The City of Boston has severed its relationship with Flock Safety, a leading provider of automated license plate reader technology, after the company’s own systems shared sensitive vehicle location data with law enforcement agencies across the country — in direct violation of a contractual agreement to keep that data exclusively within the Boston Police Department. The incident, now documented in Boston’s annual surveillance technology report, adds a significant new chapter to a growing national debate over who controls the data collected by private surveillance vendors operating on public streets.

What Happened: A Vendor Error With Nationwide Reach

Between April and September 2025, the Boston Police Department ran a pilot program deploying approximately 45 Flock Safety automated license plate reader cameras throughout the city. The contract governing that pilot was explicit: data collected by BPD cameras was to be accessible only to trained BPD personnel, and data sharing was to be disabled. BPD confirmed with Flock before launch that the sharing settings were turned off.

Within three days of initiating the pilot, the department discovered that other law enforcement agencies across the country were already accessing Boston’s license plate and vehicle data through a nationwide lookup feature — one that Flock had enabled by error. According to Boston’s 2025 Annual Surveillance Technology Report, the unauthorized function was disabled immediately upon discovery, and no further direct access was permitted for the remainder of the pilot without a formal written request to BPD.

The report did not specify how many outside agencies accessed Boston’s data during that brief window, nor what searches were conducted. What is clear is that the breach was a direct violation of the contractual terms Boston had negotiated specifically to protect its residents’ privacy.

Boston Mayor Michelle Wu confirmed the city’s response in a segment on GBH News: “We have actually abandoned Flock.” Speaking on her monthly call-in program, Wu acknowledged that while the city still intends to use license plate reader technology, it requires a vendor capable of honoring the privacy and access controls the city demands.

The Broader Architecture of Flock’s Data Sharing Network

To understand why Boston’s experience was both predictable and alarming, it helps to examine how Flock Safety’s network is designed to operate. According to an October 2025 report from the ACLU of Massachusetts, Flock’s system allows police departments to choose their level of data sharing: no sharing, sharing with specific named departments, sharing with all agencies within a state, or sharing with Flock’s entire nationwide network. As of mid-2025, that network encompassed more than 7,000 agencies and organizations.

The ACLU report notes that Flock’s design incentivizes maximum sharing: if a department opts into the full nationwide network, it gains access to search data from the entire network in return. The feature requires little more than an administrator clicking a single toggle button labeled “Enable National Lookup.” Once enabled, officers can query license plate data from thousands of jurisdictions simultaneously.

Documents obtained by the ACLU of Massachusetts revealed that over 80 Massachusetts police departments had entered into Flock contracts, with the state spending more than $2 million in taxpayer funds on the technology over three years. Many of those departments had been sharing locally collected data into the national database — making Massachusetts drivers’ movements potentially visible to law enforcement agencies in states with vastly different legal frameworks, including states that have enacted laws targeting abortion access, gender-affirming care, and civil immigration enforcement.

Officers Searching the Database With “LOL” and “LMAO” as Justifications

Boston’s contract violation did not occur in isolation. A September 2026 report from the Electronic Frontier Foundation documented a parallel accountability failure at the heart of how officers across the country are actually using Flock’s nationwide lookup tool. The EFF’s analysis of ALPR search logs from Flock Safety systems found that officers were routinely accessing sensitive location data while logging search justifications such as “LOL,” “LMAO,” “sexy,” and “idk” — shorthand for “I don’t know.”

Flock has responded to this accountability gap by introducing a dropdown menu requiring officers to select a crime category before running a search — a change implemented in late 2025. However, the EFF noted that the new system does not require any verification that the selected crime category actually matches the true purpose of the search, meaning the dropdown functions more as a formality than a meaningful safeguard.

Flock Safety announced further reforms in August 2026, including a reduction in default data retention from 30 days to 7 days, mandatory adoption of its “Audit Assistance” feature — which detects abnormal search activity — across all law enforcement customers by year’s end, and a new “proactive lockout” system that automatically suspends accounts exhibiting abnormal behavior pending administrator review. The company also announced “Offense filtering for sharing,” which would allow cities to restrict what types of cases permit outside agencies to access their camera data.

Boston Moves On — But Keeps the Cameras

The end of Boston’s relationship with Flock Safety has not translated into an end to license plate reader technology in the city. According to the annual surveillance report, the Boston Police Department launched a new pilot with Motorola in February 2026 and a third pilot with Axon beginning in June 2026. Mayor Wu made clear that the city’s rejection of Flock is about vendor compliance, not surveillance policy.

“We need a publicly approved and authorized policy to guarantee all of those protections, privacy, civil liberties,” Wu said in her GBH News appearance. “And if that’s in place, then we should deploy technology to be able to keep people safe and solve crimes faster.” She emphasized that city officials require full transparency about who can access data, how long it will be retained, and under what conditions it will be shared.

Boston’s own policy framework requires vendors to agree not to share license plate reader data and to erase recordings after 30 days unless police formally request retention for legal or investigative purposes. The city’s annual surveillance reporting requirement — which produced the Flock disclosure — is itself a product of a local transparency ordinance designed to keep residents informed about technology deployed in their communities.

The Larger Picture: A Surveillance Infrastructure Without Uniform Rules

Boston’s experience with Flock illuminates a structural tension at the core of how license plate reader networks operate in the United States. Flock Safety, as of mid-2025, had deployed nearly 90,000 cameras across the country. The ACLU has launched a national campaign urging Congress to ban ALPR cameras outright, citing documented abuses including use by federal immigration enforcement, surveillance of political opponents, and wrongful stops based on misread plates — with the ACLU noting that Flock cameras misread the state on license plates in roughly 1 in 10 cases.

What Boston’s case demonstrates is that even a municipality that explicitly negotiated data-sharing restrictions into a legal contract found those restrictions violated within 72 hours of going live. The vendor characterized it as an error. But the infrastructure that made the error possible — a nationwide sharing toggle that defaults toward openness, accessible to thousands of agencies — was not an accident. It was a design choice.

Mayor Wu put it plainly: “It can really help with safety in a lot of ways, but it has to be used responsibly. When the toggles or the access controls” fail, the consequences reach beyond any single city’s residents. In Boston’s case, the consequences prompted the city to walk away from one of the country’s largest surveillance technology providers entirely.

This article draws on reporting from Ars Technica, ACLU of Massachusetts, Flock Safety, and the ACLU national campaign page.

Want to go deeper? Ask NEX, the Decrypted Matrix research assistant, about the documents behind this story. It indexes every article here the day it is published and cites its sources.