The cameras were supposed to catch criminals. Who catches the people using them?

09 · Abuse of this technology does NOT stay theoretical

Abuse of this technology does NOT stay theoretical

Safeguards can fail because of a person, because someone misuses their access, or because the system itself is set up wrong. To catch the problem, you have to be able to follow all three.

THE QUESTION ISN'T WHETHER MISUSE IS POSSIBLE. IT'S WHETHER THE SYSTEM CAN FIND IT WHEN IT HAPPENS.

PERSON, then ACCESS, then SYSTEM

9.1 Local VCSO and Southern California Examples

Start close to home. One case raises a question about what sworn personnel could access. Another involves an alleged abuse of government information and tracking. The third concerns the settings of the surveillance system itself.

9.1.1 Camarillo: “You mean my buddies? I’m a sheriff.” — The El Rey Cantina Case

PENDING CRIMINAL CASE

A serious incident involving Sheriff’s personnel. Three reported accounts—and a test of what the technology can help reconstruct.

The charges remain pending. The allegations have not been established by a criminal conviction. The Star reported that both deputies pleaded not guilty; its March 2, 2026 follow-up described the prosecution as continuing.

DOCUMENTED

ONE NIGHT. HOW MANY GOVERNMENT RECORDS?
WHAT PROSECUTORS SAY HAPPENED

The Ventura County District Attorney places the incident shortly after midnight on March 30, 2025, at El Rey Cantina in Camarillo. Off-duty Ventura County sheriff’s deputies Dylan Davis and Anthony Malagon were both arrested that night, the Star reported. [1][3]

Prosecutors say Davis and his wife argued inside El Rey. The confrontation continued outside and allegedly became physical. The bar’s security guard intervened after allegedly witnessing Davis assault his wife. [1]

Another off-duty female deputy allegedly tried to restrain Davis. Prosecutors later charged him with misdemeanor battery related to her. [1][3]

Both Davis and Malagon face felony assault charges for allegedly using force likely to cause great bodily injury. Davis additionally faces felony spousal battery and misdemeanor battery. These are the charges announced in the District Attorney’s July 16, 2025 release. [1]

WHAT THE SECURITY GUARD REPORTED

In the Ventura County Star’s reporting, the security guard said Davis’s wife slapped Davis. He said Davis then slammed her into a bench and choked her with both hands. The security guard said he intervened to tell Davis to back off. [2][3]

The security guard alleged that Davis threatened to kill him and punched him in the jaw. He said Malagon tackled him from behind, and that both deputies kicked and stomped him while he was on the ground. [2][3]

The Star reported that the security guard went to the hospital with a concussion and injuries to his jaw, head, neck and back. The District Attorney’s announcement confirms that he was taken to a hospital, treated for his injuries and later released. [2][3][1]

The security guard told the Star that he used another person’s phone to call 911 after his own was smashed. He alleged that, after he said he had called the police, Davis invoked his Sheriff’s status. [2]

“You mean my buddies? I’m a sheriff.”

Words the security guard attributed to Davis, as reported by the Ventura County Star on May 23, 2025. [2]
WHAT THE CAMERAS REPORTEDLY SAW

KTLA reported that restaurant surveillance captured portions of the events inside El Rey, including Davis reportedly pushing his wife several times. [6]

Interior footage is one part of the timeline. It does not establish every later allegation about what happened outside.

ONE NIGHT. HOW MUCH COULD THE SYSTEM REMEMBER?

Start with the actual streets: the US-101 crossing, the signal-controlled junction where Arneill Rd ends at Ventura Blvd, and El Rey’s frontage. What records could reconstruct one night in this ordinary setting?

Google Maps close-up showing Arneill Rd crossing Ventura Fwy and ending at Ventura Blvd. El Rey Cantina is south of Ventura Blvd between Elm Dr and Palm Dr; Chapel City Church is north of Ventura Blvd.
The actual junction: Arneill Rd ends at Ventura BlvdEl Rey Cantina is at 2302 Ventura Blvd, on the south side of Ventura Blvd between Elm Dr and Palm Dr, immediately beside the Arneill Rd junction.Open source image (new tab): The actual junction: Arneill Rd ends at Ventura Blvd
What this image shows—and its source limits

Arneill Rd crosses US-101 / Ventura Fwy and ends at Ventura Blvd; it does not continue through the restaurant block. Street photographs show the signal-controlled T-junction. Chapel City Church is north of Ventura Blvd; El Rey is south. This is geographic context, not a camera-coverage map.

Source: Google Maps screenshot received October 6, 2026. Imagery date is unspecified; the view displays © 2026. Labels are not a survey or a March 2025 business directory.

The actual junction: Arneill Rd ends at Ventura Blvd

Google Maps close-up showing Arneill Rd crossing Ventura Fwy and ending at Ventura Blvd. El Rey Cantina is south of Ventura Blvd between Elm Dr and Palm Dr; Chapel City Church is north of Ventura Blvd.
  • Arneill Rd: crosses US-101 / Ventura Fwy, then ends at Ventura Blvd.
  • The junction: a signal-controlled T-junction with three road approaches.
  • El Rey: 2302 Ventura Blvd, south of Ventura Blvd, in the block between Elm Dr and Palm Dr.
  • Nearby landmarks: Chapel City Church is north of Ventura Blvd; Dizdar Park is farther east, beyond Palm Dr.
Google Maps overview of Arneill Rd crossing US-101 into Old Town and terminating at Ventura Blvd, with El Rey Cantina south of the junction and Dizdar Park to the east.
The wider setting: US-101, Old Town and the El Rey blockFollow Arneill Rd across US-101 to Ventura Blvd. El Rey is south of the freeway; Dizdar Park is farther east, beyond Palm Dr.Open source image (new tab): The wider setting: US-101, Old Town and the El Rey block
What this image shows—and its source limits

The wider view locates the junction in Old Town. It does not establish a vehicle journey, plate sighting or surveillance coverage.

Source: Google Maps screenshot received October 6, 2026. Imagery date is unspecified; the view displays © 2026. Labels are not a survey or a March 2025 business directory.

The wider setting: US-101, Old Town and the El Rey block

Google Maps overview of Arneill Rd crossing US-101 into Old Town and terminating at Ventura Blvd, with El Rey Cantina south of the junction and Dizdar Park to the east.
CHECK THE MAP AGAINST THE STREET

March 2026 Street View shows the approach, junction and frontage.

March 2026 Google Street View image labeled 147 Arneill Rd, showing traffic signals and the approach toward the US-101 crossing.
01 · Arneill Rd approach toward the freeway crossingThe source identifies this view as 147 Arneill Rd. It shows the approach toward the crossing, not a verified camera installation on the bridge.Open source image (new tab): 01 · Arneill Rd approach toward the freeway crossing
What this image shows—and its source limits

Street View labels this location 147 Arneill Rd. The road rises toward the freeway crossing. Visible signals and pole-mounted fixtures do not establish equipment make, operator or ALPR function.

Source: Google Street View, imagery dated March 2026. Privacy-masked display copy; originals are available below.

01 · Arneill Rd approach toward the freeway crossing

March 2026 Google Street View image labeled 147 Arneill Rd, showing traffic signals and the approach toward the US-101 crossing.
March 2026 Street View from Arneill Rd toward Ventura Blvd: left and right turn arrows, traffic signals and the El Rey restaurant block across the T-junction. Incidental identifiers are masked.
02 · Where Arneill Rd meets Ventura BlvdLeft- and right-turn lanes face the restaurant block. Traffic signals control the T-junction.Open source image (new tab): 02 · Where Arneill Rd meets Ventura Blvd
What this image shows—and its source limits

Turn arrows, signals and restaurant frontage corroborate Arneill’s termination at Ventura Blvd. Signal heads and camera-like fixtures are not independently identified ALPR equipment.

