# Default-On Surveillance Data Sharing as Operational Model ## Status The central mechanism question this synthesis asks — *how the 1,384-org topology came to exist* — was filed as the wiki's first dialectical tension ([[T001 - Default-On Sharing Policy or Product Design]]) on 2026-05-23 and resolved through dialectic [[D001 Synthesis]] in favor of **product design** as the mechanism. The verdict settles, for this synthesis, the structural attribution of the page's central claim: the resting state of the system is "on" because Flock's interface defaults toward sharing and Conway's per-event policy text cannot reach the configuration moment — not because Conway's administrators applied a per-event evidentiary test to platform configuration and authorized 1,384 specific relationships. The agency-culpability framing this synthesis carried in its initial form — that "Conway PD did not apply CPD 800-32 §D.4's standard to platform configuration" — is narrowed by the dialectical record. §D.4's grammar is per-event and applies to a triggering event the configuration moment has not yet produced; the standard cannot be coherently applied at the toggle. What survives, sharpened, is the narrower claim that Conway PD failed to *promulgate any successor internal directive* adequate to platform-era configuration. The chief's authority on internal directives is unilateral; the absence of one is an act, not an inaction. That residual claim is filed as [[T002 - Successor-Policy Omission]] for its own dialectical treatment. Read this page in light of that distinction: - **Settled (mechanism):** product design produces the topology; policy discipline framed in §D.4's per-event grammar cannot reach it. The page's structural observations (the menu, the toggle, the asymmetric pattern, the federal lookups, the private-business onboarding, the out-of-state hot list) are the uncontested factual base on which the dialectic resolved. - **Sharpened but unresolved (culpability):** whether Conway PD's failure to promulgate any internal directive translating §D.4's spirit into platform-era practice is a culpable governance omission. Tracked at [[T002 - Successor-Policy Omission]]. - **Empirically bracketed:** the authorship distribution of the 1,384 relationships — what fraction Conway's administrator affirmatively toggled versus inherited from counterparty-side defaults — and whether Arkansas-deployed Flock tenants ship with a default-on or default-off baseline. Supplemental FOIA (Conway tenant session logs; Flock default-state documentation by jurisdiction) could move these. - **Definitionally bracketed:** whether the platform-configuration moment is itself "an act of sharing" within §D.4's intended scope is a question of statutory construction the FOIA corpus cannot settle. In the Conway Police Department's Flock Safety deployment, sharing surveillance data across organizational boundaries is not the exception that a specific case justifies. It is the resting state of the system. A sharing relationship is an administrative setting in the vendor's platform; once it is switched on, license-plate data flows to the counterparty continuously, for as long as the setting remains on, without a memorandum of understanding, without a warrant, without a per-query approval, and without notice to anyone whose vehicle is recorded. The corpus documents this posture at three scales — a relationship inventory, an activity record, and a private-business onboarding — and the consistent finding across all three is the same: the default condition of a configured relationship is "sharing." **The topology: 1,384 relationships, and not one agreement.** A single Flock platform export, the [[SharedNetworks 2025-12-17 Snapshot]], enumerates **1,384 organizations** that held a data-sharing relationship with Conway PD as of December 17, 2025 — 486 of them bidirectional, 471 inbound-only, 427 outbound-only. Ninety-four percent of those relationships are with organizations outside Arkansas; the network reaches across at least 38 states, two federal entities, a tribal law-enforcement agency, and a national non-governmental organization. For none of the 1,384 does the corpus surface a signed data-sharing agreement, a memorandum of understanding, or even an internal email notifying Conway PD leadership that a relationship had been added. The relationships exist because they were configured. **The mechanism: a toggle, not a warrant.** Flock's own customer-facing explanation, sent to Conway's administrator in August 2025 by a Flock senior vice-president, lays out the sharing model plainly ([[Audit-System Policy Emails (Aug 2025 - Apr 2026)]]): an agency may "share with agencies in specific states only," "share within your state only or within a certain distance," "share 1:1 (only with specific agencies)," or "don't share at all." Sharing is a menu of administrative settings. "Don't share at all" is one option among several — which is to say that not-sharing is itself a configuration choice, equal in the interface to every degree of sharing. The concept page [[Flock Network Sharing - Hot Lists]] catalogs the forms this takes: network sharing (search access to another agency's plate reads), hot-list sharing (pushing a list of plates of interest into another agency's alert feed), and the federal-prefix convention. Each is a setting. The friction to enable one is the friction of a permission checkbox. **Three shapes of one posture.