Iowa House File 2161 started life as a bill purporting to regulate Automatic License Plate Readers (ALPRs). It began as a well-intentioned, if likely toothless, attempt to put guardrails around police use of surveillance technology. An amendment has turned it into something else: statutory authorization for commercial entities to access a privately-operated surveillance network built on public property, public permits, and public contracts — all under the guise of fraud prevention[1] and claims adjudication.
Civil rights organizations appear not to have caught on. At the time of writing, they are still voicing support for a bill that threatens to severely undermine the privacy rights of everyone in the country.
A Private Network on Public Infrastructure
The legal theory under which camera-operators and police operate is that they are photographing vehicles on public roadways, and that the images therefore don’t implicate privacy interests.
Flock’s cameras sit on public utility poles, installed under public permits, paid for under public contracts — infrastructure a purely private company could never obtain on its own. The data flows into a corporate-owned database that participating agencies can query nationwide. Flock is not a government agency; it’s a vendor that has successfully made itself look like public infrastructure.
The data is public enough to collect from every street corner without a warrant; when requested under open records laws, those same images and records tend to magically transform into sensitive intelligence not fit for public consumption.[2] When a Washington state court found that version of Schrödinger’s photographs — public enough to gather on every corner, too sensitive to disclose to the public whose streets paid for them — to be legally incoherent, police across the state cancelled their ALPR contracts, ostensibly to protect Washingtonian privacy.
Vendors and police have so far resisted both horns of this dilemma. There is no warrant requirement for collection, no meaningful FOIA access, and agencies can look up anyone’s long-term, nationwide location history without judicial oversight. The data is pooled nationally. A camera in Des Moines contributes plate reads to the same database as a camera in Houston.
This is not an Iowa database. It is a national one.
How Iowa Becomes a National Gateway
Readers outside the Hawkeye State may not be aware that Des Moines is a — perhaps the — major insurance hub in the United States, home to Principal Life, Transamerica, Wellmark, EMC, United Fire, and dozens of others. Iowa-domiciled insurers account for roughly 2–4% of total US premiums, heavily concentrated in life, annuity, and commercial lines.
The amendment doesn’t restrict ALPR data access to Iowa insurers, Iowa plates, or Iowa accidents. It opens the tap to any “insurance carrier, or an insurance support organization” — nationally, without geographic limitation.
Flock and similar vendors maintain a pooled database of plate reads contributed by agencies across the country. An Iowa city enters into an agreement with Flock. Under the amended bill, that city may now lawfully share the data — location history, timestamps, images — with insurers for “adjudicating insurance claims,” even if the data was originally collected nowhere near Iowa. Iowa’s authorization is the fig leaf that legitimizes access to a database populated by agencies in California, Texas, and New York.
That’s data laundering: a permissive jurisdiction provides the legal cover that turns a publicly-subsidized national surveillance network into a commercial data product. Iowa’s overrepresentation in the insurance industry means the companies most likely to exploit this are disproportionately headquartered in the same state that just handed them the keys.
The phrase “insurance support organization” makes this worse. In insurance law, that covers data aggregators, claims analytics firms, and infrastructure providers like Verisk/ISO — entities whose business is pooling and reselling data across the industry. Data that enters that pipeline does not stay in the lane it entered through.
The amendment doesn’t just give insurers access to ALPR data; it gives the entire insurance data ecosystem access to ALPR data.
Next time you’re involved in a car accident, the insurer may pour through your location history to find reasons not to pay. Stopped at a bar the night before, even for a diet soda? That may become an argument. If your employer’s insurer is watching while you recover from an injury, think twice before leaving the house to pick up your prescription.
What the Amendment Actually Removed
The original bill named a legal threshold: no one could access ALPR data more than 24 hours after capture without a magistrate-issued search warrant or a county attorney’s subpoena for a specific plate. In practice, the subpoena option gutted the warrant requirement before the ink dried — a county attorney can issue one without judicial oversight, meaning the same prosecutorial office that wants the data could authorize its own access. But even that weak threshold is gone.
In its place: a requirement to log a “call for service number or case number” before searching. That’s an administrative record-keeping requirement, not a legal threshold. No independent review, no probable cause, no judicial oversight.
The original bill also flatly prohibited sharing data with any nongovernmental third party. The amendment replaced that prohibition with an explicit whitelist that includes insurers, or anyone who promises to use the data “for the sole purpose of protecting public safety, conducting criminal investigations, or ensuring compliance with federal, state, or local law.” What was a ban became an authorization.
The penalty regime was similarly softened. Violations now require proof of “willful and intentional” conduct, and the aggravated misdemeanor threshold requires the violation also be committed “for personal gain or while violating any other provision of law.” Routine unauthorized sharing — the kind driven by bureaucratic carelessness or vendor pressure — is unlikely to be prosecuted at all.
The Lobbying Picture
The lobbying declarations for this bill tell a more complicated story than the civil liberties coalition supporting it would suggest.
The Iowa Association for Justice, Institute for Justice, the American Civil Liberties Union of Iowa (ACLU-IA), and Americans For Prosperity are all registered For the bill. AFP’s registration predates the amendment by two weeks; ACLU-IA’s and IJ’s were filed the same day the amendment dropped in committee. Whether their support reflects the amended text or the original is a question worth asking them directly.
Flock itself is registered as Undecided. So is RELX Inc. — the parent company of LexisNexis Risk Solutions, one of the largest data brokers in the country. LexisNexis Risk Solutions sells comprehensive consumer risk profiles to insurers, compiled from court records, motor vehicle databases, property records, and commercial data sources. It has no reason to be watching this legislation unless the amendment’s “insurance support organization” carve-out is relevant to its business — which it plainly is. That it hasn’t registered in support suggests either that the bill doesn’t go far enough, or that it’s waiting to see which way it moves. The National Insurance Crime Bureau — explicitly named in the amendment’s carve-out — is also Undecided.
The Iowa State Sheriffs’ & Deputies’ Association, the Iowa State Police Association, and the Iowa Peace Officers Association are all registered Against. So are Axon Enterprise and the Security Industry Association — Flock’s commercial competitors, whose objections are about market share, not civil liberties.
No group is opposing the bill on civil liberties grounds.
What This Bill Actually Does
It authorizes local Iowa governments to deploy a privately-operated surveillance network on public infrastructure — then share the resulting data with the commercial insurance industry, nationally, with no warrant requirement, no meaningful penalty for abuse, and no restriction on which insurers, in which states, beyond the three enumerated purposes.
Iowa is not regulating mass surveillance. Iowa is commercializing it.
Cross-posted from Footnote 4A, where I cover Flock, privacy, and public-private surveillance infrastructure more broadly. Flock-specific posts live on haveibeenflocked.com.
Iowa DOT’s long-running facial recognition program also began life as a tool to combat fraud. ↩︎
Despite the database being owned and operated by a private corporation — one whose cameras were installed using public permits, public contracts, and in many cases public funds. ↩︎