1 · Necessity
What specific public-safety problem requires this camera, connected system or access to a wider network?
07 · The PUBLIC test
Accountability is the floor. Necessity and proportionality are the test.
Even if every rule is followed, the public still deserves an answer: why should government build a searchable history of people’s movements at this scale?
Residents should not have to prove abuse before government has to justify surveillance.
2 · Effectiveness
What measurable result shows it actually helps solve that problem?
3 · Proportionality
Could the same result be achieved with fewer cameras, less history or less access to people’s movements?
4 · Accountability
Can residents independently check who was approved and trained, what was searched and shared, how long data stayed, what settings changed, and what audits found or corrected?
Why oversight matters—and why changing vendors is not enough
California’s official ALPR audit and the database-misuse reports it cites show why oversight needs records. Axon/Fusus product descriptions also matter when considering a switch or expansion. What a vendor offers, what VCSO enabled, and what someone actually used are different questions requiring different records.
California State Auditor findings about other ALPR programs are not evidence about VCSO. They show why rules without meaningful auditing can leave misuse undetected—and therefore inform the accountability standard Ventura County should meet.
DOCUMENTEDOfficial California audit finding
No reported misuse is not proof of no misuse.
In its February 13, 2020 Report 2019-118, California’s State Auditor examined ALPR programs at Fresno Police, LAPD, Marin County Sheriff and Sacramento County Sheriff. It found little to no auditing of user searches and weaknesses in access safeguards.
The auditor searched the agencies’ internal-affairs records and found no ALPR-misuse cases. It expressly rejected treating that absence as proof that no misuse had occurred: without regular auditing, misuse could go unnoticed and unreported.
“We do not consider this proof that no instances of ALPR misuse occurred.”
California State Auditor · Audit Results, “The Agencies Have Failed to Audit the Use of Their ALPR Systems” · February 2020.
The auditor’s recommendations call for verifiable records of the detection process, rather than assurances that a process exists.
What the auditor found—and the safeguards it recommended
The report’s recommendations show how residents could check oversight:
- How audits work: how often they happen, who reviews and approves them, what samples and risks reviewers check, what they record and how problems are resolved.
- Usable search records: complete and accurate logs, meaningful case numbers and reasons rather than fields that merely contain some text.
- Who gets access: approval, training and prompt removal of access when a user no longer needs it.
The auditor also cites two broader law-enforcement database-misuse reports:
- California, 2018: The Auditor cites a news article reporting that CHP investigated 11 database-misuse cases; three involved officers improperly looking up license-plate information through CLETS without a need to know. The audit passage does not identify the individual cases or their dispositions.
- Georgia, reported in 2016: The Auditor cites Associated Press reporting that an officer accepted a bribe to search a woman’s plate to learn whether she was an undercover officer. The cited passage does not give a case disposition.
These examples illustrate why purpose and access records need meaningful review.
Read the official audit findings and recommendations · Read the source-recovery boundaries.
ANALYSISCombined accountability argument
The combination raises the burden of proof.
- Unusual activity. The sudden out-of-state surge and the number of entries associated with distant states demand an explanation: who used the system, why, under which settings, and what did searches show?
- A system larger than its cameras. Regional networks and recorded activity across connected products make a camera count or one vendor’s file an incomplete answer.
- Safeguards must address misuse risk. California’s State Auditor found oversight failures at four agencies and warned that misuse could go unnoticed without regular audits. It also cited reports of CHP database misuse and a Georgia bribe-related plate lookup. Residents need to see how misuse would actually be caught.
- Residents still cannot check the whole system. Agency assurances are not a substitute for the records showing who could do what and whether the rules were followed.
Together, these findings and unanswered questions strengthen the case for pausing expansion. Produce the complete record. Let residents and responsible officials independently review whether the system is needed, works, intrudes no more than necessary and follows rules they can check.
