The last stretch of road into Park City feels unchanged. Open highway, a gradual climb, the familiar approach into town. Nothing suggests you've crossed into something new. But you have. Cameras at every entrance now record every car that enters or leaves the basin. The system runs twenty four hours a day. The drivers were not told. The public was never asked.
One sits twenty yards past the roundabout at Kimball Junction. Another at the Pinebrook turnoff on I 80. Another at the bridge into Old Town. They are mounted on utility poles and roadside signs, painted the color of dust, the size of a thermos. When a vehicle passes, a strobe fires for less than a millisecond. The plate is read. A record is written.
The record contains, at minimum, the plate number, a timestamp, a GPS coordinate to five decimal places, and a digital portrait of the vehicle. Make. Model. Color. Body type. A fingerprint of distinguishing detail: a roof rack, a bumper sticker, a body shop dent, a temporary paper plate. The record is uploaded to a cloud server two thousand miles away. It can be queried by police agencies, public and federal, in any of fifty states.
There is one of these cameras at Kimball Junction. There are twenty five more.
They ring the Park City basin from the I 80 corridors in the north and west to the Jordanelle and Mayflower in the south, with clusters at every road into town: the Coalville and Hoytsville approaches on eastbound I 80, the Pinebrook and Jeremy Ranch turnoffs on the western approach, the Mayflower and Empire Pass corridors on US 40, the Kimball Junction roundabouts on SR 224, the Old Town entrance on Marsac Avenue, the Quinn's Junction connector on UT 248. Some are paired, spaced just far enough apart to capture vehicles in both directions. Others sit at choke points where every driver must pass.
Together, these twenty six cameras form a closed surveillance perimeter around an American resort municipality of roughly 8,500 residents and tens of thousands of seasonal workers and visitors. The system runs twenty four hours a day. It has read, on the available evidence, hundreds of millions of plates.
The Park City public has never voted on it. Park City has not, in any meaningful way, told its residents the system exists.
What an ALPR Captures
The phrase license plate reader understates the system. An automated license plate reader does not capture identity. It captures movement.
A single read records a vehicle at a place at a time. Two reads describe a route. A month of reads, against a perimeter as dense as Park City's, describes a routine. When a person leaves home. Where they work. Which side of the basin they sleep on. Which medical facilities they visit. Which house of worship they attend. Which donor event, labor meeting, or protest they parked near. Who they travel with, inferred from the vehicles that recur within minutes of theirs at the same intersections.
Flock Safety, the Atlanta based vendor that supplies twenty four of the twenty six cameras around the basin, markets this layered capability under the name Vehicle Fingerprint. The system goes beyond the plate, capturing make, model, color, body type, distinguishing decals, bumper stickers, roof racks, aftermarket modifications, dents, damage patterns, and even temporary paper plates. The fingerprint is what lets the network re identify a vehicle when the plate is unreadable, or recover a route from a partial sighting on the other side of the country.
The network is the second feature that distinguishes ALPR systems from older traffic cameras. Flock's Nationwide Lookup pathway lets any participating agency, anywhere in the United States, query data captured anywhere on the network. A police department in Texas, Florida, or Virginia, and through certain federal partnerships a federal agency, can search Park City's plate captures without notifying Park City, without local consent, and without leaving an audit trail visible to Park City residents unless the local agency has chosen to publish one.
None of the four agencies operating cameras around the basin, namely the Park City Police Department, the Summit County Sheriff's Office, the Wasatch County Sheriff's Office, and the Heber City Police Department, has enabled the public facing transparency portal Flock provides for its customer agencies. None has published query logs. None has published a data sharing list.
The cameras run regardless. The data is captured regardless. The network is queryable regardless.
The Perimeter
A geospatial review of public mapping data, pulled from OpenStreetMap on April 26, 2026, identifies twenty six automated license plate readers positioned around the Park City basin and the highway corridors that feed into it. Twenty four are tagged Flock Safety. Two are tagged Motorola Solutions, the parent company of the Vigilant platform Park City Police later acknowledged operating.
