What Corona's $565,000 surveillance contract actually says — and what it conspicuously doesn't.
The City of Corona has spent over half a million dollars on an automated license plate reader network that watches every car entering and leaving your neighborhood — and the contract governing it says almost nothing about protecting your data.
Documents obtained through a California Public Records Act request (CPRA C000108-020325) reveal that the City's Professional Services Agreement with Flock Group, Inc. — the legal document that governs the entire program — contains zero specific language about how long your data is retained, who can access it, or under what circumstances it can be shared with federal agencies including ICE and DHS.
The "30-day deletion" promise your police department cites? It lives in Flock's own Terms and Conditions — a subordinate document Flock controls and can update. The city negotiated extensively over insurance and indemnification. Nobody put data retention in the contract.
The Professional Services Agreement — the governing document that takes legal precedence over all other contract documents — contains no specific language about how long license plate data is retained, when it must be deleted, or what happens to it when the contract ends.
The only data-adjacent requirement in Exhibit A (Scope of Services) is that cloud storage "must comply with CJIS security requirements." CJIS governs security, not retention periods or access controls for immigration enforcement.
The "30-day deletion" policy your police department cites comes entirely from Flock's own Terms and Conditions — a subordinate document that Flock controls, can update, and which is not enforceable by the City in the same way contract terms are.
Exhibit A — Scope of Services, PSA March 2, 2021 "Cloud storage for all videos must comply with CJIS security requirements."— The only data storage requirement in the entire PSA. No retention period specified.
In contrast, Section 3.5.1 requires Flock to retain "Documents & Data" for a minimum of five years following project completion — but this provision was written for contract documents, not ALPR footage. The ambiguity is Flock's to exploit.
The City wrote this language into its own RFP. It isn't buried in Flock's boilerplate — Corona's police department specifically required that data "must be available to share with other agencies as needed."
"Other agencies" is undefined. "As needed" is undefined. There is no list of approved agencies, no warrant requirement, no prohibition on sharing with federal immigration enforcement, and no process for the City to audit or restrict who is searching its data.
This language, combined with Flock's National Lookup feature (which connected Corona's cameras to 80,000+ cameras nationwide during the federal pilot program), effectively created an open pipeline — one the City signed off on without defining any limits.
Federal agencies don't need a direct contract with Flock to access your data. They ask local officers to run searches on their behalf, listing "ICE" or "DHS" as the reason. Over 4,000 such lookups were documented nationally. Corona's contract contains nothing preventing this.
While the police department points to Flock's 30-day deletion policy for footage, the actual Professional Services Agreement contains a five-year retention requirement in Section 3.5.1 — and it applies broadly to all "Documents & Data" prepared under the agreement.
The contract defines Documents & Data as anything "prepared or caused to be prepared by Consultant under this Agreement." Flock has never been asked — publicly, on record — to clarify whether ALPR records fall within this definition. The ambiguity benefits Flock.
Additionally, Flock has publicly acknowledged that audit logs — records of every search, every agency, every query — are retained indefinitely. Those logs contain a complete history of who was tracked, when, and by whom.
California Civil Code Section 1798.90.55 requires that before deploying an ALPR system, a public agency must present the program at a regularly scheduled public meeting and allow for public comment. Emails obtained through CPRA reveal something troubling: the city attorney discovered this requirement mid-negotiation, and ten days later staff still couldn't confirm it had been satisfied.
Corona used a sole source justification to award Flock the contract without competitive bidding. Flock's CEO Garrett Langley signed a letter claiming Flock is "the sole manufacturer and developer" of their ALPR system and the "only" provider of their integrated service combination.
That was arguably thin in 2021. By July 2024 — when the Third Amendment was fully executed (signed July 23, 2024, despite a document date of July 15) expanding the program to $565,283 — Axon, Genetec, and other competitors offered comparable ALPR systems. Ironically, Flock's own corporate governance documents reference an "Axon Director Period," suggesting a business relationship between the two companies that further complicates the sole source claim.
