The Camera You Won’t Mention

This week produced two artifacts from opposite ends of the power stack. At the federal end, 404 Media obtained records showing the Securities and Exchange Commission — the agency that polices insider trading, not terrorism — bought access to a database of over a billion airline ticketing records through the Airlines Reporting Corporation, a data broker jointly owned by the airlines themselves. Delta. United. American. The company your ticket money goes to, selling the record of where that ticket took you. Domestic flights, international flights into the US, and flights between two foreign countries that never touched American soil.

At the county end, police departments started writing it down. From a Wapello County, Iowa sheriff's policy on automated license plate readers, in all caps, because subtlety was apparently not the goal: "DO NOT MENTION ALPR USAGE TO THE OCCUPANTS OF THE VEHICLE." And then, for the paper trail, with a hedge at the end doing an enormous amount of quiet work: "DO NOT MENTION ALPR USAGE IN YOUR REPORT OR COMPLAINT UNLESS ABSOLUTELY NECESSARY."

Absolutely necessary. There is no audit for that. No supervisor reviews the reports where a deputy decided it wasn't. The hedge is not a limit on the instruction — it's what lets the instruction be written down at all, because a flat prohibition would be indefensible in a courtroom and a discretionary one never has to be defended anywhere.

Different budgets, different acronyms, same instruction. I've been on this beat long enough that new surveillance capabilities barely move me. This one does, because the story isn't the capability. The capability is boring — cameras read plates, brokers sell records, that's been true for a decade. The story is that the concealment has been promoted from tradecraft to policy. It used to be something an agency did. Now it's something an agency writes into the contract and hands to a deputy on a laminated card.

i · the clause is the product

Here's the tell that makes the airline story more than another data-broker outrage cycle.

When Customs and Border Protection contracted with ARC for the same Travel Intelligence Program in June 2024, the statement of work included a provision requiring the government to "not publicly identify vendor, or its employees, individually or collectively, as the source of the Reports unless the Customer is compelled to do so by a valid court order or subpoena."

Now, the fair objection: source-non-attribution language is close to boilerplate in data-broker contracts, and it has mundane justifications. Vendors protect methods. Vendors protect competitive position. A clause is not a conspiracy, and anyone who tells you a contract term is inherently sinister is selling something too.

So apply the test. What method is being protected here? There's no algorithm in a ticketing record. There's no proprietary technique in a database of who flew where — the vendor's entire advantage is possession, and possession isn't a secret you can lose by being named. Strip out the justifications that don't apply and one asset remains: the airlines' ability to keep selling you a seat while you remain unaware that the seat is also a data product. The clause has no surviving function except suppressing the customer's knowledge of the transaction. It is a feature request, and the feature is your ignorance.

And we know it was load-bearing, because we ran the experiment. After 404 Media's reporting last year and the congressional attention that followed, ARC wound the program down. Not because a court struck it, not because a law passed — no federal law governs any of this — but because it got named. The program could survive scrutiny of its legality. It could not survive being said out loud.

That's the whole architecture in one data point. These systems are not defended by legal authority. They're defended by obscurity, and everyone building them knows it, which is why obscurity is the thing they write contracts about.

ii · a concealment clause with a tax id

But the clause is the shallow layer, and I buried the deeper one in paragraph two, so let me dig it back up.

ARC is not a third-party broker that scraped a dataset. It is owned by the airlines — a joint venture through which eight nominal competitors pool their passengers' records and sell them through an entity that no individual carrier has to answer for. This is the part to sit with: Delta never sold your itinerary. United never sold your itinerary. ARC did, and ARC is a name you had no reason to know, attached to a company you cannot boycott, sitting at a remove from every brand you actually chose.

That is a concealment clause with a tax ID. The corporate structure performs the identical function as the contract language, one layer up — it makes the seller unnameable — and it is older, quieter, and far more durable, because it isn't a secret at all. It's an org chart. You can FOIA a contract. There is nothing to FOIA about a holding structure that has been sitting in public view since the 1980s doing exactly what it was built to do.

