top of page
Search

Woodstock Scheduled a Silent Vote on a Contract That Had Already Been Replaced

  • 7 days ago
  • 10 min read

It isn't dead. It comes back, probably in August. Here's what to demand before it does.



Item 7.2 came off Monday night's agenda.


For anyone catching up: that was the intergovernmental agreement connecting Woodstock Police records to Peregrine, an AI intelligence platform run by the Cherokee County Sheriff's Office. It sat on the consent agenda, scheduled to pass in one motion, in seconds, with no presentation, no discussion, and no public comment. Our full breakdown is here: https://www.ngacan.org/post/woodstock-is-about-to-sign-a-blank-check-to-a-san-francisco-ai-surveillance-company-nobody-can-tell


It came off because the County sent Woodstock a revised version of the contract Monday afternoon, hours before the vote, and the City Attorney hadn't reviewed it.

Stop and read that again.


The document in the public agenda packet wasn't even the contract the city was about to sign.


This is the part that should bother everyone regardless of how you feel about surveillance technology.


A consent agenda exists for settled, routine business. Surplus laptops. A playground contract. Things where the terms are final and nobody needs to talk about them. That is the entire premise.


Item 7.2 wasn't settled. The County was still sending over new versions the day of the vote. The file sitting in the public packet was named "IGA City of Woodstock - DRAFT Updated.pdf," which tells you there had already been at least one round of revisions before that one.


So a contract that was actively being renegotiated with the other party was placed on the agenda where nothing gets discussed.


There are two explanations. Either someone at city hall knew the terms weren't final and put it on consent anyway, or nobody at city hall was tracking the status of a contract they'd scheduled for approval. One of those is sneaky. The other is incompetent.


City Manager Jeff Moon is listed on the agenda as the presenter for item 7.2. The city manager runs the agenda. That is the job.


And when a resident asked directly why this was on the consent agenda, Moon didn't answer the question. We'll get to that.


Three people spoke. Two of them came for this.


Woodstock's public comment period holds three speakers. All three slots were used Monday night.


Sam, a lifelong Cherokee County resident who recently moved inside the city limits, said he had never considered coming to a council meeting before this.

"I think this should show how horrified I am of the thought of item 7.2 passing."

He started with the license plate cameras. "Every day I am reminded of the threat that this council has gone toward my personal data when I pass one of those ugly black cameras, those poles with the cameras and the solar panel."


Then he drew a critical distinction:

"At least with Flock, there is an audit log that has prevented Cherokee County deputies from using that information against me, as shown with the multiple deputies that have been arrested. I have not heard of that for our pending contract with Peregrine."

The lack of an audit log should alarm even those salivating over increased surveillance. Three Cherokee County deputies were arrested and fired in June for running a license plate surveillance system against people for non law enforcement reasons. One looked up a coworker. All three face a felony count of violating their oath of office. They were caught because the Sheriff's Real-Time Intelligence Division audited its own logs, which most agencies never do. We wrote about it at the time: https://www.ngacan.org/post/three-cherokee-deputies-one-surveillance-system-and-a-lot-of-unanswered-questions


The Peregrine agreement requires no audit log at all.

"Without an audit log, we don't have control or any safeguards stopping who accesses, why they would access, and for what purpose the information is used."

He asked that the document be made readily available for all residents to read before any vote, with public comment allowed.


Ms. Miller, six years in Georgia, told the council this was only her second time speaking before them.

"I feel strongly enough to get out of my comfortable little house, drive in my car, get down here and find a parking spot and come in and speak."

She described an emergency where she couldn't drive herself and had nobody to call, so she called an ambulance. Then she thought about her neighbor across the street, who called an ambulance for his wife before she passed away.

"We're both pretty law-abiding citizens. But to have my freedom taken away on that and have no control over it is just abhorrent."

She also pressed on the two things the contract never answers. "You don't have an end date on the data." And "how much is it really going to cost, and how are you going to get rid of the data when it's done and you decide not to use this company anymore?"


Worth being precise, because the mechanism matters. Section 4 of the agreement connects Woodstock's police records management system. It doesn't name EMS or fire.


