All the Chief's Men: How Coralville's Flock Contract Bypassed Oversight

Flock prides itself on being a Surveillance-as-a-Service provider (although they prefer the less accurate term “Safety-as-a-Service”). The “service” aspect begins at the pre-sales stage, where former and sometimes current government employees “will support you from procurement through permitting” — ensuring its future police customers are not waylaid by hurdles like democracy, civil rights, or accountability.

As more cities sign up for a Flock subscription, and more citizens are asking questions, patterns are beginning to emerge. Coralville, Iowa (pop. ~20,000) exemplifies the Flock procurement process — or the absence thereof — for small-to-midsize towns.

This post tells the story of how Flock leveraged a dysfunctional city council led by dishonest staff to get its cameras into a community that does not want them.

---

The Invisible Appropriation

Budgetary appropriations is where all expenditures must begin — or so the lore of cities past tells us.

The rules relevant to this story^[1] are that cities must create and submit an annual budget each year by April 30^th, for the fiscal year that generally runs from July 1 to June 30. Amendments to existing budgets must be submitted to the state by May 31^st of that year.

The first mention of what would later turn out to be a Flock contract was made at the FY2026 budget presentation, during a January 14, 2025, city council work session:

… Police Chief Kyle Nicholson said his budget proposes an increase to the overtime fee for hiring officers for security, increased EMT pay, costs for mandatory annual psychological exams, a parking ticket system, license plate recognition system, three new patrol cars with associated equipment, and the department’s share of a Mental Health Liaison. He said the estimate for the animal shelter cost for FY26 is $110,001. …

Another mention happened in finance director Ann Hester’s public presentation of the budget, during a meeting on April 22, 2025:

… And the general fund expenditures reflect of the cost necessary to provide services in a growing community and include things like three new police vehicles and equipment, new parking ticket software and license plate reading system access, a resource for future fire vehicle replacement also includes expansion of part-time EL position to full-time which will which will be funded through a grant in library board contribution. …

The final FY2026 budget contains no reference to license plate readers or similar programs in the city’s $6.7M police department/crime prevention budget.

Another public hearing on May 27, 2025, discussed an amendment to the FY2025 budget — it had no mention of license plate readers either.

The Unlawful Contract

On May 12, 2025, Coralville Chief of Police Kyle Nicholson put his signature to a $36,000, 24-month contract with Flock.

Now mind you, this is a little more than two weeks before FY2026 begins. The council had not otherwise discussed license plate readers or expenditures at this point.

But that’s not even the biggest problem.

The city’s purchasing policy (last updated in 2009) lays out a number of requirements for purchases. As in Tiffin, which has no policy covering expenditures over $5,000, Coralville’s policy is a confusing, contradictory set of rules with significant gaps.

Still, it’s reasonably clear that the policy — both as written and as intended — requires the usual: several approvals and a competitive bidding process.

It’s more than reasonably clear that the policy was not followed.

In response to public record requests, the city confirms that there was no bidding process, the city attorney did not review the contract, the finance department was unaware of it, and the city council’s only involvement in the $36,000 contract was the mention buried in a subclause in a sentence in the middle of a paragraph, deep within next year’s $104M budget.

For now, this email from Chief Kyle Nicholson sums up how the purchasing process was followed, and the level of the council’s involvement:

Now let’s get to the good part.

The Public Reckoning

Nicholson set up the meeting for the council “to learn about Flock,” at a council work session on June 24, a month and a half after he signed the contract. This was the first time the word “Flock” was mentioned in a public setting.

When people in Coralville heard about the city’s plan to allow Flock to pepper their community with AI-powered surveillance cameras, they started making noise at city council meetings.

Media mistakenly reported that the contract was for $19,000, based on a previous budget item showing $19,000 allocated for “police technology.”

The city did nothing to rectify that misconception.

In fact, the city did nothing at all. Not even inform residents that the contract had already been signed.

Even more people showed up at the August 26 city council meeting, where the city for the first time — after hearing a public comment alleging the fact — acknowledged that a two-year $36,000 contract had already been signed back in May.

Instead of addressing that problem, the council repeatedly attempted to use that fact to shut down or minimize public debate:

again contract is already signed

Two days later, the city council was given a copy of the contract for the first time. Not by Chief Nicholson, who had signed the contract, or City Administrator Kelly Hayworth who was supposed to approve it, or City Attorney Kevin Olson, who was supposed to review it, but by a resident opposing the contract.

Residents continued to voice their opposition to the contract at the September 23^rd city council meeting, where the city adopted its ALPR policy.

