Ongoing investigation

Case Updates

New evidence, contract changes, and Penn State's responses since the original investigation published in January 2026.

  1. FEB 16

    Flock rewrites contract

  2. FEB 26

    Penn State confirms cameras

  3. FEB 27

    5,773-network search logged

  4. JUL 11

    Behrend expansion reported

Expansion

Penn State expands Flock to Behrend

WJET/WFXP reports three Flock cameras around the Erie campus: two on Jordan Road and one on Knowledge Parkway.

What Penn State told WJET/WFXP

“access to the camera footage is restricted to trained and authorized university police and public safety personnel”

“campus safety is their top priority”

Source: WJET/WFXP · Jaxon Abele · July 11, 2026

What that leaves out

Penn State first described the deployment as a limited pilot. This report says the university is installing cameras on the perimeter of multiple campuses. Behrend is now a documented expansion, not a single-campus test.

The access statement describes which Penn State employees may use the system. It does not disclose the thousands of outside camera networks those employees can search, or the reciprocal network access that can expose Penn State camera data to participating agencies. The public remains locked out of records about both.

Inside the Eisenhower camera view

The interface ties plate reads to Penn State locations

These interface captures show Eisenhower-named entrances, exits, and the parking deck alongside license-plate camera views and aggregate activity figures. Plate numbers, timestamps, workstation and device identifiers, and other record-level details have been obscured for publication.

Privacy-redacted dashboard showing Eisenhower-named camera views and aggregate activity figures
Dashboard overview. Identifying details obscured; Eisenhower location labels and aggregate figures retained. This screenshot is from Penn State's previous ALPR system, not Flock.
Privacy-redacted detail of Eisenhower parking deck entrance and exit camera views
Camera-view detail with record-level text removed. This screenshot is from Penn State's previous ALPR system, not Flock.
Privacy-redacted camera tree listing Eisenhower entrances, exits, and parking deck
Camera tree with Eisenhower labels retained and device identifiers removed.

Source: Interface captures supplied by the site author · privacy-redacted for publication

Penn State's own roadmap

UPPS calls AI video analysis “Proactive Surveillance”

In a Penn State University Police and Public Safety presentation titled The next 100 years..., Physical Security describes cameras that detect, classify, and analyze behavior in real time. ALPR is one line item in a much longer wish list. Slide by slide, the deck lays out where UPPS says campus security is heading:

“AI Powered Video Analytics aka (Proactive Surveillance)”
Cameras that “detect, classify, and analyze behavior (e.g., loitering, unusual movement, crowds) in real-time.” The parenthetical is UPPS's own label, not ours.
“Advanced Biometric Access Control”
Fingerprint, facial recognition, and palm vein scanners described as “becoming standard,” with “integration with AI for anomaly detection.”
“Autonomous Robots & Drones”
Robotics and drones for automated perimeter patrol, “acting as mobile surveillance nodes.” A later robotics slide itemizes aerial drones (“drone as first responder”), EOD, tactical, patrol — and humanoid.
“Artificial Intelligence”
Three bullets: crime analysis, video analysis, and social media analysis. The deck does not say whose social media, or under what policy.
“Smart Vehicles” and “Wearables”
Police vehicles with networked location and telemetry, integrated cameras, and GPS launchers that tag fleeing cars with trackers; officers with body-worn cameras and “health and wellness tracking.”
“Real Time Crime Centers”
The convergence slide. Data sources listed: CCTV, body-worn cameras, ALPR, shot detection, alarm systems, geolocation data, and access-control systems.

The Information Technology section opens with a full-slide image of RoboCop — presented without irony. The deck closes by saying these technologies are aimed at reducing “alert fatigue,” faster incident response, and “overall operational efficiency.” Privacy appears once, in a slide about sensors that avoid capturing images. Read the whole thing:

Open the 28-slide Penn State UPPS presentation (PDF, 3.7 MB)

Source: Penn State Finance and Business · University Police and Public Safety

Confirmation

Penn State Confirms

WPSU reports what this investigation documented in January.

WPSU, February 26, 2026

Sara Thorndike, Penn State's chief financial officer, confirmed the use of the license plate readers in response to a question during a Faculty Senate meeting.

