|
Getting your Trinity Audio player ready...
|
Despite promises of strict oversight, the Menlo Park Police Department accidentally let out-of-state agencies tap into its license plate reader system, a breach of state law that city officials failed to disclose until questioned by The Almanac.
For an unknown period, the Houston Police Department and the Sauk Village Police Department in Illinois conducted tens of thousands of searches of Menlo Park’s license plate data. The breach came to light after The Almanac asked city officials how automated license plate data was shared.
Menlo Park’s use of automated license plate readers was much deliberated before the system was implemented in late 2024. The City Council originally decided against installing the cameras in 2023 due to privacy concerns, but reconsidered after a string of burglaries in Sharon Heights.
“We worked directly with our City Council to set up ordinances that govern the control of that data and to make sure that not only is it kind of on a short leash, so to speak, but also that we folded in all those concerns into the policy about how we govern ourselves as a police department, and we wrote it into the ordinance as well,” Police Chief David Norris said. “So the city, the City Council has a sense of ownership over how we are very strict about the use of this technology.”
Norris said he reviewed the New York University Policing Project’s papers on automated license plate readers and the American Civil Liberties Union’s recommendations to create Menlo Park’s policies.
“Everything is laid out very distinctly in a policy that we put together and we spent a lot of time making sure it met, as close as we could, the concerns, examples and needs of a very studious group of people,” Norris said. “We’re collecting a lot of information and we want to be prudent about that.”
Menlo Park’s policy limits the retention of ALPR data to 30 days. NYU’s policing project recommends requiring a warrant for searches beyond six hours and retention limited at seven days. ACLU recommends a three-minute retention period, just long enough to compare with law enforcement hotlists.
State law and Menlo Park policy require that an ALPR usage policy and privacy policy be posted on the city’s website. Menlo Park has not updated the online version of its policy with the significant changes that were made in October 2024 in order to implement its current network of Flock cameras. Norris said he recently learned that the online policy was not updated and it will be updated later this month.
Although state law and Menlo Park policy forbid sharing ALPR data with out-of-state agencies, access to the city’s system was shared with departments in both Illinois and Texas. Norris said he only learned about the Illinois access from The Almanac but believed both had been resolved.
Norris said he does not know how access was granted. Menlo Park policy requires the special operations commander to approve outside requests, and Flock documentation indicates approvals are logged.
“I would love to know the answer (of how access was shared.) We’re just not sure. We are exploring to find out how that occurred. It’s possible that it could have been a glitch in the system or it’s possible that there was a batch of requests that came through and we missed it,” Norris said. “I can tell you that there was no intentionality in it and so we’re grateful that we have found that and that we’ve corrected it.
“We are constantly now on the watch to make sure that doesn’t occur again. Sometimes you can prevent things from happening and sometimes you have to have a hiccup in order to learn and move forward. And so the important thing is not necessarily that the mistake occurred, the important thing is what we do to correct it,” Norris added.
Norris did not inform the public of the sharing with out-of-state departments. State law might require the department to notify all individuals whose information was exposed.
Norris also did not inform any members of the city council until after the interview.
Norris said the department learned of the breach while preparing its quarterly report to the City Council. Menlo Park municipal code requires the department to prepare a quarterly report of the ALPR system to be sent to the City Council. The report did not mention the data breach.
“It’s late-breaking information to me… We’re going to be transparent about it. I let the city manager know just recently as that information came to me,” Norris said.
“While we cannot be specific about any action involving individual accountability within our department — that is personnel matter information — we can say that we are working through the accountability issues that were uncovered, and correcting them. As the head of the organization I take full responsibility for the mistake,” Norris added in an email after his interview with The Almanac.
During the period in which Houston had access to Menlo Park’s system, Houston sent tens of thousands of requests that queried Menlo Park’s database. Norris said the department reviewed searches by Houston and found none that were for federal law enforcement or crimes outside of what the Menlo Park Police Department would investigate. He also said that many of those searches likely were not targeting Menlo Park specifically.
Menlo Park declined to provide those searches to The Almanac.
The Houston Police Department has recently come under fire for cooperating with Immigration and Customs Enforcement, including informing ICE about individuals after conducting traffic stops. There are also reports that the Houston Police Department worked with ICE to arrest 214 Houston-area immigrants who were accused of child sex offenses.
