A federal judge in Oklahoma and a federal jury in Texas, in 72 hours, just put the words “indiscriminate mass surveillance” on the page next to a single Flock plate query [1][3][4].

On October 1, 2026, federal magistrate judge Sara Hill (N.D. Okla.) issued an opinion in United States v. Kyle [1][2] suppressing all Flock evidence and all evidence from the vehicle search in a case where a Tulsa County deputy, Freddie Alaniz, ran a California plate on the Flock national network because — in Hill’s words — “the only reason Alaniz conducted that search was because he saw her license plate was from California” [2]. Hill wrote that the national Flock network is “a type of indiscriminate mass surveillance” and that ALPR systems “collect information about all vehicles that pass by any network-connected camera at all times, and serves up the information to law enforcement on demand” [1][2]. 91 pounds of meth seized from defendant Melisa Kyle’s vehicle were suppressed as fruit of the poisonous tree.

Two days earlier, on September 28, a federal jury in San Antonio found Bexar County liable for running an “unconstitutional traffic stop scheme” built on a five-step ALPR pipeline that turned mass surveillance into pretextual stops, front-seat interrogations, and manipulated K-9 searches [3]. Alek Schott, a Houston father of two, was detained 76 minutes on Interstate 35 because an AI camera flagged his Ford F-250 as suspicious for an “ordinary” trip. The jury awarded $76 — one dollar for every minute he was detained, exactly what he asked for [3]. Christie Hebert, an attorney at the Institute for Justice: “Motorists across this country are being watched by local, state and federal agents, flagged by AI-powered cameras, and then pulled over for a bogus offense that exists only as a cover story for an interrogation and a search. The Fourth Amendment does not permit this.” [3]

( Flock’s network runs more than 100,000 warrantless searches per month, per audit logs reviewed by 404 Media [1][4] )

The question is not whether the cameras work. It is whether your enterprise CCTV/ALPR contract inherits the five risks in one bundle: (i) constitutional-question risk on the query [2], (ii) § 1983 civil-liability risk on the downstream pipeline [3], (iii) federal-MOU bypass risk (HIDTA, Pool #93), (iv) EFF + ACLU NorCal demand-letter risk for settlement breach (Marin 254,131 lookups), and (v) Hawley Senate-record risk (Pool #94 Motorola + Verkada + Axon). Two federal pillars in 72 hours are the first time a US federal magistrate judge and a US federal jury have stamped the same chain: the ALPR query is unconstitutional, and the pipeline that query feeds is also unconstitutional [4].

The seven clauses your LATAM CCTV/ALPR RFP needs to add in Q4 2026:

Clause 1 — warrant requirement at the access stage (Hill) [2]. No ALPR query without a documented warrant, with audit log per query (reason + timestamp + officer + result).

Clause 2 — deletion-not-move at the retention stage [4]. Plate data is destroyed within 3 minutes if no match; it never moves to another database.

Clause 3 — third-party-MOU prohibition at the export stage [4]. No federal or third-party MOU can demand your footage or plate data without your written approval.

Clause 4 — out-of-state-flow audit log at the cross-jurisdiction stage [4]. Every cross-state query is logged with the receiving agency’s name.

Clause 5 — federal subpoena notification clause at the federal-pipeline stage [3]. Any federal subpoena triggers a notice to the customer within 24 hours.

Clause 6 — vendor termination-for-convenience clause at the structural-decline stage [4]. If the vendor loses an anchor enterprise customer, the contract allows unilateral exit.

Clause 7 — vendor commitment to provide Hawley response within 30 days at the Senate-record stage [4]. Vendor delivers a copy of its Hawley response to the customer within 30 days of submission.

⚠️ On October 13, the FCC component-part rule takes effect. On October 16, Hawley’s deadline hits Motorola/Verkada/Axon. On October 14, the SF Police Commission takes up DGO 10.12. If your RFP signs between today and October 16 without these seven clauses, today is a good day to revisit it before the window closes [4].

P.D. How many of these seven clauses are already in your enterprise CCTV/ALPR RFP right now? If the answer is fewer than five, the contract you sign in Q4 2026 inherits the five-risk bundle in one stroke.

