ALPR Updated Analysis Sept. 2025 

Definitions

An ALPR network is the set of cameras under control of a single law enforcement agency. The number of networks searched is roughly similar to the number of cities’ systems.

The median search size is the median number of networks searched. Each search can be directed at as few as one network, or as many as the maximum number of existing networks. The median search size is the typical number of networks that officers are including in their search. Since networks roughly correspond to cities, this is roughly the number of cities that were included for a single search.

Unauthorized agencies means California law enforcement agencies that are not explicitly included in our list of agencies with whom we share data. That list is maintained on our Flock Transparency site. Only agencies on that list should be able to search Los Altos ALPR data.

The following terms, with any capitalization variations, were considered “vague” or “evasive” terms when used as a reason for a search. These terms could easily be used to avoid the block that Flock has placed on using certain terms like “ICE” or “CBP” in the “Reason” field.

​

• Investigation[s]

• Invest[s]

• Inv[s]

• Intel

• Suspect

• Wanted

Results

Pre Bug Fix

We are not aware of the technical details of the bug that allowed searches of California data by out-of-state agencies, nor how it was noticed. However, the change did make a dramatic difference. Before the bug fix (that is, before March 2025), Los Altos’ data was searched as follows:

​

Number of agencies:    4110

Number of States searching:    48

Number of total searches:    2,478,191

Median Search Size:     5,224

Number of out of state searches:     1,484,353

Number of federal searches:     47

​

Note the large median search size. This indicates that very wide area searches – perhaps over the full United States – are very common. In the absence of policy, or a personal principled stand on the part of the officer to avoid overbroad searches, it seems the easiest thing to do is to just search everything.

​

The top 5 agencies searching Los Altos during this period:

​

Agency:     # of Searches

Riverside County CA SO:     81,471

OC Sheriff CA:     62,445

Houston TX PD:     61,297

Dallas TX PD:     47,443

San Francisco CA PD:     34,055

​

There is some evidence that these searches were used in support of immigration enforcement. There were 15 records whose Reason included the word “immigration”; approximately 195 records whose Reason included the word ICE in a way that was plausibly immigration related; 10 records whose Reason included “border patrol,” and 111 records whose Reason included “CBP.” Not all of those records will represent forbidden searches, but it is likely that at least some of them do.

​

Post Bug Fix

After the bug fix, Los Altos’ network was searched as follows:

​​

Number of agencies:     313

Number of States searching:     1 (California)

Number of total searches:     1,305,993

Median Search Size:     610

Number of out of state searches:     0

Number of federal searches:     1

​

As intended, no out-of-state searches were permitted after the bug fix. The median search size is also reduced, but still likely represents a majority of searches including the entire state.

​

Federal Searches

Note, however, that one federal agency was successful at searching Los Altos’ data. “Loma Linda Healthcare System CA Veterans Affairs PD [Federal]” made two searches, one on April 29, 2025, and one on May 20, 2025. Both searches appear to be statewide.

How was this federal agency able to search California ALPR networks, in violation of SB 34? Without insight into Flock’s security mechanisms, it is impossible to be sure. We might speculate that the presence of “CA” in the name was taken to imply that it is a California agency. Whatever the reason, the fact of the search is a violation of state law.

​

Unauthorized In-State Searches

SB 34 is not the only policy constraint on which agencies should have access to Los Altos’ data. The Police Department and Council have identified 213 California agencies (as of August 15, 2025) with whom we’ve agreed to share data. These agencies are listed on our Flock Transparency Site (https://transparency.flocksafety.com/los-altos-ca-pd).

Nevertheless, the post bug-fix data shows that 112 California agencies that are not on our transparency list accessed our ALPR network since the beginning of March. Included in these agencies are several departments that have publicly stated they do not intend to follow our policies. Atherton  Cmdr. Dan Larsen asserts that the searching party is responsible only to their own policies, not to the policies of the network being searched. This means that Atherton’s searches of Los Altos are not even attempting to be in compliance with our policy. Amador County’s Sheriff Gary Redman asserts that he is not obligated to follow the state’s prohibition on working with ICE, meaning that Amador County’s searches of our ALPR network would be used for immigration enforcement.