Surveillance-as-a-service, Budgets-as-approval

Defending its actions, or lack thereof, the city council maintains that policy was satisfied by approval of the non-specific budget item.

Council members emphatically claimed they made a decision:

the contract it was part of the budget it was a line item in the budget and it was approved along with the budget the line item in the budget read license plate readers.

And:

it was a budget item so when we approved the budget we approve all of that as a whole package mind you all of us are volunteer here… budget is this thick… we look through the budget and really there’s nothing alarming if there’s anything alarming we ask… so it was approved as a line item.

Councilman Knudson contradicts that:

I have serious concerns about our process by which we got here putting it in the budget… this is not a a trivial thing as we’ve learned… I would like to have have thought that this issue would have come before us for discussion prior to signing the contract so that bothers me quite a bit.

Despite this, at the September meeting:

The contract is signed… there’s no denying that there were some things about the process that were were not great… it’s been messy… I don’t believe that anyone was trying to be sneaky or trying to pull a fast one

Goodrich directly contradicts the mayor when she tries to rewrite history by claiming that the council was, in fact, fully aware from the get-go:

I do have one disagreement… as a city council member I… just want to regard our police chief and also our city administrators with the highest esteem we had four opportunities to know about this contract we had it in the budget and then at a work session there was a public hearing and we approved the budget and we watched a Flock presentation after the contract was signed … I just don’t think it’s fair that we I mean as city council members we were aware of this…

The council takes contradictory positions; at times they claim to have been unaware of the contract, at other times they say that they approved it and that there was ample opportunity for public review.

Ultimately, the council completely abdicates its duties to the chief of police and city administrator.

Taken together, it paints a picture of a disengaged, dysfunctional council that exists only to rubber stamp, not to govern.

The Performative Policy

On September 23, 2025, the city council met to discuss Kyle Nicholson’s proposed (Lexipol-generated) ALPR policy. Residents showed up to urge the council to reject the policy and revisit the contract.

To begin with the policy itself: it is designed to place oversight of the police department entirely with the police department. This is, of course, an attractive proposition for the police department.

Its most glaring fatal flaw is its section on data sharing:

The ALPR data may be shared only with other law enforcement or prosecutorial agencies for official law enforcement purposes or as otherwise permitted by law, using the following procedures …The agency makes a written request … The request is reviewed … The approved request is retained on file.

If you have spent any time on this website, you know how incompatible this policy is with the Flock national network.

Based on the average volume of nationwide searches, at least 10,000 searches of Coralville ALPR data are done every day through the Flock “national lookup” network. That number does not include statewide lookups or more local searches.

Coralville did not provide a more accurate number in response to a September 22 public records request for audit logs. It also did not respond to an October 31 request for the written requests that its ALPR policy requires.

Going by the lower number of 10,000/day, Nicholson, with a straight face, still told council and the public that he would review 10,000+ requests every day. He even proposed a policy that does not allow him to release data without that review and approval. A policy that limits oversight to be internal to the police department.

Flock Sr. Director of Government Affairs Kam Simmons confirmed at the September council meeting that the policy would not bind or restrict Flock or its other customers in any way — Flock remains free to allow anyone access, and its customers are free to search Coralville data without adhering to its policy.

The policy is purely performative.

The Administrative Failure

Nobody within the city approved the contract. Many were seemingly unaware of it until late August.

In the screenshot below, you will see my public record request in purple and Police Chief Kyle Nicholson’s responses in red.

• The Chief’s January 10 Budget Memo
• Hayworth-Nicholson emails

The email communication with city administrator Kelly Hayworth that Nicholson refers to is reproduced below. In it, Nicholson misrepresents that the purchase has been properly submitted and approved:

I had [the Flock contract] specifically listed in my memo. I talked about it during my budget presentation, and [Finance Director] Ann [Hester] brought it up again during her presentation at the last council meeting.

Hayworth responded:

Then you are fine to go ahead.

Sent from my iPhone.

This stops several football fields short of being the “affirmative recommendation” required from the city administrator. Similarly, finance director Hester’s “approval” was her mentioning the words “license plate reading system access” in the middle of a budget presentation.

Hayworth did not question Nicholson’s “I had it listed in my memo.” Hayworth’s job as city manager is to act as auditor in these situations, not to rubber stamp approvals. Either he neglected to do the job city residents pay him to do, or he was actively complicit in Nicholson’s bypassing of the city’s financial controls and procedures.

His refusal to take action or speak out against the chief speaks volumes here.