Source: Google Street View, imagery dated March 2026. Privacy-masked display copy; originals are available below.

02 · Where Arneill Rd meets Ventura Blvd

March 2026 Street View from Arneill Rd toward Ventura Blvd: left and right turn arrows, traffic signals and the El Rey restaurant block across the T-junction. Incidental identifiers are masked.
March 2026 Street View of Ventura Blvd at the Arneill Rd junction, with traffic signals, an Arneill Rd sign, the Old Town clock and the restaurant block.
03 · Ventura Blvd and the restaurant-side streetscapeThe Arneill Rd sign, traffic signals and Old Town clock connect the street view to the mapped junction.Open source image (new tab): 03 · Ventura Blvd and the restaurant-side streetscape
What this image shows—and its source limits

The restaurant-side block, junction signals and Old Town clock provide street-level reference points for the map.

Source: Google Street View, imagery dated March 2026. Privacy-masked display copy; originals are available below.

03 · Ventura Blvd and the restaurant-side streetscape

March 2026 Street View of Ventura Blvd at the Arneill Rd junction, with traffic signals, an Arneill Rd sign, the Old Town clock and the restaurant block.
March 2026 Street View of the El Rey Cantina frontage beside the Old Town clock and streetlight poles. Incidental identifying details are masked; equipment types are unverified.
04 · El Rey frontage and the Old Town clockA closer source view links the restaurant frontage, clock and streetscape to the junction map.Open source image (new tab): 04 · El Rey frontage and the Old Town clock
What this image shows—and its source limits

El Rey’s frontage and the Old Town clock locate the venue. Nearby fixtures are not verified ALPR readers. This is a March 2026 streetscape, not an incident still.

Source: Google Street View, imagery dated March 2026. Privacy-masked display copy; originals are available below.

04 · El Rey frontage and the Old Town clock

March 2026 Street View of the El Rey Cantina frontage beside the Old Town clock and streetlight poles. Incidental identifying details are masked; equipment types are unverified.
FULL ORIGINAL SCREENSHOTS AND LABELED SUPPLEMENTAL SKETCH

The photographs above are privacy-masked display copies. Compare the originals here; the separately labeled AI-assisted sketch is a reading aid, not evidence.

ORIGINAL SOURCE IMAGE
Google Maps showing Arneill Road crossing US-101 and terminating at Ventura Boulevard, with El Rey Cantina immediately across the junction.
DOCUMENTEDOriginal map: the junction and El ReyArneill Rd ends at Ventura Blvd, beside the El Rey block.Open source image (new tab): Original map: the junction and El Rey
What this image shows—and its source limits

Original location reference, not evidence of camera coverage or incident capture.

Source: Google Maps original.

Original map: the junction and El Rey

Google Maps showing Arneill Road crossing US-101 and terminating at Ventura Boulevard, with El Rey Cantina immediately across the junction.
Download original file (el-rey-junction-map.png)
GENERATED SUPPLEMENT - NOT EVIDENCE
AI-assisted generative sketch, not a survey or camera-location map: Arneill Road crosses over US-101 on an overpass and ends at a signal-controlled T-junction with Ventura Boulevard. El Rey Cantina sits just below Ventura Boulevard. No cameras or vehicles are drawn.
ANALYSISAI-assisted sketch — not evidenceA simplified drawing that follows the original map: US-101, the Arneill Road overpass, Ventura Boulevard and El Rey.Open source image (new tab): AI-assisted sketch — not evidence
What this image shows—and its source limits

Drawn with AI assistance from the junction screenshot, in the same orientation. It shows only roads, the signal-controlled T-junction and the venue address. It is not a survey.

Source: AI-assisted representation based on Google Maps.

AI-assisted sketch — not evidence

AI-assisted generative sketch, not a survey or camera-location map: Arneill Road crosses over US-101 on an overpass and ends at a signal-controlled T-junction with Ventura Boulevard. El Rey Cantina sits just below Ventura Boulevard. No cameras or vehicles are drawn.

Read this first. AI-ASSISTED GENERATIVE REPRESENTATION — NOT A SURVEY OR CAMERA-LOCATION MAP. This sketch simplifies the map. Check minor discrepancies against Google Maps and the originals; no camera placements, incident sightings or vehicle route are asserted.

Check the location on Google Maps (new tab) · Download generated sketch (SVG)

MORE ORIGINALS: WIDER MAP AND SIX STREET VIEWS

These Google Street View screenshots are dated March 2026, after the March 30, 2025 incident. They provide location and streetscape context, not proof of what hardware was installed or operating on the incident date. Visible devices have not been independently identified as ALPR readers.

Google Maps showing US-101, Arneill Road, Ventura Boulevard and El Rey Cantina in Camarillo.
DOCUMENTEDOriginal map: the wider locationThe wider area around US-101, Arneill Road and Ventura Boulevard.Open source image (new tab): Original map: the wider location
What this image shows—and its source limits

Original location reference, not evidence of camera coverage or incident capture.

Source: Google Maps original.

Original map: the wider location

Google Maps showing US-101, Arneill Road, Ventura Boulevard and El Rey Cantina in Camarillo.
Download original file (el-rey-area-map.png)
March 2026 Google Street View screenshot labeled 147 Arneill Road, showing the roadway, traffic signals and an approach toward the overpass.
DOCUMENTEDArneill Road — 147 Arneill Rd viewMarch 2026 street-level context, after the 2025 incident.Open source image (new tab): Arneill Road — 147 Arneill Rd view
What this image shows—and its source limits

Original location reference, not evidence of camera coverage or incident capture.

Source: Google Street View original, March 2026.

Arneill Road — 147 Arneill Rd view

March 2026 Google Street View screenshot labeled 147 Arneill Road, showing the roadway, traffic signals and an approach toward the overpass.
Download original file (arneill-road-reference.png)
March 2026 Google Street View screenshot showing the El Rey frontage, clock, roadway and traffic signals at the Arneill Road junction.
DOCUMENTEDVentura Boulevard — the junctionMarch 2026 street-level context, after the 2025 incident.Open source image (new tab): Ventura Boulevard — the junction
What this image shows—and its source limits

Original location reference, not evidence of camera coverage or incident capture.

Source: Google Street View original, March 2026.

Ventura Boulevard — the junction

March 2026 Google Street View screenshot showing the El Rey frontage, clock, roadway and traffic signals at the Arneill Road junction.
Download original file (el-rey-junction-reference.png)
March 2026 Google Street View screenshot showing the Ventura Boulevard frontage and signal-controlled junction from another direction.
DOCUMENTEDVentura Boulevard — opposite viewing directionMarch 2026 street-level context, after the 2025 incident.Open source image (new tab): Ventura Boulevard — opposite viewing direction
What this image shows—and its source limits

Original location reference, not evidence of camera coverage or incident capture.

Source: Google Street View original, March 2026.

Ventura Boulevard — opposite viewing direction

March 2026 Google Street View screenshot showing the Ventura Boulevard frontage and signal-controlled junction from another direction.
Download original file (ventura-boulevard-reference.png)
March 2026 Google Street View screenshot showing the El Rey frontage and nearby lamp posts and road signs; equipment function is not established.
DOCUMENTEDEl Rey — frontage detailMarch 2026 street-level context, after the 2025 incident.Open source image (new tab): El Rey — frontage detail
What this image shows—and its source limits

Original location reference, not evidence of camera coverage or incident capture.

Source: Google Street View original, March 2026.

El Rey — frontage detail

March 2026 Google Street View screenshot showing the El Rey frontage and nearby lamp posts and road signs; equipment function is not established.
Download original file (el-rey-frontage-reference.png)
March 2026 Google Street View screenshot showing the venue corner, roadway and traffic-signal arms.
DOCUMENTEDEl Rey — corner and roadwayMarch 2026 street-level context, after the 2025 incident.Open source image (new tab): El Rey — corner and roadway
What this image shows—and its source limits

Original location reference, not evidence of camera coverage or incident capture.

