Hawley's letter to Flock turns retention policy into a discovery document

Producing a total count of confirmed misuse is a schema question before it is a records question. Hawley's annex asks for that number along with a description of Flock's data security practices ^[6]. A vendor can answer it only if every query it has ever served is stored with the identity of the person who ran it, a reason captured at the moment of the search, and a retention window long enough that someone can go back and tally. If any of those fields is missing, the truthful reply to a Senate subcommittee is that the number cannot be established, and that lands worse than a large number would.

The letter itself suggests tallying is possible after the fact. It cites a Milwaukee officer who allegedly ran his girlfriend's plate 124 times and her former boyfriend's plate 55 times ^[9], which is 179 searches against two plates by one user ^[16], and a Kentucky officer arrested over more than 2,000 searches of his ex-girlfriend's information ^[10]. So someone could count. Nobody interrupted the queries while they were running, and 2,000 repetitions against one plate is not a subtle signal; it is what a rate limit or a required case number catches in the first week.

Then there is the request for internal data retention policies and technical documentation ^[7], with production due by the September 8, 2026 date printed in the letter ^[8]. A retention schedule normally lives on a trust page and is enforced approximately. Handed to a subcommittee next to a misuse count, it is read as an assertion about what the system actually deletes and when. Two versions of that document exist in the world: the one a scheduled job already enforces, and the one written in the week before a deadline. The distance between those two is the exposure.

The constitutional argument in the letter points at aggregation rather than at the sensor. Hawley writes that these networks harness artificial intelligence to pool what they capture into a national database that customers can search ^[4], and that the overwhelming majority of Americans in those records did nothing wrong ^[5]. That reasoning does not stay with license plates. Any product that takes data collected for one customer and folds it into an index every other customer can query has the same shape, and the same problem: most of the records describe people no one is investigating, held for reasons no one wrote down at collection time. Access audits and short default retention are not the compliance layer on top of that design. They are the only parts of it a senator can be shown.