Price the Audit Log, Not the Policy

Capture Corner is the premium BD intelligence companion to Mission Meets Tech. Public-record sourced. Independent analysis. Not a recommendation, not vendor advocacy, not capture material. Built for federal health BD, capture, and proposal leaders who need analytical depth, not headlines.

This issue is the companion to "A Plate Read Launches an Aircraft," published this week. The public piece reads the documents and the trajectory. This one works the buy: which grant programs now pay for plate readers and drone-as-first-responder systems and what that does to physical security scope on VA and DHA work, where false-positive acceptance criteria get set in solicitations and why that creates a protestable term, the audit-log language to demand as a deliverable instead of a reported feature, the data ownership and termination clauses worth pricing before award, the retention-period language that stopped being a privacy control on June 29, and the federal-access opt-out that has to be a contract term because a setting is not a control.

---

1. The picture at a glance

Field	Detail
Federal buyers on record	VA (two awards, 36C25023P1216 and 36C25025P1681), Interior/US Park Police (140D0425P0230) [CC1]
Total federal obligation, Flock Group Inc.	Roughly $297,050 across three prime awards
Platform authorization	FedRAMP Certified, 20x, Class B (Low baseline), package FR2527955211, since July 25, 2025 [CC2]
Governing records notice	103VA07B, republished 89 FR 23638, April 4, 2024. No reference to cameras, plate readers, drones, or aerial systems [CC3]
Constitutional development	Chatrie v. United States, 609 U.S. ___ , decided June 29, 2026, 6-3 [CC4]
Pending federal restriction	PRIVACY Act, H.R. introduced July 15, 2026, House Judiciary and House Oversight [CC5]
Aerial market gate	FAA Part 91 DFR waivers; more issued April 2025 to February 2026 than in the prior seven years combined; 1,000-plus agencies holding [CC6]
Product convergence	Flock acquired Aerodome October 2024 for over $300M; Alpha dispatches on 911, gunshot, or plate-reader hit [CC7][CC8]

Confidence: High on the awards, the FedRAMP package, the records notice, and Chatrie. All four are primary-source verified. Medium on the FAA waiver counts, which come from EFF's reading of FAA-provided figures, not an FAA publication.

The lead finding for a capture team is that the privacy control in this market is not a policy, a certification, or a vendor assurance. It is a log, and whether you can read it is a contract term. Three California jurisdictions set restrictions their platforms did not enforce. [CC16] Every one of them could produce a written policy. None of them could produce the query log without an audit.

That is the discriminator to write into a requirement and the discriminator to bid against.

---

2. Where the money comes from

Confidence: Medium. The statutory and appropriations figures below trace to secondary legal and trade analysis, not to appropriations text I verified line by line for this brief. Verify against the FY2026 Joint Explanatory Statement and the applicable NOFO before pricing a bid on them.

The FY2026 NDAA amended the Omnibus Crime Control and Safe Streets Act to make unmanned aircraft systems and counter-UAS explicitly grant-eligible. That is the structural change most vendors have not priced. It converts a local surveillance purchase into a federally reimbursable line item, which means the buying decision and the funding decision sit in different places and move on different clocks.

Three passthroughs carry most of it: DOJ Byrne JAG, COPS Technology and Equipment, and DHS/FEMA Homeland Security Grant Program, with Byrne JAG the largest by a wide margin. [CC13]

What this does to federal health capture specifically. VA and DHA physical security scope has historically been priced as guard services, access control, and CCTV. A grant-eligible sensor market sitting alongside a federal facility market creates two effects worth modeling:

• Requirement language migrates. SLTT solicitations move faster than federal ones, so the acceptance criteria, data-handling clauses, and audit provisions that appear in a county sheriff's RFP in Q1 tend to show up in federal facility security scope two to four quarters later. Reading SLTT solicitations is cheap market research for a federal pursuit.
• Incumbency forms outside your view. A vendor that wins a no-cost pilot at a municipality adjacent to a VA medical center builds an operational relationship with the same regional law enforcement partners the VA Police coordinate with. That is not a contract, and it is a reference.

