Boston tried a straightforward safeguard with its license plate reader cameras: keep the information inside the city police department. Outside law enforcement agencies were not supposed to have open access. Yet three days after a 2025 camera trial began, police discovered that the system had been set up to allow it.
The problem surfaced publicly in September 2026 when the city released its annual surveillance report. The report described a Flock Safety pilot with 45 cameras and a sharing setting that did not match the city’s agreement. Boston says the setting was corrected promptly. It is not clear from the record whether any outside agency actually searched Boston’s information during those first three days.
Now the city is considering how to prevent a repeat. The Boston City Council scheduled a November 10 hearing on the surveillance report and a proposal to strengthen oversight. The issue is bigger than one company’s mistake: who should have to approve a new camera system, and how can the public check whether the rules are being followed?
What happened during Boston’s Flock trial?
The trial ran from April 1 through September 4, 2025. According to WBUR’s review of the city report, Flock provided the system without charging Boston for the trial. It was intended to help trained detectives search vehicle sightings for legitimate investigations.
The written arrangement specified that sharing Boston’s plate data with outside law enforcement agencies was disabled. The department believed the setting was off. Within three days, however, officials learned a nationwide lookup function had left the data available to other agencies. City officials said they immediately instructed Flock to turn off that access.
That does not mean officials identified a particular officer in another state searching a Boston driver’s plate. The available report does not establish who, if anyone, actually accessed the exposed records. It shows something narrower but still important: an access setting was wrong, despite a restriction intended to protect the information.
The city and police department later said they would not use Flock’s services again. They reported that the trial’s equipment was removed and its remaining data was deleted within 30 days after the pilot ended.
The police audit raised another question
Boston police searched the Flock database 11,004 times over the five-month pilot. That figure counts database searches, not the number of people charged or crimes solved.
The department’s audit found that officers entered a case number for only about half those searches. It recommended requiring a case number in future. As WBUR explained, the report found no recorded complaints or proven misuse from the pilot, but missing case references made it harder to evaluate the reason for each lookup.
A search log is valuable only if it helps someone answer basic questions afterward. Who searched? For which investigation? Was the search appropriate? And did anyone check? An incomplete case reference does not automatically mean wrongdoing, but it makes later accountability more difficult.
The report also described 77 requests for access from other law enforcement agencies after the initial sharing problem was corrected, including federal, state and local organizations. It did not establish which requests were approved. A request for information and automatic access to the underlying database are not the same thing.
Boston moved to different camera suppliers
Ending the Flock pilot did not mean Boston stopped exploring license plate readers. The city’s report described a Motorola pilot that began in February 2026 with 45 cameras and an Axon pilot that began in June with 30 cameras.
The report did not clearly establish whether those trials were still operating in November. Nor should their camera counts simply be added together and called the city’s current active fleet. These were separate vendor trials with different start dates.
Changing suppliers may improve how data is controlled. It is not, by itself, proof that the privacy issue is solved. A system still needs appropriate settings, clear rules for legitimate searches and independent checks that its restrictions work in practice.
There is a legitimate public safety argument on the other side. Police say timely vehicle sightings can help locate missing people and vehicles connected to serious crimes. When the information is accurate and used appropriately, an investigator may follow a useful lead in minutes rather than spending hours looking for it.
The question is whether those benefits can be achieved without allowing routine trips by ordinary drivers to become broadly accessible search records.
What would the proposed city rules change?
Boston adopted a surveillance oversight ordinance in 2022. Councilor Benjamin Weber and colleagues have since proposed an amendment under Docket 1796 addressing gaps in how the City Council is notified about new uses of surveillance technology.
One point concerns switching vendors. Officials had argued that changing from Flock to another provider did not necessarily require fresh council approval because plate readers had already been authorized generally. The proposal would make vendor changes and new trials more visible to elected officials.
According to the Boston Globe’s September reporting, the amendment would also seek clearer camera inventories, locations, counts of plate reads and alerts, and disclosures about misuse and prevention policies. Emergency exceptions would face tighter limits rather than becoming a way to avoid approval indefinitely.
The proposed amendment is not yet law. The November 10 meeting is a hearing on the 2025 report and possible changes, not proof that the council has voted to adopt them. The city is also reviewing other surveillance technology issues at the same hearing.
What should residents watch for next?
The most useful outcome would be more than a promise that somebody will watch the cameras. Residents need to know which vendor is operating a system, whether normal plate records can be shared, and whether an audit can connect every search to a legitimate case.
Boston has already provided an example of why configuration and policy cannot be treated as the same thing. Its contract restricted sharing, but the vendor’s setting briefly allowed outside access. An effective oversight process has to check the system people are actually using, not merely the agreement they signed.
There is a useful parallel in our Chicago report on officers searching outside plate reader databases. Chicago is examining who may search other agencies’ records. Boston’s problem was how the city’s own records became available beyond its intended boundaries. Both are asking who can verify that access controls really work.
Sources
WBUR, September 14, 2026: Boston pilot findings, audit and vendor changes; City of Boston, Docket 1708: 2025 Annual Surveillance Report; City of Boston, November 10, 2026: official City Council hearing notice; Boston City Council, Docket 1796: proposed oversight ordinance amendment; Boston Globe, September 22, 2026: vendor change and oversight proposal.