On August 14, 2026, a committee of the West Virginia House of Delegates wrote 19 questions to its video analytics vendor and published them verbatim, without editing; all three letters are indexed in the committee’s official document repository.[3][4] On October 12, the same committee asked the vendor to appear under oath on November 9 and stated in writing that the previous answer did not contain what it had asked for.[1]

The committee’s exact words: “Your letters have made no attempt whatsoever to answer this question”.[1] The committee went as far as threatening to use its subpoena powers; Flock replied that “Flock has worked in good faith to answer your questions”.[8]

(The October 26 deadline for Flock to name its witnesses has passed with no public coverage that it did so, and none that it declined. The November 9 hearing is still ahead. State public radio put the mood plainly: “There are still several pieces of information that we requested that they did not answer.”[9])

The 19 questions are an RFP (Request for Proposal)

The committee was not building a case. It was doing exactly what an enterprise buyer does during procurement (Request for Proposal): enumerating, in writing, everything it needs to know before signing. The August 14 letter arrived in five sections — “I. Security Incidents & Unauthorized Access”, “II. Surveillance Scope & Data Sharing”, “III. Accuracy & False Positive Rates”, “IV. Internal Oversight & Employee Access Controls”, “V. Data Governance & Infrastructure” — and closed with “Please provide your most recent SOC 2 Type II compliance audit” (an independent third-party audit of security and availability controls).[3]

The three questions the committee says went unanswered were, verbatim: how many employees have ever been found accessing customer data outside authorized technical duties; what “non-U.S. vendor” Flock Safety sends customer images to; and false positive data prior to July 2026 for license plate readers.[1]

When the answer is “we don’t disclose that”

Flock’s October 9 reply was an eight-page document, and for most of it, it is an explanation of why the information cannot be disclosed rather than the information itself.[2]

“No corporate division or employee possesses broad, unrestricted access to all customer data”.[2]

“Employee oversight is continuous rather than periodic”.[2]

On false positives: “approximately nine reported inaccuracies for every one million alerts” — a vendor-supplied figure, and the committee had asked for the historical series by year from 2017 to 2025, which did not arrive.[1][2]

On employee access, Flock did not say whether its own staff had improperly accessed footage; it acknowledged one instance nationally of improper external access.[10] The point is not that the answer is false. The point is that “we don’t disclose that” and “here it is” are not the same quality of answer — only one of them lets you audit your vendor. The committee said as much in its own October 12 letter: “please forgive our strong impression that Flock Safety was avoiding putting this information on the record”.[1]

An independent finding reinforces the question. On September 9, WIRED and 404 Media documented that attackers copied a camera’s storage, recovered an encryption key held on the device itself, and unlocked more than 27,000 videos; the camera had photographed roughly 50,200 vehicles and generated about 1.6 million images.[6] Flock maintains that its central database “has never been breached or accessed by an unauthorized external party”.[2] Both can be true at once: cloud intact, roadside device compromised.

(The committee letter and the vendor’s own blog also disagree on a number. The letter says “six ‘high’ level vulnerabilities” from the Bishop Fox penetration test; the vendor blog says “7 ‘High’ findings: All 7 were fully remediated and independently verified”. The blog also reports 36 issues identified, with 24 independently confirmed as fixed.[1][7])

The counterweight: 3 million searches are not 3 million searches against the county

A citizen group called DeFlock Monongalia analyzed nine CSV (comma-separated values) exports of the Sheriff’s Office audit logs, obtained through state freedom of information law, and published the raw data alongside its analysis scripts.[5]

Its finding: 3,049,590 searches against the county’s camera data between January and September 2026, run by 3,918 agencies.[5][11]

Eighty-one point three eight percent carried no case-specific reason, and 362,452 searches were categorized as traffic infractions — a use the transparency portal prohibits.[5]

Ninety-nine point eight percent are sweeps across 5,000 or more networks that include the county’s cameras by default.[5]

For contrast, the Sheriff’s Office authorized 35 personnel to operate the equipment and had run 67 of its own searches in 30 days.[12]

The counterweight is real and has to be stated: the Sheriff’s Office responded that these are not 3 million searches aimed at the county. “It’s not like it’s 3 million individual searches just to Mon County,” Mark Ralston told WV News — “I just searched 5,000 networks, so to speak, with one inquiry.”[13] The records themselves do not establish that 3 million searches returned information about local vehicles.[13]

The point for an enterprise buyer is not whether the number is alarming. It is that the Sheriff’s Office cannot verify it either: “Ralston emphasized that he had not independently reviewed the records obtained by Lynch and could not verify the reported figures.”[13] When the vendor, the customer, and the regulator cannot reconcile the same numbers, the one who loses is the buyer who had no right to ask for them.

