The Redwood City Police Department’s automated license plate reader settings were incorrectly configured, allowing unauthorized agencies and Flock Safety employees to search the city’s database at least 99 times in a two-year period.
The police department had not publicly disclosed the unauthorized searches before an Aug. 12 Police Advisory Committee meeting. Police Chief Kristina Bell said neither the department nor Flock could determine whether the searches returned images captured by Redwood City cameras.
“About 1/1000 of a percent of queries were inconsistent with how I expected the system to be configured,” Bell said at the meeting. “We have since the beginning told Flock, our current ALPR vendor, that we wanted our system configured for California law enforcement only.”
California Senate Bill 34 limits the sharing of plate reader data to in-state government agencies.
How the searches happened
Flock Safety, the surveillance company that provides the license plate reader technology, acknowledged in March that some networks across California were “inadvertently accessible” to out-of-state agencies, in potential violation of state law.
Flock said limitations in its earlier technical logging made it impossible in some cases to determine the specific cause of the unintended sharing. However, it “takes full accountability for this situation” and has since added settings, logging and standardized data-sharing controls, the company said.
While reviewing hundreds of thousands of ALPR searches dating to 2023, the Pulse asked Bell on May 6 about several seemingly improper searches. Bell defended each one and told the Pulse on May 7 that “the city has seen no evidence of unauthorized law enforcement agencies accessing Redwood City’s ALPR technology.”
Bell said at the Aug. 12 meeting that she later ordered a comprehensive review of the ALPR audit log, comprising roughly 10 million records. Before that review, the department had been checking its own settings instead of Flock’s settings, which was the “wrong approach,” Bell said.
Instead, the May audit examined “actual activity, system activity, access records,” and configuration settings, Bell said. Department staff built a custom analysis tool that examined queries back to April 2023. Among the 10,192,450 records examined, the department identified 99 unauthorized queries.
Ninety-six improper searches police identified were due to Flock’s miscategorization of agencies as California law enforcement. In 64 cases, it was due to a “backend caching error,” police said Flock told them.
The three other improper searches were by Flock “for demonstration purposes with their technology,” Redwood City police said. That demonstration was done without the department’s permission, according to Bell.
“All of these agencies were able to query our system because the state lookup tool was activated,” Bell said. “These agencies did not send any type of request for access or sharing of our data — those are vendor failures.”
The police department intervened the moment staff became aware of the non-compliant sharing settings, Bell said, by immediately shutting off the statewide lookup tool. The police chief also said the department disabled the statewide lookup tool in February.
While unauthorized agencies could search the city’s database, “it does not mean they received Redwood City images in response,” Bell said.
Flock reviewed every improper query with the department, Bell added, noting the company’s assessment that “it is highly unlikely any Redwood City ALPR images were provided as a result.”
“This is the best information I have available,” she said. “It is not a guarantee, but we have no further ability to independently verify it, based on the vendor’s assessment of its own system.”
Community meeting
Bell discussed improper sharing of ALPR data at an Aug. 12 meeting for the Police Advisory Committee, which formed in March of 2021 and is composed of seven Redwood City residents to support police-community partnership and transparency.
There, Bell discussed the department’s audit of its plate readers and the committee contemplated the future of the program. One committee member called the three-hour meeting the “most active thus far,” with over 30 speakers and 11 written comments, nearly all of which opposed Flock and called for the city to kill the program outright or to welcome more community input.
At the meeting, Bell offered a timeline of events involving Flock. She said in April 2023 the police department set up a demo account with Flock for training and testing only. The Redwood City Council approved the program in September 2023, and in December of that year, the first of 25 active scanners was installed.
While the three-year contract with Flock will expire on Nov. 30, police put out a new request for proposals from plate reader vendors on July 7. The RFP window closed Aug. 7. Officials said it’s against department “practice” to share information about the vendors and bids until after the contract is finalized.
At the meeting, Bell defended the plate reader program as a tool she said the department uses daily. In the last 30 days, Flock detected over 760,000 vehicles on Redwood City streets and searched the data almost 380 times.
“It isn’t magic, and it doesn’t solve cases by itself,” the police chief said. “But in situations where time is critical, it gives officers the ability to move faster, focus resources more effectively and act with information they may not have had otherwise.”
As an example, Bell said, a woman was forced into a vehicle during a domestic violence incident in August 2025. ALPR data helped lead officers to the vehicle, where they arrested the suspect and brought the woman to safety.
“I don’t know how that night ends without this technology,” Bell said. “Public safety matters. Privacy matters. Civil liberties matter. Community trust matters. Our responsibility is not only to evaluate whether technology can assist investigations, but also whether its use aligns with the values and expectations of the communities served.”
Promising more transparency
In an attempt to make plate reader audit data more available to the public, Bell said the department is looking into community briefings, a designated point of contact for inquiries, and a public-facing database. The department is also interested in periodic audits of system settings and vendor activities, and oversight of new agencies added to the city’s ALPR sharing list.
According to the proposal request, the city is looking for ALPR vendors that can commit to safeguards related to immigration enforcement, privacy, civil liberties, data sharing, cybersecurity, auditability, data retention, transparency, vendor accountability and potential misuse — per input from the Police Advisory Committee and community members.
Palo Alto, San Francisco, Menlo Park, Mountain View and Richmond are among the Bay Area cities with agencies that have identified unauthorized searches of their automated license plate reader data as well.
The San Mateo County civil grand jury released a report on Aug. 3 calling for stricter oversight of plate readers countywide, and did not include Redwood City in its praise of four county agencies for strong transparency and audit practices.
In the fall, Redwood City police will go to city council with a technology recommendation based on its request for vendor proposals, the police chief said. The current contract with Flock will expire in November, and the city has notified Flock that it will not auto-renew the agreement. Flock was eligible to submit a new proposal, according to Jeanne Sullivan Billeci, the city’s communications contractor.
The Police Advisory Committee meeting recommended that the city arrange meetings so community members can weigh in before a new plate reader contract is finalized in the fall.