But police get dispatched to medical calls constantly. Overdoses. Deaths at home. Mental health crises. Anything involving a vehicle. Anything where a scene needs securing. Often just because a patrol car is closer than the ambulance. When an officer responds, there is a call for service record and usually an incident report, and the caller's name is on it.


So Ms. Miller is right. If police showed up when she called, she is in the system that would feed this platform. Same for her neighbor. Neither of them did anything but need help, and neither of them will ever be able to see what is in that file or ask for it to be removed.


The contract makes no distinction between why your name is in a police report. It just connects the database.


The third speaker was there for the other half of the same fight.


Steve Rogers, a candidate for Cherokee County Commission in District 4, came to talk about data centers.


The Cherokee County Board of Commissioners unanimously approved a 30-day moratorium on new data center applications on July 21. Community Development Director Brantley Day said the county has no ordinance specifically addressing the use, and staff needed time to research and draft one. A public hearing is set for August 18 to consider extending it, and staff expects to request 180 days, running to mid-February 2027. Coverage: https://www.wsbtv.com/news/local/cherokee-county/30-day-data-center-moratorium-approved-by-cherokee-county-commission/KUBAEKCDIBDRLN6TCEOZYDJEJE/


Rogers asked Woodstock to get in step with the county.

"We need to make sure that when they come into our neighborhoods, they need to be well regulated. Make sure that they are a net benefit to the community and not a net negative."

Data centers aren't a separate issue from item 7.2. They're both part of the same infrastructure.


Peregrine isn't a software program that runs on a computer at the Sheriff's Office. It is cloud software, built entirely on Amazon Web Services GovCloud. Peregrine says so in its own materials: "our cloud-native platform built on AWS." GovTech's 2025 AWS Champions award writeup says the platform is "built entirely on AWS GovCloud." The City of Durham's public FAQ on its own Peregrine deployment states it plainly: "Peregrine is hosted in AWS GovCloud." https://www.durhamnc.gov/DocumentCenter/View/62947/RTCC-Town-Hall-FAQs


AWS GovCloud has two regions. One in Ohio, one in Oregon. There is no GovCloud region in Georgia.


So this contract wouldn't keep Woodstock's police records in Woodstock. Not in Cherokee County, not in this state. Every incident report, every name, every address would be copied into an Amazon data center roughly a thousand miles from here, governed by a vendor agreement Woodstock has never seen and is not a party to.


That's the connection between these two fights. The data centers people are worried about are where this data would go to live.


And Durham is worth looking at for another reason.


Before deploying Peregrine, the City of Durham held public town hall meetings about it. Recorded the dates, the locations, and the attendance. Published a written FAQ answering residents' questions, including whether the data could be sold and whether facial recognition would be added later.


Durham held town halls.


Woodstock put it on the consent agenda.


The county figured out the right process for warehouses full of servers: stop, write the rules, then decide. Woodstock hasn't figured it out for its own police records.


The August 18 hearing is at 6 p.m. at the Cherokee County Administration Building, 1130 Bluffs Parkway in Canton. Worth being there.


Then, on Thursday, a resident emailed city hall.


Woodstock resident Gopi Govindaraj sent City Manager Jeff Moon, Mayor Caldwell, the entire Council, and Police Chief Castro a detailed review of the agreement. Gopi didn't send pithy talking points. He sent a section by section analysis of the financial exposure, the data governance gaps, the open records liability, and the missing indemnification.


He also asked the obvious question: why was this on the consent agenda at all?


Here is Moon's entire response:

"While I appreciate your recommendation and Chat GPT's review of the draft, it was already reviewed by the City Attorney's office prior to going on the agenda. As it was mentioned at the meeting, the County sent over a revised draft on Monday afternoon that we will be working with them on."

Count what that answers.


Jeff Moon didn't answer the uncapped pricing in Section 5. Didn't respond to the missing retention schedule. Didn't acknowledge the absent audit requirement. Didn't address the open records custodianship question under O.C.G.A. § 50-18-70. Didn't even mention the fact that the agreement contains no indemnification clause anywhere across seventeen sections. Didn't consider CJIS compliance. Jeff Moon couldn't even be bothered to answer the request to move it off the consent agenda, which a resident asked directly and which received no response whatsoever.


