City auditor finds gaps, recommends stronger controls in APD license-plate reader program

The Austin city auditor and APD officials presented findings on the city’s yearlong trial of automated license-plate readers at the May 19 Audit and Finance Committee meeting.

Jake Perry, the auditor in charge of the ALPR project, told the committee the audit covered the trial period from late May 2024 through December 2024 and that APD’s risk-management quarterly audits “generally complied with policy requirements but could be improved with greater formalization and scheduling.” Perry said gaps in metadata and timing issues limited the office’s ability to verify some audit metrics.

Perry said the audit team identified roughly 75,000,000 license-plate scans during the audit window but could not fully verify that number because staff sometimes failed to pull metadata on time. He said the audit found approximately 134 prosecutions related to ALPR activity in the period covered by the audit, while APD’s internal counts, taken over a longer timeframe, later showed 228 arrests from March 28, 2024 through March 31, 2025.

Perry said the audit’s recommended fixes focused on strengthening the audit process: “We recommend that APD continue conducting regular audits of the ALPR program while streamlining their audit process,” including automating data pulls, completing metadata anonymization, documenting roles and procedures, and scheduling and reporting audits to stakeholders on a consistent timeline.

APD Assistant Chief Sheldon Askew and Chief Lisa Davis responded to the audit. Askew described the department’s view that the program “is generally aligned with peer programs,” and emphasized APD’s belief that ALPR produced investigative results during the trial. Askew said APD had recovered vehicles and aided investigations, and that department staff had worked with the vendor to enable automated data pushes to reduce gaps.

Askew described corrective actions already under way: creating documented audit procedures and training videos so risk-management work can be replicated after staff turnover; requiring certain fields and case numbers be entered when officers search ALPR data; and scheduling regular reporting to groups including the Public Safety Commission and the Office of Police Oversight. He said APD had added transparency links for Axon and Flock data to the department’s open data portal.

The auditor raised an additional observation about contract language in the city’s agreement with Flock Safety. Perry said the contract included a section that granted the vendor what the auditor characterized as “a nonexclusive worldwide perpetual royalty-free right to use aggregated data,” and that the contract did not define “anonymization” or specify which metadata could be retained. Perry noted the audit team had not observed improper use of data but flagged the contractual wording as a potential risk and recommended the city ensure contractual language aligns with council direction.

Assistant Chief Askew told the committee he had discussed the language with the vendor and that APD’s implementation set data retention at seven days. Askew said that, in his account, Flock retains only anonymized, non-location photographs for vendor development and that Austin’s data are deleted after seven days; he said the department would work with the vendor to clarify the terms and to require audit-grade data handling.

Committee members asked for more detail about outcomes tied to ALPR. Assistant Chief Askew provided category breakdowns for arrests during a 12-month window and said about 31% were unauthorized-use-of-motor-vehicle incidents and roughly 18% were requests to apprehend (warrants). He said detectives used ALPR lookback searches in some homicide and aggravated-assault investigations where other leads were scarce and described at least one homicide investigation in which ALPR data helped identify persons of interest.

Council members pressed staff and the auditor on the number of outside data-share requests. Perry said the audit identified three data-sharing instances during the audit period and that five additional requests had arrived since the audit period ended, bringing the total to eight. APD explained that some shares originated with the Austin Regional Intelligence Center and that paperwork and reporting timing had contributed to early undercounts in APD’s internal reporting.

On contract questions, Chris Coppola of the city law department acknowledged the agreement’s language created ambiguity and said legal had raised concerns during contract review. Coppola said APD and legal interpreted vendor commitments as compliant with the resolution but agreed the contract could be clarified to eliminate ambiguity.

The auditor’s single formal recommendation to APD was to continue and formalize regular audits, automate routine data pulls, document roles and procedures, and coordinate reporting to stakeholders. APD described implementation timelines for several items and said some steps (data-push automation and public transparency links) were already in place.

The committee did not take a formal vote on continuing the ALPR program during this meeting; the trial period has ended and the full council will consider next steps after receiving audit reports and APD responses.