PAUSE → PRODUCE → PROVE → REMOVERequire justification and verifiable receipts; remove or disconnect capabilities that cannot meet that burden.
ANALYSISVisual 6
Six Key Takeaways on Surveillance Oversight
Bring the questions together before deciding what public oversight should require.
This image brings the argument together. The findings remain tied to the records and measurements explained above; the illustrations of access and growth are not additional findings.
Supporting Materials
Want to check the work? Please do.
Check the work for yourself. The report, methods, legal sources, charts and details about the data are here when you want them.
Available materials vs. originals. Included here: charts, data files, the Civic Review Packet and collected legal sources prepared for this review. The packet explains specific findings page by page. The original Flock/Axon audit files, Camarillo presentation and records-request correspondence are not included.
The actual report
Praeva Analytics ALPR Audit Records Civic Review Packet · 33 pages · September 2026
Read the complete report alongside its charts. This packet contains the analysis prepared for the review, not the agency’s original audit files, response letters or presentation.
Read the report (PDF)Download the reportPage-specific report receipts
How we checked—and where to check for yourselfMethods, source receipts, legal cross-checks and records still needed.
- Sources found so far: official audit, assurances and original records still needed
- Report explanations and sources, page by page
- Outstanding source-retrieval request
- Official law and policy receipts
- Day-by-day data for the surge
- Monthly network data
- Index of the charts and data
Legal and policy source receipts
Source notes record verification against official California Legislative Information on October 4, 2026:
- Civil Code §1798.90.51 — operator policy must address collection, use, maintenance, sharing and dissemination; authorized roles and training; monitoring; sharing and transfer; custodian or owner; retention and destruction process.
- Civil Code §1798.90.52 — access record includes date/time, query elements, username/organization, and purpose; access limited to authorized purposes.
- Civil Code §1798.90.53 — end-user policy includes monitoring and a process for periodic system audits, plus sharing/transfer, custodian/owner, retention/destruction.
- Gov. Code §7922.525(b) — reasonably segregable portions available after exempt portions deleted.
- Gov. Code §7922.530 — identifiable nonexempt records promptly available; not a fixed final-production deadline.
- Gov. Code §7922.535 — 10-day determination/notice rule; written unusual-circumstances extension subject to statutory limits.
- Gov. Code §7922.540 — written partial/complete denial; names/titles of persons responsible; withholding must be justified.
- Gov. Code §7922.600 — duty to assist includes identifying responsive records, describing IT/physical location, and suggestions to overcome practical access barriers.
Project-produced-source cross-checks:
- VCSO Policy 429: department-approved training; five-year server retention with exceptions; regular audits; inter-agency agreement/access controls.
- Flock order form: `Retention Period: 365 Days`; extended retention up to one year.
A duty to maintain records or adopt a policy, a duty to disclose records under the California Public Records Act (CPRA), and evidence of actual compliance are three different questions.
Source routes checked
- Moorpark Public Meetings
- Moorpark City Council
- Moorpark Agenda Center
- Moorpark Oct. 7, 2026 City Council calendar
Original materials referenced by the investigation but not available here include the redacted Axon audit trail, records-request and deficiency correspondence, and Moorpark City Manager correspondence. Public receipts must protect requester-identifying information.
Original charts and a closer look at the evidenceOriginal report charts, comparison methods and the full-size image index.
The original report graphics are all here, with their labels, explanations, sources and full-size views. The image index below also includes the deeper analysis.
Out-of-state data: all state totals, methods and source limits
ANALYSISMatching organization names to likely states
Texas. Florida. Ohio. The interstate context matters.
The examined profile contains 53,277 Texas-associated entries, 26,810 Florida-associated entries, 20,275 Ohio-associated entries and 47,312 Georgia-associated entries. States are assigned from the organization names in the files. The separate organization profile adds frequency, persistence and requested-window context.
The daily evidence identifies an aggregate other-state surge. The state map compares audit-label populations by candidate-associated geography.