The memo reads: “Includes funding for access to a license plate reading system similar to the ones used in North Liberty and the University of Iowa.” Not how much funding. Not which license plate reading system. This was the basis for Hayworth’s “approval.”

The word “Flock” was never mentioned. No bids were sought. No sole source justification was created. The city attorney did not review the contract. No cost was submitted to finance. Nothing. Nobody approved this contract because there was nothing to approve.

The council’s after-the-fact efforts to justify the purchase by claiming that its approval in the FY2026 budget was all that was needed is a transparent and unconvincing attempt to shield its chief of police from consequences. If the city terminated its contract because policy was not followed, Nicholson would be personally liable for the cost of the contract.

A few more excerpts from the city’s policy makes it clear that nothing that happened here comports in any way with city policy, let alone prudent financial management practices:

Although the City Council has established levels of expenditures for each program appropriation is not a permit nor a directive to expend funds … For proper management control it is necessary that expenditures be authorized prior to purchase.

Expenditures in many categories require authorization and concurrence by the City Administrator. (This is in addition to the initial budget approval.) The City Administrator will be the signor, for contracts, for services, or purchases.

The Finance Officer and Finance Department shall be responsible for facilitating city wide bids. This includes setting and following rules and procedures set out in this policy and ensuring that City staff does the same

It is intended that the City Council will approve final disbursement of all public funds as well as specific changes in program funding levels upon the recommendation of the City Administrator and Finance Officer. As a general rule, the Council must approve all contracts

Instead, oversight is limited to what happens in budget presentations, which, apparently, is not much:

mind you all of us are volunteer here um it’s not our full-time job but it is a full-time job for us so budget is this thick okay beside our full-time job we try really hard to read through all of that and we are not expert in any of these thing that’s why we have staff we trust our staff and their expertise to help us navigate and connect and ask question in order to make an informed decision so we look through the budget and really there’s nothing alarming

It’s Law-Breaking all the Way Down

The council, after hearing residents’ concerns about Flock sharing data with ICE asked some pointed questions of Flock regarding their control over the data, and made it a point to include it in the policy.

In response, Nicholson promised that Coralville would not be sharing data with ICE. At the August 26 meeting, he stated “…our policy states that Flock will not be used on the sole basis to enforce immigration law so if ICE is requesting access to our data it’s a no” [Aug 26, 02:11:58]

In September, a public commenter followed up on that by questioning whether the city’s policy would bind Flock in any way. Flock’s Sr. Director of Government Affairs, Kam Simmons, responded that the city could adopt any policy it wants, but it would not affect Flock or any of its customers:

I want to tell you why I gave a broader answer [than yes or no]… your department’s policy very often… is designed to govern things like how your agency uses the system not necessarily how Flock is going to use the system … so… So, no.

Instead, Simmons said, Coralville would have to review audit logs:

if an agency isn’t checking their audit log then you’re not going to get the value out of that oversight right… if there’s an officer that runs a search… and say stolen vehicle isn’t enough information for you to be comfortable you can terminate your sharing relationship with that agency at any time"

Of course, in light of Simmons’ comments and the practical realities of controlling access to data on Flock’s national network (where Flock controls who has access, and there is no “pre-approval” mechanism), Nicholson was already fully aware that the policy he proposed was entirely unenforceable.

But, more directly, Iowa law unequivocally bans cities from adopting policies that hinder immigration enforcement.

Nicholson and Coralville were so desperate to cover up their illegal contract that they violate public trust with an attempt at a performative, unenforceable policy. In the process, they compound their earlier violations with further violations of state law — violations that could cost the city its $7.3M in state funding.

The city is risking 7% of its budget to cover up a $36,000 contract to shield the chief of police.

Nicholson never had any intention of implementing it, or any expectation that it would be followed — there is a reason that its opening paragraph functions to disallow oversight.

Someone is violating state law, lying to the public, or both.

Probably both.

The Unresolvable Contradiction

But, aside from the glaring issues in the procurement process, there are also substantive issues with the contract itself.

The first issue is the retention period. The order form shows a period of 0 days.

Of course, it could be an error. Scrivener’s errors exist. Correcting them is trivial. It’s done by creating and approving a new document. Especially when your contract says that any modifications must happen in writing.

The problem is that there is no definitive way to say whether or not this was a typo. There is no record of any discussion about retention periods before the contract was signed.

It is entirely possible that the city specifically negotiated an “alert only” system. Such a system would fulfill the functions police most frequently tout — alert police when stolen vehicles and vehicles associated with active AMBER alerts, are spotted — without many of the issues that come with creating a national location history database.