Source: Google Street View original, March 2026.

El Rey — corner and roadway

March 2026 Google Street View screenshot showing the venue corner, roadway and traffic-signal arms.
Download original file (el-rey-corner-reference.png)
March 2026 Google Street View screenshot from Arneill Road toward its signal-controlled T-junction with Ventura Boulevard and the El Rey frontage beyond.
DOCUMENTEDArneill Road — where the road endsMarch 2026 street-level context, after the 2025 incident.Open source image (new tab): Arneill Road — where the road ends
What this image shows—and its source limits

Original location reference, not evidence of camera coverage or incident capture.

Source: Google Street View original, March 2026.

Arneill Road — where the road ends

March 2026 Google Street View screenshot from Arneill Road toward its signal-controlled T-junction with Ventura Boulevard and the El Rey frontage beyond.
Download original file (arneill-terminus-reference.png)
PHOTOGRAPHED HERE
The street setting and visible fixtures are shown in March 2026 imagery. ALPR function and map markers remain unverified. A photograph does not establish that a relevant vehicle was captured.
REPORTED HERE
Supported event/location. Reporting does not establish every allegation.
COULD HELP RECONSTRUCT
Possible system/capability; applicability not established. This does not establish that Fusus was used or an official vehicle was involved.

Walk through how one night could leave records across multiple systems.

EXPAND THE RECONSTRUCTION · 4 MIN READ
1 START WITH AN ORDINARY DRIVE

Cross US-101 on Arneill Rd toward Old Town. The bridge brings you to the signal-controlled T-junction at Ventura Blvd, where Arneill ends. El Rey Cantina, at 2302 Ventura Blvd, is on the south side of Ventura Blvd, between Elm Dr and Palm Dr.

Street geography and surveillance coverage are separate questions. Identifying a device still would not prove it recorded a particular vehicle or operated on the incident night.

A plate reading can connect a vehicle to a location and a time. If multiple readers recorded the same vehicle, those records could form a timeline. Whether such readings exist here is a question for the records.

vehicle, then location, then time

2 THEN THE VEHICLE STOPS

People leave their cars. Potential evidence expands beyond plate readers: restaurant and nearby cameras, 911 calls, dispatch and radio traffic, responding deputies’ records, body-worn cameras, and investigative or digital evidence.

Fusus matters conceptually because connected systems can bring separate information together. That capability is not evidence that Fusus was used in this incident.

Restaurant surveillance reportedly captured part of the El Rey incident. That is one reported source of evidence, not proof that every nearby system captured it. [6]

3 THEN 911 IS CALLED

The security guard told the Star that he called 911 using another person’s phone after his own was smashed. That account raises specific questions about the call and the response. [2]

  • When was the call received, and what was reported?
  • When was it dispatched, which units were sent, and when did they arrive?
  • What records did the responders make, and what did Major Crimes collect?

One physical event can now exist as fragments across numerous information systems.

4 NOW LOOK BEYOND EL REY

The wider reconstruction asks about ALPR infrastructure elsewhere on Camarillo’s roads. Each proposed installation needs location-linked evidence identifying the hardware and its operation. The map alone cannot establish coverage.

The question shifts from “Did one camera see a vehicle?” to “How much of a vehicle’s journey could the network reconstruct?” This is a possible sequence to test against records, not a route or a claim that these sightings occurred.

earlier location, then approach, then arrival, then departure, then later location

That is the difference between a camera and a network.

5 NOW TURN THE SYSTEM AROUND

These systems are justified partly as ways to reconstruct public activity. Test that capability here instead of guessing what happened.

  • How did everyone arrive, and what vehicles were involved?
  • What were the arrival and departure times?
  • What did restaurant cameras, 911 and dispatch, responders, and Major Crimes record or collect?
  • What was preserved?

Official government vehicle involvement is not established. Only if independent evidence later establishes that an official vehicle was involved should these additional questions be asked:

  • Which vehicle, who operated it, and what was the operator’s duty status?
  • Which systems were actually installed in or associated with that vehicle?
  • For those established systems, what records were generated, collected and preserved?

We do not need to guess the answers. That is the point of having records.

6 AND THEN ASK WHO COULD ACCESS THE SYSTEM

We presently have no evidence that Davis or Malagon improperly accessed ALPR, Flock, Fusus, Axon, ECOM or other surveillance systems in connection with this incident. Access and relevant use must be established from records, not inferred from their employment.

  • Who had access, and to which systems?
  • Were relevant people or vehicles searched? When, and for what reason?
  • What information was returned, and who reviewed the activity?

If nothing was searched, show that.

If they couldn’t access the system, show that.

An audit trail capable of exposing misuse should also be capable of clearing someone when misuse did not occur.

7 LOOK AT THE MAP AGAIN

A freeway.

A bridge.

A signal-controlled T-junction.

A restaurant.

Cars going somewhere completely ordinary.

And the question of which surveillance systems could have created relevant records.

The maps and photographs establish the street setting. The records must establish which systems operated, what they captured and who could access them.

The public lives in this ordinary environment. If surveillance systems can reconstruct our activity here, accountability should run both directions: show what relevant records exist, what they establish, and who could access them.

DON’T ASK US TO TRUST THE NETWORK.

SHOW US WHAT THE NETWORK REMEMBERS.

A) SURVEILLANCE AS EVIDENCE

What can the surveillance and digital-evidence systems establish about the event?

A serious incident occurred involving multiple Sheriff’s personnel. Contemporary surveillance reportedly captured part of it. Government investigative records reconstructed another part. If additional government technology recorded relevant events, preserve it, identify it and account for it. [1][6]

The question is what relevant records can establish—not an assumption that any particular system captured the incident.

  • What surveillance footage was collected and preserved?
  • What does it establish about arrival, departure and the timeline?
  • What 911 recordings and call records exist?
  • What do the responding officers’ and investigators’ records establish?
  • What other relevant government-generated digital records did Major Crimes identify?
  • Were potentially relevant records preserved?
B) SURVEILLANCE AS POWER

What parts of the surveillance and investigative systems could the involved sworn personnel themselves access?

We currently have no evidence that Davis or Malagon used ALPR, Flock, Fusus, Axon or ECOM in connection with this incident.

“No access” or “access but no relevant use” are meaningful, exculpatory answers—answers that can clear someone of a concern. A complete audit trail should be able to establish them, or show that a relevant search had a legitimate reason.

  • Which sensitive systems could each deputy access?
  • When did that access begin and end?
  • Did either search any person or vehicle connected to the incident?
  • What reasons were entered?
  • What information was returned?
  • Who reviewed the activity?
HOW DID EVERYONE GET THERE?

Arrival and transportation may be reconstructable through independent evidence. What do the restaurant’s cameras and exterior surveillance show about how people arrived, who traveled together and when they left?

Only if independent evidence establishes that an official vehicle was involved should investigators follow the vehicle-specific questions below. First establish its identity and actual equipment; do not assume a vehicle or its records exist.

  • Which official vehicle was it?
  • Who operated it, and what was that person’s duty status?
  • What systems were actually installed in or associated with that vehicle?
  • For systems established to be installed or associated, what relevant records were generated and preserved? That may mean asking about GPS or automated vehicle-location (AVL) records, an in-car computer (MDT), Axon or ALPR—only where the vehicle’s configuration supports the question.
  • Did Major Crimes obtain those relevant records?
ONE INCIDENT CAN LEAVE A LOT OF DIGITAL FOOTPRINTS

Which of these records exist for the incident, who holds them and how long are they kept? These are places to look, not a claim that every record was created or has been provided.

