# Vendor Capture of Local Surveillance Policy When the Conway City Council asked the Conway Police Department, in April 2026, whether Flock Safety had ever suffered a data breach, the department did not answer from its own knowledge. It asked the vendor, and relayed the vendor's answer. That sequence — an elected body's question about a surveillance system, routed to the company that sells the system, and returned to the elected body in the company's words — is the clearest single instance of a broader pattern this page describes. Flock Safety does not only sell Conway PD a product. It supplies the apparatus that surrounds the product: the cadence of contact, the framing of the roadmap, the answers to oversight questions, and the language with which the program is defended in public. The vendor is positioned inside the local policy conversation. The term for that position is vendor capture — used here not as an accusation of corruption but as the name for a structural condition. **The talking points the agency did not write.** The April 2026 thread is worth stating precisely ([[Flock Cameras Apr 2026 City Council QA Thread]]). Conway's Flock administrator, Lt. Burningham, emailed Flock support: "Our city council is wanting some information about Flock ... They are wanting to know specifically about information security and if Flock has ever had any data breaches." A Flock customer-success manager replied the same evening with talking points and an attached "Flock Safety Security Claims and Facts" one-pager — a vendor-produced marketing document — asserting that "Flock has not experienced a data breach or been hacked." The agency's intermediary between its elected oversight body and the factual question that body had asked was the vendor. The Council asked about the vendor; the vendor wrote the answer; the agency carried it. **The May 2026 Mayor's-Office FOIA ingest (`FOIA-2026-127`) extends the chain by one further step:** the Flock customer-success reply — through a parallel branch from Flock's "Flock Advisory Network" CSM Emmie Tajik — was forwarded by Chief Harris to Mayor Castleberry's executive office within ~5 hours of Burningham's original request, with the message body *"See below."* ([[Flock Talking Points to Mayor's Office April 2026]]). The vendor's defensive material reached the City's executive office at the same hour the executive office was facing the broader [[Spring 2026 Citizen FOIA and Reconsideration Wave|citizen oversight wave]] — multiple FOIAs and Council-agenda-reconsideration requests arriving across the April 17 – May 9 window. The chain that began with Council questioning at the PD level ended at the Mayor's desk in real time. Whatever the accuracy of Flock's assertions — and the corpus cannot verify them, a limit developed on the concept page [[Vendor Information Security Posture]] — the structural fact is that the oversight body received the regulated company's self-description in place of an independent assessment, and that self-description traveled rapidly to the executive level when citizen scrutiny rose. **A vendor-curated information environment.** The April thread is not an isolated contact; it sits inside a continuous one. The [[Account Management Series (Discussions, Q3 Updates, FY26 Planning)]] documents a structured customer-success cadence — standing monthly check-ins, quarterly business reviews, an annual "FY26 Planning + New Tech from Flock" conversation — amounting to roughly twelve to fifteen vendor meetings a year, separate from operational issues. Around that cadence runs a second layer: monthly product newsletters, an annual user conference with invitations addressed personally to Lt. Burningham by Flock executives, and the launch of a pooled customer-success resource, the "Flock Advisory Network" ([[Vendor Newsletters and Flock Forward Conference]]). Taken together, the vendor's broadcast and touchpoint communications reach the agency's administrator on the order of several times a week. The concept page [[Surveillance Vendor Capture - Roadmap Influence]] catalogs this. The point is not that any one meeting or newsletter is improper — each is ordinary business-to-business customer success. The point is cumulative: the working information environment of the official who administers Conway's surveillance system is, to a substantial degree, furnished by the company that sells it. **The roadmap, and the agency's staff as its instrument.** The vendor's position extends to the agency's forward planning. At onboarding, Flock's kickoff worksheet captured Conway PD's multi-year technology goals on a vendor-authored template ([[Surveillance Vendor Capture - Roadmap Influence]]); the annual "FY26 Planning + New Tech from Flock" meeting is, by its title, a joint roadmap conversation. And the relationship runs in the other direction as well: in February 2025, Flock asked Conway PD leadership to pass the vendor's contact to the Conway Housing Authority, pitching federal grant funding for a separate camera deployment, and Lt. Burningham made the outreach call and fed the Housing Authority's interest back to the vendor ([[HUB Federal Grant Cross-Sell Thread]]). A police lieutenant became, for that exchange, a sales bridge to an adjacent public body. The vendor does not only occupy the agency's information environment; it draws on the agency's staff and standing to extend its own reach. **Framing the accountability question.** The most consequential form of the pattern is the vendor's framing of the surveillance system's accountability mechanisms. In December 2025, Flock changed its audit-log system: it stripped officer names, specific plates, and vehicle-fingerprint data from the inter-agency "Network Audit Logs," and it told customers the rationale in its own broadcast — "We cannot let those abusing our transparency compromise officer safety" ([[Audit-System Policy Emails (Aug 2025 - Apr 2026)]]). The change reduces what a public-records requester to one agency can learn about another agency's searches; the vendor framed that reduction, for its customers, as a protection. When Flock later introduced an "Audit Assistance" analytics tool, it attached a warning that customers should evaluate how the tool's aggregated view would be treated under public-records law before opting in. The audit log is the principal accountability instrument for an ALPR program — the record of who searched what. The corpus shows the vendor designing that instrument, narrowing it, and supplying customers the language to understand the narrowing. Accountability for the surveillance program is, in meaningful part, a vendor-managed product feature. **The customer as constituency.