{"resourceId":"missionlocal-sf-flock-guardrails-20260929","versions":[{"version":"external-c58efc05bb6001a4df24fa6aaf5c0d18a199beee6b636bfc3000ed95e3d240c3","resource":{"id":"missionlocal-sf-flock-guardrails-20260929","title":"San Francisco keeps Flock but shortens open access, forces vendor purge, and ties searches to incident reports","organization":"Mission Local","sector":"Independent local nonprofit journalism","geography":"San Francisco, California, United States","publishedAt":"September 29, 2026","publicationDate":"2026-09-29","eventDate":"2026-09-29","sourceName":"Mission Local","sourceLabel":"Mission Local report on Mayor Lurie Flock privacy policies after Human Rights Commission findings","sourceUrl":"https://missionlocal.org/2026/09/san-francisco-flock-cameras-daniel-lurie-guidelines/","evidenceClass":"independent-reporting","outcomeClass":"mixed","topics":["governance-procurement","data-security","infrastructure","operating-model"],"finding":"On Sept. 29, 2026, Mission Local reported Mayor Daniel Lurie’s office announced new San Francisco Police Department Flock ALPR policies covering more than 400 cameras: officers need police-leadership approval and an active-investigation showing to access data older than 30 days; Flock must delete San Francisco data from its databases after 30 days and transfer it to the department (which can hold it up to a year); every Flock search must include an incident report; SFPD must review Flock logs monthly and request annual Department of Police Accountability audits. The changes follow a Sept. 28 Human Rights Commission report on about 1.6 million improper out-of-state searches that found no sanctuary-law violation by SFPD but urged tighter guardrails. The Board of Supervisors will vote on contract extension in February 2027; Lurie, Assemblymember Matt Haney, and DA Brooke Jenkins will pursue state misuse-penalty legislation after a San Jose off-duty officer ALPR-sharing case revealed no state criminal penalty for improper sharing.","sledRelevance":"Municipal policing ALPR retention, vendor-platform control, search documentation, and civilian audit design—public-safety oversight, not fire/EMS.","evidence":"Mission Local Sept. 29 primary reporting with correction clarifying post-30-day access requires internal approval (not automatic department deletion); quotes mayor’s office, Chief Derrick Lew, Haney, and DA office on pending state bill; situates policies one day after HRC report.","architectureImplications":"Agencies keeping Flock need a hard vendor-side purge/transfer at day 30 so plate data leaves the shared Flock plane, plus case/incident binding on every query and a separate agency evidence store for investigation holds.","governanceImplications":"Keep-and-harden is the political path: SF Democrats reaffirmed Flock while HRC urged controls; Board renewal in Feb 2027 and a state criminal-misuse bill become the next accountability gates.","securityPrivacyImplications":"Moving data off Flock after 30 days aims to cut outsider portal access, but one-year department retention and supervisor-approved exceptions still create a large searchable local store; commenters question whether vendor training-set use is truly blocked.","caveats":"Policies announced at mayor’s office level—implementation fidelity and Flock contract mechanics not independently audited here; HRC report itself summarized secondarily; ACLU critique carried in other same-day coverage; state bill not yet introduced.","streamIds":["public-safety"],"roles":{"sales":"Sales framing: San Francisco is buying trust restoration, not a new camera SKU—position 30-day vendor purge/transfer, incident-bound search, monthly log review, and annual civilian audit as the keep-Flock package before a February 2027 Board renewal. Discover whether the agency can prove data leaves the vendor plane, whether supervisors actually gate post-30-day access, and whether DA/state partners will criminalize improper sharing. Bound the engagement to a controls design and renewal brief; do not promise crime-drop attribution from Flock marketing.","engineering":"Engineering framing: implement Flock-to-agency evidence transfer at day 30 with immutable purge receipts, require CAD or incident IDs on every query path, log supervisor approvals for investigation holds, and export monthly audit packages for DPA-compatible review. Prerequisites include contract language forcing vendor deletion, a CJIS-aligned agency store, and role-based search. Prove value with sample purge attestations and zero unauthorized outsider shares after transfer—not marketing theft-reduction percentages or unverified arrest assists.","delivery":"Delivery framing: stand up the 30-day purge/transfer runbook, incident-number validation, monthly SFPD log review, and DPA annual audit request before the February 2027 renewal hearing. Own operations in SFPD technology leadership with city attorney co-ownership of vendor deletion clauses. Acceptance means published policy, demonstrated purge samples, and a documented supervisor-exception workflow; risks include paper-only supervision and vendor non-compliance with deletion or training-data reuse."