A point in polygon check against the State of Utah's authoritative municipal boundary file, published by the Utah Automated Geographic Reference Center, finds eight of the twenty six cameras inside Park City's corporate limits. They appear along SR 224, Deer Valley Drive, the Empire Pass corridor, and the southern annexed pockets toward Quinn's Junction. The remaining eighteen cameras sit in unincorporated Summit and Wasatch counties. Every road into or out of Park City passes at least one.
Twenty three of the twenty six cameras have no documented purchaser in any public record. Two are Vigilant units consistent with Wasatch County's $100,000 Vigilant payment in fiscal year 2023. One is roughly attributable to Heber City's $24,000 Flock payment in fiscal year 2026. The other twenty three sit in the basin under no agency's name.
The cameras stand in plain sight. They are bolted to power poles, road signs, and street furniture along the most photographed scenic corridor in northern Utah. They have been visible for years. They were not, until recently, named.
The Community Got There First
Park City residents found the perimeter before any agency described it.
The OpenStreetMap deployment record makes the timing precise. Between April 23 and April 27, 2025, a user named Ferrett documented nine ALPR cameras in the Park City and Heber Valley corridors. It was the first formal record of the perimeter, made by a private citizen with a phone. Then nine months of silence. On January 25, 2026, a post on the r/ParkCity subreddit titled "Flock cameras in Park City" drew 126 upvotes and 82 comments. The author identified Flock devices on SR 224 and SR 248 entering town, described the artificial intelligence features the cameras advertise (make, model, occupant count, identifying stickers), and pointed neighbors to DeFlock.org, the crowdsourced national mapping project. Five days later, a user named Tommy Tran began a second wave, importing ten cameras between January 30 and 31 through the DeFlock app. A final camera was added on February 14.
Two waves. Four mappers. Twenty cameras documented from outside the agencies that operated them.
The agencies issued no parallel disclosure during either wave. By April 2026, the cameras had entered casual local conversation. In a Reddit thread about a manhunt in Summit County, a top voted comment asked: "WTH are we paying for drones, training, thermal tech, Flock cameras etc.. when dangerous felons simply stroll away from these Keystone Kops?"
The community knew. The community had known for at least a year. What the community did not have was a written acknowledgment from any agency that the cameras existed at all.
One Sentence, in February
That acknowledgment, when it came, came in a single sentence inside a procurement notice for a software upgrade.
The notice was titled "Command Central Evidence Plus and WatchGuard Cloud Storage Solution." It was filed on February 6, 2025, signed by Park City Police Captain Rob McKinney, and posted to the city's RFP portal for a seven day comment window. Its purpose was to ask the City Council to waive competitive bidding and award $78,754 to Motorola Solutions, on the grounds that Motorola was the only vendor that integrated with the systems Park City Police already had. Among those existing systems, the notice listed:
"This software would also allow PCPD to integrate their current license plate reader system, Motorola Vigilant, to better share information."
One clause. One sentence. Buried inside the justification text of a routine sole source waiver, posted to a government RFP portal almost no one reads, during a seven day comment window almost no one tracked.
That clause is, on the available public record, the only formal statement by any of the four agencies that they operate a license plate reader system at all. The notice did not list locations. It did not name partners. It did not estimate a deployment count. It did not announce a public hearing. It treated the existence of the system as already known, which, inside the agency, it presumably was.
The notice has been posted, public, and unchallenged since.
The Omission
One month before Captain McKinney signed the procurement notice, the Park City Police Department published its 2024 Annual Report, a 22 page community facing document directed at residents.
The report lists the department's technology stack with care. Body cameras. In car cameras. Communications equipment. The Unmanned Aerial System program. The records management partnership with the Spillman platform. The partnership with the Utah Statewide Intelligence and Analysis Center.
It does not mention the license plate reader system. The phrase "license plate" appears nowhere in the document. Captain McKinney, who signed the procurement notice in February, is named in the report as one of the bureau commanders responsible for the police budget.
The City's FY2025 budget book, Volume I and Volume II combined, more than thirty thousand lines, names automated license plate recognition systems exactly twice. Both references appear in the Parking section, describing technology improvements after parking enforcement was brought in house. Park City's parking ALPR program is disclosed openly in its operating budget. The police program is disclosed only in the sole source waiver, by accident, in a sentence that reads as if it were already common knowledge.
