Vallejo advisory board presses police and Flock Safety for stricter audits and data controls

The Vallejo Surveillance Advisory Board spent much of its June meeting pressing the police department and vendor Flock Safety for stronger transparency and audit controls over license-plate readers and other surveillance technologies.

Public commenters said the volume of automated alerts and unclear data-sharing practices raise privacy and civil‑liberties concerns. “Is anyone elected, appointed, or hired by the city getting security audits of Flock and the other surveillance systems used by the city?” asked resident Eric McGarren during the community forum, adding that the systems "paint a picture of the day-to-day lives of the people of Vallejo." Mike Casalcabe, who identified himself as a research director, said ALPR (automatic license-plate recognition) produced 37,335 alerts in the period covered by the packet and urged the board to clarify which alerts merited a police response.

Vallejo Police Department Captain Bautista and a VPD data sergeant said the department currently triages alerts based on available officers and the nature of calls; the sergeant said training logs are not included in the public packet because they are not tied to specific operations. On questions about redacted cell-site simulator dates, VPD explained those redactions are often tied to ongoing homicide investigations, and staff said items linked to active investigations remain sequestered to avoid revealing investigative techniques.

Flock Safety’s public-affairs manager, Lily Ho, told the board that Flock has published some audit materials on a vendor portal (security.flocksafety.com) and that since 2025 the company has implemented digital guardrails to prevent California agencies from sharing data with out-of-state agencies. Ho also described a new “search anomaly” feature that flags unusual user behavior—such as repeated searches for the same plate or off-hours access—to assist administrators in detecting misuse. She said Flock has worked with external cybersecurity teams (citing a partnership with Miami‑Dade) and that the company represents it will not pursue good-faith security researchers.

Board members framed the issue as two distinct audit needs: external-access audits (who outside the agency accessed the network) and internal-use audits (which VPD personnel accessed or queried data). An ad hoc audit committee reported its intent to develop an overarching auditing policy covering all surveillance technologies and suggested setting a minimum audit cadence; VPD said a quarterly cadence may be feasible depending on the technology and analyst resources. The board asked staff to report back with: (1) whether any known sharing with out-of-state agencies has occurred, (2) how VPD and Flock define and publish audit reports, and (3) demonstrations of Flock’s anomaly‑detection features.

VPD also stated its contract does not allow Flock to retain Vallejo’s data on the vendor side and that data are retained for about 30 days unless preserved for an active investigation or criminal case. Multiple public speakers urged the board to require logs of every external request and a signed usage agreement for each outside agency that accesses Vallejo data; some asked the board to consider whether Flock’s platform should be used at all.

The meeting produced no formal adoption of a resolution on the audit portal that night; legal counsel said staff would draft a resolution for consideration at the next meeting. Board members asked staff to return with more detailed audit-plan language, reports on product updates, and a demonstration or documentation of the anomaly and off‑hours flagging features. The board also requested that VPD and the vendor provide materials that can be posted to a public-facing transparency portal describing data‑sharing partners and the mechanics of audits.

The board moved several items forward for future agendas, including an ad hoc audit-policy effort and follow-up briefings from VPD and Flock on the technical safeguards and reporting practices. The meeting adjourned at 7:52 p.m.