  • Restaurant surveillance video and its original timestamps.
  • The 911 call, call records and dispatch records.
  • Records made by responding officers and investigators.
  • Major Crimes investigation records.
  • Arrest and booking records.
  • Administrative and internal-affairs investigation records.
  • Court filings and hearing records.
  • POST certification actions.
  • Authenticated government-system logs, if applicable: accounts, access dates, searches, reasons, returned information and review.
THE INVESTIGATION AND ADMINISTRATIVE RESPONSE

VCSO’s Major Crimes Unit investigated the incident. The Star reported that both deputies were placed on leave and that the California Commission on Peace Officer Standards and Training (POST) suspended their peace-officer certifications. Its March 2, 2026 follow-up reported that the suspensions and paid leave continued while the case proceeded. [1][3][5]

An internal-affairs investigation was also reported. These processes leave records of their own: what investigators examined, what administrative action followed and when it happened. [4]

THE CIVIL CLAIM AND THE COUNTY’S RESPONSE

The security guard filed a government claim for damages in April 2025. The Star reported on October 26, 2025 that the County paid $440,000 in July to settle the claim before it went to court, citing records obtained from the County. The County continued to deny and dispute the allegations. A settlement is not an admission. [4]

VCSO demonstrated that it can investigate its own. Its Major Crimes Unit investigated this incident. Prosecutors filed charges. Administrative processes followed. [1][3]

WE'RE ASKING FOR THE SAME SERIOUSNESS WHEN THE EVIDENCE LIVES INSIDE A SURVEILLANCE SYSTEM.

This is not asking VCSO to prove every employee is good. It is asking whether the system can establish what happened when access becomes relevant. The same seriousness should apply to a preserved recording, an account history, a search or a record of what someone saw.

BECAUSE ‘WE FOUND NO MISUSE’ ONLY MEANS SOMETHING IF THE SYSTEM IS CAPABLE OF FINDING IT.
Sources and what each covers
  1. Ventura County District Attorney · July 16, 2025 · charges and investigation (PDF) (opens in new tab)

    Official charging announcement, account of the alleged confrontation, hospital treatment and Major Crimes investigation. A charging document is not a conviction.

  2. Ventura County Star · May 23, 2025 · the security guard’s account (opens in new tab)

    Reported allegations, injuries, the 911 call and the short quotation about Sheriff’s status. The call recording itself was not reviewed here.

  3. Ventura County Star · July 16, 2025 · charges and certification suspensions (opens in new tab)

    Charging chronology, reported injuries, leave and suspended California peace-officer certifications.

  4. Ventura County Star · October 26, 2025 · $440,000 settlement (opens in new tab)

    Reports the government claim, the July settlement, the County’s continuing denial, not-guilty pleas and the internal-affairs investigation. The article cites County records; the underlying settlement agreement is not available here.

  5. Ventura County Star · March 2, 2026 · case follow-up (opens in new tab)

    Reports the prosecution continuing, not-guilty pleas, paid leave and continuing certification suspensions. No later disposition is established by the sources reviewed here.

  6. KTLA · May 27–28, 2025 · restaurant surveillance video (opens in new tab)

    Reports on interior restaurant video. No original video is hosted here, and the described interior footage is not treated as a complete recording of events outside.

9.1.2 Bell — Government access becomes personal

PENDING CRIMINAL CASE

Bell, Los Angeles County, California—not Ventura County. Prosecutors allege government information and a GPS tracker were used for personal reasons.

This is a pending criminal case, not a conviction. The allegations below are those announced by the Los Angeles County District Attorney on August 3, 2026.

DOCUMENTED

He didn't need Flock. He allegedly had access.

Government database, then Personal relationship, then Physical location tracking

On August 3, 2026, the Los Angeles County District Attorney announced charges against Bell Police Officer James Ixcoy. Prosecutors allege that on July 17, 2025 he ran an unauthorized California DMV registration inquiry on a car belonging to a man who had also dated his ex-girlfriend. [1]

They also allege that on August 18, 2025 he placed a GPS tracking device on his former girlfriend’s vehicle. The device was later found, according to the announcement. [1]

The charges are one felony count of accessing and using computer data without permission and one misdemeanor count of unlawful use of an electronic tracking device. The announcement says Bell Gardens Police Department was investigating the case. [1]

The technology is different. The control problem is the same.

This is why ‘authorized user’ is not the same thing as ‘authorized use.’

An account can belong to a police officer. That does not make every personal reason for using it a lawful investigation.

Camarillo asks whether the deputies could access sensitive location systems. In Bell, prosecutors allege that an officer abused government information and tracking involving an ex-partner. That is why the first question isn’t paranoid. It is an accountability question.

What reason was recorded for a lookup? Would a reviewer have noticed a personal connection? Was the device’s use approved? What records could show the answer—and what would alert someone that something was wrong?

How was it discovered?

The District Attorney’s announcement says the tracking device was later found and that Bell Gardens Police Department was investigating. It does not explain who found the device, how the DMV inquiry was uncovered or whether an audit first detected either alleged act. [1]

The public record reviewed here does not yet establish the complete detection path.

Sources and what each covers
  1. Los Angeles County District Attorney · August 3, 2026 · James Ixcoy charging announcement (opens in new tab)

    Primary source for the July 17, 2025 DMV inquiry allegation, the August 18, 2025 GPS allegation, charges and investigating agency. The DMV inquiry concerned a man who had dated the ex-girlfriend; the GPS allegation concerned her vehicle. The announcement schedules an October 2 arraignment but does not establish its outcome or a complete detection path.

9.1.3 Ventura County — Nobody has to go rogue

SYSTEM / GOVERNANCE

The local Flock issue is a settings-and-oversight example—not a case alleging officer misconduct.

This example concerns the system and its rules. The statements about the cause, investigation and restrictions below are VCSO’s account, not an independently reconstructed change history.

VCSO SAYS

Nobody has to go rogue for a safeguard to fail.
Data became searchable beyond California

VCSO’s February 27, 2026 notice says that from February 19 through March 19, 2025, local Flock ALPR data became searchable by out-of-state and federal law-enforcement agencies without the agency’s knowledge or approval. The later Camarillo account called the period a “data searching issue” and described availability for approximately one month. [1][2]

VCSO said its internal investigation determined that nobody from the agency activated the national lookup feature. Its notice also said Flock could not identify the specific cause because of limitations in technical logging. [1]

The notice described a possible agency administrator action, a Flock employee action or a software bug; VCSO said it ruled out the first through its internal investigation. Those possible explanations are not a demonstrated cause. [1]

VCSO said that on or about March 19, 2025, Flock removed California agencies’ ability to activate national lookup. The notice described later restrictions and enhanced audits. Reporting of the August 26, 2026 Camarillo update also described current sharing as limited to 58 California agencies, with no federal or out-of-state agencies. [1][3]

Being able to search the data and actually receiving a plate image or other information are different questions. VCSO’s notice said it did not know whether out-of-state or federal agencies received images or information captured by its readers. [1]

What changed—and how would anyone know?

If a safeguard depends on a setting, residents need a record of that setting—not just an account of what users were supposed to do.

  • Who or what changed the setting, and when?
  • Was it a vendor action, a default, a software change, an administrator action or an inherited setting?
  • Who could see the change? Which records would show it?
  • Who discovered the problem, and how?
  • Which data became available? Who searched it, and what information came back?
  • When was access closed? Which records confirm that?
  • What prevents the same thing from happening again—and how is that protection checked?
Auditing people isn't enough. You have to audit the system too.

Check the users and their reasons. Also check the settings, outside access, software changes and whether the records can show what happened. The agency’s own account raises both kinds of oversight question.

Sources and what each covers
  1. VCSO · February 27, 2026 · Flock ALPR and data-security notice (opens in new tab)

    Existing site citation. Agency account of the February 19–March 19, 2025 availability, its internal investigation, limited technical logging, possible explanations, later restrictions and unknown returned information.