The no-cost pilot is the mechanism to understand. The pattern documented in municipal records is a free or heavily discounted trial that converts to a multi-year paid contract unless the buyer affirmatively withdraws by a date. A governing body votes on a pilot. It does not vote on the conversion. If you are bidding against that structure, the competitive fact is that the incumbent arrives with deployed hardware and an installed integration before the competitive action exists. [CC14]

---

3. The field, and where the gates are

Confidence: Medium. Vendor positions below are drawn from public reporting and company materials. Treat the competitive read as analysis.

Player	Position	Gate that matters
Flock Safety	Largest ALPR install base; Alpha DFR after the Aerodome acquisition; Nova people-lookup platform	FedRAMP Low baseline caps the federal data it can carry; sharing-default architecture is now a live procurement question
Skydio	Blue UAS Cleared List across its lineup; R10 positioned as the cleared DFR system	Blue UAS status is grant eligibility, not a badge
Motorola Solutions	CAPE software plus airframes; Plano five-year award July 27, 2026; Yonkers running Nokia airframes on CAPE	Software layer is the durable position, airframe is substitutable
BRINC	Equipment plus software plus training bundles at municipal scale	Training-inclusive delivery is a differentiator in agencies with no aviation unit
Axon	Evidence.com FedRAMP authorized; Axon Air integration; Lightpole ALPR entry	Evidence management is the sticky layer
Leonardo (ELSAG)	SignalTrace device-signal collection add-on; US arm holds USSOCOM and GSA contracts [CC9]	Federal vehicles already in place; device collection sits outside the requirement language currently in circulation

Two competitive observations worth carrying into a bid review.

The airframe is not the position. Yonkers runs Nokia aircraft on Motorola software, and Plano bought a Motorola program. [CC12] A team that bids hardware into this market is bidding the substitutable layer. The durable positions are the dispatch software, the evidence chain, and the integration into an existing records management or computer-aided dispatch system.

Leonardo is the name missing from most competitive assessments. SignalTrace is a Bluetooth, Wi-Fi, and RFID collection add-on for plate reader infrastructure, first reported in June, and it belongs to a company that already holds federal vehicles. Much of the public conversation this month has misattributed that capability to Flock. If your competitive intelligence file has that wrong, your requirement language will be aimed at the wrong vendor and your teaming decision will be built on a false picture of who can actually deliver device-level collection.

---

4. The six terms to price before award

Confidence: High on the underlying facts each term responds to. The contract language framing is my analytical construction.

Each of these is a place where a buyer either specifies a control or inherits a vendor default. Every one of them has a documented failure behind it.

1. Audit-log access as a deliverable, not a feature. The failure it answers: Oxnard, Ventura County, San Francisco, Pasadena, and Illinois all learned what had happened in their data from an audit, and in Pasadena's case corrected a public statement afterward. A vendor-generated report substitutes the seller's account of the log for the log. The term should specify the buyer's ability to export the complete query log, including querying agency, authority asserted, justification text, and timestamp, on demand and without vendor mediation, in a machine-readable format, for the full retention period.

2. Enumerated query authorities. Who may query, under what authority, is a list. If the list lives in a settings panel, it is a preference. If it lives in the contract, it is a control. For a federal health facility, this is also the term that connects to the Privacy Act, because a routine use is exactly an enumerated disclosure authority and the two documents should say the same thing.

3. Federal-access opt-out as a contract term. Flock's stated position is that federal sharing is disabled by default and requires explicit local grant. Three jurisdictions had set restrictions and were queried anyway. The distinction that matters at award is between a setting the vendor can change with a feature release and a term the vendor cannot change without a modification.

4. Data ownership and disposition at termination. Oakland County commissioners amended a drone deal specifically to guarantee the sheriff owned the data. That amendment happened because someone read the default. Specify ownership, export format, deletion verification, and the vendor's obligation to certify deletion at termination or non-renewal.

5. Retention as a records provision, not a privacy control. See Section 5. This one changed on June 29.

6. False-positive threshold in the acceptance criteria. See Section 6. This is the protestable one.

---

5. What Chatrie did to retention language

Confidence: High on the holding. Medium on the acquisition consequence, which is my read.