State law prohibits local law enforcement from cooperating with immigration enforcement but law enforcement can cooperate regarding crimes not related to immigration. ICE investigates many types of transnational crime. However, regardless of how an agency uses ALPR, it can not be shared with federal or out-of-state agencies, according to the California Attorney General’s Office.
“(ALPR license plate data) is the type of information that could be used to say, track immigrants or aid ICE in immigration enforcement. California has very good reason to not want this data leaked out of state. It can be used to track someone seeking reproductive health care… I think we should all care about protecting the privacy of these people. There are different laws in different states, and the federal government has different priorities than California,” said Electronic Frontier Foundation civil liberties attorney Lisa Femia.
“State law explicitly prohibits the sharing of ALPR information with out-of-state or federal agencies. And the Attorney General confirmed that again in 2023 guidance that explicitly said it is the meaning of the law. It’s been very disappointing to see how many agencies have continued to freely break the law since then,” she added.
This is the first full year of Menlo Park’s two-year pilot program using fixed ALPR from Atlanta-based surveillance company Flock Safety. The City Council approved 35 cameras for two years at a cost of $245,500. The city has installed 30 cameras as of July 2.
The police department uses ALPR in several ways, Norris said. First, every license plate that passes one of Menlo Park’s cameras is checked against California’s stolen vehicle system and AMBER alerts, in addition to other databases of flagged vehicles.
Additionally, the cameras can be used to identify vehicles from eyewitness descriptions. Since Flock is prevalent across the Bay Area, Norris said the department also uses Flock to track where a vehicle is going and alert nearby agencies. Additionally, the department uses Flock to find the routine of a suspect so they can make contact.
“We’ve actually done that a few times with great success. If we’re looking for a particular vehicle that was involved in a particular crime, and we know for the last several weeks, at 4 p.m., this car goes down this street at this time, there can be an officer waiting to make a stop and make an arrest,” Norris said.
Menlo Park also has stopped stolen vehicles the department believed was intending on committing crimes in Menlo Park as the suspects were carrying burglary tools, firearms or stolen property from other jurisdictions.
Some residents aren’t convinced the benefits outweigh the privacy risks.
According to a study by The Independent Institute cited by Menlo Park resident and privacy attorney Soody Tronson, only 0.1% of license plates scanned in Piedmont, Calif., generated an investigative lead.
“The evidence continues mounting that these systems represent an unacceptable threat to civil liberties with minimal public safety benefit. I continue to call for immediate termination of the ALPR program and permanent deletion of collected data,” Tronson said.
“The residents of Menlo Park deserve to know their movements are now being tracked and shared with hundreds of agencies through systems with complex legal frameworks that weren’t fully understood during the approval process,” she added.
Tronson is concerned about how Menlo Park shares its ALPR data with the Northern California Regional Intelligence Center. Menlo Park shared its data with Houston and Sauk Village outside of NCRIC.
“The systems are collecting so much data and there are so many searches happening every month that the number of crimes being solved in comparison to that is a tiny percentage,” said Femia of the Electronic Frontier Foundation. She added that the foundation did a study that found only 0.05% of license plates scanned by the largest users of ALPR in California were on a hotlist.
According to its Flock transparency portal, 0.5% of license plates scanned by Menlo Park in the last 30 days were on a hotlist.
Not everyone sees ALPR as a privacy violation.
“At the end of the day, the data we’re talking about is license plate numbers and, in some cases, make and models of cars,” Mayor Drew Combs said. “We’re not talking about Social Security numbers or people’s more personal information.”
Femia disagreed, saying the tracking capability represents “a fundamentally different type of privacy invasion than just seeing someone on a street corner.”
“(ALPR is) so comprehensive that it reveals far beyond what the founders would have assumed movements in public would have revealed… especially as we see more and more ALPR installed in cities,” Femia added.
Combs also said that individuals can and do install private surveillance equipment including security cameras with little to no requirements on how that data is kept or used. Flock also sells its technology to private companies and homeowner’s associations.
The Menlo Park Police Department is exploring expanding its use of Flock.
“(Flock has) other features available and they have video features that are available with their current LPR cameras. They also have strictly video cameras that utilize different types of technologies. We have had some conversations… we used to have CCTV cameras on certain intersections in Menlo Park but that technology has aged out, and so we are looking for ways that we can recapture that,” Norris said.
