SFPD License Plate Reader Data Improperly Accessed by Out-of-State and Federal Agencies
San Francisco police discovered that automated license plate reader data was improperly accessed by out-of-state and federal agencies through intermediary organizations that lacked proper access controls. The audit found nearly 300 improper searches over one year, and access was immediately disabled upon discovery.
What happened
San Francisco police discovered through regular audits in May 2026 that its Flock automated license plate reader network was improperly accessed by out-of-state and federal agencies. The audit found nearly 300 improper searches conducted over approximately one year, representing 0.005% of all searches during that period.
The searches were performed by analysts at the Western States Information Network (WSIN), a multi-state law enforcement organization, which had been granted access by the Northern California Regional Intelligence Center (NCRIC). WSIN analysts conducted searches on behalf of outside agencies without direct access to the system themselves. WSIN stated that its analysts were unaware of California law prohibiting such sharing.
Upon discovery, San Francisco police Chief Derrick Lew disabled NCRIC's access to the ALPR system and initiated an internal review. The audit found no searches related to immigration enforcement or reproductive rights investigations.
Reported impact
License plate data from SFPD's network was made available to out-of-state and federal law enforcement agencies in violation of California law, which prohibits sharing ALPR data with such agencies without a court order or warrant issued by a California court.
Index analysis
The incident represents unauthorized sharing of surveillance data through intermediary organizations that failed to enforce state-mandated access restrictions. All queries to SFPD's network were simultaneously made to between 531 and 763 other law enforcement agencies.
Governance controls
California law prohibits law enforcement agencies from sharing ALPR data with out-of-state or federal agencies without a court order or warrant issued by a California court. SFPD had authorized NCRIC to access its ALPR data under state law, but NCRIC improperly granted that access to WSIN without implementing necessary restrictions.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.