From the Public Safety edition of September 29, 2026
San Francisco keeps Flock but shortens open access, forces vendor purge, and ties searches to incident reports
Mission Local · Independent local nonprofit journalism · San Francisco, California, United States
- Publisher
- Mission Local
- Original publication
- September 29, 2026
- Source retrieved
- 2026-09-30
- Event date
- 2026-09-29
What happened
On Sept. 29, 2026, Mission Local reported Mayor Daniel Lurie’s office announced new San Francisco Police Department Flock ALPR policies covering more than 400 cameras: officers need police-leadership approval and an active-investigation showing to access data older than 30 days; Flock must delete San Francisco data from its databases after 30 days and transfer it to the department (which can hold it up to a year); every Flock search must include an incident report; SFPD must review Flock logs monthly and request annual Department of Police Accountability audits. The changes follow a Sept. 28 Human Rights Commission report on about 1.6 million improper out-of-state searches that found no sanctuary-law violation by SFPD but urged tighter guardrails. The Board of Supervisors will vote on contract extension in February 2027; Lurie, Assemblymember Matt Haney, and DA Brooke Jenkins will pursue state misuse-penalty legislation after a San Jose off-duty officer ALPR-sharing case revealed no state criminal penalty for improper sharing.
Why it matters
Municipal policing ALPR retention, vendor-platform control, search documentation, and civilian audit design—public-safety oversight, not fire/EMS.
Evidence and measured results
Mission Local Sept. 29 primary reporting with correction clarifying post-30-day access requires internal approval (not automatic department deletion); quotes mayor’s office, Chief Derrick Lew, Haney, and DA office on pending state bill; situates policies one day after HRC report.
Limitations and uncertainty
Policies announced at mayor’s office level—implementation fidelity and Flock contract mechanics not independently audited here; HRC report itself summarized secondarily; ACLU critique carried in other same-day coverage; state bill not yet introduced.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-09-30; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- A city keeping 400+ Flock cameras after improper outsider searches must show retention, search, and misuse-penalty controls before Board renewal.
- Stakeholders
- Mayor's office
- SFPD chief/CIO
- Board of Supervisors
- Department of Police Accountability
- District Attorney
- State legislators
- Privacy advocates
- Discovery questions
- Can the city produce vendor purge/transfer receipts at day 30?
- Who in police leadership approves post-30-day access and is that logged?
- Will DPA annual audits have raw log access, not only SFPD summaries?
- What criminal penalties will the Haney/Jenkins bill actually attach to improper sharing?
- Value hypothesis
- Bounded value is enforceable vendor-plane exit plus incident-bound search and civilian audit cadence—not guaranteed crime reductions.
- Potential engagement
- 6-week renewal-readiness controls package: purge/transfer design, search-validation SOP, DPA audit protocol, Board briefing.
- Unsupported claims
- That Flock has already completed citywide day-30 deletion
- That HRC found SFPD violated sanctuary law
- Guaranteed privacy restoration from internal supervision alone
- That the state misuse bill is enacted
Pre-sales engineering
Role takeaway
- Fit
- Large municipal ALPR programs remaining on Flock after data-sharing scandals and facing legislative renewal.
- Architecture and integration
- Flock capture to 30-day vendor retention to automated export/purge into agency evidence store to incident-ID-gated search UI to monthly log export to DPA annual review interface.
- Prerequisites
- Contract clause requiring vendor deletion/transfer
- Agency evidence system with investigation-hold flags
- CAD/RMS incident-number validation
- Supervisor approval workflow with audit trail
- Constraints
- One-year local retention still allowed
- Board renewal not until Feb 2027
- State misuse statute not yet introduced
- HRC recommended direct Nationwide Lookup control not fully detailed in mayor announcement
- Security
- Default deny outsider Flock-network access after transfer; encrypt agency store; continuous search logging; separate immigration/First Amendment prohibited-purpose rules already claimed by SFPD.
- Proof of value
- Sample day-30 purge attestation from vendor
- Month of searches with 100% incident-number binding
- DPA-accessible annual audit package defined
Delivery
Role takeaway
- Work
- Implement purge/transfer, incident binding, monthly review, and DPA audit request; brief Board for 2027 renewal.
- Dependencies
- Flock contractual cooperation
- SFPD Technology Services
- City attorney
- DPA capacity
- Legislative partners for state bill
- Ownership
- SFPD operational owner; mayor's office policy sponsor; city attorney enforceability co-owner.
- Skills and adoption
- Train officers that searches without incident numbers are blocked; train supervisors on investigation-hold criteria; train auditors on outsider-share detection.
- Governance checkpoints
- Policy effective-date compliance check
- First monthly log review published internally
- Pre-Board renewal public control report
- Acceptance criteria
- Documented vendor purge/transfer operating
- Incident-report requirement enforced in system
- DPA annual audit request formally lodged
- Risks
- Supervisor approvals become rubber stamps
- Vendor retains copies or training derivatives
- Board renews without verifying purge mechanics
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Agencies keeping Flock need a hard vendor-side purge/transfer at day 30 so plate data leaves the shared Flock plane, plus case/incident binding on every query and a separate agency evidence store for investigation holds.
Governance
Who approves, reviews and stays accountable for outcomes?
Keep-and-harden is the political path: SF Democrats reaffirmed Flock while HRC urged controls; Board renewal in Feb 2027 and a state criminal-misuse bill become the next accountability gates.
Security and privacy
What data, permissions and controls need testing?
Moving data off Flock after 30 days aims to cut outsider portal access, but one-year department retention and supervisor-approved exceptions still create a large searchable local store; commenters question whether vendor training-set use is truly blocked.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Supervisors need capacity to approve post-30-day holds; auditors need monthly log-review time; officers need clear incident-number UX to avoid workarounds.
Procurement
What should contracts, pricing and exit terms secure?
February 2027 Board extension should condition renewal on demonstrated purge/transfer and audit access—not only policy memos.
Operating model
Which teams own the service once it runs?
Treat keep-Flock as contingent on continuous control proof; pair local policy with state criminal misuse path after San Jose sharing case.
Publication history
- 2026-09-29Public Safety · Issue 234 resources
Stable resource ID: missionlocal-sf-flock-guardrails-20260929