Illinois College Tried to Cancel Its Flock Surveillance Contract — And Was Refused: A Privacy and Data-Sharing Controversy

How It Started: From Installation to Wanting Out

In April 2025, Elgin Community College in Illinois deployed six Flock safety cameras, with the stated rationale of "enhancing student safety and security." Automated License Plate Recognition (ALPR) systems like these have rapidly expanded across American campuses, communities, and law enforcement agencies in recent years, and Flock Safety is one of the leading vendors in this space.

Just a few months later, however, the college's position shifted. By September, administrators had grown concerned about the system and sought to terminate their agreement with Flock. Notably, according to reports, that contract turned out to be far easier to sign than to cancel.

ALPR systems use cameras to continuously photograph passing vehicles, automatically extracting license plate numbers via optical character recognition (OCR) algorithms and logging plate data alongside timestamps and geographic coordinates into a searchable database. Founded in 2017, Flock Safety is now one of the largest commercial ALPR providers in the United States, serving local police departments, homeowners associations, schools, and private businesses — with an estimated deployment of over 100,000 cameras nationwide. Unlike traditional closed-circuit television, the core value of ALPR lies in its structured, queryable data: authorized users can search where a particular vehicle appeared during a given time window, effectively reconstructing an individual's movement history. This is precisely why, despite being marketed as a "safety tool," these systems are viewed by privacy law scholars as a low-cost, high-coverage mass surveillance infrastructure.

The College's Three Core Concerns

The concerns documented in reports fall into three categories, each touching a sensitive nerve in the debate over surveillance technology deployment.

Data Being Shared with Border Enforcement Agencies

The college feared that Flock was sharing collected data with U.S. Customs and Border Protection (CBP). For a community college serving a diverse student population, this meant that information gathered under the banner of "campus safety" could flow into federal law enforcement systems with no connection to campus administration. This kind of "mission creep" is precisely the most common criticism privacy advocates level at ALPR systems — once data is collected, its uses often exceed what was originally promised.

Mission creep in the surveillance technology space follows a well-documented institutional path: ALPR operators typically pool data from all their clients into a unified shared network (such as Flock's "Falcon" platform), making it queryable by other subscribing agencies. This means footage captured by a college's cameras could be accessed by networked law enforcement agencies — or even federal departments — without the college's knowledge. Investigations by the ACLU and multiple digital rights organizations have documented cases of Immigration and Customs Enforcement (ICE) and CBP using such shared databases to track undocumented immigrants. For community colleges serving diverse and vulnerable student populations, this lack of control over data flows is especially concerning, as it may expose marginalized groups to additional legal risk.

Camera Data Transmissions Not Properly Secured

The second concern centered on the camera feeds not being adequately protected. If video or license plate data contains vulnerabilities at the transmission and storage stages, not only does the promised "security" become hollow — it actively introduces new data breach risks for students and visitors.

Ambiguous Access Permissions

Reports also noted concerns about law enforcement and other parties' access to the data. Who can view the footage, under what conditions, and whether authorization is required — when access controls are not clearly defined in the contract, they become real privacy liabilities.

Why the Contract Couldn't Simply Be Canceled

The most noteworthy aspect of this incident isn't just the technology itself, but the predicament of wanting to leave and being unable to. The situation bluntly illustrates a widely underestimated problem in surveillance technology procurement: the lock-in effect of contract terms.

Many security services operate on long-term subscription or fixed-term contracts. When institutions sign on, they tend to focus on features and price while overlooking exit mechanisms. Once a data-use dispute arises during operations, institutions may find they have no unilateral legal grounds to cancel the contract — leaving them stuck between a rock and a hard place.

For public institutions, and especially educational ones, this lock-in means that even when public opinion, faculty, students, or administrators have lost confidence in the system, the technology may keep running, and data may keep being collected and shared.

The "lock-in effect" of surveillance technology contracts typically stems from several legal provisions: penalty clauses for early termination within a fixed service period, arrangements where equipment ownership remains with the vendor (with the client purchasing only a subscription), and contract structures that grant data processing rights to the vendor rather than the client. Public institutions often adopt these services through streamlined procurement processes that lack rigorous legal review. Academics have described this as "procurement attention deficit" — decision-makers focused on budgets and feature demonstrations tend to overlook the absence of exit clauses. Some U.S. states have begun legislating requirements for public agencies to conduct "Surveillance Impact Reports" before purchasing surveillance technology, aiming to bring contract risks into pre-purchase review. However, no unified federal standard currently exists.

The Broader Implications

Flock Safety's ALPR network has sparked sustained regulatory and ethical debate across the United States in recent years. The central tension is this: how can large-scale surveillance infrastructure deployed in the name of public safety maintain transparency around data sharing, access control, and accountability?

Elgin Community College's experience serves as a microcosm of a much larger issue. It's a reminder to any institution considering this type of technology to clarify several things before signing:

• What third parties will the data actually be shared with, including whether federal law enforcement agencies are included;
• What security standards govern data transmission and storage;
• How access permissions are defined and audited;
• And most critically — if problems arise, can the institution exit the contract, and how?

As surveillance technology becomes ever easier to deploy, "how to stop" has become a harder question to answer than "how to start." That is the core warning this case leaves for the public and for policymakers.

Conclusion

Given the limited public information currently available, the ultimate resolution of the dispute between the college and Flock, the specific legal grounds involved, and Flock's official response remain to be disclosed. But even based on what is known, this incident is sufficient to demonstrate that procuring surveillance technology is not merely a technical decision — it is a comprehensive undertaking involving data sovereignty, privacy boundaries, and contractual risk.