One of the benefits for law enforcement of Flock’s non-ALPR products is its Flock Freeform People Search function, which allows law enforcement agencies to search camera footage for descriptions of people. Flock says that feature is not available on ALPR cameras. Access to the camera footage and freeform search can also be shared across Flock’s network.
Even without its own cameras, Menlo Park can use Freeform people search to look through available cameras. Norris said the department has not yet used that technology since it is new. The department does use Flock Freeform vehicle search which allows it to find vehicles without a license plate number by describing the vehicle.
The Almanac previously reported that outside agencies searched Atherton’s Flock network 832 times citing federal immigration enforcement. In many of those cases, the searches applied to more than 300 agencies, which typically indicates the request was made across all networks available to a department.
Despite the fact many of the departments also have access to Menlo Park’s Flock system. Norris says the police department did not find any searches by outside agencies that had any “buzzwords” the department would be concerned about like “ICE” or “HSI,” referring to a division of ICE.
Norris added that Menlo Park requires all agencies it shares with to sign an agreement to follow its policies, which Atherton did as well.
Unlike Atherton, however, Menlo Park refused to provide the searches outside agencies requested and the reasons for those searches when The Almanac sent a Public Records Act request on July 9. Police departments across the country including in Oakland, Riverside County, Los Angeles, San Diego and Orange County have complied with near-identical Public Records Act requests.
The Almanac’s request asked for two types of already-existing reports generated by Flock Safety that include information about searches by Menlo Park staff members and outside agencies. The Almanac did not seek the license plate or identifiable information about the individual being searched.
Menlo Park refused to provide the reports claiming that it would cause the city to generate new records as it did not have the data from the dates requested.
Even if Menlo Park needed to download new requests from Flock, David Loy, director of the First Amendment Coalition, said downloading from an online database with specific filters would not count as creating new records.
Menlo Park also denied the request on the grounds it would be disclosing an investigatory record. It is not clear whether it would be considered an investigatory record under relevant law, but that exemption is voluntary and agencies are free to disclose such records.
“The city attorney’s office provides us with a recommendation, and the vast majority of the time, unless there’s an overwhelming need to do something differently, we follow the city attorney’s recommendation,” Norris said.
“There wasn’t some type of overwhelming need to get this information released in any other way than what the city attorney was recommending… If there was something else that was causing us to rethink that, then we would have rethought that,” Norris said.
“(The decision on The Almanac’s records act request) was made by the city attorney and based on her legal expertise… I cannot myself overrule a decision of the city attorney,” Combs said. “If it is the desire of the council that the guidance from the city attorney is not the stance that the city wants to take in this instance, then obviously a majority of the city council has the agency to direct the city attorney otherwise.”.
“It’s extremely important that those kinds of reports are made public. I think recent reporting has made that very clear… We’ve seen reasons given in the search audits that say ‘ICE’ or ‘FBI’ and that’s the only way we’ve been able to tell that they’re actually sharing this information with federal law enforcement,” said Femia. “Another reason it’s really important is just to make sure that the reasons that the database is being searched are actually legitimate. I think a lot of the search audits that have come out have really shown how loose the policies seem to be on providing reasons for these searches.”
“I’ve seen tons of them that just say ‘case’ or ‘investigation’ or ‘crime,’ which tells you basically nothing and provides the public with no transparency on how this data is being accessed, despite the fact that law enforcement agencies in California are required to have a use policy,” Femia added.
When Flock was discussed by the city council, Councilmember Betsy Nash was the only member to vote against the program. Nash declined to comment.
West Menlo Park schools end lockdown, authorities say suspect died of self-inflicted gunshot woundDecember 16, 2025 1:31 pm
Thank you to the Almanac for this investigation.
Come on, Menlo Park city government. Admit you blew it, come clean and try to do better. Nobody likes a cover-up.
This was clearly a cover-up. By not acknowledging that, city administration is helping to ensure that it will happen again. I am not overly concerned by the breach itself, but I am concerned when our police agencies do not conform to civilian oversight in general. While he seems to be doing a good job in other respects, it is probably time for Chief Norris to be replaced by someone who respects civilian authority.
