Three days. That is how long it took for Boston’s tightly restricted license plate reader pilot to develop a serious problem. Despite a contract requiring data sharing to be disabled, outside law-enforcement agencies gained access to Boston vehicle and license plate information within 72 hours of the program launching, according to the city’s 2025 Surveillance Technology Report. Boston has since ended its relationship with Flock Safety entirely.
What Went Wrong
A vendor error in the first days of the pilot exposed Boston vehicle data to outside agencies, despite explicit contract terms meant to prevent exactly that.
The Boston Police Department ran a pilot from April 1 to September 4, 2025. The contract explicitly required data-sharing functions to remain off.
BPD confirmed with Flock before launch that those settings were disabled. Within three days, the department learned that was not the case.
Flock attributed the exposure to an internal “error.” After BPD moved to disable the function, no further direct outside access occurred for the remainder of the pilot, according to the city’s report as summarized by WBUR.
Outside agencies submitted 77 requests for access to Boston’s Flock data during the pilot period. Available reporting does not confirm whether any agency actually viewed specific records during the brief exposure window; it establishes only that the access capability existed.
Mayor Michelle Wu said, “We have actually abandoned Flock,” in her monthly “Ask the Mayor” segment on GBH, as reported by Ars Technica. She has indicated that Boston will not continue using surveillance platforms that cannot enforce city access restrictions.
Compliance Failures Inside the Department
The vendor error was not the only accountability problem the annual report surfaced; officers also failed a basic documentation requirement at a significant rate.
The vendor’s lapse was not the only problem the report identified. An internal audit found that BPD officers conducted 11,004 database searches during the pilot and failed to include a required case number roughly half the time.
That finding matters because case numbers are how auditors trace whether a search had a legitimate law-enforcement purpose. Without them, oversight becomes difficult to sustain.
Boston’s Surveillance Oversight Ordinance requires the city to publish an annual report on surveillance technology use. That report must document technology costs, effectiveness, privacy safeguards, and data-sharing practices.
This disclosure came through that legally required process, not through a leak or a public-records request.
What Comes Next
The Flock episode adds pressure to a statewide debate over how automated license plate reader systems should be governed and shared across agencies.
At issue is how automated license plate reader systems are governed, shared across agencies, and held accountable in Massachusetts. Boston’s stated position, that a vendor unable to honor access restrictions is not viable, sets a meaningful de facto standard for future contracts.
What remains unresolved is whether that standard will be written into procurement requirements statewide, or whether it stays a city-by-city decision made only after something goes wrong.
