The vendor didn't leave. They bagged the cameras instead.

Evanston asked Flock to take its cameras down. Flock took them down. Then it put them right back on the same pole.

The city of Evanston, Illinois, deactivated its 19 license plate readers — 18 fixed and one mobile — on August 26, 2025, and issued a termination notice effective September 26 [1]. The stated reasons were the Illinois Secretary of State’s audit, which found federal agencies had been able to reach the data, plus the vendor’s own admission: Flock wrote that it “didn’t create distinct permissions and protocols in the Flock system to ensure local compliance for federal agency users” [4].

Flock’s answer was to fight the contract. Its chief legal officer wrote that the city had “no legal basis” for relieving itself of “clear and unambiguous contractual obligations, simply by declaration” and asked for a 30-day cure period before pulling the hardware [10]. It did pull 15 of the 18 fixed cameras by September 8. On September 24, a physical mapping of the pole locations found the 15 had been reinstalled at their previous addresses [2].

(Evanston didn’t find out from the company. It found out because a Flock technician called the police department asking where to find a camera’s power source [5]. The city bagged the lenses with black plastic on September 25 and sent a cease-and-desist [2][3].)

What the vendor left on the table: Evanston’s transparency portal was still reporting 155,507 vehicles detected in the past 30 days, with at least 128 searches [10]. Flock had challenged the termination; the contract, a five-year extension signed in January 2024, was scheduled to run through January 24, 2029 [10]. By November the provider had apologized in writing — “we understand that you put your credibility on the line in support of our partnership, and we let you down” [3] — and the CEO called the police chief to apologize directly [3]. Two cameras stayed another six months, under the city’s plastic, until the local weekly asked about them [3].

(The reporter mapped all 18 fixed cameras in June and confirmed on site that all but three had been pulled; the three that never moved are still up. The balance the city still owed for the final three years of the contract, if it was upheld, was $145,500 [2]. The Chicago Tribune described the contract as near $200,000 [5]. Those are different magnitudes — balance versus total value — and each carries its own source.)

Three months later, the same story at town scale

Verona, Wisconsin, walked away from two Flock contracts in the fall of 2025: one covering two cameras since April 2024, another covering an additional camera from July [7]. The 2026 contract cost $9,600 according to the official Common Council agenda [8]. The cameras stayed.

Mayor Luke Diaz says the department made several removal requests and Flock “weren’t removing them”; the city’s answer was to cover the units with black bags in January [11]. Before that, the town had demanded the cameras come down and the vendor had responded by selling: “they didn’t have enough time to send a technician out here for the cameras, but they did have sales people reaching back out to us,” Diaz said [6]. Only after the city covered them did the company agree to take them down [6].

(The vendor says the cameras weren’t operating during the months they remained up; Diaz says there’s no way to be sure and that he’s “100% certain that they were still working” [6][11]. The contradiction is unresolved, and this post does not resolve it.)

The hard number for that town wasn’t in the cameras. It was in the logs. Alderman Beth Tucker Long reviewed the city’s year of search records and found that Verona’s data was searched 1,628 times by organizations self-identifying as ICE, and 5,739 times via “other image search” — Flock’s name for an AI search across the full contents of the images rather than a plate number [7]. The Wisconsin Examiner’s own analysis found the Flock network was searched by 221 unique Wisconsin law enforcement agencies between January and May 2025 [7][11].

At scale, the number isn’t small: at least 30 localities have deactivated cameras or canceled contracts since the beginning of 2025 [9]. Flagstaff cut its retention from 30 days to 14 [9].

What this means for an RFP

Verona and Evanston did everything right: written termination notice, cease-and-desist, public record, lenses covered. And still, between them, the hardware sat on the street for months against the city’s will, and the only measure that worked was physical.

Three clauses that change the outcome:

1. Verifiable physical removal, with a deadline and a receipt. A termination notice is not a removal order. The clause has to state what happens to installed hardware — a maximum number of days, a signed removal certificate, and what happens if the vendor doesn’t show up. In Evanston the turning point was the cease-and-desist [2]; in Verona it was the plastic [6].

2. Inventory reconciliation at closeout. Evanston had the official count and the reinstallation still slipped past, until a technician called to ask about a power source [5]. Closeout should require a signed inventory of every unit — serial, location, status — before the final payment clears.

3. An exit right that outlives the contract. A city that already paid two years of an extension has $145,500 behind it [2]. The drafting matters: a 30-day cure period [10] hands the vendor a month to unbolt the hardware — and a month to bolt it back up.

And one security note that has nothing to do with contracts

From the same body of source material CISA works with, the agency published an ICS advisory on October 13, 2026 covering three CVEs in Swann SWIFI-SE2KIC camera firmware: firmware ≤ 2.0.22, and successful exploitation “could allow an attacker to view video information without authentication” [12]. NVD scores CVE-2026-107605 at 6.2 MEDIUM (CVSS v3.1) [13]; MITRE records the same pattern for CVE-2026-107607, at 6.9 on CVSS 4.0 [14]. CISA makes two points most summaries skip: the vulnerabilities are not remotely exploitable, and the vendor’s mitigations are “interim security measures,” not a patch [12].