  2. Existing Praeva Analytics source receipt · Camarillo acknowledgment and records still needed

    Existing site source note for the “data searching issue” wording and approximate one-month representation. The original presentation, slides and audit workpapers are not included.

  3. VC Reporter · August 26, 2026 Camarillo update · current-sharing representation (opens in new tab)

    Existing site citation for the reported 58-California-agency limit and no current federal or out-of-state sharing. A statement about current settings is not a complete history of prior access.

PERSON, then ACCESS, then SYSTEM

THREE DIFFERENT PROBLEMS. ONE ACCOUNTABILITY QUESTION.

HOW WOULD VCSO CATCH THIS?

Camarillo
Can access to sensitive systems be reconstructed when sworn personnel face grave allegations?
Bell
The risk of government access being used for personal reasons is not hypothetical. Prosecutors have brought a case alleging it.
Ventura County
Settings and oversight can allow data to cross boundaries without a rogue-user explanation.

National examples

9.2 When the Search Becomes Personal

These cases occurred outside Ventura County. They do not establish misconduct by VCSO. They show why searchable location histories require independently verifiable access controls and oversight.

9.2.1 Indianapolis, Indiana · September 2026

He kept showing up. The searches may explain why.

CHARGES / ALLEGATIONS — NOT CONVICTIONS

A gym. A store. A school function where a woman’s daughter was present. WTHR’s account of a probable-cause affidavit describes women reporting encounters with Indianapolis Metropolitan Police Department officer Jonathan Schultz that turned ordinary routines into an unsettling question: how did he know where to appear?

According to that reporting, Schultz allegedly made 1,396 Flock searches of 11 women’s license plates from August 2023 through August 2026, including plates associated with former or current romantic interests. The reported encounters and searches are allegations—not a finding that every encounter resulted from an ALPR query.

In September 2026, Schultz was charged with 12 counts of official misconduct, 12 counts of fraud and two counts of stalking. Five current or former IMPD officers were charged in the broader investigation.

The detection story matters too. IMPD’s official September 23 statement says internal audits in August and September 2026 identified potential misuse. The department revoked ALPR access and initiated administrative and criminal investigations. This was not misuse that could never be audited: auditing helped uncover it.

“The allegation is that the officers were searching or running the license plate information and tracking individuals through the Flock system.”

Marion County Prosecutor Ryan Mears, quoted by WTHR.
A policy tied to a reason

IMPD says its August 2026 policy requires a case or incident number and a NIBRS offense code for every search. It also reports stronger auditing and single sign-on to reduce credential-sharing risks.

A review someone else can check

Which records connect the user, search, case, purpose and review? Could an independent reviewer reproduce the department’s detection of improper access?

Evidence and case status
Charges and case status
The charges and search allegations are reported by WTHR. The probable-cause affidavit was described by that outlet, not independently inspected for this section. The supplied sources do not establish convictions or a final adjudication.
Investigative findings
IMPD’s official release confirms internal audits, access revocation and administrative and criminal investigations. These are agency representations of the detection and response, not a claim that independent review has validated every audit finding.
Vendor and search-scope interpretation
WTHR identifies Flock. No separate vendor response is supplied here. The alleged 1,396 searches of 11 women’s plates are query counts and a reported plate population—not a count of successful matches, sightings or proven tracking encounters.
Public log availability
These sources describe audit activity and affidavit allegations; they do not provide a complete public query-log dataset. That does not establish that the logs are unavailable or do not exist.
Warrant status
The supplied sources do not establish warrant or court-authorization status for each ALPR query. Unknown warrant status is not proof that no warrant existed.

9.2.2 Braselton, Georgia · November 19, 2025

What happens when the person accused of stalking is the police chief?

GBI INVESTIGATION / CHARGES

The person at the top of a department can also be the person whose access needs scrutiny. On November 19, 2025, the Georgia Bureau of Investigation announced that Braselton Police Chief Michael Steffman had been arrested and charged with violation of oath by a public officer, stalking, harassing communications and multiple counts of misuse of automated license plate recognition systems.

The Jackson County Sheriff’s Office requested the external GBI investigation. After a multi-month investigation, GBI said Steffman had misused ALPR systems “to harass and stalk multiple individuals.” That is an attributed investigative finding accompanying charges—not an adjudicated conviction.

An external investigation did occur. The oversight question is therefore not whether outside review was possible, but who independently reviews surveillance access before a complaint or an outside investigation becomes necessary.

“to harass and stalk multiple individuals.”

GBI’s description of the alleged ALPR misuse in its November 19, 2025 announcement.
Who reviews the chief?

A department leader’s authority does not remove the need for review of that leader’s searches, purposes and access.

Outside investigation is not routine oversight

The sheriff’s request and GBI investigation show an external path existed. What independent checks operate before allegations trigger that path?

Evidence and case status
Charges and investigative findings
GBI is the primary source for the arrest, listed charges and its stated investigation findings. The announcement says the case file would be provided to the Piedmont Judicial Circuit for prosecution. It does not establish a conviction.
Later case-status reporting
On April 24, 2026, FOX 5 reported that Steffman had been found dead, citing a source. GBI confirmed a death investigation, but authorities had not officially identified the deceased in that article. The supplied reporting does not establish an adjudicated conviction, the cause of death or the final disposition of the criminal case.
Vendor and search scope
GBI’s release does not identify the ALPR vendor, search volume, geographic reach, lookback periods or successful matches. Do not substitute Flock or infer those quantities.
Public log availability
The supplied sources do not establish whether query logs are publicly available. Absence of a public dataset in these sources is not proof that no audit trail exists.
Warrant status
The release and later reporting do not establish warrant or court-authorization status for the individual ALPR searches.

9.2.3 Johnson County, Texas · May 9, 2025 searches · October 7, 2025 EFF reporting

She had an abortion. Investigators searched a nationwide camera network.

PUBLIC-RECORDS REPORTING / DISPUTED CHARACTERIZATION

The reason recorded for two May 9, 2025 Flock searches was explicit: “had an abortion, search for female”. According to EFF’s account of the search logs, the first query covered 17,684 cameras across 1,295 networks with a seven-day lookback. The second widened to 83,345 cameras across 6,809 networks and a month of data.

Cameras in reported search scope
83,345
Networks in reported search scope
6,809
Reported second-query search scope: cameras across networks, with a one-month lookback. These figures are not actual sightings, matches or cameras that observed the person. Source: EFF’s account of Flock search logs.

The numbers describe the reported scope of the queries—not how many cameras saw the woman or her vehicle. The distinction matters: an enormous search boundary is not evidence of an enormous number of actual sightings.

EFF’s October 7, 2025 report says an incident report and sworn affidavit describe a death investigation involving a nonviable fetus, collection of evidence, consultation with prosecutors about potential charges and later examination of text messages. According to those records as reported by EFF, prosecutors advised that the woman could not be charged for taking medication to cause the abortion or miscarriage.

Flock and the sheriff disputed the characterization, saying the woman was sought for welfare or missing-person purposes. EFF argues that the underlying records conflict with that explanation. This section presents that dispute with attribution; it does not assert a judicial finding that the searches were illegal.

“She was being searched for as a missing person, not as a suspect of a crime.”

Flock Safety’s response, describing the sheriff’s account.
The recorded reason

“had an abortion, search for female” — the exact reason reported for both queries. A reason field makes a purpose review possible; it does not by itself prove a search was justified.

The explanation and the records

Flock describes a missing-person search. EFF interprets the incident report and affidavit as an abortion-related death investigation. Independent review requires the records—not simply choosing one account.