},"roleDetails":{"sales":{"customerProblem":"A city keeping 400+ Flock cameras after improper outsider searches must show retention, search, and misuse-penalty controls before Board renewal.","stakeholders":["Mayor's office","SFPD chief/CIO","Board of Supervisors","Department of Police Accountability","District Attorney","State legislators","Privacy advocates"],"discoveryQuestions":["Can the city produce vendor purge/transfer receipts at day 30?","Who in police leadership approves post-30-day access and is that logged?","Will DPA annual audits have raw log access, not only SFPD summaries?","What criminal penalties will the Haney/Jenkins bill actually attach to improper sharing?"],"valueHypothesis":"Bounded value is enforceable vendor-plane exit plus incident-bound search and civilian audit cadence—not guaranteed crime reductions.","potentialEngagement":"6-week renewal-readiness controls package: purge/transfer design, search-validation SOP, DPA audit protocol, Board briefing.","unsupportedClaims":["That Flock has already completed citywide day-30 deletion","That HRC found SFPD violated sanctuary law","Guaranteed privacy restoration from internal supervision alone","That the state misuse bill is enacted"]},"engineering":{"fit":"Large municipal ALPR programs remaining on Flock after data-sharing scandals and facing legislative renewal.","architectureIntegration":"Flock capture to 30-day vendor retention to automated export/purge into agency evidence store to incident-ID-gated search UI to monthly log export to DPA annual review interface.","prerequisites":["Contract clause requiring vendor deletion/transfer","Agency evidence system with investigation-hold flags","CAD/RMS incident-number validation","Supervisor approval workflow with audit trail"],"constraints":["One-year local retention still allowed","Board renewal not until Feb 2027","State misuse statute not yet introduced","HRC recommended direct Nationwide Lookup control not fully detailed in mayor announcement"],"security":"Default deny outsider Flock-network access after transfer; encrypt agency store; continuous search logging; separate immigration/First Amendment prohibited-purpose rules already claimed by SFPD.","proofOfValue":["Sample day-30 purge attestation from vendor","Month of searches with 100% incident-number binding","DPA-accessible annual audit package defined"]},"delivery":{"work":"Implement purge/transfer, incident binding, monthly review, and DPA audit request; brief Board for 2027 renewal.","dependencies":["Flock contractual cooperation","SFPD Technology Services","City attorney","DPA capacity","Legislative partners for state bill"],"ownership":"SFPD operational owner; mayor's office policy sponsor; city attorney enforceability co-owner.","skillsAdoption":"Train officers that searches without incident numbers are blocked; train supervisors on investigation-hold criteria; train auditors on outsider-share detection.","governanceCheckpoints":["Policy effective-date compliance check","First monthly log review published internally","Pre-Board renewal public control report"],"acceptanceCriteria":["Documented vendor purge/transfer operating","Incident-report requirement enforced in system","DPA annual audit request formally lodged"],"risks":["Supervisor approvals become rubber stamps","Vendor retains copies or training derivatives","Board renews without verifying purge mechanics"]}},"retrievedAt":"2026-09-30T02:58:43Z","enrichedAt":"2026-09-30T03:06:44Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Supervisors need capacity to approve post-30-day holds; auditors need monthly log-review time; officers need clear incident-number UX to avoid workarounds.","procurementImplications":"February 2027 Board extension should condition renewal on demonstrated purge/transfer and audit access—not only policy memos.","operatingModelImplications":"Treat keep-Flock as contingent on continuous control proof; pair local policy with state criminal misuse path after San Jose sharing case.","sourceVerification":{"openedUrl":"https://missionlocal.org/2026/09/san-francisco-flock-cameras-daniel-lurie-guidelines/","referenceExcerpt":"Flock will have to delete San Francisco data from its databases after 30 days","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}