The gap between Flock's own paperwork and the city's contract is itself worth scrutiny: Flock's Order Form prepared for this renewal shows a contract total of $780,000 over 60 months — a $214,717 discrepancy from the $565,283 the city authorized. The city has never publicly explained the difference.
Meanwhile, Denver replaced Flock with Axon in 2025, getting 50 cameras with 21-day retention, no national database, and a contractual commitment to fight subpoenas. That's what competitive bidding gets you.
California Civil Code Section 1798.90.51 requires agencies operating ALPR systems to have written use policies and to conduct regular audits of access logs. CPRA documents reveal that Corona discovered it had 203 users with active system access who hadn't logged in for six months — not through its own audit, but through a notification from Flock.
The number was later revised to 36 inactive users. Either figure represents a significant access control failure for a system that can query 80,000 cameras nationwide.
No independent audit records, compliance reviews, or usage reports appear anywhere in the CPRA production. The city has apparently relied entirely on Flock's self-reporting for accountability.
What's happened in Corona isn't unique — it's the same playbook documented in cities across the country. The same contract language, the same sharing architecture, the same result: federal agencies accessing data that local governments promised would stay local.
1. Amend the contract to include explicit retention limits, federal access prohibitions, and warrant requirements — in the PSA itself, not Flock's subordinate Terms.
2. Enable Flock's Transparency Portal so the public can see how the system is being used.
3. Conduct an independent audit of all searches conducted on Corona's network, including searches by out-of-state and federal agencies.
4. Hold a public council meeting with community input before renewing or expanding the program.
5. Publish camera locations — the public has a right to know where they are being surveilled.
The Third Amendment — expanding the program to $565,283 — was processed without a council vote and without city attorney review. Both facts are documented in the CPRA production.
On the council vote: internal emails show staff initially didn't know if council approval was required. Management Analyst Amanda Andrade wrote on July 15, 2024: "We never took this to council because we were waiting for Flock to clear out some billing discrepancies first." Purchasing Manager Yasmin Lopez ultimately confirmed the amendment qualified under the city's 10% change order threshold (Corona Municipal Code Section 3.08.070(I), up to $15,300 annually) — a legitimate procedural mechanism, but one that had the effect of bypassing public deliberation on a cumulative half-million-dollar surveillance expansion.
On legal review: Lt. Jason Perez asked "Did Legal review this?" before signing. Purchasing's answer: no. The city attorney's office does not review amendments unless the vendor proposes changes to the PSA's terms and conditions. Flock didn't propose any changes — so no legal review occurred. A $565K surveillance contract was amended and signed without the city's own lawyers reading it.
While the accountability questions raised in this report remain unanswered, internal emails show the program is already expanding again — using the same mechanisms that raised concerns the first time.
In January 2025, Management Analyst Andrade emailed Flock's customer success manager requesting a sole source justification letter for a new product: "Enhanced LPR," priced at $15,000 per year. Flock obliged within hours. No competitive evaluation is documented. No council agenda item is visible.
Separately, Flock conducted multiple sales meetings with Corona PD in late 2024 pitching Real Time Crime Center (RTCC) integration and Drone as First Responder (DFR) capabilities — a significant expansion of surveillance infrastructure well beyond license plate reading.
The pattern is consistent: program expands, sole source letter covers it, council is not consulted, no new public oversight is required. The city is on the verge of a contract renewal — potentially a new 60-month term with a 24-month auto-renewal — and none of the structural accountability gaps have been addressed.
Enhanced LPR — $15,000/year add-on. Sole source letter already requested and received (January 2025). No competitive bid documented.
RTCC Integration — Real Time Crime Center demo conducted at Corona PD headquarters November 13, 2024. Multiple Flock sales staff attended in person.
Drone as First Responder (DFR) — Flock pitched DFR capabilities in a December 18, 2024 meeting with Corona PD. This would add autonomous drone surveillance to the existing camera network.
Contract renewal — The initial 60-month term expires around March 2026. A new 5-year commitment with a 24-month auto-renewal is apparently under discussion. No public notice has been announced.