Police chief says SFPD is investigating how ALPR system was queried from outside California; transparency portal planned

Interim Chief Paul Yip told the San Francisco Police Commission on Sept. 10 that the San Francisco Police Department is investigating audit findings showing queries of its flock automated license-plate reader network from agencies outside California and is launching a public transparency portal.

Why it matters: The flock ALPR system is a widely used investigative tool, and Commissioners raised whether any data sharing violated the city’s sanctuary policies and state law. The chief described immediate steps the department is taking and acknowledged historical gaps in oversight while the department traces how out-of-state queries occurred.

Yip said that when the department launched the flock system in 2024 it reviewed and approved only “requests from local state law enforcement agencies for a limited period of time,” and that an out-of-state query log in an audit prompted the review. “To my knowledge, our administrators of this system ... have not knowingly allowed for out of state sharing,” Yip said. He added the department is investigating how those out-of-state queries were recorded and whether outside agencies were able to obtain information from them.

The chief outlined steps the department is taking: routine network audits to detect unauthorized users, coordination with the city attorney’s office and attempts to get records and explanations from Flock (the vendor), and the creation of a transparency portal that will list state agencies with approved access. “We are currently running routine network audits to ensure that no unauthorized users are querying SFPD’s flock data,” Yip said. He said the portal will show “who we’re sharing with within California,” and he described the portal as intended to provide near-real-time information on new requests and approvals.

Commissioners pressed for more detail. President Clay asked bluntly whether the department had “directly provide[d] this license plate reader data information collected by FLOC to any prohibited agency, federal or in or out of state,” and Yip replied, “To my knowledge, we have not provided flock information.” Clay also asked whether nondisclosure or “do not share” contract terms exist between SFPD and Flock; Yip said he would review historic contracts and consult the city attorney.

Commissioner Elias asked whether the audit report would be made public; Yip said the underlying audit results had been produced through a public-records request and that he would consult with the city attorney about posting a fuller version. Elias pressed for a timeline; Yip said the inquiry was in its early stages and he did not yet have start dates for any out-of-state access but said the department is “really in the beginning” of the investigation.

Commissioner Benedicto and others urged the department to review other systems that store sensitive data in third-party clouds — such as body-worn camera vendors and evidence platforms — to confirm they do not pose similar access risks. Benedicto also asked whether the department had an internal policy covering sharing of data from technology systems; Yip said state law and internal policies apply and that he would review whether additional department notices were needed.

Yip scheduled a town hall and promised to release body-worn-camera footage and additional information on the officer-involved shooting noted in the report. He also said limited-English-proficiency users would get translated information for the town hall and that the department is translating a department notice about civil immigration enforcement into core languages.

Ending: Commissioners sought additional briefings and a timetable for results. Yip said he would review contracts and provide updates, and he committed to notifying the commission if he learns that SFPD policy or practice allowed unauthorized sharing.