It was, in fact, common knowledge: to neighbors with phones, to OpenStreetMap users, to the moderators of the r/ParkCity subreddit. It was not common knowledge to the public the police department was nominally informing.
The Money, Half Visible
Every dollar that paid for this network came from a Park City region taxpayer. The cameras, the cloud storage, the analytics, the integration software, the network access fees: all of it appears, somewhere, in a city or county budget that residents fund.
What does not appear, in any public ledger searchable on Utah's transparency website, is the word Flock.
The state's transparency website tells two stories about how Park City region agencies have paid for license plate readers. The first is in plain language. Wasatch County paid Vigilant Solutions $100,000 in fiscal year 2023. Summit County paid Vigilant Solutions LLC $10,280 the same year. Both records appear in Transparent Utah under the vendor name itself. They are the only direct ALPR vendor payments by any of the four agencies operating in the basin, and they are consistent with the two Motorola/Vigilant cameras visible on the OSM map, at Kimball Junction and East Jordanelle.
The second story is the twenty four Flock Safety cameras.
Park City Police, Summit County Sheriff, and Wasatch County Sheriff have collectively paid Flock Safety, Flock Group Inc, or any other Flock branded vendor a total of zero dollars across six fiscal years. Heber City Police is the lone exception: $24,000 in FY2026, the first appearance of any Flock payment in the region. The Heber City Police Department has not published an ALPR usage policy on its website, which appears to be in conflict with Utah Code § 41 6a 2003(2)(a). A public records request seeking the policy or written confirmation that none exists is pending.
What Park City has paid, in growing amounts, is Insight Public Sector.
| Fiscal year | Amount |
|---|---|
| FY2021 | $66,085 |
| FY2022 | $76,203 |
| FY2023 | $114,594 |
| FY2024 | $130,570 |
| FY2025 | $169,675 |
| FY2026 (partial) | $21,997 |
| Total | $579,125 |
The annual figure grew 2.5× in four years. Across the same period, Park City paid CDW Government, another large IT distributor, more than $2.59 million. Summit County, Wasatch County, and Heber City together paid the same two vendors more than $1.5 million additional.
Insight Enterprises (NASDAQ: NSIT), the parent of Insight Public Sector, is a Fortune 500 IT distributor that reported $8.70 billion in revenue in 2024. Its public sector arm holds cooperative purchasing contracts with OMNIA Partners, Sourcewell, NASPO ValuePoint, and the federal General Services Administration. Through those contracts, a single Insight invoice line item can include Microsoft Office licenses, Cisco networking gear, Dell laptops, cloud storage, professional services, and a Flock Safety subscription. Flock's own published price list under OMNIA contract R250203, in effect from April 2025 through March 2028, names Insight Public Sector and CDW Government as authorized resellers.
For the buyer, the structure is convenient: one vendor relationship, one approved contract, one invoice. For the public record, the structure is opaque by construction. A purchase that, made directly from Flock, would appear in Transparent Utah as "Flock Group Inc DBA Flock Safety," appears instead as "Insight Public Sector, Inc.": indistinguishable, at the line item level visible to the public, from a software license renewal.
A Flock subscription bought through a reseller appears in the public record as routine IT spend.
This is not proof that any specific Park City payment to Insight Public Sector funded a Flock camera. It is proof that the public record is structured in a way that would not surface such a payment if it occurred. The detail lives inside the agencies' purchase orders and invoices, records that Utah's Government Records Access and Management Act obligates the city to disclose on request but not to publish. A public records request for those line items is pending.
The Law That Was Supposed to Catch This
Utah law is not silent on who may operate a license plate reader and how.
The Utah Automatic License Plate Reader System Act, codified at Utah Code §§ 41 6a 2001 through 41 6a 2007, sets out the framework. Section 41 6a 2003 requires every agency operating an ALPR system to publish a usage policy on a public website. Section 41 6a 2005 limits permitted use of ALPR data to a closed list (stolen vehicles, AMBER and Silver Alerts, missing persons, outstanding warrants, registration verification, toll collection, parking enforcement) and requires reasonable suspicion before any query relevant to a criminal investigation. Section 41 6a 2007 caps retention of captured data at nine months unless preserved for a warrant, preservation request, or disclosure order.