Verifying each state’s trend over time requires the underlying name-to-state classifications and dated entries, using the same periods and totals as the report.
State profile and broader map: source limits
The original map remains intact as an analytical receipt. The controlled supplemental profile includes 20,275 Ohio-associated audit observation rows.
Source status and remaining receipts. The totals are transcribed from the report, not independently recalculated from original exports.
All eleven state totals in the out-of-state data examined here
- Texas: 53,277 entries in the data
- Georgia: 47,312 entries in the data
- Illinois: 30,035 entries in the data
- Florida: 26,810 entries in the data
- Ohio: 20,275 entries in the data
- Indiana: 20,070 entries in the data
- Virginia: 14,569 entries in the data
- Michigan: 12,140 entries in the data
- North Carolina: 11,663 entries in the data
- Missouri: 11,642 entries in the data
- Tennessee: 11,397 entries in the data
Original state map · Organization profile · Original supplemental device-hours analysis (new tab) · Return to Chapter 03
Which states are associated with the organizations in the data?
What this chart means—and how it was made
This original map classifies primary-period-eligible Network Audit rows by candidate-associated state. It compares populations rather than trends over time. The February–March surge appears separately in the daily-regime graphic. Unknown or multi-state labels remain separate.
Source: Praeva Analytics candidate-state map; totals are transcribed from the analytical report, not independently recalculated. Original name-to-state classifications and dated state-level tables are not available here.
How often did these names appear, for how long, and how far back did searches look?
What this chart means—and how it was made
The graphic compares export rows, observed persistence and requested time windows for a selected non-California label population. The controlled supplemental profile includes 20,275 Ohio-associated audit observation rows. Review flags identify labels for further examination.
Source: Praeva Analytics organization profile; Civic Review Packet pp. 6–7 explains the screening approach. Underlying classification and query-level tables are not available here.
NCRIC connects a region—not just one local agency.
What this chart means—and how it was made
The graphic describes NCRIC as a California regional fusion center serving the federal Northern District and Northern California coastal counties. It cites NCRIC scope and governance pages. The comparison uses entries in the report’s eligible period for six selected networks.
Source: Praeva Analytics regional-network graphic; scope references: ncric.ca.gov/about_old/ and ncric.ca.gov/ncric-hidta-executive-board/. Underlying network export is not available here.
NCRIC appears less often—but its searches could reach more networks.
What this chart means—and how it was made
Monthly attributed rows, requested scope, requested windows and activity-band comparisons describe different dimensions. The graphic warns against treating the source-period scope concentration threshold as constant. Device-hour coverage is incomplete; time ranges represent requested windows. The profile identifies review questions about query construction, practice and export coverage.
Source: Praeva Analytics NCRIC profile; Civic Review Packet pp. 24–25 explains the mid-2024 change and possible source/reporting explanations. Query-level data and original export are not available here.
More than cameras: the system that has to be accounted for
What this chart means—and how it was made
The original graphic maps dependencies across the physical layer, platform/data, and operations. Its ratings describe transition complexity. Active configuration and substitution feasibility require further records.
Source: Praeva Analytics capability-dependency graphic accompanying the analytical report.
A 29-day change, with a visible ending
What this chart means—and how it was made
The upper panel shows daily audit rows; the lower panel shows distinct other-state candidate labels. Both identify the same bounded interval.
Source: Praeva Analytics daily graphic; Flock exports analyzed in daily_regime.json.
The monthly view shows the change in scale—and the return
What this chart means—and how it was made
Bars count monthly network-audit rows; the line counts distinct raw organization labels. These are exported populations, not verified people, searches, recipients or search direction. The chart establishes structural change, not cause. March 2026 is a partial-period export.
Source: Praeva Analytics monthly graphic and monthly_network.json.
An activity file is not a complete account of who did what.
What this chart means—and how it was made
The original matrix organizes documented observations, interpretations and the records needed to answer questions about access, sharing, purpose and results.
