The Argument
Constitutional protections are written to govern one party — the government. When the government contracts a private intermediary to perform the equivalent function, the text goes silent: the limit stays intact on paper while the contract does the work the Constitution forbids the state to do directly. This is the generalization of the Atlanta Passed a Sanctuary Resolution. The Vendor Contract Didn’t. thesis, now shown to recur identically across four constitutional domains — speech (First Amendment), search (Fourth Amendment), biometric compulsion, and health-data privacy (HIPAA). The working instrument the piece hands the reader is “Follow the vendor”: in any domain where a right is supposed to limit government, ask who holds the database and what they require to share it.
Structure
- The Glitch — “The audit said 3,254 searches. The ordinance said none.” Atlanta’s late-2025 open-records response held both a true denial (APD assisted no federal immigration enforcement) and an audit of 3,254 Border Patrol searches + 3,383 immigration-keyword searches of APD cameras during the sanctuary policy. An ATF specialist (Keya Chavies) ran “ERO assist” searches on APD-issued Flock Safety credentials. The mechanism is National Lookup: a reciprocal-by-default feature — turning it on to query other agencies also lets every other agency query you. Receipts: Bend, OR (279 federal queries in three weeks, CBP 118; Capt. Brian Beekman’s discovery); Pierce County, GA (4 “Border Patrol Assist” searches Sept 15, a month after Flock said the pilots ended); Ventura County (disabled National Lookup in 2023 for CA-law compliance, something reactivated it → 364,000 unauthorized queries); Gibbs Mura class action (SFPD cameras hit 1.6M times in seven months). ~4,500 credentialed agencies sit on the network.
- The Source Code — “How a constitutional limit stops at the vendor contract.” The same architecture, four times: (1) First Amendment / CISA “switchboarding” — Director Jen Easterly’s “cognitive infrastructure” framing made content moderation a federal cybersecurity function; the platform executes the removal CISA can’t order. Murthy v. Missouri dismissed on standing (June 2024); the March 2026 settlement bars only CISA, the Surgeon General, and the CDC for 10 years — every other agency keeps the instrument. (2) Fourth Amendment / Flock — no warrant needed for the government to query a private database of public-space recordings. (3) Biometric compulsion / the SCREEN Act + 19 state ID-check laws — the verification vendor holds the database; NSLs reach it without a warrant; the Tea-app breach is the failure mode (selfies + licenses on 4chan). (4) HIPAA / BetterHelp — relabeling therapy intake as an ad-targeting category exits the HIPAA framework; FTC forced $7.8M in refunds.
- The Upgrade — “The class action is real. The constitutional fix isn’t.” Gibbs Mura grounds its claim in CA Civil Code § 1798.90.55(b) ($2,500/violation → ~$4B exposure at 1.6M SFPD accesses); Oregon SB 1516 (signed March 31, 2026) writes vendor-side liability and 30-day public audits into the ALPR regime. Both are real remedies that stop at one state line. No federal court has held a government-contracted intermediary to the limits that bind the government directly; no legislation treats vendor contracts as state action. The only accountability tool that currently works is the open-records request — which is how both the Atlanta and Ventura audits became visible at all.
- My Debug — “I wrote two pieces before the pattern became visible.” The Jawboning Papers (Oct 2025, speech beat) and Atlanta Passed a Sanctuary Resolution. The Vendor Contract Didn’t. (Apr 2026, immigration beat) were the same story from two angles. The pattern spans four beats and is therefore owned by none — speech, immigration, child-safety, and health-privacy journalists each see one face of it. Atlanta’s April 20, 2026 resolutions don’t mention Flock or touch the contract; the cameras are still on.
Key Insight
The “vendor workaround” is not a loophole exploited case-by-case — it is a single reusable architecture. Each documented instance (CISA→platform, Flock→query, verification vendor→biometric, BetterHelp→ad category) instantiates the same structure: the constitutional protection governs Actor A; the government routes the prohibited function to Actor B. Because the pattern lacks a journalistic beat, every fix gets written for the single case in front of the fixer (settle with CISA, cancel Flock, challenge one age-verification law) while the architecture keeps running. “Follow the vendor” is the diagnostic that makes the architecture visible across domains.
What It Leaves Open
- Whether any court or legislature will treat a government-contracted intermediary as a state actor for constitutional purposes (currently: none).
- What reactivated National Lookup in Ventura County — Flock said its logging couldn’t determine the cause; the department found no internal actor.
- Whether the SCREEN Act passes and federalizes vendor-held biometric verification, and whether vendor liability is ever addressed (S.737 §4(d) leaves it unaddressed).
- Whether other states adopt Oregon SB 1516’s §7(2)(e) mandatory-contract-terms model, the first state codification of the vendor-as-structural-actor proposition.
Connections to Research Wiki
- Flock Safety — the Fourth Amendment node; ~4,500-agency network; National Lookup reciprocity
- National Lookup — the reciprocal-by-default mechanism that converts opt-in into network-wide federal reachability
- Flock Safety Surveillance Network — structural surveillance context
- Gibbs Mura — the live class action (CA Civ Code § 1798.90.55(b); $2,500/violation; ~$4B exposure)
- Oregon SB 1516 — first state statute writing explicit vendor-side liability into ALPR contracts
- SCREEN Act — federal age-verification bill; vendor holds the biometric database, liability unaddressed
- CISA — the First Amendment node; “switchboarding” / “cognitive infrastructure”; Murthy v. Missouri; March 2026 settlement
- BetterHelp — the HIPAA node; therapy-intake-to-ad-category relabeling; FTC $7.8M
- Vendor-State Governance — concept page not yet created; this article is the public-form articulation of the deferred concept (threshold flagged “strongly met” in the 2026-05-24 ingest log); the unifying pattern across all four nodes
- The Jawboning Papers — the speech-beat predecessor (CISA/First Amendment)
- Atlanta Passed a Sanctuary Resolution. The Vendor Contract Didn’t. — the immigration-beat predecessor this piece generalizes
- 3,000 Arrests, 335 Names, One Court Order — adjacent enforcement-accountability piece in the same surveillance cluster
Series Note
Functions as the synthesis that retroactively unifies The Jawboning Papers and Atlanta Passed a Sanctuary Resolution. The Vendor Contract Didn’t. under one architecture. The closing tease points to the next Friday piece — the Samsung 78,000-worker ratification (May 27) and the ten-year, 10.5%-of-operating-profit claim on the chip division that every hyperscaler PPA was priced before — extending the “a contract the buyers didn’t read” frame from civil liberties into the AI-buildout / memory-pricing thread (The Bluff Is Over. The Price Isn’t., 12 Gigawatts Were Announced. 4 Are Being Built.).