The framework was strengthened in May 2025. House Bill 468, signed during the 2025 legislative session and effective May 7, 2025, hardened policy and reporting requirements and assigned annual reporting oversight to the Utah Commission on Criminal and Juvenile Justice. The statute, on its face, contemplates a system in which every agency operating ALPRs is identifiable, every policy is published, every query is logged, and every year a report is filed.
The available record does not show that this is happening in Park City.
The Brackets They Forgot to Fill In
Each of the four agencies operating cameras in the basin has a published ALPR policy somewhere. The policies themselves are nearly identical Lexipol templates and disclose almost nothing about what the agencies actually run.
Lexipol, a private company that supplies law enforcement policy manuals to thousands of departments nationwide, ships its templates with literal placeholder text in square brackets, like [Department/Office], [Chief/Sheriff], [department/office] personnel, that the subscribing agency is expected to overwrite with its own name before the policy is adopted. The brackets are there so the customizer knows where to type.
The version of Summit County Sheriff's Policy 460, currently posted on the county's document portal as the only ALPR policy the agency has made public, reads, verbatim:
"No member of this [department/office] shall operate ALPR equipment or access ALPR data without first completing [department/office] approved training."
The brackets are in the original. So is the rest of the boilerplate: "Use of an ALPR is restricted to the purposes outlined below. [Department/Office] personnel shall not use or allow others to use the equipment…" "No ALPR operator may access confidential [department/office], state, or federal data unless otherwise authorized to do so."
The policy that supposedly governs the conduct of every Summit County deputy does not, on its own terms, say which department or office it governs. The brackets remained because no one filled them in. The Lexipol footer date is February 10, 2026, within weeks of the Reddit thread that put the cameras into local conversation. The document contains no sheriff's order, no county council resolution, and no internal adoption record. There is no published audit log. There is no published Special Use Permit, despite the policy itself promising both. Summit County's own self imposed transparency clause states that the policy and any UDOT permits obtained for stationary ALPRs are to be published on the county website or the Utah Public Notice Website. A direct check of the Utah Public Notice Website on April 26, 2026 returned no ALPR Special Use Permits for Summit County. The promise is on paper. The publication has not happened.
What Summit County uploaded is not a policy. It appears to be a screenshot of the absence of one.
[Department/Office] placeholders appear on every page. Source document on summitcountyutah.gov. Local copy preserved by Insanity Wolf on April 26, 2026: summit-county-policy-460.pdf.The Park City Police Department's policy is older but no more specific. Policy 429, "Automated License Plate Readers (ALPRs)" sits on page 359 of a 704 page Lexipol managed manual, with a revision date of April 23, 2024. It is procedurally compliant. It is also vendor anonymous: it does not name Motorola Vigilant, the system the department subsequently acknowledged operating in the February 2025 procurement waiver. It does not identify a single camera location. It does not list the agencies the department shares data with.
What Policy 429 does contain is language the Utah Privacy Office has already flagged. Section 429.2 authorizes the use of ALPR data to "gather information related to active warrants, homeland security, electronic surveillance, suspect interdiction, and stolen property recovery." Section 429.3(b) states: "An ALPR may be used in conjunction with any routine patrol operation or official investigation. Reasonable suspicion or probable cause is not required before using an ALPR." The Wasatch County Sheriff's Office Policy 427, dated December 12, 2023, contains the identical language, line for line. Both are Lexipol templates from an older revision cycle. Both remain posted as the current operative policy.
The Utah Privacy Office's 2025 audit, report 25 04, reviewed two unnamed Utah law enforcement agencies and found that one had a policy authorizing ALPR use for "homeland security and electronic surveillance," purposes that exceed the closed list in Utah Code § 41 6a 2005(1). The same audit found a policy that "failed to require reasonable suspicion for criminal investigations." The agency names in the report are redacted. The phrases are exact matches for the Park City and Wasatch policy texts.
No ALPR policy is publicly findable on the Heber City Police Department's website; a public records request seeking the policy or written confirmation that none exists is pending. Flock Safety also offers each customer agency the option to enable a public transparency portal at transparency.flocksafety.com, listing camera counts, search statistics, and data sharing partners. None of the four agencies have enabled portals. Direct checks of every plausible URL slug return HTTP 403.
