The contract said sharing was off. Flock Safety confirmed it was off. Three days after the Boston Police Department switched on 45 Flock license plate cameras in April 2025, the department learned that police agencies outside Boston could see what the cameras had recorded. That is the central finding of the City of Boston’s 2025 Surveillance Technology Report, obtained by WBUR ahead of its delivery to the City Council on Monday, and it is the reason Boston has now said it will not use Flock again.
“The contract clearly noted that data sharing was to be disabled, and BPD confirmed with Flock that settings were ‘off’ for sharing,” the report says. “Within three days of initiating the Pilot, BPD became aware that other law enforcement agencies were able to access license plate and vehicle information.” The report attributes the exposure to an “error” by Flock. Flock did not respond to WBUR’s request for comment.
This piece sets out what the report says happened, what the pilot’s own audit found about how Boston officers used the system, why the failure matters under a city ordinance that most residents have never heard of, and what it adds to a running story that has now reached at least 25 Massachusetts communities. For background on the company and its cameras, see What is Flock Safety? For the towns that have ended their contracts, see the running list.
The pilot
Boston ran Flock’s system for 156 days, April 1 to September 4, 2025, at no cost to the city. Forty-five cameras photographed passing vehicles and logged plate, description, location and time. Under the agreement, Boston was to be an island: its data visible only to a small number of trained BPD detectives, not to the thousands of agencies on Flock’s national network. The city’s policy purpose, in the report’s words, was “legitimate law enforcement goals and enhancing public safety.”
The island lasted three days. The report does not say which outside agencies accessed Boston data during that window, or how many Massachusetts drivers’ records were exposed. BPD “immediately directed the vendor to disable” the sharing function once it was discovered, according to a joint statement from the department and the city, and Flock secured the system.
What the rest of the pilot looked like
After the sharing was closed, outside agencies had to ask. Over the next five months BPD received 77 requests for access to its Flock data. The report lists the U.S. State Department, the Bureau of Alcohol, Tobacco, Firearms and Explosives, the Drug Enforcement Administration, Brookline police, Watertown police, the Massachusetts State Police and the Maine State Police, plus about two dozen requests from BPD investigators who were not part of the trial. The stated reasons ranged from homicide and drug trafficking investigations to counterfeit currency and a fraudulent rideshare driver. The report does not say which requests were granted.
BPD audited its own use. Officers ran 11,004 searches in five months. About half of those searches did not include a case number tying the search to a specific investigation. The audit, by Lieutenant Detective Justin Wood to the chief of the Bureau of Investigative Standards, recommended that the department require a case number for every future search. The report found no complaints of misuse and no evidence that the pilot affected “the civil rights or liberties” of any marginalized group. Within 30 days of the pilot’s end, the data was deleted and the cameras removed.
Boston then piloted two competitors: 45 Motorola cameras beginning in February 2026 and 30 Axon cameras beginning in June. Officials say no error like Flock’s has recurred. City Councilor Ben Weber, who sits on the Surveillance Oversight Advisory Board, said the council was not told about either pilot until after it had started.
The ordinance that produced the report
The reason any of this is public is a 2021 Boston ordinance on surveillance oversight and information sharing, passed by the City Council in October of that year and in effect since 2022. It requires city departments to obtain City Council approval before funding, acquiring or using surveillance technology, requires existing technology to be approved for continued use, and requires an annual report to the mayor and council on how each technology was used, what data was shared and with whom, what it cost and what it accomplished. The first annual report was delivered in July 2024. The 2025 report is the one WBUR obtained.
The ordinance is a disclosure and approval regime, not a privacy statute. It does not create a right to sue when a vendor shares data it promised not to share, and it does not set penalties for a department that runs a pilot without council notice. What it does is force the facts into a document the council receives every year, which is how the three-day exposure became known sixteen months after it happened rather than never.
Weber’s concern reaches beyond one vendor. Boston’s Trust Act, a separate ordinance, limits police cooperation with federal immigration enforcement. “It’s hard to cordon off one set of information and say, ‘Well, we’re going to obtain this and not share it with ICE,'” he told WBUR. “What the Flock pilot has shown is that we really can’t guarantee that we’re not sharing information or violating our own Trust Act.” The 77 access requests included three federal agencies. Whether any were immigration-related is not stated.
Why the failure mode matters
Every Massachusetts town that has dropped Flock has cited some version of the same concern: the cameras are local, the database is national, and the switch that separates the two is controlled by the vendor. Boston’s report is the first public document from a Massachusetts city establishing that the switch failed in practice, in a contract that explicitly required it to be off, with the vendor having confirmed it was off. That converts a hypothetical into a record.
Mayor Michelle Wu’s framing, as quoted by MassLive, is the one other municipalities will borrow: “When the toggles or access controls either are not able to be restricted, or can be unset in ways that violate policy, we would not use that platform.” That is a procurement standard, and it applies to Motorola and Axon as much as to Flock. Kade Crockford of the ACLU of Massachusetts made the same point to WBUR: the concern about license plate readers is the suspicionless collection itself, not the name on the camera.
The counterargument was put by Quincy Police Chief Mark Kennedy, whose department uses Flock in what he describes as a closed system: 47 of 237 officers have access, he is not one of them, and in a recent 30-day period the cameras captured more than 704,000 plates of which 134 were searched, all for what he called a legitimate investigative purpose. “In criminal investigations, time matters,” he said. Whether Quincy’s closed system is closed in the way Boston’s was supposed to be is a question Quincy’s own contract answers, and residents there can ask for it.
What Boston residents can do
The 2025 report is a public record. Once delivered to the council it can be requested from the City Clerk or the council’s central staff, and prior reports are on boston.gov. The Surveillance Oversight Advisory Board meets publicly. If your plate was captured by a Boston Flock camera between April 1 and April 3, 2025, the report gives no way to know whether an outside agency viewed it, and the data has since been deleted; a public records request to BPD for the Flock access logs from that window is the only avenue, and the department may not hold them.
Statewide, the bill that would regulate license plate readers, H.3755, cleared committee unanimously in March and died in Ways and Means when the session ended. We explain what it would have done in Massachusetts had a Flock camera bill. Boston’s report is the kind of fact that gets a bill refiled.
Common questions
What did Flock do wrong in Boston?
According to the city’s 2025 Surveillance Technology Report, Flock’s data-sharing function was enabled for the first three days of Boston’s pilot despite a contract requiring it to be off and Flock’s confirmation that it was off. Outside law enforcement agencies could access Boston plate data during that window. The report calls it a Flock “error.”
Is Boston still using Flock?
No. The pilot ended September 4, 2025, the data was deleted and the cameras removed. City officials have committed not to use Flock going forward. Boston has since piloted license plate readers from Motorola and Axon.
How many searches did Boston police run?
11,004 in five months. About half lacked a case number. BPD’s audit recommended requiring one for every search.
What is the Boston surveillance ordinance?
A 2021 city ordinance requiring City Council approval before departments acquire or use surveillance technology, and an annual public report on how each technology was used and what data was shared. The 2025 report is the source of these findings.
Which outside agencies asked for Boston’s Flock data?
The report lists 77 requests, including the State Department, ATF, DEA, Brookline and Watertown police, and the Massachusetts and Maine State Police. It does not say which were granted.
Findings and quotations from the City of Boston 2025 Surveillance Technology Report as reported by WBUR (September 14, 2026) and by MassLive as republished by Government Technology; the report itself was not yet posted at publication. Ordinance history from the ACLU of Massachusetts and City of Boston materials on the 2021 surveillance oversight ordinance. Flock Safety did not respond to WBUR’s request for comment. General information about Massachusetts law, not legal advice.