** The corpus shows the default-on posture operating in three concrete forms. The first is federal: the [[Federal Searches CSV]] records **5,929 lookups by federal law-enforcement agencies** against Conway PD's data in a single 51-day window, none of which required Conway's per-query approval or generated a Conway-side notice. The second is private-business: the [[Home Depot Camera Sharing Series]] documents a corporate-coordinated, state-wide rollout in which six Arkansas Home Depot stores' cameras became searchable by Conway PD across a one-month window in spring 2026 — governed, in the vendor's own description, by a template paragraph that no party signs. The third is out-of-state peer sharing: on January 22, 2026 a sheriff's office in Escambia County, Florida — roughly 700 miles away — pushed a custom hot list into Conway's alert feed, and Conway could begin receiving hits on those Florida-authored plates simply by enabling an audience in the admin interface ([[Escambia County FL SO Hot List Share]], [[2026-01 Escambia County FL Hot List Share to Conway PD]]). Federal agency, private corporation, distant sheriff: three different counterparties, one common structure — no agreement, no warrant, no notice, continuous flow once configured. **The local policy does not reach the toggle.** Conway PD operates under a written local rule for license-plate-reader data, CPD Policy 800-32 ([[CPD Policy 800-32 — License Plate Reader Vehicle Operations]]). The policy contemplates data sharing — it permits LPR data to "be shared with other law enforcement agencies if evidence of an offense is indicated." That standard, "evidence of an offense is indicated," is a per-event test: it asks, of a specific sharing act, whether an offense is in view. It maps cleanly onto a world in which sharing is a discrete decision an officer makes about a particular record. It does not map onto a platform in which sharing is a standing relationship configured once and then operative for thousands of subsequent queries the configuring officer never sees. Nothing in the corpus indicates the "evidence of an offense" standard was applied to the configuration of the 1,384 relationships in the [[SharedNetworks 2025-12-17 Snapshot]]. The policy that would govern sharing, if it governed the toggle, appears to govern only the per-event act the platform has made obsolete. The dialectical record at [[D001 Synthesis]] settles that §D.4 *cannot coherently be applied at the configuration moment* — the per-event evidentiary trigger is logically prior to the events the standard regulates — so the operative culpability question is not whether §D.4 reached the toggle but whether Conway PD's chief promulgated a successor directive that could (see [[T002 - Successor-Policy Omission]]). **"Full control" — exercised once.** Flock's framing to its customer is that the agency is in charge: "that data belongs to you as the customer," the August 2025 explainer states, and "you have full control over whether and how your agency shares this information" ([[Audit-System Policy Emails (Aug 2025 - Apr 2026)]]). As a description of who owns the configuration, this is accurate — the agency, not the vendor, sets the controls. But "full control" is exercised at one moment, at the toggle, by one person. At Conway that person is overwhelmingly a single Narcotics lieutenant who appears in 330 of the production's 389 emails ([[Conway Police Department]]). After the toggle, control is not exercised again: the counterparty queries continuously, and the agency receives no per-query prompt at which control could be re-asserted. Control over a default-on relationship is control over whether the default applies — not control over the queries the default permits. The two are not the same, and the distance between them is the operational fact this page describes. **Not a peculiarity of one vendor.** The default-on posture is documented in the corpus through Flock, but it is not specific to Flock. In the corpus's second jurisdiction, Fayetteville, the competing vendor Axon markets its Fusus platform with "cross-agency sharing when and where you choose" as a standard, advertised capability, and the Axon Fleet 3 trial there ran on managed hotlists ([[Axon Fleet 3 ALPR Trial]], [[Axon RTCC and Surveillance Ecosystem Pitch]]). Cross-organizational sharing as a built-in, configurable feature is a property of the ALPR product category as the corpus documents it, not a quirk of a single company. The operational model — sharing by configuration, as the system's resting state — travels with the technology. **What this is, and is not.