The Privacy Office did not name the agencies. The agencies have not named themselves.
The Permit That Doesn't Travel With the Cameras
Cameras installed within the right of way of a state highway require a Special Use Permit from the Utah Department of Transportation. The agency's published guidance is direct:
"Only one ALPRS Special Use Permit is required for each municipality. Multiple ALPRS may be installed within the law enforcement's jurisdiction using the approved ALPRS Special Use Permit."
One permit per agency. Any number of cameras. Applications submitted by email to a UDOT inbox, not through any public portal. There is no published list of which agencies have applied or been approved.
UDOT does maintain a public ArcGIS database of every encroachment permit, the second permit required for any actual construction work in state right of way. A pull of all 1,425 encroachment permits in the Park City basin returned, across applicant name, contractor, beneficiary, and full purpose text, no mention of Flock, Motorola, Vigilant, ALPR, license plate, or plate reader. The construction work that placed the cameras on UDOT controlled poles, when it happened, appears to have been filed under generic infrastructure language.
One 2019 record demonstrates the precedent. UDOT permit 91070, sponsored by a Park City staff member and issued to the Salt Lake City data company Blyncsy, authorized the installation of "traffic monitoring sensors around the area of the Snyderville Basin to provide volumes and origin and destination information for the county dashboard." The original system used cellular and Bluetooth tracking, not plate readers. Blyncsy is now a documented partner of Rekor, one of Flock's main competitors. The infrastructure pathway from "transit data sensor" to "license plate reader" is a single contract amendment.
That precedent matters now. In April 2026, UDOT and High Valley Transit broke ground on the SR 224 Bus Rapid Transit project, with Stacy and Witbeck Inc. as the prime contractor. New conduit, new poles, new electrical infrastructure, all installed along the same corridor where Flock cameras have been organically appearing for two years. The permit trail required to verify what is being installed where, by whom, with what data collection capability, and under whose authority, is not public.
The Mayflower Question
South of Park City, the surveillance ring crosses into a different governance regime.
The Mayflower Mountain Resort area, where four of the twenty six mapped cameras cluster, sits inside a Military Installation Development Authority project area. MIDA is a state level entity created by the Utah Legislature in 2007. It has its own board, its own contracting authority, and its own tax increment financing mechanism that routes development around standard county procurement. MIDA, Wasatch County, and Extell Development executed a three way agreement governing the Mayflower buildout in 2023.
The Wasatch County Sheriff has jurisdiction over the project area. The Sheriff has Policy 427 on its website, no Flock spending in the public record, and at least four Flock cameras in territory the agreement governs.
Whether MIDA, Extell, or another party installed those cameras and granted the Sheriff query access in lieu of the Sheriff buying its own equipment is the most plausible explanation for the gap between camera count and spending record. It is not the only possible explanation. The agreement that would prove or disprove it is not public. A records request to MIDA seeking law enforcement related contracts and surveillance technology agreements within the project area is pending.
What is known: the cameras are there. What is plausible but unproven: someone other than the Sheriff bought them.
What the Gap Enables
The disclosure failures are not procedural. They map directly onto the four categories of harm Utah's ALPR statute was written to prevent.
Warrantless long term tracking tied to a person. Section 41 6a 2005(2) limits ALPR queries to those supported by reasonable suspicion of relevance to a criminal investigation. Without a published policy that codifies the reasonable suspicion standard internally, and without query logs available for outside review, the line between targeted lookup and continuous tracking of an identifiable individual becomes invisible. A networked ALPR perimeter can reconstruct a person's movements across weeks or months: every entry into the basin, every drive past Deer Valley, every late night return on US 40, from data captured without a warrant.
Data retention beyond the statutory cap. Section 41 6a 2007 caps retention at nine months unless data is subject to a warrant, preservation request, or disclosure order. Wasatch County's Policy 427 reproduces the cap; the other three agencies have no posted policy that confirms the cap is honored. The Utah Privacy Office's 2025 04 audit reviewed two unnamed agencies and found that neither had created a formal retention schedule. Without the schedule, the cap is an aspiration. Without audit, the cap is unverifiable.