Zero. Jeff Moon's response answers zero of this Woodstock resident's valid questions.


What it does instead is note that the City Attorney already looked at it, as though that ends the conversation. It doesn't. A City Attorney reviewing a contract for legal sufficiency to the city is a completely different question from whether that contract protects the people whose data it moves. Both things can be true at once, and right now both are.


It also confirms one of the biggest problems we've cited. The City Attorney reviewed a draft. Then the County sent a different one. The version that got reviewed and the version that would have been signed were not the same document, and that item was still sitting on the consent agenda when the meeting started.


And Jeff Moon opens by snarkily attributing a resident's work to a chatbot.


That is a City Manager, paid by Woodstock taxpayers, informing a Woodstock taxpayer that his careful reading of a public document isn't worth a substantive reply. Not one point engaged. Just a jab about the tool and a note that the professionals had it handled.


Jeff Moon's email is the response of an official who expects residents to lose interest and go away, and it should be remembered the next time anyone at city hall talks about community engagement or transparency.


Then Jeff Moon made a promise.


Gopi wrote back saying he hoped to see the revised agreement return "as part of a regular agenda item for review by council and public feedback."


Moon's reply, copied to Mayor Caldwell and every member of Council:

"Of course it will, Gopi."

Four words. Sent to seven elected officials.


Whatever tone he intended, the City Manager has now stated in writing, in front of the Mayor and the entire Council, that this contract comes back as a regular agenda item with council review and public feedback. Not consent. Not a block vote. On the agenda, discussed out loud, with residents able to speak.


That is exactly what people have been emailing about all week, and it is now on the record.


So here's where we are.


If item 7.2 returns on a consent agenda, that's not just a scheduling error. It's a broken commitment made in writing to the Mayor and six council members, and every one of them has it in their inbox.


We'll be watching every agenda until it comes back. So should you.


What Gopi's review caught that we missed


The Georgia Open Records Act problem. If someone files a records request for an intelligence product built partly from Woodstock data sitting in a County platform, who is the legal custodian? Who pays a non-compliance penalty? The agreement is silent, and that is real exposure for the city.


CJIS compliance, the federal security standard for criminal justice information systems. Never mentioned in the agreement.


Indemnification. There is none. We checked all seventeen sections. No hold harmless, no allocation of third party claims, nothing about liability if data is breached or misused.


And a concrete fix on price: cap annual increases at three to five percent, or tie them to the Consumer Price Index, instead of leaving years two and three entirely to the County's discretion.


Not one of those points has been answered.


What is still unresolved


No retention schedule, so the default is indefinitely. No audit log requirement, meaning no record of who searches what. No rule on who else can see Woodstock data once it is in the County system. No deletion or return if Woodstock terminates. No stated price for years two and three. And the County policies Woodstock's officers would be bound by are still not attached to anything the public has seen.


What to ask for, and who to ask


This is the same ask we have made since Sunday. Three things.


One. Put it on the regular agenda with a public hearing. Not consent. Residents get to speak before a vote. The City Manager has now committed to this in writing.


Two. Release the revised contract publicly before that vote, with enough lead time for people to actually read it. Nobody can weigh in on a document they have never seen, and the last version was replaced hours before a scheduled vote.


Three. Put real protections in writing. How long the data is kept. Who can search it and whether there is an audit log. Notice before any third party disclosure. Deletion or return if Woodstock terminates. A cap on the price for years two and three.


And if your position is that Woodstock should not do this at all, say that directly. That's a legitimate position and Council needs to hear it.





Anyone can request records from the city. Free, no reason required, about five minutes: https://woodstockga.justfoia.com/publicportal/home/newrequest


One last thing


Five days ago this was going to pass in silence and nobody outside city hall would have known it happened.


Monday, two residents who had never done this before drove down, found parking, and said so out loud. A third came to warn the council about what is coming next.


Today there is a written commitment, sent to seven elected officials, that it comes back in public.


This isn't over. It comes back. Keep going.

Comments

bottom of page