San Francisco Police Audit Shows Feds ‘Improperly’ Accessed License Plate Data Hundreds of Times

But the revelations from the audit have already drawn renewed scrutiny of the partnership — after cities across the Bay Area have reconsidered or terminated contracts in the last year following reports that some customers’ data had been illegally accessed by out-of-state agencies, including U.S. Immigration and Customs Enforcement, without their knowledge and in violation of California law.

Under a 2015 state law, California public agencies are barred from sharing license plate reader data with federal and out-of-state agencies, and they are subject to strict privacy policies on such information.

“Local law enforcement continue not to care, not [to] pay attention to these sensitive databases that we have,” said Brian Hofer, whose nonprofit, Secure Justice, sued Oakland over reports of illegal data sharing last year. He said the organization plans to file a separate suit over the new findings.

Civil liberties organizations have also sued San José related to its Flock cameras, alleging that the technology creates an unconstitutional “mass surveillance system.” Critics fear the data could be used against immigrants and women seeking reproductive care, as the Trump administration moves to expand deportations and limit abortion access.

Flock advertises its data-sharing offerings, which allow customers to share camera data with other contracted agencies on either a national, state or one-to-one sharing level. In part, the tool is intended to increase coordination between neighboring departments, such as being able to track a suspect vehicle that travels from one jurisdiction to another.

While many Bay Area agencies have said that they do not participate in the “National Lookup,” and instead share their data on a one-to-one basis with neighboring departments, some have alleged that the wider sharing setting was reactivated by Flock without their knowledge, allowing out-of-state agencies to access their information.

In this case, SFPD allowed NCRIC to access its data, but said that the partner organization gave access to analysts from a third-party group, the West States Information Network, “during night hours.” SFPD Chief Derrick Lew said analysts from WSIN, an agency that provides law enforcement coordination and analytical support, conducted the searches on behalf of other agencies and did not know about California’s state law prohibiting data sharing out of state. The department has since disabled both NCRIC and WSIN’s access to the city’s camera network, Lew said.

Hofer said Secure Justice has been warning about illegal inquiries for years.

“This was always a known speculative concern, and for the last two-and-a-half years of doing audits, it’s been a proven concern,” he said.

NCRIC Executive Director Mike Sena said the organization’s protocol is not to share data with federal and out-of-state agencies. He said that was not part of WSIN’s protocol before the audit, but that its policies have been “corrected.”

In a statement, a Flock spokesperson said the breach “was not the result of a software malfunction, platform issue, unauthorized access or any failure of the Flock system. It involved searches conducted by authorized users at a California state agency that were later determined to be inconsistent with California’s ALPR data-sharing requirements.”

It’s not clear, according to Lew, if any of the outside organizations accessed any SFPD data. Not every query “hits,” or leads to relevant information, he explained.

Among the searches, he said, were queries related to criminal activity and “serious” crime, including homicide, child sexual abuse and drug and gun trafficking.

Lew said the “queries of concern” conducted by NCRIC don’t include any that reference immigration enforcement or reproductive rights. He confirmed that the department is not aware of data being accessed by ICE or the Department of Homeland Security.

But Hofer said that doesn’t guarantee the searches weren’t conducted for a related purpose.

“They just stopped putting things in writing,” he said. “Before all these public record requests and scandals started blowing up, people were actually honest. When they would do a search for ICE, they would literally type in, ‘looking for ICE, investigation number …’”

In December, a federal law enforcement agency in Texas told local officers to be as “vague as permissible” in their Flock database searches, instructing them to say it is for the purpose, for example, of “investigation.” Hofer said Flock has also removed features that track the name of the officer who conducts a search, and suppressed searches with terms like immigration enforcement and abortion.