Source: Praeva Analytics evidence-boundary matrix accompanying the report; original exports are not available here.
Promises need records the public can test
What this chart means—and how it was made
The original comparison covers training, compliance audits, retention, sharing agreements, equipment tracking and complete access records. The accompanying policy and contract references require repository-specific reconciliation.
Source: Original Praeva Analytics public-control reconciliation graphic; project analysis of policy, grant, contract and public-records materials.
How VCSO compares with other agencies
ANALYSISExplained in the report; original agency-by-agency data not included
The comparison group changes the answer
In several groups, VCSO ranks high for how often it appears and how far back its searches looked. The comparison is more mixed for how many networks and cameras its searches typically could reach.
| Comparison group | Number of agencies | Why compare them? |
|---|---|---|
| California sheriffs | n = 40 | Agencies with a similar role |
| Activity band (0.5×–2× VCSO) | n = 4 | Similar activity totals, not necessarily similar duties |
| Population band (±25%) | n = 4 | Agencies serving similarly sized populations |
| Nationwide sheriffs | n = 848 | A broader comparison |
What this chart means—and how it was made
The four panels compare California sheriffs, an activity band, a population band and nationwide sheriffs. Cohorts vary greatly in size, so percentile rankings are not interchangeable. These candidate-qualified comparisons describe the export population.
Source: Praeva Analytics peer-percentile graphic; Civic Review Packet pp. 10–11 and methods p. 31. Comparison-group definitions and sizes appear in the image; raw membership and metric tables are not available here.
These rankings describe the comparison, account for ties and are not grades. Small groups can change greatly when different agencies are included. The full agency lists and how they were grouped still need to be checked.
Source: Civic Review Packet, pp. 10–11 and methods p. 31. Report explanation, not raw comparison-group data.
Funding over time
What this chart means—and how it was made
Read this project-provided timeline alongside the report and legal receipts; it is not a substitute for the original procurement, grant or contract records.
Source: Praeva Analytics funding timeline accompanying the analytical report.
All original charts · 28 PNG images
Each link opens its original image, without cropping or recompression.
Original report charts
- The 29-day surge
- Monthly expansion
- What the files can—and cannot—tell us
- Funding over time
- How the systems connect
- Promised safeguards vs. the records provided
Charts from the deeper analysis
- Expanded monthly trends
- Map of likely states associated with organization names
- A closer look at regional networks
- Organizations associated with states outside California
- Camera-time requested: total device-hours
- How VCSO ranks against other agencies
- How VCSO’s ranking changes by month
- VCSO before, during and after the surge
- How different assumptions affect the combined VCSO comparison
- Organizations with Ventura in their names
- How broadly VCDA searches could reach
- How broadly VCSO searches could reach
- How broadly NCRIC searches could reach
- VCSO entries and how much unusual activity stands out
- VCSO camera locations: DeFlock context
- All graphics together for visual review
- The 29-day surge · supplemental package copy
- Monthly expansion · supplemental package copy
- What the files can—and cannot—tell us · supplemental package copy
- Funding over time · supplemental package copy
- How the systems connect · supplemental package copy
- Promised safeguards vs. the records provided · supplemental package copy
Story infographic originals and evidence notesFull-resolution editorial artwork, Chapter 8 receipts and evidence limits.
These seven editorial graphics accompany the investigation. The notes distinguish measured findings from illustrated claims that remain unverified.
Chapter 8: graphics and source receipts
Official VCSO 2025 Military Equipment Annual Report — April 22, 2026
DOCUMENTED Official Ventura County Sheriff’s Office report, dated April 22, 2026, covering January 1–December 31, 2025. Its reported inventories and usage are agency-reported figures, not independent operational verification.
