A FinePrint Field Guide

Before You Vote on AVCC: A Field Guide for City Council Members

A starting point from The Accurint Files. Enough to ask the right questions and slow a bad vote down.

The Accurint Files·For City Council

You are being asked to approve a contract for a product called the Accurint Virtual Crime Center, or AVCC, sold by LexisNexis Risk Solutions. It may reach you described as "analytics software," "crime mapping," or "investigative tools." It may be bundled into a consent agenda with a dozen other items. Before it passes, there is one thing you need to understand, and a handful of questions you need answered on the record.

This is not legal advice. It is a map. Pull the actual contract, read it against this page, and run it by your City Attorney before you vote.

Primer

Start here: Access is not the same as Contribution

This is the whole ballgame, so spend thirty seconds on it.

Access means your officers log into AVCC and look things up. Your department pays a subscription. That is what most council members think they are voting on.

Contribution means your department's records get copied out of your own systems and into a national exchange called PSDEX, the Public Safety Data Exchange, where other agencies and federal users can query them. That is a separate thing. It is governed by a separate document, usually called the AVCC XML Addendum. A department can subscribe without contributing. A department can also be set up to contribute without anyone on the council realizing they signed off on it.

In other words, one version of this deal lets your police search a database. The other version turns your residents' police records into a permanent line item in someone else's database. You are entitled to know which one is in front of you, and you should not accept "it's just software" as an answer.

Three Facts

Three facts that should slow the vote down

Box 1 - You can audit your own officers. You cannot audit LexisNexis.

When one of your sworn officers runs a name through your records system, that query is logged and auditable. You can answer "who looked this person up, and why." Once a copy of that data sits inside PSDEX, you lose that. You cannot pull a log of how the broker's copy gets queried, by whom, or for what. The question to put to your chief in public: why are we accepting less accountability from a private company than we demand from our own police?

Box 2 - You can cancel the contract. You cannot get the data back.

The contribution addendum grants LexisNexis a worldwide, irrevocable license to the data you contribute (this is the clause labeled Section II.1 in the addendums we have reviewed). Irrevocable means exactly what it sounds like. If your city votes to end this contract next year, every record already contributed stays licensed to the company. You are not renting. You are giving.

Box 3 - Once it is in, federal agencies may be able to query it.

PSDEX is a shared exchange. The question you need answered on the record, in writing, is direct: once our data is in PSDEX, which federal agencies can query it, and does that route around our own policies on cooperation with immigration enforcement? If your city has sanctuary protections, this is where they can quietly spring a leak. Make them put it in writing.

Where You Are

Where are you in the process?

You have the most leverage right now, before anything is signed. Use it.

Ask for

The document that decides whether we are subscribing only or also contributing. Show it to the council.
The AVCC XML Addendum, if one exists. We want to read Sections I.2 and II.1 before we vote.
A plain list of what gets contributed: incident records, calls for service, and whether names of victims, witnesses, and reporting parties are included.
Whether we can restrict contribution to a regional consortium, or whether signing pushes our data into the national exchange automatically.
What happens to anything we contribute if we cancel.

Then do: pull the contract, hold a noticed public hearing before approving, and consider Motions 1, 2, and 4 below.

What Flows In

The data you may be handing over

This is the part that should keep you up. The records flowing into these systems are not abstractions. They include the people your department exists to protect.

When records are imported into the LexisNexis law enforcement environment, they default to "Law Enforcement Only" visibility. In plain terms, the full feed from your records system reaches the company before any public-facing filter is applied. The 500-foot location offset that some cities point to as a privacy protection only blurs the public map. It does nothing to the law enforcement view. The broker sees the real thing.

So the question is not whether the public map is fuzzy. The question is what your city is feeding into the pipe in the first place. Victims. Witnesses. Children. People who called 911 during a mental health crisis. People who reported a partner's abuse and were promised it would be handled with care. Ask your department, by category, what is being contributed and what is being held back. If the answer is "we contribute everything," that is a policy choice your council never voted on, and you can vote on it now.

For Your IT Department

For your IT department: how to tell if the pipe is already connected

Most of this page is about contracts. This section is about your own network, and it is the fastest way to learn the truth, because it does not depend on the vendor's cooperation or on what a staff summary said. Your IT or records team can confirm or rule it out in an afternoon.

Here is how the contribution actually works, in plain terms, taken from LexisNexis's own technical setup document. The company installs a piece of software on your network called the PSDex Data Client. That client runs an automated job, usually daily, that extracts read-only data from your Records Management System and Computer-Aided Dispatch, cleans it into the format LexisNexis wants, and uploads it to LexisNexis servers over an encrypted file transfer. The same setup document states a preference: the vendor would rather pull raw, unfiltered data straight from your records system than work from a filtered view or a limited copy. Read that twice. The default ask is for everything.

