Federal and out-of-state agencies “improperly” searched San Francisco license-plate data gathered through the police department’s Flock system of surveillance cameras, a department audit released Wednesday found.
Police Chief Derrick Lew acknowledged issues with the Flock system when he revealed the leak at the city’s Wednesday evening police commission meeting.
“As helpful as the Flock cameras have been for the department, they have also caused immediate concern,” he told the commission. “It’s no secret ALPR [automated license-plate reader] is a controversial tool, and I think there are a lot of privacy concerns.”
He said immigration enforcement agencies did not directly access the data.
San Francisco has, since 2024, used Flock surveillance cameras to capture license plates on city streets. The San Francisco Police Department then uses the data to track and locate cars in its criminal investigations.
SFPD discovered that there had been 299 illegal inquiries of its Flock camera network over the course of a year, according to a department statement.
This is at least the second such breach: Between 2024 and 2025, SFPD let out-of-state agencies access its Flock data 1.6 million times, according to the San Francisco Standard.
California law prohibits law-enforcement agencies from sharing license plate data to any out-of-state entity. Such data can be used to track drivers’ locations and movements, and elsewhere it has been used by immigration agents for years.
Other police departments across the country routinely share this data with Immigration and Customs Enforcement and other federal agencies. Because other states have no prohibitions against sharing data with ICE, and actively do so, California has cut off access to those agencies, too.
Still, despite Lew’s concerns at Wednesday’s meeting, the police department defended the Flock surveillance camera system.
“This network allows officers to identify suspects more efficiently and with more precision than ever before,” SFPD wrote. “It has helped lead to a historic drop in both violent and property crime amid critical staffing shortages.”
Lew called it a “big tool in our tool vault in terms of our ongoing crime-fighting efforts” during the commission hearing.
Lew did not list all the agencies that accessed the license-plate data, but he said they included the Drug Enforcement Agency and the Internal Revenue Service. The SFPD said “the federal agencies identified do not include Immigration and Customs Enforcement or the Department of Homeland Security.”
But that does not mean agencies like ICE did not subsequently obtain the information from other agencies.
There is ample data-sharing among federal agencies — the IRS, for example, in 2025 agreed to share data with ICE. Last year, the tax agency sent addresses for some 47,000 people to ICE, according to a government watchdog.
A list shared with Mission Local at the police commission meeting showed that the U.S. Marshals, the Idaho and Oregon state police, and the U.S. Forest Service also accessed the data, among others.
The list detailed the agencies’ reasons for using the data, including to investigate serious crimes like homicide, kidnapping, sexual assault of a minor and drug trafficking, but also for prostitution, robbery, theft, “obstructing justice,” and poaching.
The leak is now being investigated by the city’s Human Rights Commission and the Department of Police Accountability, Lew said.
Upon learning about the breach, Lew “immediately turned off” access to the surveillance system from the Northern California Regional Intelligence Center, where the leak originated. At the same time, Lew initiated an internal review, the department wrote in a statement Wednesday evening.
Federal agencies sought data from hundreds of other law-enforcement agencies as part of the same data probe, SFPD said. San Francisco was the first to discover what is apparently a statewide issue, according to the SFPD.
The Northern California Regional Intelligence Center is one of 80 nationwide “fusion centers” — effectively data clearinghouses — that help with the “receipt, analysis, gathering and sharing” of data between local, state, federal agencies, and their private-sector partners, according to the Department of Homeland Security.
It is unclear how the fusion centers ordinarily silo San Francisco data from these agencies.
That center gave access to the Western States Information Network, a Sacramento-based federally funded group that provides “secure, accurate, and timely criminal intelligence and assistance” to western states and and the Pacific islands, according to an informational flyer.
It was that group that ultimately queried the SFPD data for the out-of-state agencies, the department said. It is unclear if any guardrails were set up to prevent the group from accessing the data.
The intelligence center gave the group access to conduct its searches “during night hours,” SFPD said.
The analysts were purportedly unaware that California law prohibits such data sharing, and have since updated their policies.
Bad news but no surprise.
Time for government of the city to take these cameras down or we the fine folks of the city will do it ourselves.
Who knows, maybe if I get arrested sfpd will set up a dance battle between Chris Larsen and my funky self.
“or we the fine folks of the city will do it ourselves”. Yea, sure thing. You first.
Let’s both do it! I believe in you! ❤️
How do analysts at a Sacramento organization whose purpose is to share information not know key California law that regulates sharing information?
Someone (maybe many someones) should be fired, the organization should lose whatever credentials it had to hold all this private information, and people should be arrested.
This is a major scandal. Right-wing crypto billionaire Chris Larsen “donated” the money for this surveillance system without almost zero democratic oversight, or a vote on whether SF residents wanted 24/7 surveillance. The flock contract must be terminated IMMEDIATELY.
SFPD has plenty of staff and funding. I am so tired of this Big Lie about staff shortages being used to justify every abuse under the sun. Cities all across the country are ditching Flock to protect immigrants, from Austin, Texas to El Cerrito just across the Bay, and San Francisco should too — and while we’re at it, redirect excessive SFPD funding to services that address root causes of crime.
Isn’t Flock Chris Larsen’s and isn’t he the billionaire supporting the city’s moderates? Why is San Francisco caving to billionaire republicans? GrowSF, TogetherSF, this new PAC attacking Fielder and Lee, Michael Moritz, Gary Tan? They want to take over SF, Weiner and Manny want to erase rent controlled housing and develop over it and I’m not really understanding why the rest of my SF residents are ok with this.
It is troubling that between the two staff reporters on the byline, they couldn’t manage to get a reaction from privacy advocates. They aren’t hard to find. Instead we have Lee’s assurance that no harm was done and unsubstantiated claims that this surveillance technology has any meaningful impact on crime investigation or deterrence.
Was the flock data only the camera’s that San Francisco owns and installed, or did it include any of the public private partnership cameras that feed into the RTIC system?
The question is who are the private companies also getting the data from Flock. Do we have to wait a year or two to find out that the SFPD was not only sharing with Ripple, but Palantir, Open AI, Anthropic etc.? Should we believe the SFPD when they say they’ve got it all under control? And didn’t Larsen also finance the drones that are now going to be chasing down “criminals” in SOMA? Why don’t you talk to someone from the Electronic Frontier Foundation?
Why are some comments regulated and not allowed to be posted, but other random ones including “dance battle between Chris Larsen and my funky self” are okay? Not relevant.
Hi Lupe —
These comments are monitored in real time by real people, so they’re not always approved immediately. If people are working or on the bus or feeding their children, the comments tend to sit.
Comments that send us on fact-checking expeditions are not approved, nor are abusive or silly comments or comments that, for lack of a better term, have no redeeming value.
Best,
JE
FWIW a lot of my comments do get zapped and you don’t see me bitching about it.