Boston Drops Flock After License-Plate Data Access Error

Boston has ended its relationship with Flock Safety after a city report found that outside law-enforcement agencies could access license-plate and vehicle data collected during a 2025 pilot, despite a contract requiring the system to remain closed.

The finding, disclosed in Boston’s 2025 Surveillance Technology Report and reported September 14-15, concerns roughly 45 automated license-plate reader cameras operated for the Boston Police Department between April 1 and September 4, 2025. The pilot was intended to create a Boston-only data environment. Instead, police discovered within three days that other agencies could view information collected by the cameras. City officials attributed the exposure to a vendor configuration error and directed Flock to disable the sharing function. (wbur.org)

What changed

Boston says it will not use Flock cameras going forward. That decision turns a technical-control failure into a procurement and governance issue: the city did not merely object to how police searched the data; it concluded that the vendor’s platform did not reliably enforce a contractual restriction on external access.

The report also describes extensive activity during the pilot. Boston police received requests from outside agencies and conducted thousands of searches, raising a second question beyond the initial access error: whether local oversight can meaningfully govern a system designed to connect law-enforcement databases across jurisdictions. Ars Technica reported that the city’s review found officers often failed to associate searches with a criminal case number, underscoring the difference between having an audit trail and having accountable use. (arstechnica.com)

Why it matters

Automated license-plate readers are often presented as limited tools for locating stolen vehicles or suspects. In practice, their value comes from scale: cameras record passing vehicles, software makes the records searchable, and network connections can allow agencies in different jurisdictions to query one another’s data. That architecture creates a privacy risk even when a city believes it has opted out of broader sharing.

Boston’s experience therefore matters beyond Massachusetts. It suggests that contractual promises may not be enough when access controls are implemented centrally by a private platform. Cities considering these systems will likely demand technical proof of isolation, independent access logs, rapid notification of configuration changes and clearer remedies when vendors violate restrictions.

The episode also arrives as Flock faces wider scrutiny over its nationwide network and law-enforcement sharing practices. Boston’s response—dropping the vendor rather than accepting a corrective setting—could strengthen the hand of local officials seeking warrant rules, public reporting and limits on cross-jurisdiction searches. (apnews.com)

What remains uncertain

The public report does not establish how many individual records were viewed by outside agencies during the three-day window, which agencies accessed them, or whether any search influenced a criminal investigation. It also leaves unresolved whether access logs were complete enough to answer those questions. Boston says the affected data was deleted, but deletion does not reconstruct who may have seen it.

The larger test is whether other cities treat the incident as an isolated vendor mistake or evidence that networked surveillance requires stronger legal and technical safeguards before deployment.