If that job is running, it leaves fingerprints all over your infrastructure. Ask your IT or records team to check for these, and to answer each in writing:

A dedicated machine running the "PSDex Data Client." It may live on its own virtual machine or on an existing server. Look for a Windows Server box (2012 R2 or newer) set up specifically for a LexisNexis ETL process.
A scheduled task that runs on a timer. Look for a daily scheduled job that launches a Data Client executable or batch file to extract and upload records.
A service account with read-only access to the RMS and CAD databases, with a password set never to expire. The non-expiring password exists so the automated daily job never breaks. That is a flag worth finding.
Outbound firewall rules that allow traffic to LexisNexis endpoints. This is the clearest single indicator. If your firewall is permitting outbound connections to any of the hosts in the table below, data is leaving your network for LexisNexis.
WinSCP installed and scripted to push files by SFTP, and SQL Server Management Studio installed on the same machine. These are the named tools the setup process uses to move and prepare the data.
VPN credentials issued to LexisNexis, or GoToAssist screen-sharing sessions granted to a LexisNexis engineer. Either one means an outside party has had hands-on access to your internal environment.
Whitelisted email domains. Check whether runlumen.com and amazonses.com were added to your mail server's allow list.
What the feed actually pulls. Ask for the list of source tables and fields the ETL job reads. This is where you find out whether victim, witness, juvenile, and call-type data is in the extract.

LexisNexis endpoints to check your firewall and DNS logs against

These are the published destinations from the vendor’s setup document. If your network is talking to any of them, the pipeline is live.

Hostname	IP / range	Port	What it means
PSTRANSFER.LEXISNEXISRISK.COM	209.243.48.150, 66.241.42.90	22 (SFTP)	Bulk transfer of your extracted records to LexisNexis
PSIMPORTER.LEXISNEXISRISK.COM	209.243.50.85, 66.241.45.212	443 (HTTPS)	Import of your data into the LexisNexis environment
API.PSDEX.LEXISNEXISRISK.COM	198.62.62.0/23, 69.84.182.0/23, 198.62.63.0/23, 69.84.183.0/23	443 (HTTPS)	The Public Safety Data Exchange API, the national pool
COMMUNITYCRIMEMAP.COM	209.243.50.85, 66.241.45.212	443 (HTTPS)	The public-facing crime map feed
SSH.RUNLUMEN.COM / *.RUNLUMEN.COM	52.222.111.198	22 / 443	Lumen, hosted in AWS GovCloud

What this confirms: if these fingerprints exist, your residents' police records are being copied off your systems and shipped to a private company on an automated schedule, and you can establish that on your own, today, without filing anything. If your IT team checks and finds none of it, that is a meaningful answer too. Get it in writing either way.

Records To Request

Documents and exports to request

Ask for these by name. If records staff say there is nothing responsive, the search terms are usually the problem, not the absence of documents. Have them also search for Community Crime Map, Coplogic, LexisNexis Coplogic Solutions, BAIR Analytics, and TraX.

Contract documents

The base AVCC or Accurint subscription agreement. Tells you what your city is paying for and whether it is access only.
The AVCC XML Addendum. This is the contribution document. Section I.2 describes what data flows out. Section II.1 is the irrevocable license. If this exists, your city is contributing, full stop.
Any consortium agreement or amendment. Tells you whether you can keep data regional or whether national contribution is automatic. Read the amendment language closely. (See member-controlled vs mandatory-national consortiums deep dive.)
Data sharing or interconnection agreements (fusion center, CISC, or similar). Tells you the downstream path, including how federal users may reach the data.
Community Crime Map agreement. A strong signal that an automated feed is running.
The LexisNexis Technical Setup Requirements document, and any related onboarding or firewall-change tickets. This is the engineering playbook for the data feed. If your agency went through setup, someone has this, and it names the exact machine, accounts, and endpoints involved.
Invoices and renewal notices. Tell you the real scope and whether you are locked into a multi-year auto-renewal.

System exports your AVCC admin can pull in minutes

These do not require a records request. Any AVCC administrator at your agency can produce them, and they show the live configuration rather than what a contract promised.

Agency Configuration Page.

Ask for a printout of your agency's full AVCC configuration page, including any other agencies listed on the same page. The other agencies on that page tell you the shape of the sharing arrangement you are part of.

Example: Agency Configuration Page (opens in Google Drive) →

Data Classification Crime Results export.

This shows how each crime type from your records system is classified inside the LexisNexis environment, which is where you confirm that imported types default to law-enforcement-only visibility. To pull it, an AVCC administrator can:

1Open the link on the left-hand side, under admin permissions, called "Data Classification Manager."
2Click the Export link at the top right of the Data Classification Manager page.
3Provide the exported file to the council.

TODO {{SCREENSHOT: Data Classification Manager export example}}

A simple rule for reading all of this: a contract that only lets your officers search is one thing. A contract or configuration that contributes data is a different thing, and it is the one that deserves a public hearing.

Alternatives

What other cities do instead

You are not choosing between AVCC and nothing. Departments shared data long before a private broker offered to hold it for them.

Pick up the phone. Detectives have always called the next jurisdiction over. Targeted, logged, accountable, and free.
Regional and state-run systems. Many states operate law enforcement data networks that keep records inside government control with real audit trails.
Member-controlled consortiums. Some sharing arrangements let agencies restrict access to named regional partners, rather than pushing data into a national commercial exchange.
Subscribe without contributing. If your officers want the lookup tool, you can buy the lookup tool. You do not have to also donate your residents' records to get it.
Formal mutual aid and information-sharing agreements between named agencies, with defined scope and clean termination.