All we know is that Nicholson signed his name to a contract that specified “0 days.”

The city council claims that it approved the system, including its retention period at a budget hearing, but asked Nicholson for clarification on the retention period at the September council meeting.

After being presented with that question, Nicholson brushes it off as a “typo” and the city council accepts it without further explanation — a further expression of their disinterest in effective governance.

At that same meeting, Simmons confirms that the retention period is a contractual choice, not an “all or nothing” choice for 30 days.

the longest… is Los Angeles which has a 5-year retention schedule… the shortest retention period on flock today is a 7-day retention period… we’re aware of that [New Hampshire 3-minute] law certainly"

Rather than correct the “typo,” which would be a trivial matter of producing the official record showing the intent and getting the copies signed, Chief Nicholson and Flock ignore the terms of the contract and Iowa municipal law and quietly amended the contract without creating a written record.

At the August meeting, Nicholson provided his reasoning for doing so:

… they [ACLU] suggested storage for 3 minutes as opposed to 30 days which we are not in favor of… If we’re to shorten from 30 days down to 21 I’m not opposed but I think the 30 days absolutely helps us …

The dais again responded to this sidelining with a shrug.

The Time-Traveling Detective

Audit records show that Hanna Dvorak (or, as Flock reports it, “H. Dvo”), a detective with the Coralville Police Department, searched the Flock system in March 2025. Two months before the contract with Flock was signed.

The city denies it had any prior agreements with Flock.

Johnson County, however, signed a 5-year memorandum of understanding with Flock that grants it unfettered access to Flock data. The University of Iowa also heavily proselytizes for Flock.

It’s possible that either of these two entities created the account, the account was then transfered to Coralville, and Flock retroactively modified the audit logs.

Flock claims the logs contain a permanent audit trail.

Johnson County, in responding to a public records request, claims it has no access to its own logs.

The University of Iowa claims its logs are exempt from Iowa’s public records law.

Coralville claims not to have had a contract before May.

Not all of these claims are true: either Coralville was using the system before May, the logs are mutable on Flock’s end, or the agencies that have released logs have tampered with them before release.

Someone is lying about immutable logs, contract dates, or both.

Coralville city council was informed about the Dvorak anomaly on September 23, the day of the policy vote.

Coralville did not respond.

A System of Lies

The procurement of Flock’s surveillance system in Coralville is not a story of a single “honest mistake,” as Mayor Foster claimed. It is a story of a complete, multi-layered system of deception designed to bypass democracy — a system of dysfunctional government that Flock helps its customers prepare for and navigate.

This system is built on a series of documented falsehoods:

A contract was secured through active misrepresentation by the Chief of Police, who equated a vague memo line item with a specific, $36,000 contract.

This misrepresentation was either negligently or complicitly rubber-stamped by a City Administrator who failed to perform his primary duty as an auditor, violating the city’s purchasing policy.

When the illegal procurement became public, the City Council invented a contradictory and logically impossible defense: that they had both approved the contract via the budget and had “no knowledge” of it. This fiction was created for the sole purpose of shielding city staff from legal and financial liability.

To quiet public outrage, the city adopted a “policy” that is a performative lie. It violates state law, is procedurally impossible for the Chief to implement (auditing tens of thousands of daily queries), and, by the vendor’s own admission, is not binding on Flock or its customers.

The official contract, which specifies an “alert-only” system with 0-day retention, is dismissed as a “typo.” The city (as far as we know) allows Flock to create a 30-day location history database, a system of mass surveillance, in direct opposition to the only contract on file.

Finally, the Flock system’s audit logs show the city’s police department using the system months before the contract was signed. This is an unresolvable contradiction. Either Coralville PD was illegally using the system, or Flock’s “immutable” audit logs were manipulated.

The entire process, from its inception to its chaotic public defense is a testament to a government and its corporate partner that believe democracy, accountability, and truth are obstacles to be routed around, not a duty to be fulfilled.

The council’s stance that each individual failure is as a minor procedural error or mistake is untenable. Signing a $36,000 contract without discussion, bids, or approvals is a deliberate choice and — in any functional organization — a fireable offense. It’s not an “oopsie” to be covered up with a gambit that may cost the city its $7.3 million in state funding.

The $36,000 they’re protecting as a sunk cost has already cost far more in democratic erosion and public trust, and that’s before the attorney general and the state auditor have weighed in.

---

1. Iowa Code 384.16 and section 18 set many of the rules for Iowa cities. ↩︎