A few months ago, the Combating Organized Retail Crime Act (CORCA) looked to have nearly unstoppable political momentum in Congress. Propelled by a media narrative of out-of-control retail theft—a narrative that appears massively overblown—proponents promised CORCA would “protect American businesses, safeguard our frontline workers, and ultimately, help protect every American.” It passed the House in May, with broad bipartisan support and backing from the powerful retail lobby. Its prospects in the Senate looked promising as well, especially once it was added as a possible amendment to the fiscal year 2027 National Defense Authorization Act (NDAA)—legislation typically described as “must pass.” But that bill still hasn’t passed, leaving CORCA’s future uncertain. And as that process drags on, recognition of the downsides and potential harms of the legislation—which, as written, greatly expands the federal government’s power to surveil people in the United States in the name of protecting them—is growing.

Congress punted on the NDAA until after the midterms, leaving the bill, along with a lot of other urgent unfinished business, for a post-election lame-duck session. Whatever comes out of that session will likely be affected not only by the November results but also by increasing public outrage over the sort of automated surveillance CORCA has the potential to expand. Now, with some wondering whether defeated members of Congress will even show up for lame-duck votes (and given that Democratic support for the bill had already declined prior to its May passage), there’s some reason to be hopeful CORCA will not, as currently drafted, become law—though the fight is far from finished.

What is CORCA?

While CORCA is framed as a bill to combat organized retail theft, it does not actually specify how “organized” retail theft is different from any other sort, which could lead to federal prosecutions—and disproportionately harsh punishments—for accused shoplifters with no connection to organized crime. The bill’s main mechanism for fighting actual organized retail theft is through a new center that would facilitate information sharing among federal and state law enforcement and private-sector companies that operate retail surveillance networks. That centralized coordination center would be run out of the U.S. Department of Homeland Security (DHS), which has been a reckless and unaccountable agency throughout President Donald Trump’s second term. The Organized Retail and Supply Chain Crime Coordination Center would be housed in Homeland Security Investigations (HSI)—the same agency that just raided the Washington home of U.S. Representative Ilhan Omar—and its leader would be appointed by the director of U.S. Immigration and Customs Enforcement (ICE). HSI’s remit is supposed to be transnational crime, but under this administration, it has been heavily involved in ICE’s draconian mass deportation campaign.

How does CORCA threaten privacy?

CORCA could give federal law enforcement agencies greater access to surveillance data collected by private retailers, including footage from security cameras and information gathered by automated license plate readers (ALPRs).

Privacy is already a hot topic in Congress, thanks in part to widespread community pushback against the ubiquity of ALPRs. This technology is epitomized by the networked and searchable cameras of Flock Safety—which are routinely abused by police, who have used them to harass romantic partners, track women seeking legal abortions across state lines, target critics and protesters, and accuse people of crimes they did not commit. The backlash to Flock has been swift and bipartisan: at least 28 states across party lines have enacted laws regulating ALPRs and more than 400 actions have been taken nationwide to terminate, suspend, or decline to renew Flock contracts.

Meanwhile, as multiple civil rights organizations have pointed out, agents from HSI “routinely deploy facial recognition technology,” and DHS has its own secretive network of ALPRs. CORCA works in part by giving DHS even more power to amass information about people in the United States collected by private retailers—including from networked cameras—with no data retention limits, oversight boards, or privacy audit requirement.

As the ACLU’s Jina John told The Intercept: “The risk here is that when retailers share information, it’s not a specific clip of footage related to a specific theft, in practice, they are sharing continuous footage. That means access to Flock license plate readers in retail parking lots and surveillance cameras at stores and malls.” In other words, CORCA is a surveillance bill as much as a “crime” bill.

That connection is why cybersecurity engineer Benn Jordan told the Senate in September that grandstanding against unpopular Flock cameras while still supporting CORCA was hypocritical. As he said: “From a security perspective, it would be absurd to be concerned with the scenarios playing out with Flock while supporting bills like CORCA. . . . That would be the equivalent of feeding a monster in an attempt to defeat it.”

What’s next for CORCA?

Confronted with these objections to CORCA, the National Retail Federation, which is heavily lobbying for the bill, says that Congress can fix the legislation after it passes—though with the likelihood of divided government next year, the prospect of revisiting the legislation remains uncertain.

Growing public opposition to the sort of high-tech surveillance embodied by Flock, whose networked cameras are already installed at stores across the country, and widespread public concern over the worst abuses of ICE under Trump could make it increasingly difficult for lawmakers to justify expanding federal surveillance powers under CORCA.

The larger lesson is that “tough-on-crime” measures become a much harder sell when voters see what “tough” measures look like in action.Much like how Trump’s immigration agenda has grown unpopular as people see the brutality inherent in mass removal efforts, Flock’s promise of greater security has become less popular as people begin to understand how much privacy they must trade away. A similar awakening is happening on CORCA: polling commissioned by Vera Action suggests that an innocuous-sounding political goal can look very different once voters understand the broad expansion of the surveillance powers attached to it. Retail theft is a real problem—but it’s not one that harsher punishments and more spying can solve.