The Data-Sharing Shell Game: San Francisco Figured it Out

Today, KALW reports that the San Francisco Police Department has cut outside agencies’ access to its Flock license plate reader network:

The announcement came after a routine audit revealed that out-of-state and federal agencies made queries into SFPD’s Flock license plate reader cameras network, despite state law prohibiting exactly this. … The data was originally queried by the Northern California Regional Intelligence Center, which then shared information with the Western States Information Network. It was through these two entities that out-of-state agencies were able to make requests.

Gasp.

KALW puts the scale at nearly 300 improper queries into San Francisco’s network in the past year alone. SFPD can’t say what actually went out the door. Chief Derrick Lew said at the Police Commission meeting:

“A query is just that. It’s checking our system to see if there was an actual return,” said Lew. “We don’t know of those queries what generated a real hit, therefore, we don’t know what was actually disseminated.”

The San Francisco Standard reported the same audit, noting SFPD waved off the 299 queries as 0.005% of its total. The Standard’s 2025 reporting documented more than 1.6 million out-of-state searches of the city’s data, at least 19 of them flagged as ICE-related. SFPD now insists no outside agency ever had direct access to its system.

The law is not ambiguous: a California public agency may not sell, share, or transfer ALPR data except to another public agency.^[1] And the statute defines “public agency” narrowly: the state and its cities, counties, and political subdivisions.^[2] Out-of-state and federal agencies are not on that list. Neither are private RISS corporations, like WISN.

Even if NCRIC — which brands itself a government program — were to meet the definition of “public agency,” the data did not stop there. It went to agencies that are definitely not “public agencies” under California’s definition. Laundering the data through a fusion center does not change that. That is the whole shell game.

And it was not a leak. Per the Standard, NCRIC handed WSIN’s Watch Center access to San Francisco data during overnight hours, without telling SFPD. The analysts running those queries were simultaneously searching the databases of between 531 and 763 other agencies — one search, hundreds of jurisdictions, at once. That is the product working exactly as designed.

None of this is news to anyone who was paying attention — which, apparently, did not include SFPD.

In July of 2025, The San Francisco Standard identified the same data-laundering problem, specifically in San Francisco, in “California cops are breaking surveillance laws. Who’s going to stop them?,” quoting EFF:

"It’s the fruit of the poisonous tree,” said Adam Schwartz, privacy litigation director at the Electronic Frontier Foundation. “I don’t think judges like these kind of shenanigans, where the cops are saying, ‘But judge, we didn’t give them the ALPR information; we took the ALPR information, made it into new information, then gave them that information.’”

In February, 2026, I published “The Northern California Fusion Center: A High School Case Study,” which laid out both NCRIC and WSIN. In March, I wrote “Flock promises to implement logging feature it claimed existed,” documenting Flock’s deficient practices — a lack of meaningful logging, and its habit of talking its way around any commitment to comply with California’s ALPR laws.

A few weeks ago, students writing for Carlmont High’s Scot Scoop student paper published “Smile, you’re on Flock: Inside San Mateo County’s expanding surveillance system.” Their story mapped the exact pipeline in San Mateo County that just burned SFPD:

Of the cameras Scot Scoop identified in San Mateo County, the majority of operating agencies, including the San Mateo County Sheriff’s Office and police departments in Atherton, Colma, Hillsborough, Menlo Park, Pacifica, Portola Valley, Redwood City, and San Mateo, share data with the NCRIC, which is a multi-jurisdictional “fusion center.” … That means a license plate in Redwood City can be searched not just by Redwood City officers or the other agencies listed in the city’s Transparency Portal, but also by hundreds of other agencies plugged into the NCRIC network.

Dozens of publications, from a high school paper to the SF Standard, figured this structure out and published it. Privacy advocates and organizations like the EFF and the ACLU talked about it. Multiple ongoing civil suits allege exactly these violations. Countless public comments flagged these problems to elected officials at hearings across the Bay Area and beyond.

After all that, SFPD cracked the case all by itself — during what was either the first routine audit it has ever run, or through some stroke of luck as it bumbled through the most recent repetition of the same audit that routinely failed to reveal this glaringly obvious problem for months, if not years.

Either way … what happens now that they’ve “found” it? Termination is an option. After federal agencies turned up in its network, Mountain View’s council voted unanimously to kill its Flock contract for good; Los Altos Hills cut ties entirely, and Santa Clara County barred its sheriff’s office from touching Flock data. SFPD won’t follow. KALW figures the department won’t terminate its contract, and Chief Lew told the Commission that ALPR has become “a cornerstone of our work.”

Instead, SFPD will probably slap some policies together, call them “guardrails”, and continue to allow Flock to collect data in San Francisco, just as they did after the 1.6 million searches were discovered. In a few months, or maybe years, we’ll be right back to high school papers doing better investigative work than the SFPD can muster with its $849M budget.

Even now, there is no chance that the people who stood by and allowed these violations of law to happen will see any consequences. At most, the city will have to pay someone (mostly lawyers) a bunch of money, and that money will not come out of the police budget.

That’s what “law enforcement” really looks like.