Evidence and case status
Records and investigative context
EFF reports obtaining search logs, an incident report and a sworn affidavit. Its reporting describes a death investigation involving a nonviable fetus, evidence collection, prosecutor consultation and review of texts. These documents were reported by EFF, not independently authenticated for this section.
Recorded query scope
May 9, 2025: first query — 17,684 cameras, 1,295 networks, seven days; second query — 83,345 cameras, 6,809 networks, one month. Both reportedly used the reason “had an abortion, search for female”. These are reported query boundaries, not counts of detections, successful returns or unique people tracked.
Vendor statements and disputed interpretation
Flock’s statement says the woman was sought as a missing person, not a crime suspect. The sheriff also described a welfare purpose. EFF argues the underlying records conflict with that explanation. Attribute both accounts; the supplied sources do not establish a judicial finding of illegality.
Charges and case status
EFF reports prosecutors advised the woman could not be charged for taking abortion medication. Flock says no charges were filed against her. This account is not a conviction or an adjudication of the legality of the ALPR searches.
Public log availability
EFF publishes reporting and record excerpts and says it obtained the relevant logs. That is not a complete nationwide query-log dataset or proof that every requested record is publicly available.
Warrant status
The supplied accounts do not establish warrant or court-authorization status for these specific ALPR queries. The existence of a sworn affidavit does not itself establish a warrant authorizing the searches.

These cases did not happen in Ventura County. They demonstrate why independent oversight matters here. The question is not whether every person with access will misuse it. The question is whether the public can verify that access is justified, properly limited, and independently reviewed—and whether misuse can be discovered when safeguards fail.

What would Ventura County’s records allow an independent reviewer to discover—and what might remain invisible?

9.3 — International examples

No international examples are included in this release.

Back to all example groups ↑

Supporting Materials

Want to check the work? Please do.

Check the work for yourself. The report, methods, legal sources, charts and details about the data are here when you want them.

Available materials vs. originals. Included here: charts, data files, the Civic Review Packet and collected legal sources prepared for this review. The packet explains specific findings page by page. The original Flock/Axon audit files, Camarillo presentation and records-request correspondence are not included.

ANALYSIS

The actual report

Praeva Analytics ALPR Audit Records Civic Review Packet · 33 pages · September 2026

Read the complete report alongside its charts. This packet contains the analysis prepared for the review, not the agency’s original audit files, response letters or presentation.

Read the report (PDF)Download the reportPage-specific report receipts

How we checked—and where to check for yourselfMethods, source receipts, legal cross-checks and records still needed.

Legal and policy source receipts

Source notes record verification against official California Legislative Information on October 4, 2026:

  • Civil Code §1798.90.51 — operator policy must address collection, use, maintenance, sharing and dissemination; authorized roles and training; monitoring; sharing and transfer; custodian or owner; retention and destruction process.
  • Civil Code §1798.90.52 — access record includes date/time, query elements, username/organization, and purpose; access limited to authorized purposes.
  • Civil Code §1798.90.53 — end-user policy includes monitoring and a process for periodic system audits, plus sharing/transfer, custodian/owner, retention/destruction.
  • Gov. Code §7922.525(b) — reasonably segregable portions available after exempt portions deleted.
  • Gov. Code §7922.530 — identifiable nonexempt records promptly available; not a fixed final-production deadline.
  • Gov. Code §7922.535 — 10-day determination/notice rule; written unusual-circumstances extension subject to statutory limits.
  • Gov. Code §7922.540 — written partial/complete denial; names/titles of persons responsible; withholding must be justified.
  • Gov. Code §7922.600 — duty to assist includes identifying responsive records, describing IT/physical location, and suggestions to overcome practical access barriers.

Project-produced-source cross-checks:

  • VCSO Policy 429: department-approved training; five-year server retention with exceptions; regular audits; inter-agency agreement/access controls.
  • Flock order form: `Retention Period: 365 Days`; extended retention up to one year.

A duty to maintain records or adopt a policy, a duty to disclose records under the California Public Records Act (CPRA), and evidence of actual compliance are three different questions.

Source routes checked

Original materials referenced by the investigation but not available here include the redacted Axon audit trail, records-request and deficiency correspondence, and Moorpark City Manager correspondence. Public receipts must protect requester-identifying information.

Original charts and a closer look at the evidenceOriginal report charts, comparison methods and the full-size image index.

The original report graphics are all here, with their labels, explanations, sources and full-size views. The image index below also includes the deeper analysis.

Out-of-state data: all state totals, methods and source limits

ANALYSISMatching organization names to likely states

Texas. Florida. Ohio. The interstate context matters.

The examined profile contains 53,277 Texas-associated entries, 26,810 Florida-associated entries, 20,275 Ohio-associated entries and 47,312 Georgia-associated entries. States are assigned from the organization names in the files. The separate organization profile adds frequency, persistence and requested-window context.

The daily evidence identifies an aggregate other-state surge. The state map compares audit-label populations by candidate-associated geography.

Verifying each state’s trend over time requires the underlying name-to-state classifications and dated entries, using the same periods and totals as the report.

State profile and broader map: source limits

The original map remains intact as an analytical receipt. The controlled supplemental profile includes 20,275 Ohio-associated audit observation rows.

Source status and remaining receipts. The totals are transcribed from the report, not independently recalculated from original exports.

All eleven state totals in the out-of-state data examined here

  • Texas: 53,277 entries in the data
  • Georgia: 47,312 entries in the data
  • Illinois: 30,035 entries in the data
  • Florida: 26,810 entries in the data
  • Ohio: 20,275 entries in the data
  • Indiana: 20,070 entries in the data
  • Virginia: 14,569 entries in the data
  • Michigan: 12,140 entries in the data
  • North Carolina: 11,663 entries in the data
  • Missouri: 11,642 entries in the data
  • Tennessee: 11,397 entries in the data

Original state map · Organization profile · Original supplemental device-hours analysis (new tab) · Return to Chapter 03

Which states are associated with the organizations in the data?
Map grouping entries by the likely state of the organization named. California appears most often; Texas, Georgia and Florida stand out outside California. The legend groups states by number of entries.
ANALYSISWhich states are associated with the organizations in the data?California appears most often. Texas, Georgia and Florida stand out among names associated with other states.Open original image (new tab): Which states are associated with the organizations in the data?
What this chart means—and how it was made

This original map classifies primary-period-eligible Network Audit rows by candidate-associated state. It compares populations rather than trends over time. The February–March surge appears separately in the daily-regime graphic. Unknown or multi-state labels remain separate.

Source: Praeva Analytics candidate-state map; totals are transcribed from the analytical report, not independently recalculated. Original name-to-state classifications and dated state-level tables are not available here.

Which states are associated with the organizations in the data?

Map grouping entries by the likely state of the organization named. California appears most often; Texas, Georgia and Florida stand out outside California. The legend groups states by number of entries.
How often did these names appear, for how long, and how far back did searches look?
Ranking of selected organization names outside California by how often they appear, led by Texas-associated names, with Georgia and Florida also represented. Other panels compare how far back searches looked and flag names for further review.
ANALYSISHow often did these names appear, for how long, and how far back did searches look?Texas-associated names appear prominently in this ranking. Georgia and Florida names also appear.Open original image (new tab): How often did these names appear, for how long, and how far back did searches look?
What this chart means—and how it was made

The graphic compares export rows, observed persistence and requested time windows for a selected non-California label population. The controlled supplemental profile includes 20,275 Ohio-associated audit observation rows. Review flags identify labels for further examination.

Source: Praeva Analytics organization profile; Civic Review Packet pp. 6–7 explains the screening approach. Underlying classification and query-level tables are not available here.

How often did these names appear, for how long, and how far back did searches look?