For reasons like these, we have been selective in which California agencies can search our data. However, it is evident that despite what Flock claims on their transparency page, our data is being shared much more widely.

The table in the appendix shows all agencies that have searched our data since the bug fix, as well as their approved status.

​

Vague and Evasive Reasons

By Los Altos policy, ALPR searches must have a reason or a case number. In the data, less than 1% of searches include a case number, but most have a reason listed. However, as this is a free field, officers can enter anything they like. Some entries are very specific, like a case number (still in the Reason field) or at least the crime being tracked (e.g., “stolen vehicle”). However, 156,161 searches, or 12% of all searches post bug-fix are so vague as to be meaningless, using one of the terms listed above in the Definitions section. Vague reasons completely undermine the accountability function of the audit.

Most concerning, vague reasons are an easy out for an officer who is performing an unauthorized search, perhaps on behalf of ICE, CBP, or FBI, or an officer from another state. A vague reason is not a lie but still conceals the true purpose. Of course, officers may simply use a vague reason on every search as a paperwork shortcut. While not every vague reason implies unauthorized cooperation, every vague reason is a policy violation.

The degree to which officers rely on vague reasons varies strongly by department. 28 agencies have vague reasons listed for 50% or more of their searches. In these cases, there is effectively no accountability on how the data is being used. Policies and accountability are not being taken seriously by the department.

At the other end of the spectrum, there are 114 agencies where fewer than 2% of searches have vague reasons. These include some large departments that make many searches, like Palo Alto PD, San Mateo PD, Irvine PD, and CHP. When Los Altos searches our own data, it also shows up in the network audit. Once again, our department takes its responsibility very seriously, with only two vague reasons given in 1736 searches, or 0.12%.

A minimum threshold for policy compliance should likely be around 5% or fewer vague reasons given, so that 95% of the searches are accurately recorded. Roughly half (156 of 314) of the agencies that searched our data, authorized or unauthorized, meet that threshold. Of course, this doesn’t come close to the standard which our own department regularly achieves.

The complete list can be found in the table in the Appendix.

Conclusion

​

While Flock promised that their internal controls would prevent data from being shared contrary to Los Altos policy, out-of-policy data sharing is occurring. The amount of out-of-policy sharing is extensive – far beyond incidental errors or one-off mistakes. It is also clear and obvious; these kinds of errors would show up in any basic software testing protocol. The fact that they have not been caught means that Flock’s testing standards are woefully inadequate and far below industry best-practice.

These violations continue all the way through the final days of the available data, suggesting that they likely continue to this day. This means that despite the best efforts of our Police Department and Council to craft and implement a responsible policy, Flock’s software is allowing an end-run around that policy. 

The violations are not evident to our Department when they happen. These out-of-policy searches happen silently. The only way to find and quantify them is by subjecting the network audit data to programmatic data analysis like that presented here.

It must be noted that these breaches actually enhance Flock’s business model. Flock benefits from a “network effect,” where the more agencies fully share their data, the more Flock’s offering is valuable to its customers. This means that Flock profits when data is shared, whether that sharing is in- or out-of-policy. They thus have very little incentive to rigorously implement and test data sharing controls, especially if the violations are unlikely to be noticed without sophisticated analysis.

To responsibly address these issues, City Council should:

1. Require that Flock restrict searches only to the approved agencies.

2. Develop a process that regularly verifies that no unapproved searches have been performed. This could be a regular network audit and the application of this analysis code (or something like it). 

3. Regularly review the approved agencies, and remove those that appear to be in violation of our policies. Reasons for removal should include, but not be limited to: common use of vague search reasons; common use of extremely broad searches; media or public comments that an agency practices or intends to practice activity that is not in compliance with our policy.

We recognize that this could represent a substantial cost to the City. This cost must be recognized as part of the “system cost,” just like the training to our officers or the fees we pay to Flock.

Finally, we thank the Los Altos PD for its scrupulous attention to the policy. If every department were as conscientious as ours, there would be no problem.