Which reframes the clause entirely. The clause wasn't the mechanism; it was the redundant belt on top of structural suspenders — the layer thin enough to be printed, and therefore thin enough to be discovered. It got named and it died. The structure it was protecting did not, and won't.

Keep that in mind for what comes next, because it answers a question the police half of this story raises: who, exactly, is authoring all this silence.

iii · parallel construction, now in municipal beige

The police version has a name. It's called parallel construction, and it's older than most of the people being stopped by it.

In 2013, Reuters reported on internal Justice Department documents directing the DEA's Special Operations Division to systematically launder the origins of its intelligence — take a lead from a source you don't want disclosed, then build a second, presentable chain of evidence that arrives at the same arrest. The source that needed laundering, in many cases, was Hemisphere: a program running since 2007 in which AT&T gave law enforcement query access to call detail records going back to 1987, covering every call that crossed an AT&T switch whether or not you were a customer, with roughly four billion new records added daily. Hemisphere documents instructed agents never to refer to the program in official paperwork. The Electronic Frontier Foundation has been litigating around it for over a decade. Senator Wyden was still writing letters about it in 2023.

So: twenty years, three technologies, one instruction. Phone records, then travel records, then plate readers. The pipe changes. The plumbing note stays identical.

What's new in 2026 isn't the practice. It's the paperwork tier it now lives on. Parallel construction used to be a federal-agency thing — classified-adjacent, deniable, the sort of thing you learned about from a leak. It has now been compiled down and shipped to the edge. A sheriff's office in a county of thirty-five thousand people has a written ALPR policy telling deputies to describe a Flock hit as "county resources" in the report. Not a memo. Not a wink from a supervisor. A policy document, the kind that exists to be followed by people who don't ask why.

That's what normalization actually looks like from the inside. Not a dramatic expansion — a downward diffusion, until the exceptional procedure is just the standard operating procedure, and nobody in the building remembers it was ever a decision.

iv · the vendor wrote the script

There's a seam in everything I've said so far, and an honest reader will have found it by now. A federal procurement clause and a county evidence policy are different animals with different authors and different motives. One is a vendor guarding a commercial relationship. The other is an agency shaping a record that a defense attorney might one day read. Calling them "the same instruction" is a rhetorical move, and rhetorical moves should be made to show their work.

So here is the work. In August, 404 Media published a leaked Flock Safety guide that teaches police departments how to talk about Flock.

It is not a technical document. It's a communications playbook. It tells agencies to "own the narrative before someone else does" — to champion the cameras publicly before opposition organizes. It tells them to brief city managers early and meet council members before votes occur, which is to say: settle it before the part where the public is in the room. It advises against engaging the central objection head-on — "Don't avoid the concept of mass surveillance because you're not going to convince opponents that it's not" — and instead recommends reframing the budget conversation away from what the cameras cost and toward "the cost of unresolved crime." And it locates the source of resistance not in anything the technology does but in citizens failing to understand "how it works or how it is governed."

Read that alongside the ARC clause and the seam closes. These are not two agencies coincidentally arriving at the same posture. They are two ends of a single industry with a house style, and in both cases the vendor is holding the pen. Flock does not merely sell cameras to a department and let it improvise; it ships the silence as an included accessory — the policy language on one side, the council-meeting script on the other. ARC does not merely sell records to an agency; it contracts for its own invisibility as a term of sale.

The instruction is the same because the author is the same kind of party. Not the state, deciding to hide something from its citizens. A supplier, selling a state the capacity not to be asked.

v · the carve-out that gives it away

The Iowa policy contains a detail so revealing I want it framed.

Officers are told not to mention ALPR to the driver, and not to put it in the report. But if someone with standing — an attorney, in the example — asks directly, they're told to tell the truth.

Sit with the design implied by that. The people writing this policy are not asking their officers to lie. They know lying creates exposure: perjury, suppression motions, civil liability, the ugly discovery process. They've engineered around the risk with precision. The system isn't built to defeat the question. It's built so the question never gets asked.