Ranking of selected organization names outside California by how often they appear, led by Texas-associated names, with Georgia and Florida also represented. Other panels compare how far back searches looked and flag names for further review.
NCRIC connects a region—not just one local agency.
Comparison of six regional networks or groups of organizations. NCRIC appears in 83,555 entries across 27 months; the other five groups appear much less often. The note explains that NCRIC serves a region.
ANALYSISNCRIC connects a region—not just one local agency.Of the six groups compared, NCRIC appears most often and continues appearing over the longest span.Open original image (new tab): NCRIC connects a region—not just one local agency.
What this chart means—and how it was made

The graphic describes NCRIC as a California regional fusion center serving the federal Northern District and Northern California coastal counties. It cites NCRIC scope and governance pages. The comparison uses entries in the report’s eligible period for six selected networks.

Source: Praeva Analytics regional-network graphic; scope references: ncric.ca.gov/about_old/ and ncric.ca.gov/ncric-hidta-executive-board/. Underlying network export is not available here.

NCRIC connects a region—not just one local agency.

Comparison of six regional networks or groups of organizations. NCRIC appears in 83,555 entries across 27 months; the other five groups appear much less often. The note explains that NCRIC serves a region.
NCRIC appears less often—but its searches could reach more networks.
Four NCRIC charts showing monthly entries, how much camera-time searches asked to cover, how far back they looked, how many networks and cameras they could include, and comparisons with other agencies. Notes identify missing data and incomplete periods.
ANALYSISNCRIC appears less often—but its searches could reach more networks.Around mid-2024, the number of entries changes sharply. How broadly the searches could reach and how far back they looked also change.Open original image (new tab): NCRIC appears less often—but its searches could reach more networks.
What this chart means—and how it was made

Monthly attributed rows, requested scope, requested windows and activity-band comparisons describe different dimensions. The graphic warns against treating the source-period scope concentration threshold as constant. Device-hour coverage is incomplete; time ranges represent requested windows. The profile identifies review questions about query construction, practice and export coverage.

Source: Praeva Analytics NCRIC profile; Civic Review Packet pp. 24–25 explains the mid-2024 change and possible source/reporting explanations. Query-level data and original export are not available here.

NCRIC appears less often—but its searches could reach more networks.

Four NCRIC charts showing monthly entries, how much camera-time searches asked to cover, how far back they looked, how many networks and cameras they could include, and comparisons with other agencies. Notes identify missing data and incomplete periods.
More than cameras: the system that has to be accounted for
Map connecting the cameras and their locations to online software, stored history, access logs, sharing settings, users, alerts and contracts. It shows what must be considered when changing systems.
ANALYSISMore than cameras: the system that has to be accounted forChanging vendors involves data, software, settings, users, sites and audit history—not just replacing cameras.Open original image (new tab): More than cameras: the system that has to be accounted for
What this chart means—and how it was made

The original graphic maps dependencies across the physical layer, platform/data, and operations. Its ratings describe transition complexity. Active configuration and substitution feasibility require further records.

Source: Praeva Analytics capability-dependency graphic accompanying the analytical report.

More than cameras: the system that has to be accounted for

Map connecting the cameras and their locations to online software, stored history, access logs, sharing settings, users, alerts and contracts. It shows what must be considered when changing systems.
A 29-day change, with a visible ending
Daily entries and distinct organization names for January–April 2025. Both charts show a large surge in names associated with other states during February 19–March 19, followed by their disappearance.
ANALYSISA 29-day change, with a visible endingNames associated with other states surge from February 19 through March 19, 2025, then disappear from this daily view.Open original image (new tab): A 29-day change, with a visible ending
What this chart means—and how it was made

The upper panel shows daily audit rows; the lower panel shows distinct other-state candidate labels. Both identify the same bounded interval.

Source: Praeva Analytics daily graphic; Flock exports analyzed in daily_regime.json.

A 29-day change, with a visible ending

Daily entries and distinct organization names for January–April 2025. Both charts show a large surge in names associated with other states during February 19–March 19, followed by their disappearance.
The monthly view shows the change in scale—and the return
Monthly entries in the network audit file and a line showing the number of different organization names. February–March 2025 rise sharply; April returns toward the surrounding months.
ANALYSISThe monthly view shows the change in scale—and the returnFebruary and March 2025 stand out in the number of entries and different organization names. April returns to 270 names as written in the file.Open original image (new tab): The monthly view shows the change in scale—and the return
What this chart means—and how it was made

Bars count monthly network-audit rows; the line counts distinct raw organization labels. These are exported populations, not verified people, searches, recipients or search direction. The chart establishes structural change, not cause. March 2026 is a partial-period export.

Source: Praeva Analytics monthly graphic and monthly_network.json.

The monthly view shows the change in scale—and the return

Monthly entries in the network audit file and a line showing the number of different organization names. February–March 2025 rise sharply; April returns toward the surrounding months.
An activity file is not a complete account of who did what.
Table separating what appears in the files, what the analysis concludes, and which further records are needed to answer the remaining questions.
ANALYSISAn activity file is not a complete account of who did what.The file shows changing activity and organization names. It does not identify every user, reason, result or safeguard.Open original image (new tab): An activity file is not a complete account of who did what.
What this chart means—and how it was made

The original matrix organizes documented observations, interpretations and the records needed to answer questions about access, sharing, purpose and results.

Source: Praeva Analytics evidence-boundary matrix accompanying the report; original exports are not available here.

An activity file is not a complete account of who did what.

Table separating what appears in the files, what the analysis concludes, and which further records are needed to answer the remaining questions.
Promises need records the public can test
Six-part comparison of the promised safeguards, what the records provided show, and the records residents still need to check those promises.
UNRESOLVEDPromises need records the public can testResidents still need records showing that six important safeguards were followed.Open original image (new tab): Promises need records the public can test
What this chart means—and how it was made

The original comparison covers training, compliance audits, retention, sharing agreements, equipment tracking and complete access records. The accompanying policy and contract references require repository-specific reconciliation.

Source: Original Praeva Analytics public-control reconciliation graphic; project analysis of policy, grant, contract and public-records materials.

Promises need records the public can test

Six-part comparison of the promised safeguards, what the records provided show, and the records residents still need to check those promises.
How VCSO compares with other agencies

ANALYSISExplained in the report; original agency-by-agency data not included

The comparison group changes the answer

In several groups, VCSO ranks high for how often it appears and how far back its searches looked. The comparison is more mixed for how many networks and cameras its searches typically could reach.

Comparison groups shown in the original chart. Group sizes are copied from it, not recalculated; n means the number of agencies.
Comparison groupNumber of agenciesWhy compare them?
California sheriffsn = 40Agencies with a similar role
Activity band (0.5×–2× VCSO)n = 4Similar activity totals, not necessarily similar duties
Population band (±25%)n = 4Agencies serving similarly sized populations
Nationwide sheriffsn = 848A broader comparison
Four charts comparing VCSO with California sheriffs, agencies with similar activity, agencies serving similarly sized populations, and sheriffs nationwide. Each shows its group size and a dashed line marking the middle of the group.
ANALYSISContext depends on the comparison groupIn several comparison groups, VCSO appears often, over a long span, with searches looking far back. Its typical numbers of networks and cameras are lower.Open original image (new tab): Context depends on the comparison group
What this chart means—and how it was made

The four panels compare California sheriffs, an activity band, a population band and nationwide sheriffs. Cohorts vary greatly in size, so percentile rankings are not interchangeable. These candidate-qualified comparisons describe the export population.

Source: Praeva Analytics peer-percentile graphic; Civic Review Packet pp. 10–11 and methods p. 31. Comparison-group definitions and sizes appear in the image; raw membership and metric tables are not available here.

Context depends on the comparison group

Four charts comparing VCSO with California sheriffs, agencies with similar activity, agencies serving similarly sized populations, and sheriffs nationwide. Each shows its group size and a dashed line marking the middle of the group.

