Boston terminates Flock contract over data sharing concerns

Key facts

• Boston has terminated its contract with Flock Safety.
• The EFF found police routinely searched Flock's database without legitimate justification.
• Reasons logged for searches included 'LOL', 'LMAO', 'sexy', and 'idk'.
• Flock Safety updated its system to require selection from a crime dropdown list.
• Boston requires vendors to not share license-plate data and to erase recordings after 30 days.
• Mayor Wu stated the city needs technology for safety but it must be used responsibly.

Boston has ended its contract with Flock Safety, a company that provides automated license plate reader (ALPR) technology, due to concerns over data sharing and potential misuse of surveillance data. The decision follows an analysis by the Electronic Frontier Foundation (EFF) which found that law enforcement officers across the country were accessing Flock's database with nonsensical justifications, such as 'LOL' and 'sexy,' thereby undermining civil liberties.

According to the EFF, while Flock Safety has updated its system to require officers to select from a dropdown list of crimes before conducting a search, this new system, in place since late 2025, does not verify if the selected reason aligns with the actual purpose of the search. Boston Mayor Michelle Wu stated that the city requires technology to enhance public safety and solve crimes faster, but only under a publicly approved policy that guarantees privacy and civil liberties protections.

Boston's annual report mandates that vendors agree not to share license-plate reader data and to erase recordings after 30 days, unless police request retention for legal or investigative reasons. Wu emphasized that the police department has been piloting different versions of the technology to understand vehicle movements better. She stressed the importance of knowing exactly who can access the data, how it will be retained, and for how long. Wu concluded that if access controls cannot be restricted to conform with policy, or if they can be reset in violation of policy, the platform would not be used.