** Nothing in this pattern is alleged to be unlawful. Inter-agency law-enforcement data sharing is lawful, and the cross-jurisdictional sharing of plate data through commercial platforms is, at present, largely unregulated rather than prohibited. This page does not claim that any particular one of the 1,384 relationships is improper, or that any particular federal or private-party query was wrongful; the corpus does not support claims at that resolution, and the searching parties and plates are redacted in the records that would. The claim here is structural, and it concerns the default. Historically, law-enforcement access to information held by another jurisdiction was gated — by a warrant, a subpoena, a request, a memorandum, some act that created a record and a decision point. The platform model replaces that gate with a setting, and sets the setting's consequence to run continuously. Whether surveillance data sharing should have a resting state of "on" — whether the per-event standard in a policy like CPD 800-32 should attach to the configuration and not only to the per-event act the platform has superseded — is a policy question for Conway and for the Arkansas bodies that could legislate it. The record establishes only that, in this deployment, the resting state is "on." ## Evidence - **The topology.** [[SharedNetworks 2025-12-17 Snapshot]] enumerates 1,384 organizations sharing with Conway PD (486 bidirectional, 471 inbound-only, 427 outbound-only); 94% of relationships are out-of-state; no per-relationship MOU or agreement appears anywhere in the production. - **The vendor's sharing menu.** Flock's August 2025 explainer describes sharing as a set of administrative options ranging from "share with agencies in specific states only" to "don't share at all" ([[Audit-System Policy Emails (Aug 2025 - Apr 2026)]]). - **Federal activity.** [[Federal Searches CSV]] — 5,929 federal-agency lookups against Conway data in a 51-day window, with no per-query Conway approval or notice. - **Private-business sharing.** [[Home Depot Camera Sharing Series]] — six Arkansas Home Depot stores' cameras shared to Conway PD in spring 2026, under template language no party signs, no MOU. - **Out-of-state peer sharing.** [[Escambia County FL SO Hot List Share]] — a custom hot list pushed from a Florida sheriff's office into Conway's alert feed on 2026-01-22, accepted by enabling an audience setting. - **The policy gap.** CPD Policy 800-32 permits data sharing "if evidence of an offense is indicated" — a per-event standard ([[CPD Policy 800-32 — License Plate Reader Vehicle Operations]]); the corpus does not show it applied to platform-level relationship configuration. ## Caveats - The mechanism claim of this synthesis (that product design produces the default-on topology, and that policy discipline framed in §D.4's per-event grammar cannot reach it) was tested and resolved through dialectic [[D001 Synthesis]] on 2026-05-23. The agency-culpability framing was narrowed in the same record; see the `## Status` section above. - The [[SharedNetworks 2025-12-17 Snapshot]] is a single point-in-time export; the corpus contains no time series, so the network's growth rate and its earlier or later size are not established. - The corpus does not establish that any specific sharing relationship is improper. The absence of MOUs in the production is not proof that none exist at the Flock-platform level; it is an absence in this agency's records. - "Default-on" describes the posture that emerges from the product design together with the absence of policy friction. It is not a Flock advertising term; Flock's interface offers "don't share at all" as an option. The finding concerns which choice the system makes the path of least resistance. - The cross-jurisdiction observation rests on two productions. Whether the posture holds across the wider Arkansas ALPR landscape is a hypothesis future productions will test. - This page is the author's analytical synthesis, demarcated as such per the wiki's editorial posture. Every factual claim above is anchored to a source page and, through it, to a raw FOIA document. ## Open questions - **Authorship distribution among the 1,384 relationships.** The mechanism question is settled via [[D001 Synthesis]]: product design produces the topology. The remaining sub-question — what fraction of the 1,384 relationships involved an affirmative Conway-side toggle versus a counterparty-initiated configuration the Conway tenant inherited — is empirically bracketed. Conway PD administrator session logs in the Flock tenant would move it. - **Successor-policy omission.** Whether Conway PD's failure to promulgate any internal directive translating §D.4's spirit into platform-era configuration is a culpable governance omission. Tracked at [[T002 - Successor-Policy Omission]]. - **Does any Arkansas law, or any Conway ordinance, attach a standard to platform-level ALPR-sharing configuration** as distinct from per-event sharing? The legislative posture is the load-bearing intervention if D001's verdict holds — counterfactual legislation modeled on Virginia's out-of-state-sharing prohibition is a candidate analytic next step. - Would a refreshed [[SharedNetworks 2025-12-17 Snapshot]] export show the network larger or smaller than the 1,384 organizations recorded on 2025-12-17? - Do the jurisdictions whose FOIAs were filed in May 2026 show the same default-on posture, or do any of them gate platform-level sharing? The [[Axon Fleet 3 ALPR Trial]] (Fayetteville) and [[Pulaski County Sheriff's Office]] productions are the first corroborating data points; the Arkansas State Police and Little Rock Police Department productions, when received, will extend the test.