# T003 — Vendor-Imposed Secrecy: Deliberate Transparency-Defeating Design or Inherited Procurement Boilerplate The executed Cellebrite Advanced Services Agreement obligates the City of Little Rock, on the agency side, to limit visibility into the vendor's work — most strikingly at **§5.7**, under which the customer "shall use reasonable efforts to mitigate the risk that its own employees will report Cellebrite's services to law enforcement," and at **§6.4**, which designates Cellebrite's unlocking "Sources and Methods" non-disclosable trade secrets ([[Cellebrite Advanced Services Agreement]]). The tension concerns *what these clauses are*: a deliberate architecture for defeating public, defendant, and judicial visibility that surveillance procurement now adopts as routine, or standard forensic-vendor licensing boilerplate the agency accepted without bespoke negotiation. The reading is load-bearing for [[Vendor-Imposed Secrecy as Procurement Routine]] and determines whether the remedy is procurement hygiene or structural prohibition. ## Statement A **The secrecy clauses are standard forensic-vendor boilerplate, not a bespoke transparency-defeating design.** §§5.5/5.7/6.4 are Cellebrite's nationally-standard terms — anti-circumvention, anti-tip-off, and trade-secret-protection language common to exploit-dependent forensic tooling, where premature disclosure of an unlocking method "burns" it for every customer. LRPD's negotiating attention went where the agency had leverage and interest, and it secured what it sought: the **§§11.1/11.8 Arkansas FOIA carve-outs** and **§13.16 Arkansas governing law** were redlined *into* the bundle ([[Cellebrite Advanced Services Agreement]]). That is evidence of an agency that negotiated against vendor secrecy where it chose to and accepted the vendor's standard product terms elsewhere. §5.7, read in this frame, is a generic provision protecting the vendor's methods from disclosures that would defeat the tool, not a Little-Rock-specific instruction to suppress employee whistleblowing. The remedy this reading implies is procurement hygiene: subject vendor T&Cs to City-Attorney review (as [[Sherri Latimer]] did for the Flock EULA) and strike or qualify the clauses — the regulated object is the agency's negotiating diligence, not the vendor's standard form. ## Statement B **The secrecy regime is a deliberate transparency-defeating architecture that surveillance procurement adopts as routine.** §5.7 is not a trade-secret clause: it imposes on a *government agency* an affirmative obligation to reduce the chance its *own employees* report the vendor's services to law enforcement — an anti-disclosure duty running inward, against the agency's staff, structurally unlike IP protection. Read together with §6.4 (methods categorically non-disclosable) and §10.3 (the extracted data may be "transferred or stored outside … the country where Customer is located"), the contract defeats the ability of the public, a defendant, and a court to learn what was done to a seized device and where. The dispositive tell is that the clauses required a bespoke FOIA carve-out (§§11.1/11.8) to be disclosable *at all*: the default posture the vendor's instrument supplies is concealment, and the agency had to negotiate against it just to preserve ordinary public-records access. That a provision this notable drew no City-Attorney risk memo — where the less-remarkable Flock EULA did ([[Cellebrite Advanced Services Agreement]], Open questions) — shows the regime travels into the agency unexamined, i.e., as routine. The remedy this reading implies is structural: a prohibition on public-agency contract terms that obligate the agency to limit employee reporting, or that designate forensic methods categorically non-disclosable in criminal discovery. ## Why it matters - **If Statement A is correct (boilerplate):** the remedy is procurement discipline. Follow-on FOIA targets the City Attorney's review file (or its absence) for forensic-vendor contracts; the legislative/administrative ask is a mandate that vendor T&Cs receive documented legal review and that anti-disclosure clauses be struck or qualified. The vendor's standard form is regulated only through the agency's negotiating diligence. - **If Statement B is correct (deliberate design):** the remedy is structural. The ask is a statutory bar on government contract terms that require an agency to limit its employees' reporting, and a rule that forensic "Sources and Methods" cannot be withheld from criminal-discovery scrutiny by private trade-secret designation. The vendor's contract architecture is the regulated object. ## Resolution status `open`. The tension turns on a fact the corpus cannot supply on its own: whether §§5.5/5.7/6.4 are materially identical across Cellebrite's public-agency contracts nationally (supporting A) or were negotiated/elevated in a way that marks them as bespoke (supporting B). A Tier-2/3 comparison of other jurisdictions' executed Cellebrite Advanced Services agreements is the discriminating evidence and is a research target, not a corpus question. No dialectic has been run; pushing T003 through the [[Vendor-Imposed Secrecy as Procurement Routine|secrecy synthesis]]'s dialectic (D003) is available as an opt-in but is not invoked this cycle. ## Discovery Surfaced 2026-06-06 while promoting the Cellebrite §5.5/§5.7 contract-clause material from the [[Cellebrite]] and [[Cellebrite Advanced Services Agreement]] pages into the [[Vendor-Imposed Secrecy as Procurement Routine]] synthesis. The §5.7 employee-reporting clause is the highest-leverage contested object in the corpus's vendor-secrecy layer; T003 makes the boilerplate-vs-design question a first-class object. ## Notes - The two statements share the same Tier-1 evidentiary base (the executed Cellebrite Advanced Services T&C). They differ in *what the clauses signify*, not in *what the clauses say* — a framing tension on a shared record, not an evidentiary dispute over contested facts. - Neither reading alleges unlawful conduct. The clauses are contract terms a public agency executed; whether they are enforceable against Arkansas public-records or criminal-discovery law (given the §§11.1/11.8 carve-outs) is a separate legal question the corpus does not resolve. - §5.7's verbatim text is preserved on [[Cellebrite Advanced Services Agreement]] and quoted in [[Vendor-Imposed Secrecy as Procurement Routine]]; the tension does not restate it beyond what the record shows.