** Flock's communications to Conway PD include a genre unusual for a software vendor: political-defense messaging. The [[Vendor PR and Political Communications]] source page documents broadcasts titled "Defending the Tools That Keep Communities Safe," "Fact Check: No Hack," and "Federal Court Upholds Constitutionality of LPR Technology" — not product or training content, but advocacy: rebuttals of critical coverage, amplification of favorable rulings, ready-made frames for defending the program against community criticism. A vendor that distributes such material is cultivating its law-enforcement customers as a constituency — a body of public officials equipped and inclined to defend the product when scrutiny rises. The agency that adopts the product also, through this channel, adopts the vendor's case for it. **The same pattern, the second vendor.** None of this is specific to Flock. In the corpus's second jurisdiction, the competing vendor Axon ran the same motion at the Fayetteville Police Department: a customer-success manager's recap of an on-site meeting laid out Axon's roadmap for the agency — extend the trial, add AI tools, "begin budgetary modeling" for fixed cameras and a Real-Time Crime Center — and Axon proposed reusing its trial mechanism for each next product ([[Axon RTCC and Surveillance Ecosystem Pitch]]). The same Flock Arkansas sales personnel who closed Conway also courted Fayetteville. Vendor capture, as this page uses the term, is not a property of one company or one city; it is how the surveillance-vendor market, as the corpus documents it, engages local law-enforcement agencies — and, through them, local surveillance policy. **What this is, and is not.** "Capture" here is a structural description, not an allegation of corruption, illegality, or bad faith by anyone. The officials involved appear to be doing their jobs; the vendor's customer-success operation is, taken activity by activity, ordinary commercial practice. A fair reader can hold the counter-reading: high-touch account management, product newsletters, and user conferences are how every enterprise-software company treats a customer, and an agency relaying a vendor's security claims to a council is, on one view, simply forwarding the information it has. The synthesis claim is narrower, and it survives that counter-reading. It is that the apparatus surrounding the product — the cadence, the roadmap framing, the audit-system design, the political messaging — places the vendor inside the local surveillance-policy conversation, in the specific and documented sense that when Conway's elected body asked an oversight question, the answer it received was written by the company being asked about. Whether a city's surveillance policy should be discussed, defended, and audited substantially in the vendor's terms is a question for that city. The record establishes that, in Conway, to a significant degree, it is. ## Evidence - **The Council's question, answered by the vendor.** Burningham relayed the Council's data-breach question to Flock; a Flock customer-success manager returned talking points and a "Security Claims and Facts" one-pager asserting "Flock has not experienced a data breach or been hacked" ([[Flock Cameras Apr 2026 City Council QA Thread]]). - **The customer-success cadence.** Roughly 12–15 vendor meetings a year — monthly check-ins, quarterly reviews, annual planning ([[Account Management Series (Discussions, Q3 Updates, FY26 Planning)]]). - **The broadcast layer.** Monthly newsletters, a personally-addressed annual user conference, the Flock Advisory Network ([[Vendor Newsletters and Flock Forward Conference]]). - **The roadmap and the sales bridge.** A vendor-authored onboarding worksheet capturing multi-year goals; Flock using Conway PD to reach the Housing Authority with a grant-funded camera pitch ([[HUB Federal Grant Cross-Sell Thread]], [[Surveillance Vendor Capture - Roadmap Influence]]). - **Accountability as a vendor product.** Flock's December 2025 narrowing of Network Audit Logs, framed to customers as protection against "those abusing our transparency," and its FOIA-exposure warning on the Audit Assistance tool ([[Audit-System Policy Emails (Aug 2025 - Apr 2026)]]). - **Political-defense messaging.** Flock broadcasts "Defending the Tools," "Fact Check: No Hack," and "Federal Court Upholds Constitutionality of LPR Technology" to its law-enforcement customers ([[Vendor PR and Political Communications]]). - **The same motion at the second vendor.** Axon's roadmap recap and trial-reuse proposal to Fayetteville PD ([[Axon RTCC and Surveillance Ecosystem Pitch]]). ## Caveats - Every component activity in this pattern — account management, newsletters, conferences, talking points — is, in isolation, ordinary enterprise-software customer practice. The synthesis is in the cumulative effect, and a reader may reasonably weigh that effect differently. - The corpus does not show what Conway PD did with the vendor's talking points after receiving them — whether the Council was satisfied, whether anyone independently checked Flock's claims. The documented fact is the relay, not its reception. - Flock's security and audit claims are recorded as vendor assertions; the wiki does not verify or refute them (see [[Vendor Information Security Posture]]). - The vendor-capture characterization rests on two jurisdictions; future productions will test whether it generalizes. - This page is the author's analytical synthesis, demarcated as such per the wiki's editorial posture. Every factual claim above is anchored to a source page and, through it, to a raw FOIA document. ## Open questions - When Conway PD relayed Flock's talking points to the City Council, did any council member or city official seek an independent assessment of the vendor's data-security claims? - Did Conway PD personnel attend the Flock Forward user conference, and were those trips processed as City travel records? - Has Conway PD opted into the "Audit Assistance" tool — and if so, is the aggregated view itself being treated as a public record? - Do other Arkansas jurisdictions show the same vendor-supplied oversight answers, or do any answer surveillance-policy questions from independent or in-house analysis?