on poles along public roads. DeFlock and this investigation have already mapped them. The "security" justification protects the deployment from public scrutiny, not from criminals.
"Access is restricted to trained, authorized (University Police and Public Safety) personnel."
Access to Penn State's cameras is restricted. Access through Penn State's cameras to thousands of other agencies' networks is not mentioned. And access by other agencies to Penn State's camera data through Flock's shared network is bidirectional.
"There is no public access to (automated license plate reader) data."
Correct. The public has no access to data about how their vehicles are being tracked. That is the problem.
In January, this site was investigative reporting. As of February 26, 2026, Penn State's CFO confirmed the deployment at a Faculty Senate meeting. The cameras are documented. Who authorized them, and under what policy?
Search Log Record
One day after WPSU article
The original investigation asked: "If a test query searches 96,504 devices, what does a real investigation look like?"
Networks Searched
5,773
Penn State University Police and Public Safety, 3:41 PM EST
Search Parameters
Operator
Penn State University Police and Public Safety PA
Search Window
30-day rolling
Stated Justification
Missing/Endangered Person
Case Number
Blank
How we know
Kyle, Texas PD publishes its Flock transparency logs. Those logs record every agency that queries the Flock network through Kyle's cameras. On February 27, 2026, the logs show Penn State Police as the querying agency.
Flock Search Log
Agency: Penn State UPPS
Time: 3:41 PM EST
Reason: Missing/Endangered
Networks: 5,773
This search happened one day after WPSU published its article confirming the Flock deployment, and one day after Penn State's spokesman told reporters that "access is restricted to trained, authorized personnel" and that "system use is logged and audited."
The system is logged. That is how we found this.
Penn State said:
"There is no public access to automated license plate reader data."
The Flock network shares data bidirectionally. When Penn State searches other agencies' cameras, those agencies can search Penn State's cameras through the same network.
Penn State said:
"Access is restricted to trained, authorized (University Police and Public Safety) personnel."
Penn State officers accessed data from 5,773 external networks. Officers at those agencies have reciprocal access to Penn State's camera data.
Penn State said:
"Data are retained for up to 30 days unless preserved as evidence."
Penn State's 30-day policy applies to Penn State's cameras. The 5,773 agencies Penn State searched each set their own retention periods. Some retain data for years.
CONTRACT ANALYSIS
Flock Safety Terms & Conditions
Revision Comparison
On , Flock rewrote its standard contract. They called it a "simplification."
Flock Safety Blog, February 17, 2026:
"Customers own and control their data. That has not changed."
1. What counts as "Customer Data"?
DEC 2025 · Section 1.3
"Customer Data" meant images, audio, video, and metadata available through the Web Interface.
"For clarity, Customer Data does not include the underlying raw Footage captured by the Flock Hardware or any Flock IP."
Agencies "owned" a processed subset. Flock kept the raw footage and everything derived from it.
FEB 2026 · Section 1.6
"Customer Data" now means all data captured by Flock Hardware, content input by users, and data from third parties at Customer's direction.
The raw footage exclusion is gone. Everything is "Customer Data" now.
Agencies "own" a broader category. Sounds better. Read the license.
2. What can Flock do with that data?
DEC 2025 · Section 4.1
Flock received a license to use Customer Data to "perform all acts as may be necessary for Flock to provide the Flock Services to Customer."
FEB 2026 · Section 4.1
Flock now receives a license to (a) "use and disclose Customer Data to provide the Flock Services" and (b) "use Customer Data to support and improve Flock's products and services."
| DEC 2025 | FEB 2026 | |
|---|---|---|
| Scope | Provide services | Provide services + improve products |
| Duration | Not specified as perpetual | PERPETUAL |
| Purpose | Necessary acts only | Anything that "supports or improves" |
3. What disappeared?
"Training Data" (Dec §1.17)
Was: A small fraction of images, stripped of all metadata and identifying information, used for improving Flock Services through machine learning. "Never sold or shared with third parties."
Eliminated. Folded into "Customer Data" with the broader perpetual license. The privacy safeguards described in the old Training Data section have no equivalent in the new terms.
"Customer Generated Data" (Dec §1.4)
Was: Content submitted by Customer through Flock Services. Flock had a separate limited license and did "not claim ownership."
Eliminated. Folded into "Customer Data." The separate non-ownership statement is gone.
"Data Distribution" (Dec §4.4)
Was: Described how Customer could choose to share data with third-party integrations, with a separate license grant.
Eliminated as a standalone section. The mechanics of data sharing between agencies through Flock's network are no longer described in the terms.
In December, agencies owned a narrow slice of processed data. Flock needed that data only to run the cameras. Training data had explicit privacy protections. Raw footage stayed with Flock.
In February, agencies "own" everything. Flock gets a perpetual, irrevocable license to use all of it to "support and improve" any product Flock builds. The Training Data privacy safeguards are gone. The Data Distribution mechanics are gone.
Flock handed agencies a larger bucket labeled "yours" while writing itself a permanent key to that bucket. The agencies own the label. Flock controls the data.
Sources