- Open preserved official report (PDF; new tab)
- Original report on VCSO’s official website (new tab)
- Page-specific receipts and claim boundaries
Research leads—not findings of misconduct
UNRESOLVED 70 “Homeless related operations”: What did those drone operations involve? Who approved them? How long was data kept, and which systems could receive it? These events cover the overall program, not Wingtra alone.
UNRESOLVED 81 Organized Retail Theft operations. What UAV workflows and safeguards were used? The report does not document any relationship between these UAV events and Flock or Axon.
UNRESOLVED Approximately $15,229 for “network video upgrades, enhanced recorders and associated equipment.” This appears under ROOK/tracked-armored-vehicle equipment costs, from the existing FY 25/26 budget (printed page 5; PDF page 6). Ask what equipment and governing rules it covered. The report does not establish a relationship to ALPR, Axon or Fusus. It is a follow-up lead only.
The Chapter 8 comparison is a governance recommendation, not a claim that ALPR is covered by AB 481 or that a statutory reporting violation occurred.
Axon switcheroo: sources, original graphics, and evidence limits
The graphics illustrate possible connections, not a verified local system map. Vendor capability is not confirmed VCSO deployment. The cell-site-simulator purchase and integration remain unverified.
1 · How ALPR Data Moves
This is a conceptual illustration, not a verified feature inventory for a particular ALPR device or a map of VCSO’s deployed system. People or objects visible in an image are not necessarily identified, indexed or separately searchable. VCSO-specific records are needed to establish video capture, enabled tools and actual search results.
Source: editorial infographic. Compare with the analytical report, report receipts and source status; the artwork is not an agency record or a new calculation.
2 · A Wide Network of Access
The lines show possible ways to get access, not completed searches, returned information or verified local connections between vendor platforms. Dated agreements and settings records are needed to check federal, out-of-state and international access. The California-agency label represents an attributed assurance, not a verified inventory of all current or historical sharing.
Source: editorial infographic. Compare with the analytical report, report receipts and source status; the artwork is not an agency record or a new calculation.
3 · Audit Assurances vs. Records Received
Flock Organization and Network Audit Logs and an Axon audit trail were received. “Not provided” means missing accountability detail, not no activity files or proof that a record does not exist. Original presentation and response records are needed to verify the quoted wording and categories.
Source: editorial infographic. Compare with the analytical report, report receipts and source status; the artwork is not an agency record or a new calculation.
4 · Who Can Access the Data?
These are possible users and connections, not a checked list of who has access now. The 58-agency statement is what VCSO said at a particular time, not the full history of settings or use.
Source: editorial infographic. Compare with the analytical report, report receipts and source status; the artwork is not an agency record or a new calculation.
5 · February–March 2025 Anomaly
The measured series counts entries and organization names. The artwork’s reach and network lines are illustrative, not calculations from the daily/monthly datasets. March 2026 is partial.
Source: editorial infographic. Compare with the analytical report, report receipts and source status; the artwork is not an agency record or a new calculation.
5.2 · Frequency and Requested Scope Are Different Questions
The report compares NCRIC across January–July 2024 and August 2024–February 2026. The artwork uses October 2024–March 2026; its ratios (~70% fewer searches, ~3× scope, ~4× networks), camera counts and international access remain unverified. What a search asked to cover is different from what it actually showed.
Source: editorial infographic. Compare with the analytical report, report receipts and source status; the artwork is not an agency record or a new calculation.
6 · Six Key Takeaways on Surveillance Oversight
This image brings the argument together. The findings remain tied to the records and measurements explained above; the illustrations of access and growth are not additional findings.
Source: editorial infographic. Compare with the analytical report, report receipts and source status; the artwork is not an agency record or a new calculation.
The labels tell you what supports each statement: DOCUMENTED = backed by a record provided or an official source, with the source limits stated; VCSO SAYS = the agency’s account; PLATFORM CAPABILITY = a vendor-described function, not confirmed VCSO deployment; ANALYSIS = a conclusion drawn from the available evidence; UNRESOLVED = the available records leave the question unanswered.