Audit shows San Francisco police Flock license plate camera data accessed by outside agencies

The San Francisco Police Department said an audit of its automated license plate reader camera network shows it was improperly accessed by out-of-state and federal agencies.

Data from the SFPD's ALPR network, manufactured by Flock Safety, was improperly searched nearly 300 times by over roughly one year, representing about 0.005% of all searches during that period, the department said. The audit found no searches related to immigration enforcement or reproductive rights investigations, according to police.

California law prohibits law enforcement agencies from sharing ALPR data with out-of-state or federal agencies without a court order or warrant issued by a California court. 

The SFPD said it had legally authorized the Northern California Regional Intelligence Center, a California law enforcement intelligence-sharing center, to access its ALPR data, but the department found that NCRIC's access was used to conduct searches on behalf of outside agencies that had no direct access to SFPD's system themselves. The department did not identify the outside agencies involved. 

Atlanta, Georgia-based Flock Safety reiterated that its cameras were not directly accessed by outside agencies.

"This was not the result of a software malfunction, platform issue, unauthorized access, or any failure of the Flock system," a Flock spokesperson said. "It involved searches conducted by authorized users at a California state agency that were later determined to be inconsistent with California's ALPR data-sharing requirements."

How outside agencies accessed the SFPD's ALPR network

According to the department, after reporting the issue to NCRIC, SFPD learned that the searches had actually been performed by analysts working for the Sacramento-based Western States Information Network a multi-state law enforcement information-sharing and intelligence organization. SFPD found that NCRIC had granted WSIN access to the department's ALPR data network, and WSIN analysts conducted searches on behalf of outside agencies, which California law prohibits.

"WSIN has indicated that the analysts who conducted the ALPR searches at the request of other agencies were unaware of California law prohibiting the sharing of ALPR data with federal and out-of-state law enforcement agencies," the SFPD said in a press release.  

The department said that audit logs show that the quieries performed by WSIN on behalf of outside agencies involved the investigation of criminal activities and serious crimes including homicide, child sexual abuse, and gun and drug trafficking.

The SFPD said it is the first and only law enforcement agency to identify the improper access as a statewide problem. After the discovery, Police Chief Derrick Lew revoked NCRIC's access to the ALPR system and initiated an internal review, the department said.

"To ensure transparency and community trust in our ALPR system, SFPD is publicly disclosing this issue while outlining the steps the department immediately took to remedy the matter," the department said.  

Criticism of ALPR networks and data retention

The SFPD calls its ALPR network "a crucial public safety tool" that has led to a historic drop in both violent and property crime since 2024 amid staffing shortages. Its estimated that over 300 California agencies use ALPR systems.

However, critics argue that much of the data collected and stored concern people not suspected of any wrongdoing, and it amounts to unwarranted surveillance of people's lawful activities. Critics also point to the risk of large databases being misused, breached, or illegally accessed, while civil liberties groups argue that people may avoid attending protests, seeking reproductive health, or participating in political activities if they believe their movements are being tracked.

in April, three San Jose residents filed a lawsuit over the city's ALPR network, alleging it constitutes a mass surveillance of the public and violates their right against unreasonable searches and seizures guaranteed by the Fourth Amendment to the United States Constitution.  

In February, the Mountain View Police Department halted the use of ALPR cameras after it was found that hundreds of federal and state law enforcement agencies had accessed the city's ALPR data without the department's knowledge.

A recent CBS News investigation showed multiple cases of ALPR errors leading to wrongful police stops or instances of the technology being abused.