On June 29, 2026, the Supreme Court held 6-3 in Chatrie v. United States that police conduct a Fourth Amendment search when they acquire a person's cell-phone location history, and it rejected the government's argument that a narrow, time-limited slice of a larger dataset falls outside the Amendment [CC4].

The reason this belongs in a capture brief and not a legal one: retention windows have been doing double duty in this market as both a records-management provision and a privacy control, and only one of those two jobs survived the decision.

A federal district court upheld Norfolk's plate reader network in January on reasoning that a rolling 21-day window did not capture enough of a person's life to matter constitutionally [CC10]. That case is now at the Fourth Circuit, the same circuit Chatrie came from, and Norfolk requested additional time specifically to respond to the decision [CC11].

Three practical consequences.

A requirement that specifies a retention period and stops there has specified a storage cost, not a safeguard. If your technical volume treats a 30-day window as the privacy answer, expect that to age badly inside the period of performance.

The question shifting into view is capability rather than use. The Institute for Justice is arguing that Chatrie moves the analysis toward what a system is able to collect instead of what officers actually pulled. Whether or not a court adopts it, that framing is already in requirement-writing circulation, and a system description that emphasizes restraint in use while the capability is unbounded is the profile most exposed to it.

Anything with a multi-year period of performance should carry a change-in-law clause that contemplates a retention or warrant requirement arriving mid-performance. Pricing a five-year DFR program in this environment without one is taking a regulatory position you were not paid to take.

---

6. The false-positive threshold, and why it is protestable

Confidence: Medium. The LAPD audit figures are from public reporting on the Inspector General's findings. The protest analysis is my construction.

The Los Angeles Police Department's Inspector General reviewed plate reader hot-list alerts over a two-month sample and found 161 incorrect stolen-vehicle flags against 337 correct ones. [CC15] Roughly one alert in three was wrong.

Here is the acquisition problem. In most solicitations for this class of system, accuracy shows up as a marketing claim in a capability statement, with no measurable acceptance criterion carrying a threshold, a test method, and a remedy. That produces three consequences a capture lead should be able to name in a bid/no-bid meeting.

It removes a discriminator. If the requirement does not specify a false-positive threshold, a bidder with a demonstrably better matching engine cannot price a premium for it, because the government has not created a place to evaluate it. Technical superiority with no evaluation hook is B&P spent on nothing.

It creates protest exposure for the government. A solicitation that evaluates accuracy without defining how accuracy is measured invites a challenge to the evaluation criteria's adequacy. If your competitor wins on an accuracy claim the RFP never defined a way to test, the evaluation record on that factor is thin.

It is the strongest question to ask in an industry day. Requesting that the government define a measurable accuracy threshold, a test protocol, and a remedy for exceedance is a question that improves the requirement and simultaneously advantages whoever can actually meet the threshold. That is the rare industry-day question that serves both sides, which is also why it usually gets answered.

Then extend the same logic upward. That matching logic is now mounted on an aircraft that dispatches on a plate hit and reads plates from two thousand feet. The error rate did not improve on the way up, and the consequence of an error changed.

---

7. The designation mechanism inside the privacy bill

Confidence: Medium. The bill text summary is from public reporting on introduction. Verify against the referred text before briefing it internally.

Representative Keith Self introduced the Protecting Rights in Video and Equipment Acquired Discovery Act on July 15, 2026. It would require a warrant before federal law enforcement queries state or local surveillance data, purge warrant-obtained data after thirty days, direct the creation of a federal list of covered surveillance technologies, and bar federal funds from buying or installing them, with exceptions [CC5].

Most coverage has treated this as a privacy bill. For a capture team it is something else.

A federal list of covered surveillance technologies is a designation process. Designation processes decide who is in scope, who is exempt, and what an exception costs to obtain. Section 848 supply chain restrictions and the Blue UAS Cleared List already demonstrate the pattern in the aerial market: a list that begins as a security measure becomes the eligibility gate that decides which vendors can be bought with federal money.