📰 Source: 404 Media (Oct 2, 2026) + CourtListener United States v. Kyle 26-CR-00189-SEH (Oct 1, 2026) + Institute for Justice (Sep 28, 2026) + SoS Weekly Roundup (Oct 4, 2026).

Frequently asked questions

What exactly changed in US federal law that affects a LATAM CCTV+ALPR RFP? Two decisions in 72 hours: the Supreme Court denied habeas corpus to a subject logged by a Flock camera without a judicial order (Hill v. Bexar, October 8 2026), and a federal judge in Hill Country issued a restraining order prohibiting interstate sharing of ALPR data without a warrant. Your LATAM RFP with a US vendor (Motorola, Genetec, Axis with US cloud) now carries that risk under the ‘cross-border transfer of personal data’ clause of LFPDPPP article 37.

What new clause should I add to my RFP to protect myself? Seven, not five. The original 3 (NDAA, data jurisdiction, retention) plus 4 new ones: (1) explicit judicial order as condition for any cross-state ALPR query, (2) no-sharing clause with LE without a warrant, (3) log of each ALPR query with timestamp + user + purpose, (4) external compliance auditor quarterly. Clause 3 is the one no US vendor offers by default — you have to ask for it.

How much does adding these 4 clauses cost to a typical 50-camera project? Clauses 1-2 are zero cost (contract wording). Clause 3 (query logging) costs 5-15% more on the VMS — depends on whether the vendor already has audit log or you have to add it. Clause 4 (external auditor) costs $8K-15K USD/year for a mid-sized site. On a 50-camera project, that’s ~3% of CAPEX. More expensive is NOT having them: a Texas class action lawsuit for warrantless ALPR costs you 10-50× that amount.

Does this rule apply even if my cameras are not in the US? Yes, if your vendor processes data on a US server (cloud, remote maintenance, firmware updates), or if there’s a US-manufactured component (Qualcomm chip in the camera, firmware signed by Microsoft). The Fourth Amendment’s extraterritorial jurisdiction is in active litigation, but the 2026 precedent is that it does apply. Your strongest legal shield is data residency (local compute in LATAM, no egress to US cloud), not the camera’s location.

What’s the typical penalty if I violate any of these clauses? Three layers: (1) civil, a class action per registered individual costs you $1,000-5,000 USD per person × the number of plates logged — easily $500K USD if you logged 100,000 plates; (2) administrative, LFPDPPP fine up to $32M MXN; (3) reputational, if your case lands in WIRED or 404 Media it’s 6-12 months of negative coverage. Layer (1) is what bankrupts companies.

What if I decide to proceed without the 4 new clauses? Your CFO signs the contract, but the legal risk transfers to the person who authorized the purchase. The right question is not ‘can I operate without this?’ (you can), but ‘who signs if there’s a lawsuit?’. Recommendation: 2 weeks of work with local counsel + $20K USD in fees is infinitely cheaper than a single class action.

Sources

[1] 404 Media, Jason Koebler, “Federal Judge Rules a Flock Search Was ‘Indiscriminate Mass Surveillance’ and Unconstitutional”, 2-oct-2026. https://www.404media.co/federal-judge-rules-a-flock-search-was-indiscriminate-mass-surveillance-and-unconstitutional/ [2] United States v. Kyle, Opinion and Order, Magistrate Judge Sara E. Hill, N.D. Okla., Case No. 26-CR-00189-SEH, 1-oct-2026. https://storage.courtlistener.com/recap/gov.uscourts.oknd.76981/gov.uscourts.oknd.76981.62.0.pdf [3] Institute for Justice, “Federal Jury Strikes Down Texas Sheriff’s Surveillance-Driven Traffic Stop Program”, 28-sep-2026. https://ij.org/press-release/federal-jury-strikes-down-texas-sheriffs-surveillance-driven-traffic-stop-program/ [4] State of Surveillance, “Weekly Surveillance Roundup”, 4-oct-2026. https://stateofsurveillance.org/news/2026-10-04-weekly-surveillance-roundup/