This is the part that should worry anyone who thinks of accountability as a legal problem. Every safeguard we have — suppression hearings, discovery, FOIA, oversight boards, the entire apparatus of democratic correction — is query-driven. It activates when somebody knows enough to pull the thread. None of it fires on its own. A defense attorney has to suspect the stop was pretextual. A journalist has to know which agency to file against. A citizen has to know the camera exists to ask what it recorded.

Cut the signal that would prompt the query, and you don't have to defeat a single safeguard. You just never trigger them. The whole oversight regime sits there, fully functional, permanently at rest.

There's a systems word for this and it isn't "privacy violation." It's a severed feedback loop. Any system that adjusts to reality does so through information flowing back from what it's doing. A democracy's error-correction runs on citizens knowing what was done to them. These clauses and policies aren't stealing data — the data was already gone. They're cutting the return path. And a system with no return path doesn't get more oppressive on purpose. It just stops being able to tell that it's drifting, and neither can anyone else, until the drift is the landscape.

vi · the asymmetry has to be invisible to hold

Here is why this rises above bad policy into something worth being genuinely angry about.

A power relationship survives on how it's perceived. When a traffic stop looks like an officer noticing a broken taillight, both parties are playing a game whose rules everyone roughly agrees on — visible cause, visible consequence, contestable in a courtroom. When the actual sequence was a private company's camera network flagged your plate, a database returned a hit, and a deputy was dispatched to find a pretext — that's a different game with different rules, and only one side knows which one is being played.

The concealment isn't hiding a fact. It's maintaining a false picture of the relationship itself. You go on believing you live in a country where the state notices you when you do something noticeable. In fact you live in one where you are continuously indexed and the noticing is retroactive — the pretext gets assembled after the fact, to explain an interaction that was already decided.

Both of those are surveillance states, technically. Only one of them lets you know which one you're in, and that difference is the entire content of consent. You cannot object to a system you have been methodically prevented from perceiving. That's not a slippery slope; it's a design specification, and it is currently being met.

vii · what actually works

I'm supposed to end these weary, and I will, but the record here is annoyingly clear about one thing, so let me be precise before I go back to being sour.

ARC didn't stop selling your itineraries because of a court, a statute, or a regulator. It stopped because a small independent outlet filed public records requests, printed the contract language, and made the word ARC appear next to the word DHS in enough places that the arrangement became more expensive than it was worth. The concealment clause told us in advance that this would work. They wrote down what they were afraid of.

Which is why the SEC records — documentation of what that program was doing while it ran, surfacing only now, after the program itself is gone — matter more than the specific agency. And let me not cheat on the SEC, because there's an easy version of this paragraph that I don't get to write. The Commission has a genuinely plausible use for travel data: insider-trading cases turn on who met whom and when, and a ticketing record is real evidence of exactly that. If a securities investigator went to a magistrate with a specific target and a specific theory and came back with a subpoena, that's the system working.

That's precisely the comparison that indicts this. The SEC didn't need a theory. It didn't need a target, a showing, a predicate, or anyone's permission. It needed a purchase order. An exceptional justification is a thing that exists to be contested — it has a form, a signature, a judge, an opposing party, a docket number you can look up. Routine commercial availability has none of those, and so it cannot be argued with, only used. The alarming part was never that the SEC had no reason to want a billion travel records. It's that having a reason stopped being a requirement.

That is what infrastructure does once it exists: it stops needing a justification and starts needing only a budget line.

So here's the timer. The next generation of these contracts won't have a concealment clause, because concealment clauses turn out to be discoverable and embarrassing — and because, as the ownership structure already demonstrates, they were never the part doing the real work. They'll have a data-handling addendum with a source-attribution protocol, drafted by someone who read this cycle carefully. The Iowa policy will get rewritten by counsel into something that never uses the phrase "DO NOT MENTION" and produces exactly the same silence. Flock's next guide will not be leakable, because it will be a training video.

And the honest all-caps version — the one written by a sheriff's office that hadn't yet learned to be careful — will look, in retrospect, like the last time anybody told us the truth about how it works.

We should probably keep a copy.