Watch three things. Whether the bill moves out of Judiciary. Whether the list construct survives markup, because that is the durable part even if the warrant requirement does not. And whether any exception language distinguishes facility-perimeter security from investigative network participation, because that distinction is the difference between a VA medical center being able to buy a camera at all and having to buy it from a different market.

---

8. What to do in the next ninety days

Federal health pursuits. If you are positioning physical security scope on VA or DHA work, pull 103VA07B and read it against whatever sensor scope is in your solution. A capability that the customer's own published records notice does not describe is a capability the customer may not be able to accept without a notice amendment, and a notice amendment is a schedule risk you should price rather than discover.

Solicitation review. For any active or forecast opportunity touching plate readers, cameras, or drone-as-first-responder capability, check for six things: audit-log export, enumerated query authorities, federal-access terms, data disposition at termination, retention with a stated purpose, and a defined accuracy threshold. Missing terms are questions to ask, and they are also where a protest lives if you lose to a claim the RFP never made testable.

Teaming. The durable layer is software and evidence chain, not airframe. If your team is assembled around a hardware position, look at what happens to it when the customer switches airframes and keeps the dispatch software.

Competitive files. Correct the SignalTrace attribution if you have it wrong. It is Leonardo's, not Flock's, and a requirement aimed at the wrong vendor is worse than no requirement.

---

Let's roll.

Mary

Mission Meets Tech Premium

---

Next Capture Corner: scheduled for the next major federal health or defense-health opportunity in active capture. Subscribers will receive an alert when the next issue publishes.

Capture Corner is an independent intelligence product. It is not affiliated with the Department of Veterans Affairs, the Department of War, the Defense Health Agency, or any company named here, and it is not connected to any offeror's bid strategy. Premium subscription includes access to the standing intelligence sidebar plus the searchable archive.

---

Sources

[CC1] USAspending.gov, spending_by_award API, recipient "Flock Group," FY21 to present, contract award types A/B/C/D. Award 140D0425P0230, Department of the Interior, $231,600, start September 25, 2025. Award 36C25023P1216, Department of Veterans Affairs, $44,450, start July 2, 2023. Award 36C25025P1681, Department of Veterans Affairs, $21,000, start September 18, 2025. https://www.usaspending.gov/

[CC2] FedRAMP Marketplace, Flock Safety Platform, package FR2527955211, FedRAMP Certified, 20x, Class B (Low), authorized July 25, 2025. https://www.fedramp.gov/marketplace/products/FR2527955211/

[CC3] Department of Veterans Affairs, "Privacy Act of 1974; System of Records," 89 FR 23638, April 4, 2024, full republication of 103VA07B. Full text checked August 9, 2026 for references to license plate readers, ALPR, cameras, drones, aircraft, and unmanned or aerial systems; none appear. https://www.federalregister.gov/documents/2024/04/04/2024-07137/privacy-act-of-1974-system-of-records

[CC4] Chatrie v. United States, No. 25-112, 609 U.S. ___ (June 29, 2026), Kagan, J., 6-3. https://www.supremecourt.gov/opinions/25pdf/25-112_0am4.pdf

[CC5] Protecting Rights in Video and Equipment Acquired Discovery (PRIVACY) Act, introduced by Rep. Keith Self (R-TX-3), July 15, 2026; referred to House Judiciary and House Oversight and Government Reform. Bill summary from public reporting on introduction; verify against referred text. https://tx3dnews.com/keith-self-privacy-act-flock-camera-warrant/

[CC6] Electronic Frontier Foundation, "Hundreds of Drone-as-First-Responder Programs Could Soon Be Launched Across the Country," July 2026. FAA waiver counts attributed to an FAA representative; not independently verified against an FAA publication. https://www.eff.org/deeplinks/2026/07/hundreds-drone-first-responder-programs-could-soon-be-launched-across-country

[CC7] TechCrunch, "Flock Safety paid over $300 million for 17-month-old drone startup Aerodome," October 23, 2024. https://techcrunch.com/2024/10/23/flock-safety-paid-over-300-million-for-17-month-old-drone-startup-aerodome/