(This isn’t an argument for or against any brand. It’s the reminder that camera firmware is part of your attack surface, and that the same government publishing the list of vulnerable gear is the one auditing permissions on a plate-reader network.)

P.D. Open the last email where cameras were installed or expanded for you and ask: if you terminated tomorrow, what stops the hardware from staying on the street? If the answer is “nothing in writing,” your RFP doesn’t terminate contracts — it requests a favor.

Sources

[1] City of Evanston, Illinois — “Statement: Evanston Deactivates Flock Cameras and Terminates Contract” (official bulletin). https://content.govdelivery.com/accounts/ILEVANSTON/bulletins/3efa81d — accessed 2026-10-24.

[2] Evanston RoundTable (Alex Harrison) — “City sends cease-and-desist after Flock reinstalls license plate cameras” (Sep 24, 2025). https://evanstonroundtable.com/2025/09/24/flock-safety-reinstalls-evanston-cameras — accessed 2026-10-24.

[3] Evanston RoundTable (Alex Harrison) — “Flock removes final two license plate cameras from Evanston after RoundTable inquiry” (Mar 27, 2026, emails obtained via FOIA). https://evanstonroundtable.com/2026/03/27/flock-removes-final-two-license-plate-cameras-from-evanston-after-roundtable-inquiry — accessed 2026-10-24.

[4] Flock Safety — “Ensuring Local Compliance” (official statement by Garrett Langley, CEO, Aug 25, 2025). https://www.flocksafety.com/blog/ensuring-local-compliance — accessed 2026-10-24.

[5] Chicago Tribune / Pioneer Press (Richard Requena) — “After Evanston fires Flock, it reinstalls license-plate reader, so Evanston covers them” (Sep 29, 2025). https://chicagotribune.com/2025/09/29/after-evanston-fires-flock-it-reinstalls-license-plate-reader-so-evanston-covers-them — accessed 2026-10-24.

[6] Bolts Magazine (Pascal Sabino) — “This Wisconsin City Ditched AI Surveillance Cameras. Now Activists Want to Keep Going.” (Mar 18, 2026). https://boltsmag.org/verona-wisconsin-ends-contract-flock-ai-surveillance-cameras — accessed 2026-10-24.

[7] WORT-FM 89.9 (public radio, Madison) — “Verona Common Council Votes Against Flock Camera Contract Extension”. https://www.wortfm.org/verona-common-council-votes-against-flock-camera-contract-extension/ — accessed 2026-10-24.

[8] City of Verona WI — Common Council Agenda, Monday November 10, 2025 (official PDF). https://www.veronawi.gov/AgendaCenter/ViewFile/Agenda/_11102025-2502 — accessed 2026-10-24.

[9] NPR (Feb 17, 2026) — “Why some cities are ditching their Flock license plate readers”. https://www.npr.org/2026/02/17/nx-s1-5612825/flock-contracts-canceled-immigration-surveillance-concerns — accessed 2026-10-24.

[10] Evanston Now (Matthew Eadie) — “Flock reinstalls cameras, city orders removal” (Sep 23, 2025). https://evanstonnow.com/flock-reinstalls-cameras-city-orders-removal — accessed 2026-10-24.

[11] Wisconsin Examiner (Isiah Holmes) — “Verona has waited months for Flock cameras to come down after canceling contract” (Feb 2, 2026). https://wisconsinexaminer.com/2026/02/02/verona-expected-to-begin-work-to-removing-flock-cameras — accessed 2026-10-24.

[12] CISA — “Swann Communications SWIFI-SE2KIC”, ICS Advisory ICSA-26-286-02 (Oct 13, 2026). https://www.cisa.gov/news-events/ics-advisories/icsa-26-286-02 — accessed 2026-10-24.

[13] NIST National Vulnerability Database — “CVE-2026-107605” (Swann Communications SWIFI-SE2KIC). https://nvd.nist.gov/vuln/detail/CVE-2026-107605 — accessed 2026-10-24.

[14] MITRE — “CVE-2026-107607” (ICS-CERT CNA record, via CVE API). https://cveawg.mitre.org/api/cve/CVE-2026-107607 — accessed 2026-10-24.

📰 Source: City of Evanston (official bulletin) + Evanston RoundTable (FOIA) + City of Verona (official agenda) + WORT-FM 89.9 + CISA ICSA-26-286-02, Oct 2026. ⚠️ The Evanston figures are not merged with each other: 15 cameras reinstalled [2] vs. the Tribune’s “15 to 18” range [5]; $145,500 balance for three years [2] vs. a “near $200,000” contract [5]. Each carries its own attribution. The Swann section is Claim 12 from the same research, cited to CISA + NVD + MITRE, and supports no claim about Flock.