|
Getting your Trinity Audio player ready...
|
Just weeks after Mountain View police revealed that they had allowed hundreds of law enforcement agencies unauthorized access to license plate data, Palo Alto will consider an audit of the city’s own contract with Flock Safety, the company that administers the technology.
Automated License Plate Readers, or ALPRs, have come under national scrutiny after reports that the cameras have been inadvertently used for immigration and reproductive healthcare enforcement under the Trump administration — despite local privacy guardrails that were intended to prevent data sharing.
The city’s Policy and Services Committee will vote to recommend to the City Council on Tuesday that the city reallocate $30,000 so that the consulting firm Baker Tilly, which serves as the City Auditor, can assess Flock’s systems for “appropriate policies, procedures and controls to ensure City information and data is secure and confidential.”
The audit would review Flock’s IT security, source code, accessibility and infrastructure, according to the staff report.
Baker Tilly has operated Palo Alto’s City Auditor’s Office since 2020, but Flock Safety also became a client of the consulting firm in 2024. That means that both Palo Alto and Flock have to sign a conflict-of-interest waiver, which is currently under review by the City Attorney’s Office.
The funding for the audit is coming from unused funds for previous items, so the net impact to the budget is zero, according to the staff report.
Palo Alto first entered into a three-year contract with the company in 2023, to maintain 20 ALPR cameras throughout the city. The contract was then amended in 2024 to add 10 more cameras. The current agreement goes through December 2029.
Many cities throughout the Peninsula and broader Bay Area have contracted with Flock to install and operate license-plate cameras as a crime deterrence and investigation tool.
“Anecdotally, these jurisdictions report that since the deployment of fixed ALPR, they have experienced a marked increase in the recovery of stolen vehicles and report investigative success stories attributable to ALPR data,” city staff wrote in a report back in 2023, when the City Council was voting on the initial contract.
But under the Trump administration’s immigration and reproductive healthcare crackdown, some cities have become aware of the ALPR data being used by hundreds of unauthorized law enforcement agencies across the country — including in neighboring Mountain View.
Mountain View Police Chief Mike Canfield announced on Feb. 2 that the city’s entire ALPR fleet would be disabled, effective immediately. Three weeks later, the City Council unanimously terminated its contract with Flock.
The Santa Clara County Board of Supervisors also terminated contracts with Flock on Feb. 24 in Saratoga, Cupertino and Los Altos Hills, which all contract with the county sheriff rather than having their own police departments.
Ahead of the meeting, Sheriff Robert Jonsen wrote to the board urging them to pass a measure consolidating the surveillance use policies of all contract cities to improve consistency when it comes to ALPR data.
Jonsen wrote that support of the surveillance use policy “is not an endorsement of a particular vendor. It is a mechanism to ensure that when the Sheriff’s Office uses ALPR technology — regardless of the vendor selected by a contract city — we do so judiciously, transparently, and in full compliance with state law and County policy.”
The board’s decision also directed staff to explore more stringent data sharing requirements, such as warrants, a time limit for data retention and an outright ban on generative AI and facial recognition technology for ALPR systems.
State law prohibits sharing ALPR information with out-of-state agencies as well as the sharing of this information for immigration enforcement purposes.
Locally, the Palo Alto Police Department has stricter requirements in order to share ALPR data with other law enforcement agencies. According to the Surveillance Use Policy that was approved alongside the initial Flock contract, other agencies must make a written request for the data and its purpose and earn approval from the Chief of Police. The access is then laid out as a formal Memorandum of Understanding between PAPD and the other agency.
“Requests for ALPR data by non-law enforcement or non-prosecutorial agencies will be processed by the Department’s custodian of records and fulfilled only as required by law,” the policy states.
PAPD is also required to audit the ALPR system at least once a year to make sure that the data is being used in accordance with the surveillance use policy. The internal audit is reviewed by the chief and retained on file in the department.
Now, city officials appear to want an external audit by Baker Tilly as well, given “given recent
concerns about the security of the City’s data within Flock Safety’s system.”
Depending on the outcome of the Policy and Services Committee — made up of Councilmembers Julie Lythcott-Haims and Keith Reckdahl and Vice Mayor Greer Stone — the City Council will then vote on conducting the audit. The preliminary schedule in the task order suggests that the audit would be complete by June 30.
Correction: The previous version of the story misstated the duration of the city’s contract with Flock. It currently goes through December 2029.