–Chuck Bernstein, Oak Court, Menlo Park
I have a suspicion the reason the department is withholding releasing the specifics about the searches is because they would cause even further outrage. Remember the news story from earlier this year about the Texas sheriff that searched over 83,000 traffic camera locations across the country (not just Texas) looking for a woman who had an abortion? It’s really disappointing to hear the officials in charge calling this a “glitch” as if it doesn’t have any consequences.
This doesn’t bother me. There is long established case law that there is no expectation of privacy while in public. This case should be moot. If someone takes this law to SCOTUS I’m pretty confident it would be ruled unconstitutional.
Your reading comprehension is very low. You clearly missed the entire point of the article.
I have no problem with reading comprehension. You seem to however.
Echoing most of what was said above: David Norris, you need to turn over all of the searches that were done, no one believes your claim that no searches were done for ICE, just like everyone (correctly) doubted your assurances on the safety of the system. Please resign. Mr. Margulis, you did an amazing job and your work, just like with Atherton, is greatly appreciated. Thank you and all of the country Almanac for its hard-hitting work. I am sure the paper is in great hands with you.
Keep up the good reporting on this. It is important work.
To the writer talking about lack of expectation of privacy in public, that isn’t the issue. You’re right, that’s well established. And why ALPR systems are allowed at all. But these systems collect more than that. The aggregate data can provide information about your location, time, movements, etc. which is much more hazardous to civil liberties. And it goes beyond the constructs for “reasonable expectations of privacy”. This is less well established in case law but really a matter of where the line is not if it exists.
RE our Chief of Police, this is yet another example where he appears to be one thinking that he does not really need to comply with all policies and that “oopsies” have no consequences. Perhaps we should argue that precedent if we get a ticket. I can understand that a mistake in configuration or permission could be made. But it’s not ok to wave it off as if it’s normal. And as a public agency, they need to be compelled to have more transparency about the mistake and corrective actions taken.
Which brings us to the City Council. They are failing in their oversight. They demanded reasonable constraints when authorizing this system (I would have preferred even less retention closer to the ACLU guidelines but reasonable people can disagree.). But apparently the Mayor and Council are willing to look the other way on this policy violation, again. They should be demanding answers in public, not making excuses that it’s not that bad.
TR: That is not what the case law says. It does not address “data in the aggregate”. It addresses one’s reasonable expectations of privacy in public. We have none. Perhaps if someone took your argument to SCOTUS they might agree, but I doubt it. I would think if that argument had any legs the ACLU would have had it in front of SCOTUS already. ALPRs are not new.
I approve of our police and our police chief. We are fortunate to have them protecting our community. “Menlo Voter” has the right view on the this matter.
So you believe that the police chief should decide what laws he will enforce and what laws he will ignore? You have absolutely no idea how dangerous that is.
If I break the law in Menlo Park, intentionally or unknowingly, the MPPD either arrests me or issues me a ticket. This includes laws that, as Menlo Voter suggests, could be unconstitutional if someone decided to take it “all the way.”
An example of this is the red light cameras they ran for many years. Perhaps they still do. Many people have argued that wouldn’t hold up at the Supreme Court because there’s no ability for the accused to confront the actual company that operates and maintains the camera in court.
Will this violation of the current California law on the books have ANY consequences for the MPPD? Of course not. There’s something very wrong with this.
Incidentally, I happen to disagree with the law they violated and don’t believe in a sanctuary state or city concept. Nonetheless, the concept that the police department violates the law, nothing happens, and then gets to continue to cite other citizens with any type of moral authority is ridiculous.
I highly recommend, for your voice to be loudly heard, that those who are worried about the City officials conduct as exposed in this excellent Arden Margulis’ piece above to contact their own District City Council member to voice your opinion directly to them, at least by copying & pasting your above comment into an email addressed to your corresponding elected District Representative.
Chief Norris is a lot like Trump in many ways, specifically that he picks and chooses what laws he will obey and enforce and which laws he doesn’t like and won’t. Just look at the problem of dilapidated RVs that have found their way to Menlo. Norris is on the record saying “enforcement isn’t an answer.” As the head law enforcement officer you took an oath to enforce the laws of our city. You don’t get to pick and choose. This mess camera data mess is just another example of a rogue chief believing he’s above the laws that govern us. The city council needs to find a replacement.
You think maybe the progressives on the council aren’t telling the Chief to leave the people in RV’s alone? I do. “enforcement isn’t the answer” sounds exactly like something the progressives would say.