Chandler didn't cancel because of a protest. It cancelled because the audit log worked.

Two weeks ago I wrote that an audit log is only as good as the person reading it, and that the plate-reader logs which caught two officers this summer were read from the outside, by the public, under records law. This is the follow-up, because August moved the story somewhere I didn't expect.

On August 7, the City of Chandler, Arizona, discontinued its 40 Flock plate readers. The trigger wasn't a council fight or a records request. Flock's own anomaly-detection tool flagged unusual search activity, the department opened a misuse probe, and the renewal came off the August 13 agenda. As far as I can find, that's the first time a city has walked away from a vendor because the vendor's accountability feature did exactly what it was built to do.

Six days later Flock announced the feature would no longer be optional. By January 1, every law enforcement customer has to run anomalous-search detection. Searches need a case number. Default retention drops from 30 days to seven. The CEO apologized publicly for the misuse cases. Critics pointed out, fairly, that enforcement still depends on the agency that gets flagged. But the shape of the thing has changed. A control that used to live in a policy manual now lives in the product.

Chandler wasn't alone by month's end. On August 27, Pflugerville, Texas cancelled its contract after a resident requested the network audit logs and found that 459 outside agencies had searched the city's data 1.6 million times in six months. The department itself had run about five thousand searches. Two cities, one month, both walked away because someone finally read the log. In Chandler the reader was the vendor's own software. In Pflugerville it was a guy with a records request.

I want to sit with that for a minute, because I think it's the most interesting design question in physical security right now, and I don't think it belongs only to Flock.

Milestone shipped something on August 12 called Selective Blur. When you export video, it masks faces and plates but leaves the rest of the frame intact, so the evidence is still evidence. Privacy used to be a paragraph in the retention policy. Now it's a checkbox on the export dialog. On August 2, the EU's AI Act transparency rules went live, and any system doing emotion recognition or biometric categorization in Europe now has to tell the people it's pointed at. Connecticut's governor paused new plate-reader installs on August 7 pending state standards. California's Senate is back with a bill that would put search logs, training requirements, and out-of-state sharing limits into statute. Even the chiefs' own association moved: on August 20 the IACP published a statement calling for tamper-resistant audit records, regular supervisory audits, and treating every plate alert as an investigative lead, not evidence.

Every one of those is the same move. Something that was a customer's choice is becoming the architecture.

Here's where I'm honestly unsure, and I'd rather ask than pretend. When a vendor makes the brakes mandatory, is that the vendor doing its job, or is that the vendor doing the city council's job?

The case for mandatory is strong. Chandler is the proof. A control that's off by default is off in most places, because most agencies are understaffed and the person who would have turned it on is also the person answering the phones. If the log had been optional in Chandler, nobody would have read it, and the officer would still be running plates. Making it part of the product means the smallest department in the state gets the same guardrail as Fairfax County, which published its whole real-time crime center scorecard on August 7 and clearly has the staff to do it.

The case against is also strong, and it's the one I heard for 21 years in briefing rooms. Seven days is the wrong number for a missing-persons case that comes in on day nine. A case-number requirement slows down the patrol officer who saw the car five minutes ago and doesn't have a report yet. A vendor in Atlanta deciding how a department in Utah handles its data is a kind of governance nobody elected. Utah's governor said on August 20 he's deeply concerned about officer misuse, and he was talking about the officers, not the vendor. The remedy for a police problem is usually a police policy, written by the people who answer to that community.

Jay Draisin, who supervised homicide cases and later built a real-time crime center, put a version of this on my last piece that I haven't been able to shake: an RTCC needs seven minutes, and evidence storage is for investigations. Different rooms, different clocks, different rules. That split does more work than most of the policy debate.

I think both of those are true at once, and the way I've started to resolve it is this. The vendor should ship the brakes. The community should set the speed limit. Retention length, sharing scope, who gets to search: those are policy, and they belong to the city. But whether a search gets logged, whether an anomaly gets flagged, whether a human has to look before the lockout lifts: those aren't policy questions. Those are whether the car has brakes at all. Nobody should have to vote on that.

One caution, because I've watched this fail from the inside. A brake with an emergency bypass and a free-text reason field is only a brake if someone reviews the bypass log. Flock's case-number requirement ships with an override for emergencies, and the Milwaukee officer convicted this year of running personal plates, 124 searches on one of them, had typed "investigation" in the reason box every time. He wasn't caught by the reason field. He was caught because one of the drivers looked up her own plate on a public audit site. The control isn't the field. The control is the person who reads what got typed into it.

What changed in August is that one company decided it agreed, and it cost them a customer to prove it. I don't think Flock is going to be the last. The next real-time crime center RFP I read is going to have a line in it that wasn't there a year ago, and it won't be about resolution or frame rate. It will be about what the system refuses to let an operator do.

If you write those RFPs, or answer them, I'd like to know where you would draw the line between brake and speed limit. I have a draft in my head and I'm fairly sure it's wrong somewhere.