[CC8] Flock Safety, "Flock DFR - Drone as First Responder" product page. Source for dispatch to the geo-coordinates of 911 calls, LPR hits, gunshot detection, or manual operator command; 60 mph; plate reads to 2,000 feet. https://www.flocksafety.com/products/flock-dfr

[CC9] Joseph Cox, "This Company Will Add Phone, AirPod, and Smartwatch Trackers to License Plate Readers," 404 Media, June 8, 2026. Source for SignalTrace as a Leonardo ELSAG product and Leonardo's US arm holding USSOCOM and GSA contracts. https://www.404media.co/this-company-will-add-phone-airpod-and-smartwatch-trackers-to-license-plate-readers/

[CC10] Courthouse News Service, "Judge holds Norfolk's license plate reader use constitutional," January 27, 2026. Source for Judge Mark Davis's summary judgment, the 176-camera network in roughly 75 clusters, and the 21-day retention reasoning. https://www.courthousenews.com/judge-holds-norfolks-license-plate-reader-use-constitutional/

[CC11] 13News Now, "Norfolk license plate reader lawsuit gains momentum after US Supreme Court ruling," July 8, 2026. Source for the Fourth Circuit appeal in Schmidt v. City of Norfolk, Norfolk's request for additional time to respond to Chatrie, the Institute for Justice capability-versus-use framing, and expected oral argument timing. https://www.13newsnow.com/article/news/local/mycity/norfolk/norfolk-license-plate-reader-lawsuit-gains-momentum-after-us-supreme-court-ruling/291-7785e25b-7a48-4d3e-8560-b456b4925dc5

[CC12] Government Technology, "Flock Drones Spark Debate in Two Connecticut Cities," August 2026; Audacy KRLD, Plano City Council five-year drone-as-first-responder contract with Motorola Solutions, approved July 27, 2026; reporting on Yonkers Police drones operating on Motorola CAPE software. https://www.govtech.com/public-safety/flock-drones-spark-debate-in-two-connecticut-cities · https://www.audacy.com/krld/news/local/plano-is-latest-dfw-community-to-add-drones-to-first-responder-program

[CC13] Grant eligibility framing: FY2026 NDAA amendments to the Omnibus Crime Control and Safe Streets Act making UAS and counter-UAS grant-eligible, and the DOJ Byrne JAG, COPS Technology and Equipment, and DHS/FEMA HSGP passthroughs. Traced to secondary legal and trade analysis, not appropriations text verified for this brief. Verify against the FY2026 Joint Explanatory Statement and the applicable notice of funding opportunity before pricing.

[CC14] Municipal contract structures, including the no-cost pilot converting to a multi-year paid contract absent affirmative withdrawal, and the Oakland County amendment guaranteeing sheriff ownership of data. Drawn from local government reporting and meeting records. Treated as indicative of the pattern; verify the specific instrument before citing in a bid.

[CC15] Los Angeles Police Department Inspector General audit findings on ALPR hot-list alerts, two-month sample, 161 incorrect stolen-vehicle flags against 337 correct. From public reporting on the audit, not the audit document itself. Verify against the OIG report before external use.

[CC16] Oxnard Police Department statement of February 27, 2026 on its Flock audit; Pasadena Now on VA Police queries of Pasadena PD data and the initial no-federal-access report subsequently corrected; Mission Local on the San Francisco audit finding 1.6 million federal and out-of-state queries across seven months; edhat on the Ventura County Sheriff's National Lookup disablement and approximately 364,000 out-of-state queries in a one-month window. https://vidanewspaper.com/2026/03/05/oxnard-police-department-suspends-use-of-cameras/ · https://pasadenanow.com/main/veterans-affairs-police-accessed-local-flock-license-plate-reader-database · https://missionlocal.org/2026/06/federal-agencies-sf-surveillance-flock-data-audit/ · https://www.edhat.com/ventura/news/oxnard-police-suspend-flock-license-plate-readers-ventura-agencies-tighten-controls-after-out-of-state-access/

Sources verified as of August 9, 2026.