The point is leverage. When the vendor says "everyone uses this," the honest answer is that everyone has options, and most of them keep your data under your control.

Procurement Red Flags

How these deals slip through

A clean vote is a public vote. Watch for the opposite:

Consent agenda burial. A data-sharing agreement riding along with routine purchases, approved in a single omnibus motion with no discussion.
The "software" relabel. Described as analytics, mapping, or investigative tools, with the word "contribution" nowhere in the staff summary.
Department-level sign-off. Approved by the chief or a purchasing officer with no council visibility, then treated as settled.
Auto-renewal. A multi-year term that renews on its own, so the one chance to say no quietly passes.

If you see one of these going by, that is your cue to pull the item for a full hearing. You only need one council member to ask.

Read Into The Record

Motion language you can use at the next meeting

This is the part nobody else hands you. Below is ready-to-introduce text. Drop in your city's name, run it past your City Attorney, and read it into the record. You can use one or stack several.

Motion 1: Require a public hearing before any contribution agreement.

Moved, that the City of __________ shall not enter into, renew, or amend any agreement that contributes Police Department records to a third-party data exchange, including but not limited to the LexisNexis Public Safety Data Exchange (PSDEX), without prior approval by the City Council at a noticed public hearing. Subscription-only agreements that do not contribute City data are excepted.

Motion 2: Protect vulnerable-population data.

Moved, that the Police Department shall not contribute to any third-party data exchange any records identifying victims, witnesses, or reporting parties, any records arising from calls for medical or mental health service, any records involving minors, and any records arising from domestic violence reports, and that the Chief shall certify compliance to the Council annually.

Motion 3: Require auditability and annual transparency.

Moved, that the City shall not contribute Police Department data to any system that does not provide the City a complete, queryable audit log of how the contributed data is accessed, by whom, and for what purpose, and that the Chief shall present an annual public report on all third-party data-sharing arrangements, the categories of data shared, and the agencies with access.

Motion 4: Restrict to subscription only, or to regional members only.

Moved, that the Police Department's use of the Accurint Virtual Crime Center shall be limited to subscription access only, with no contribution of City records to any national exchange; or, in the alternative, that any data sharing shall be restricted to named regional law enforcement partners and shall not flow into any national commercial database.

If your city already signed, Motion 3 and an order to produce the existing XML Addendum and Agency Configuration Page are the fastest way to find out what you are actually party to.

Glossary

A plain-language decoder

The acronyms are how the conversation gets controlled. Here are the translations:

Accurint: LexisNexis Risk Solutions' law enforcement data platform.
AVCC: Accurint Virtual Crime Center. The product your city subscribes to.
PSDEX: Public Safety Data Exchange. The national pool your data gets copied into if you contribute.
XML Addendum: the contract attachment that turns a subscription into a contribution. Read Sections I.2 and II.1.
Contribution vs. access: giving your data vs. searching theirs.
RMS / CAD / JMS: your Records Management System, Computer-Aided Dispatch, and Jail Management System. The source systems a feed pulls from.
PSDex Data Client: the software LexisNexis installs on your network to extract and upload your records.
ETL: Extract, Transform, Load. The automated process that pulls your data, reformats it, and ships it out.
SFTP: the encrypted file transfer method used to send your extracted records to LexisNexis servers.
Lumen: a LexisNexis law enforcement search product, hosted in Amazon's GovCloud, that you may see named alongside AVCC.
CCM: Community Crime Map. The public-facing map, and a sign that an automated feed is running.
DCM: Data Classification Manager. The console that decides how imported data is classified. Most crime types default to law-enforcement-only visibility.
Coplogic / TraX: LexisNexis reporting and data tools you may see named in your contracts.
BAIR Analytics: a separate LexisNexis pathway involving crime-analyst staffing. Worth searching for in records, but it is a different thing from AVCC contribution.
Irrevocable license: the company keeps the rights to your contributed data even after you cancel.

Who To Ask

Who in your own city can answer this

Three people, three questions:

Your City Attorney:
Do we have an XML Addendum, and what does Section II.1 commit us to permanently?
Your Police Chief:
What categories of data do we contribute, and can we audit how the contributed copy is queried?
Your IT or Records Manager:
Does our RMS, JMS, or CAD system have any integration that copies or shares data with a private or third-party database, what is the full pipeline, and where does it end? Check our network against the indicators in the IT section above, including a PSDex Data Client machine, a daily scheduled extract job, a non-expiring service account, and outbound firewall rules to the LexisNexis endpoints listed.

Ask the City Attorney and IT to review this together and report back in writing. Bring the answers to a public meeting. That is how a vote becomes accountable.

The Accurint Files

The Accurint Files is an investigation by FinePrint into how local police records move into a private national database accessible to federal agencies. If you are a council member, records officer, or department staffer and you want help reading your city's contract, reach out. If you have documents, send them. We read every one.

tips@fineprint.report →