Federal and out-of-state agencies “improperly” searched San Francisco license-plate data gathered through the police department’s Flock system of surveillance cameras, a department audit released Wednesday found.
Police Chief Derrick Lew acknowledged issues with the Flock system when he revealed the leak at the city’s Wednesday evening police commission meeting.
“As helpful as the Flock cameras have been for the department, they have also caused immediate concern,” he told the commission. “It’s no secret ALPR [automated license-plate reader] is a controversial tool, and I think there are a lot of privacy concerns.”
He said immigration enforcement agencies did not directly access the data.
San Francisco has since 2024 used Flock surveillance cameras to capture license plates on city streets. The San Francisco Police Department then uses the data to track and locate cars in its criminal investigations.
SFPD discovered that there had been 299 illegal inquiries of its Flock camera network over the course of a year, according to a department statement. This is at least the second such breach: Between 2024 and 2025, SFPD let out-of-state agencies access its Flock data 1.6 million times, according to the San Francisco Standard.
California law prohibits law enforcement agencies from sharing license plate data to any out-of-state entity. Such data can be used to track drivers’ locations and movements, and elsewhere it has been used by immigration agents for years.
Other police departments across the country routinely share this data with Immigration and Customs Enforcement and other federal agencies. Because other states have no prohibitions against sharing data with ICE, and actively do so, California has cut off access to those agencies, too.
Still, despite Lew’s concerns at Wednesday’s meeting, the police department defended the Flock surveillance camera system.
“This network allows officers to identify suspects more efficiently and with more precision than ever before,” SFPD wrote. “It has helped lead to a historic drop in both violent and property crime amid critical staffing shortages.”
Lew called it a “big tool in our tool vault in terms of our ongoing crime-fighting efforts” during the commission hearing.
Lew did not list all the agencies that accessed the license-plate data, but he said they included the Drug Enforcement Agency and the Internal Revenue Service. The SFPD said “the federal agencies identified do not include Immigration and Customs Enforcement or the Department of Homeland Security.”
But that does not mean agencies like ICE did not subsequently obtain the information from other agencies. There is ample data sharing among federal agencies — the IRS, for example, in 2025 agreed to share data with ICE. Last year, the tax agency sent addresses for some 47,000 people to ICE, according to a government watchdog.
A list shared with Mission Local at the police commission meeting showed the U.S. Marshals, the Idaho and Oregon state police and the U.S. Forest Service also accessed the data, among others.
The list detailed the agencies’ reasons for using the data, including to investigate serious crimes like homicide, kidnapping, sexual assault of a minor, and drug trafficking, but also for prostitution, robbery, theft, “obstructing justice,” and poaching.
The leak is now being investigated by the city’s Human Rights Commission and the Department of Police Accountability, Lew said.
Upon learning about the breach, Lew “immediately turned off” access to the surveillance system from the Northern California Regional Intelligence Center, where the leak originated. At the same time, Lew initiated an internal review, the department wrote in a Wednesday evening statement.
Federal agencies sought data from hundreds of other law enforcement agencies as part of the same data probe, SFPD said. San Francisco was the first to discover what is apparently a statewide issue, according to the SFPD.
The Northern California Regional Intelligence Center is one of 80 nationwide “fusion centers” — effectively data clearinghouses — that help with the “receipt, analysis, gathering and sharing” of data between local, state, federal agencies, and their private-sector partners, according to the Department of Homeland Security. It is unclear how the fusion centers ordinarily silo San Francisco data from these agencies.
That center gave access to the Western States Information Network, a Sacramento-based federally funded group that provides “secure, accurate, and timely criminal intelligence and assistance” to western states and and the Pacific islands, according to an informational flyer.
It was that group that ultimately queried the SFPD data for the out-of-state agencies, the department said. It is unclear if any guardrails were set up to prevent the group from accessing the data.
The intelligence center gave the group access to conduct its searches “during night hours,” SFPD said. The analysts were purportedly unaware that California law prohibits such data sharing, and have since updated their policies.
Bad news but no surprise.
Time for government of the city to take these cameras down or we the fine folks of the city will do it ourselves.
Who knows, maybe if I get arrested sfpd will set up a dance battle between Chris Larsen and my funky self.
How do analysts at a Sacramento organization whose purpose is to share information not know key California law that regulates sharing information?
Someone (maybe many someones) should be fired, the organization should lose whatever credentials it had to hold all this private information, and people should be arrested.