Access without audit. The same statute requires that every query be logged: querying officer, time, purpose, case or incident number. The Park City and Wasatch policies reproduce the requirement. Summit's posted document includes it but in unfilled template form. None of the four agencies has published audit logs, summary statistics, or any other artifact that would permit outside verification. The Flock Nationwide Lookup network, which lets any participating agency query data captured anywhere on the network, magnifies the exposure: a query from an out of state agency reading Park City plate captures leaves no Utah side audit trail at all unless the local agency has configured one.
Use outside the statutory framework. Section 41 6a 2005(1) limits permitted ALPR use to a closed list. The Privacy Office's 2025 audit found that one of the two unnamed agencies it reviewed had a policy authorizing ALPR use for "homeland security and electronic surveillance," purposes outside that list. That phrase is verbatim language from the Park City and Wasatch policy documents.
These are not theoretical risks. They are the four specific failure modes the legislature wrote the statute to prevent. The statute prevents nothing it cannot see, and the agencies operating the cameras have not made themselves visible.
What It Looks Like in Other Towns
Park City is not the first municipality to discover the gap between Flock's marketing and how its network actually behaves. Several have already discovered it. Most have reversed course.
In Mountain View, California, the city council voted unanimously on February 24, 2026, to terminate its Flock Safety contract. The trigger: between August and November 2024, several federal law enforcement agencies had accessed the city's ALPR data through a "Nationwide Lookup" search setting that Flock had silently enabled without the police department's knowledge. From December 2024 through December 2025, more than 250 unapproved agencies had run approximately 600,000 searches against Mountain View's records.
In Santa Clara County, the Board of Supervisors adopted a new surveillance use policy in early 2026, prohibiting the Sheriff's Office from contracting with Flock Safety. Camera logs had shown the Las Vegas Metropolitan Police Department searching the Santa Clara network 5,600 times in a single month: an out of state agency querying California plate captures with no local notification or consent. Santa Cruz, Los Altos Hills, and Mountain View all terminated their contracts in January and February 2026.
In Richmond, California, the police department discovered in October 2025 that federal agencies had been accessing local data through Flock's "National Lookup" feature. The Richmond City Council voted in March 2026 to extend the contract only on a short timeline while staff explored alternative vendors. In Palo Alto, hundreds of out of state agencies were found to have searched the city's plate data. In Menlo Park, the police department appeared to have shared plate data out of state in apparent violation of California law.
The aggregate scale of unauthorized access is now a matter of public record. A class action lawsuit filed by California drivers in early 2026 alleges that Flock allowed law enforcement agencies from outside California to query the San Francisco Police Department's database more than 1.6 million times between August 2024 and February 2025, and the Los Altos database more than a million times across 2024 and 2025. The plaintiffs allege the searches happened without consent, without notification, and without local audit.
The vendor itself has been the source of additional exposures. 404 Media reported in 2025 that sixty Flock Condor cameras were left fully exposed on the open internet, no password required, including a camera surveilling children at a playground. The same outlet reported that Flock account credentials had surfaced in infostealer malware dumps, meaning private criminals could log in as a participating police officer and run queries the officer's own department would not authorize. United States Senator Ron Wyden of Oregon asked the Federal Trade Commission to investigate. In Texas, separate reporting documented ALPR systems being used as mobile debt collection tools, with police running plates against private collection lists.
What every one of these stories has in common is structural, not moral: in each case, the local police department learned about the access after the access had already happened. Mountain View did not authorize federal agencies into its data; Flock did, by flipping a default. Richmond did not consent to the National Lookup pathway; it found out months later, in October. Santa Clara County did not approve Las Vegas Metro's 5,600 monthly queries; the searches showed up in audit logs the county had to ask for. The settings that opened these systems to outsiders were configured by the vendor. The agencies whose names sat on the contracts had no role in those decisions and, in several cases, no way to see them.
This is the part of the precedent that should disquiet anyone reading this in Park City.
The agencies are customers of the surveillance network, not its operators.