Source: WPSU · February 26, 2026

Penn State's official claims (via unnamed spokesman)

  1. The pilot is "limited in scope and duration, with no contract or cost during the testing period."

    Flock's standard model gives cameras away free during pilots. The cost starts when the pilot ends and the cameras are embedded in police workflows. The original investigation described this as the sustainability trap.

  2. "Camera locations and counts are not published for security reasons."

    The cameras are solar-powered units mounted on poles along public roads. DeFlock and this investigation have already mapped them. The "security" justification protects the deployment from public scrutiny, not from criminals.

  3. "Access is restricted to trained, authorized (University Police and Public Safety) personnel."

    Access to Penn State's cameras is restricted. Access through Penn State's cameras to thousands of other agencies' networks is not mentioned. And access by other agencies to Penn State's camera data through Flock's shared network is bidirectional.

  4. "There is no public access to (automated license plate reader) data."

    Correct. The public has no access to data about how their vehicles are being tracked. That is the problem.

Status

In January, the cameras were this site's claim. On February 26, 2026, Penn State's CFO confirmed the deployment at a Faculty Senate meeting, so the cameras are now the university's own admission. Who authorized them, and under what policy?

The contract

The Quiet Rewrite

On , Flock rewrote its standard contract. They called it a "simplification."

The claim

"Customers own and control their data. That has not changed."

Source: Flock Safety Blog · February 17, 2026

01

What counts as "Customer Data"?

§1.3
Definition

"Customer Data" meant images, audio, video, and metadata available through the Web Interface.

"For clarity, Customer Data does not include the underlying raw Footage captured by the Flock Hardware or any Flock IP."

Agencies "owned" a processed subset. Flock kept the raw footage and everything derived from it.

§1.6
Definition

"Customer Data" now means all data captured by Flock Hardware, content input by users, and data from third parties at Customer's direction.

The raw footage exclusion is gone. Everything is "Customer Data" now.

Agencies "own" a broader category. Sounds better. Read the license.

02

What can Flock do with that data?

§4.1
License grant

Flock received a license to use Customer Data to "perform all acts as may be necessary for Flock to provide the Flock Services to Customer."

§4.1
License grant

Flock now receives a license to (a) "use and disclose Customer Data to provide the Flock Services" and (b) "use Customer Data to support and improve Flock's products and services."

Dec 19, 2025Feb 16, 2026
ScopeProvide servicesProvide services + improve products
DurationNot specified as perpetualPERPETUAL
PurposeNecessary acts onlyAnything that "supports or improves"
03

What disappeared?

“Training Data” (Dec §1.17)
Removed

Was: A small fraction of images, stripped of all metadata and identifying information, used for improving Flock Services through machine learning. “Never sold or shared with third parties.”

Eliminated. Folded into “Customer Data” with the broader perpetual license. The privacy safeguards described in the old Training Data section have no equivalent in the new terms.

“Customer Generated Data” (Dec §1.4)
Removed

Was: Content submitted by Customer through Flock Services. Flock had a separate limited license and did “not claim ownership.”

Eliminated. Folded into “Customer Data.” The separate non-ownership statement is gone.

“Data Distribution” (Dec §4.4)
Removed

Was: Described how Customer could choose to share data with third-party integrations, with a separate license grant.

Eliminated as a standalone section. The mechanics of data sharing between agencies through Flock’s network are no longer described in the terms.

Read the Contract, Not the Blog Post

In December, agencies owned a narrow slice of processed data. Flock needed that data only to run the cameras. Training data had explicit privacy protections. Raw footage stayed with Flock.

In February, agencies "own" everything. Flock gets a perpetual, irrevocable license to use all of it to "support and improve" any product Flock builds. The Training Data privacy safeguards are gone. The Data Distribution mechanics are gone.

Flock handed agencies a larger bucket labeled "yours" while writing itself a permanent key to that bucket. The agencies own the label. Flock controls the data.

Sources

Flock T&C (Dec 19, 2025)Flock T&C (Feb 16, 2026)Flock Blog (Feb 17, 2026)

Source: Flock Safety terms comparison · Dec. 19, 2025 / Feb. 16, 2026