These rankings describe the comparison, account for ties and are not grades. Small groups can change greatly when different agencies are included. The full agency lists and how they were grouped still need to be checked.

Source: Civic Review Packet, pp. 10–11 and methods p. 31. Report explanation, not raw comparison-group data.

Page-specific report-context receipt

Funding over time
Original Praeva Analytics timeline showing funding over time.
ANALYSISFunding over timeFollow the original timeline of funding alongside the report and its sources.Open original image (new tab): Funding over time
What this chart means—and how it was made

Read this project-provided timeline alongside the report and legal receipts; it is not a substitute for the original procurement, grant or contract records.

Source: Praeva Analytics funding timeline accompanying the analytical report.

Funding over time

Original Praeva Analytics timeline showing funding over time.
All original charts · 28 PNG images

Story infographic originals and evidence notesFull-resolution editorial artwork, Chapter 8 receipts and evidence limits.

These seven editorial graphics accompany the investigation. The notes distinguish measured findings from illustrated claims that remain unverified.

Chapter 8: graphics and source receipts

Official VCSO 2025 Military Equipment Annual Report — April 22, 2026

DOCUMENTED Official Ventura County Sheriff’s Office report, dated April 22, 2026, covering January 1–December 31, 2025. Its reported inventories and usage are agency-reported figures, not independent operational verification.

Research leads—not findings of misconduct

UNRESOLVED 70 “Homeless related operations”: What did those drone operations involve? Who approved them? How long was data kept, and which systems could receive it? These events cover the overall program, not Wingtra alone.

UNRESOLVED 81 Organized Retail Theft operations. What UAV workflows and safeguards were used? The report does not document any relationship between these UAV events and Flock or Axon.

UNRESOLVED Approximately $15,229 for “network video upgrades, enhanced recorders and associated equipment.” This appears under ROOK/tracked-armored-vehicle equipment costs, from the existing FY 25/26 budget (printed page 5; PDF page 6). Ask what equipment and governing rules it covered. The report does not establish a relationship to ALPR, Axon or Fusus. It is a follow-up lead only.

The Chapter 8 comparison is a governance recommendation, not a claim that ALPR is covered by AB 481 or that a statutory reporting violation occurred.

Axon switcheroo: sources, original graphics, and evidence limits

The graphics illustrate possible connections, not a verified local system map. Vendor capability is not confirmed VCSO deployment. The cell-site-simulator purchase and integration remain unverified.

1 · How ALPR Data Moves

This is a conceptual illustration, not a verified feature inventory for a particular ALPR device or a map of VCSO’s deployed system. People or objects visible in an image are not necessarily identified, indexed or separately searchable. VCSO-specific records are needed to establish video capture, enabled tools and actual search results.

Source: editorial infographic. Compare with the analytical report, report receipts and source status; the artwork is not an agency record or a new calculation.

Open original PNG · Return to the story beat

2 · A Wide Network of Access

The lines show possible ways to get access, not completed searches, returned information or verified local connections between vendor platforms. Dated agreements and settings records are needed to check federal, out-of-state and international access. The California-agency label represents an attributed assurance, not a verified inventory of all current or historical sharing.

Source: editorial infographic. Compare with the analytical report, report receipts and source status; the artwork is not an agency record or a new calculation.

Open original PNG · Return to the story beat

3 · Audit Assurances vs. Records Received

Flock Organization and Network Audit Logs and an Axon audit trail were received. “Not provided” means missing accountability detail, not no activity files or proof that a record does not exist. Original presentation and response records are needed to verify the quoted wording and categories.

Source: editorial infographic. Compare with the analytical report, report receipts and source status; the artwork is not an agency record or a new calculation.

Open original PNG · Return to the story beat

4 · Who Can Access the Data?

These are possible users and connections, not a checked list of who has access now. The 58-agency statement is what VCSO said at a particular time, not the full history of settings or use.

Source: editorial infographic. Compare with the analytical report, report receipts and source status; the artwork is not an agency record or a new calculation.

Open original PNG · Return to the story beat

5 · February–March 2025 Anomaly

The measured series counts entries and organization names. The artwork’s reach and network lines are illustrative, not calculations from the daily/monthly datasets. March 2026 is partial.

Source: editorial infographic. Compare with the analytical report, report receipts and source status; the artwork is not an agency record or a new calculation.

Open original PNG · Return to the story beat

5.2 · Frequency and Requested Scope Are Different Questions

The report compares NCRIC across January–July 2024 and August 2024–February 2026. The artwork uses October 2024–March 2026; its ratios (~70% fewer searches, ~3× scope, ~4× networks), camera counts and international access remain unverified. What a search asked to cover is different from what it actually showed.

Source: editorial infographic. Compare with the analytical report, report receipts and source status; the artwork is not an agency record or a new calculation.

Open original PNG · Return to the story beat

6 · Six Key Takeaways on Surveillance Oversight

This image brings the argument together. The findings remain tied to the records and measurements explained above; the illustrations of access and growth are not additional findings.

Source: editorial infographic. Compare with the analytical report, report receipts and source status; the artwork is not an agency record or a new calculation.

Open original PNG · Return to the story beat

The labels tell you what supports each statement: DOCUMENTED = backed by a record provided or an official source, with the source limits stated; VCSO SAYS = the agency’s account; PLATFORM CAPABILITY = a vendor-described function, not confirmed VCSO deployment; ANALYSIS = a conclusion drawn from the available evidence; UNRESOLVED = the available records leave the question unanswered.

Key findings · 90-second overview

Ten chapters in brief: capabilities, records, agency statements and unanswered questions. Follow a chapter link for its evidence and limitations.

  1. PLATFORM CAPABILITY

    Plate sightings can build a searchable movement history. It shows where a vehicle was—not why.

    Read chapter 01
  2. DOCUMENTED

    Out-of-state organization names surge in the delivered Flock data from Feb. 19–Mar. 19, 2025, then disappear from its daily view.

    Read chapter 02
  3. DOCUMENTED

    The reviewed out-of-state subset contains 259,190 entries and 2,021 organization names—not counts of unique vehicles or proven misconduct.

    Read chapter 03
  4. VCSO SAYS

    On Aug. 26, 2026, VCSO acknowledged roughly one month of federal/out-of-state access, said such searching had stopped, and described daily then weekly audits.

    Read chapter 04
  5. DOCUMENTED

    VCSO’s Sept. 14 response called Flock logs the “only information available responsive”; an Axon audit log followed on Oct. 2.

    Read chapter 05
  6. UNRESOLVED

    Delivered logs do not establish the whole architecture. Audit findings, settings history, access permissions and data-copy/retention records remain necessary to verify safeguards.

    Read chapter 06
  7. ANALYSIS

    Compliance is the floor. Government must prove surveillance is necessary, effective, proportionate and independently accountable.

    Read chapter 07
  8. DOCUMENTED

    Axon logs record testing, a 30-to-365-day retention change, a Fusus Web comparison search and ECOM activity. Vendor capabilities do not establish every local integration.

    Read chapter 08
  9. ANALYSIS

    Local cases and national comparisons examine misuse, authorized surveillance and oversight. Allegations, documented outcomes and unanswered local questions are kept separate.

    Read chapter 09
  10. ANALYSIS

    PAUSE expansion. PRODUCE the records. PROVE the burden is met. REMOVE or disconnect what cannot meet it.

    Read chapter 10

Explore further: who can reach the history · why the combination matters · supporting materials and source limits.

Evidence labels and source limits

The labels tell you what supports each statement: DOCUMENTED = backed by a record provided or an official source, with the source limits stated; VCSO SAYS = the agency’s account; PLATFORM CAPABILITY = a vendor-described function, not confirmed VCSO deployment; ANALYSIS = a conclusion drawn from the available evidence; UNRESOLVED = the available records leave the question unanswered.