San Francisco police said Wednesday that their license plate reader data was improperly searched nearly 300 times on behalf of federal and out-of-state law enforcement agencies, a disclosure likely to renew scrutiny of a surveillance tool that has expanded rapidly across California and the nation.

Every day in San Francisco and across the Bay Area, thousands of cameras – many operated by Atlanta-based Flock Safety – capture license plates. Police say the system helps flag stolen or wanted cars and locate vehicles connected to investigations of murders, robberies and other crimes.

The San Francisco Police Department said it was among 532 to 764 law enforcement agencies whose license plate data was simultaneously queried over a year by the Northern California Regional Intelligence Center, an anti-crime fusion center that acts as an information-sharing hub for law enforcement.

SFPD said the searches were conducted through NCRIC by another entity, the Western States Information Network, on behalf of out-of-state and federal agencies that were not allowed to access its data under California law.

The searches were related to criminal investigations involving crimes including murder, child sexual abuse, and gun and drug trafficking, SFPD said. Agencies generally run license plates to try to find vehicles connected to people they want to track or arrest.

San Francisco police called the disclosure a “statewide issue,” but did not disclose how many of the other agencies whose data was accessed are in California.

Police Chief Derrick Lew, revealing the issue at Wednesday evening’s meeting of the Police Commission, said WSIN conducted the searches on behalf of agencies including the Drug Enforcement Administration, the IRS, the Bureau of Alcohol, Tobacco, Firearms and Explosives, and state agencies in Oregon and Washington.

Lew said his department cut off NCRIC’s access to the city’s Flock data after discovering the issue. However, the city has not disabled its Flock cameras.

The audit found 299 improper inquiries over about one year, accounting for 0.005% of all inquiries during that period, according to SFPD. Lew said San Francisco does not know how many matches, if any, were made by the outside agencies as they searched for license plates across hundreds of jurisdictions.

The department said the audit did not find any inquiries referencing federal immigration enforcement or reproductive rights investigations, and the federal agencies identified did not include U.S. Immigration and Customs Enforcement or the Department of Homeland Security.

Police said no federal or out-of-state agencies had direct access to SFPD’s Flock system.

Flock Safety, the company that operates the platform, also said the searches were not caused by a software malfunction, unauthorized access or a failure of its system.

“Every search in Flock is recorded, visible, and traceable to the agency that ran it,” a Flock spokesperson said in a statement.

Instead, the department said NCRIC had access under an arrangement allowed by state law, and NCRIC granted night-hour access to WSIN analysts.

Based on NCRIC’s investigation, SFPD said WSIN analysts conducted the improper searches at the request of other agencies.

WSIN told NCRIC that the analysts were unaware California law prohibited sharing license-plate data with federal and out-of-state law enforcement agencies, according to SFPD.

SFPD said it discovered the issue during a compliance audit in May and reported the findings to NCRIC. Lew told commissioners the department began acting on the issue “as soon as we knew” and that it took nearly a month to review the data.

“There’s a difference between a query and a hit,” Lew told commissioners. “So we don’t know, of those queries, what actually generated a real hit. So, therefore, we don’t know what was actually disseminated.”

Mike Sena, the executive director of NCRIC, said SFPD notified him about the issue May 12. He said WSIN had analysts log the “exact reason” for every search.

“Not one of them was immigration enforcement-related,” Sena told the Chronicle.

He said the state law banning out-of-state and federal sharing has created “gaps” in law enforcement’s ability to investigate crimes that cross state lines and in federal investigations into serious crimes involving suspects in California.

But Sena said he understood why Lew disabled NCRIC’s access to San Francisco’s Flock data.

“It’s a big deal to me because we need to make sure people are in compliance,” Sena said.

Sena was unsure whether all of the other agencies whose data was accessed were located in California, but he said they probably were.

San Francisco began installing Flock license plate readers in 2024, after city leaders announced a plan to deploy 400 cameras at about 100 intersections to combat retail and vehicle theft and other crimes.

SFPD said Wednesday that the technology has helped officers solve crimes and narrow investigations. But the department also acknowledged privacy concerns and said it would continue reviewing access to the system.

“We understand the power of these tools and that the public has interest in privacy,” SFPD spokesperson Evan Sernoffsky told the Chronicle.

Brian Hofer, executive director of the privacy advocacy group Secure Justice, criticized the department’s handling of license plate data and threatened to sue over the disclosure.

“Today’s revelation that SFPD has again violated (state law) and general privacy best practices further demonstrates that they do not take such things seriously,” Hofer said.

Hofer said the failure came even though other agencies have had their data improperly accessed through NCRIC before.

The SFPD disclosure comes as civil liberties groups and news organizations have raised concerns about California police agencies allowing federal or out-of-state access to license plate reader data. The scanners have become a major law enforcement tool, but privacy advocates say the systems can expose detailed information about where people travel, including people who are not suspected of crimes.

SFPD said it was the first and only agency to discover the problem. The department said a regional call will be held with other agencies whose data may have been improperly searched. Lew said the department would continue to update the Police Commission and the public as its review continues.

“Any time protocols and laws are not strictly adhered to by agencies we share data with,” the police force said in a statement. “SFPD will take immediate action to ensure public trust.”

Subscribe

There’s more to San Francisco with the Chronicle. Subscribe today for just 25¢.

This article originally published at San Francisco police cut off Flock access after improper searches for federal, out-of-state agencies.