The question is not whether Park City Police are operating a surveillance system in bad faith. The question is whether the four agencies operating the twenty six cameras around the basin would know if a Mountain View style misconfiguration were active here right now. They have not enabled the public Flock transparency portals. They have not published query logs. They have not published Special Use Permit lists. The infrastructure is configured by the vendor; the network is administered by the vendor; the data sharing partners are determined by the vendor's defaults. The captain who signed the procurement waiver does not have visibility into any of it. Park City, Kansas Police Department has enabled its public Flock transparency portal. Park City, Utah has not.
In Park City, the route by which captured data travels appears to run through Motorola's Spillman records system. The February 2025 procurement waiver justified the $78,754 award to Motorola on the grounds that Motorola was the only vendor that integrates with Spillman, the records platform shared county wide. The waiver text said the new software would let the department "integrate their current license plate reader system, Motorola Vigilant, to better share information." That phrase is not idle. It describes the architectural intent: surveillance data captured at Kimball Junction and Mayflower flows into a shared records environment that other agencies, including federal partners, can access depending on the configuration.
What This Could Mean for the Basin
The Park City basin is structurally vulnerable to the failure modes documented in the towns above, and to several specific to it.
The Sundance Film Festival brings filmmakers, journalists, foreign nationals, activists, and political figures through SR 224 and US 40 every January, every plate read into a system whose data sharing partners are not publicly disclosed. The basin holds some of the densest concentrations of substance treatment and behavioral health facilities in the Mountain West; patients arrive and depart through the same surveilled corridors. Tens of thousands of service workers commute into the resort towns from the Heber Valley and Coalville every shift; the same corridors that capture the plates of executives capture every shift worker, contractor, and seasonal employee who keeps the lifts and hotels running, and an out of state agency with Flock query access does not need a warrant to know which apartments those vehicles return to at night.
None of this requires misuse. It requires only the system to be operating as designed.
The Timeline
[Department/Office] placeholders.The Questions That Remain
The available record establishes the following:
- There are twenty six automated license plate readers around the Park City basin. The hardware is real, geolocated, and visible on public mapping data.
- Twenty three of those cameras have no documented purchaser in any public spending record.
- The only formal acknowledgment that any Park City region agency operates an ALPR system is one sentence inside one procurement notice, signed by one police captain, in February 2025.
- No agency has published its query logs, data sharing partners, retention schedule, or Special Use Permit.
- Two of the four agencies have published policies containing language the Utah Privacy Office has already flagged as exceeding the statute. A third has published a document still containing Lexipol placeholder brackets. A fourth appears to have published nothing at all.
- Other municipalities running the same vendor have already been exposed to large scale unauthorized access, discovered after the fact, in every case.
What the available record does not establish, and what residents of the Park City basin are entitled to know:
- Who paid for the twenty three Flock Safety cameras for which no public spending record exists?
- Which agencies operate them, day to day, and which agencies have query access?
- How many plate captures have been recorded against Park City area drivers across the last twenty four months, and how many have been queried by agencies outside Utah?
- Has the Flock Nationwide Lookup pathway been enabled, by default or otherwise, for any of the four agencies' data?
- Are the cameras inside MIDA's Mayflower project area owned by the Sheriff, by MIDA, or by a private developer with a query access agreement?
- Have all four agencies filed the annual reports required by Utah Code § 41 6a 2004 and HB 468 with the Commission on Criminal and Juvenile Justice?
- Will Park City Police, Summit County, Wasatch County, and Heber City publish the Special Use Permits their policies promise, and the audit logs the statute requires?
- Will the agencies enable the public facing Flock transparency portals available at no cost?
These questions are answerable. The records that answer them exist inside the agencies operating the system. The agencies have not chosen to release them. Insanity Wolf has filed the public records requests that would close the gap.
Who can see what those cameras see?
There is no dispute that the cameras exist. Twenty six cameras, twenty four hours a day, photographing every car that crosses the basin: that part is settled. There is no public record of who paid for twenty four of them. The published policies of the agencies operating the system contain language the state's own Privacy Office has flagged as exceeding statutory authority. The only public acknowledgment that any of this is happening is one sentence, signed by one captain, posted in February 2025 to a portal almost no one reads. The cameras have been running ever since. The residents who paid for them have not been told what they paid for. They have not been asked if they consent. Until they are, the system runs in their name and at their expense, and the only people who know what it sees are the people it sees with.