The question nobody asked in writing

Flock’s Terms split “Customer Data” — the raw images, which belong to the customer — from “Flock Property”: the analysis, the derivatives, the models. And they grant the customer “no rights… to download, extract, export, or otherwise create or retain copies” of that analytics layer.[14]

That is the question a legislative committee never asked but every enterprise buyer has to ask in writing before signing: who owns the analytical output? If the video enters your system and the layer interpreting it belongs to the vendor, the right to produce the result, retain it, and audit it does not come bundled with the camera contract.

Five questions that need written answers before you sign:

  1. Can I export the complete audit trail of my own organization’s searches? No log access, no audit.
  2. Who inside the vendor touches my images, at what privilege level, and with what record? “Oversight is continuous” is not a log.
  3. How many inaccuracies does the system generate, by year, not aggregated? A 2026 aggregate is worthless if the model changed.
  4. Who is the subprocessor outside my country, and what do they do with my images? Annotation, subcontracting, or both.
  5. Are the analytics layer and its derivatives mine, or the vendor’s? If the answer is “the vendor’s,” I need retention and portability rights in the contract.

(The committee also asked whether device encryption uses FIPS 140-validated modules (the U.S. government encryption standard), what Flock’s exact FedRAMP status is, what its wholly-owned subsidiary in Finland does, and why it excludes images from states with a statutory license plate reader retention period from training.[1][2] Flock’s answer: it uses non-U.S. vendors exclusively for machine learning data annotation, on isolated and decontextualized images stripped of customer identifying metadata.[2])

P.D. The next time a vendor hands you its transparency portal as proof that everything is fine, run the test nobody ran: ask in writing for the audit log of your own organization and the historical false-positive series by year. If the answer takes longer than the letter does, you already know what you negotiated.

📰 Source: West Virginia House of Delegates, Committee on Government Organization (letters of Aug 14 and Oct 12, 2026; Flock response of Oct 9, 2026), WIRED + 404 Media (Sep 9, 2026), DeFlock Monongalia FOIA analysis (Oct 2026), WV News (Oct 14, 2026).

Sources

  1. West Virginia House of Delegates, Committee on Government Organization — 2026-10-12 letter to Flock Safety (Nov. 9 hearing) — official document, accessed 2026-10-24.
  2. West Virginia House of Delegates, Committee on Government Organization — 2026-10-09 response from Flock Safety to WV House — official vendor document, accessed 2026-10-24.
  3. West Virginia House of Delegates, Committee on Government Organization — 2026-08-14 WV House to Garrett Langley, Flock Safety (19 questions) — official document, accessed 2026-10-24.
  4. West Virginia Legislature — House Committee on Government Organization document index — official index, accessed 2026-10-24.
  5. DeFlock Monongalia — FOIA results: analysis of Monongalia County Sheriff’s Office Flock audit logs (Jan-Sept 2026) — analysis with published raw data and scripts, accessed 2026-10-24.
  6. WIRED + 404 Media (Dhruv Mehrotra, Joseph Cox) — Hackers Got Inside a Flock Camera. Its Data Shows How the System Really Works — joint investigation, Sep 9 2026, accessed 2026-10-24.
  7. Flock Safety — Flock Security Testing 2026: What the Bishop Fox Penetration Test Found — vendor security disclosure, Sep 22 2026, accessed 2026-10-24.
  8. The Intermountain (Steven Allen Adams) — Republicans summon Flock Safety to hearings — local press, Oct 19 2026, accessed 2026-10-24.
  9. West Virginia Public Broadcasting (Chris Schulz) — Lawmakers Request Surveillance Company Flock Appear At November Committee Meeting — state public media, Oct 13 2026, accessed 2026-10-24.
  10. Just The News (John Solomon) — West Virginia lawmakers press Flock on new privacy concerns — press, Oct 18 2026, accessed 2026-10-24.
  11. WV News (Charles Young) — Monongalia County Flock camera data searched 3 million times, group says — local press, Oct 14 2026, accessed 2026-10-24.
  12. WBOY (Hannah Heiskell) — More than 3 million searches run by 3,000 agencies hit Mon County Flock cameras — local broadcast, Oct 13 2026, accessed 2026-10-24.
  13. WV News (Chase Hughart) — Monongalia County Sheriff’s Office offers context on 3 million Flock camera searches — local press, Oct 14 2026, accessed 2026-10-24.
  14. DeFlock Monongalia — analysis of Flock Safety Terms and Conditions: Customer Data vs Flock Property — independent analysis of the Terms, accessed 2026-10-24.