Every day I hear more and more rumblings that the city’s upcoming budget season is going to be a tough one. So, before that rollercoaster tips over the precipice and plunges into twists and turns unknown, I thought now would be a good time to pause and talk about a handful of issues that have been percolating in public comment and on committee agendas. The public comments are an open mic — let’s see what the residents are grumbling about!

I hope to do a short series on these this week, so enjoy the first one taking a look at concerns raised over the city’s Flock camera program.

Flock cameras: public safety hero, or privacy villain?

First up at the mics are a handful of public comments on the city’s Flock cameras delivered way back at the February 17th meeting, starting with the one below and continuing through three of the next four speakers:

Before we dive into these comments, let’s back up. What are “Flock cameras”?

Flock cameras are “automated license plate reader”, or ALPR, cameras, which are typically installed at intersections. As the name implies, these cameras take real-time video and photographs of the license plates as well as the make and model of passing vehicles, allowing law enforcement officers to cross reference this information against “hot lists” and other criminal activity databases. “Flock” refers to Flock Safety, a private company that has been providing these cameras at a prodigious clip to local public safety agencies, including Costa Mesa.

At least since 2024, the city has leased 46 cameras from Flock Safety and has installed them at various intersections. And the police department loves them because they get results: according to a 2024 city report, “Costa Mesa’s ALPR cameras have directly led to 84 felony arrests, including cases of grand theft, possession of stolen vehicles, embezzled vehicles, vehicle burglaries, and apprehending wanted individuals. Flock has also led to the recovery of 69 stolen vehicles in Costa Mesa, valued at approximately $1.118 million.”

All good, right? Well, not necessarily. Flock’s business model involves leasing, rather than selling, these cameras to public safety agencies. Those agencies, therefore, neither own the cameras nor directly control the databases that store the information those cameras collect.

So, in addition to creating a recurring line item in the public safety budget to continuously lease these cameras — the Costa Mesa contract with Flock Safety costs about $150,000 per year — a city’s relationship with Flock represents a significant data privacy challenge. As illustrated by the public comments above, immigration doves have been particularly concerned that data collected by these cameras are searchable by federal agencies, including federal immigration enforcement, allowing them to pinpoint the location of deportation targets by tracking their cars.

Flock vehemently denies this. It asserts that agencies like Costa Mesa can control how its data is used, including by removing its data from national databases and strictly limiting access to authorized users. And, so far, local officials are echoing this confidence. In response to some public grumbling last Fall, Costa Mesa Police Department Chief Joyce LaPointe conducted an audit of the city’s Flock camera program. In a memorandum sent to the City Council, Chief LaPointe confirmed that “no unauthorized organizations have access to [Costa Mesa] data” and that, per the city’s Flock camera settings, “We do not have the ability, even if we wanted, to share Flock information with federal agencies or out of state agencies.”

But here is where my contract-lawyer ears perk up. First of all, Chief LaPointe is repeating legal protections of Costa Mesa’s data, rather than physical ones. At the end of the day, the city’s data lives on Flock’s servers, and those are beyond the city’s control. Flock got caught providing unauthorized (and undetected!) access to Ventura County’s data to federal agencies earlier this year, and (gulp) even Flock’s own administrators couldn’t figure out how the error occurred. So, really, the city’s contract protections are subject to Flock’s own ability to protect that data it handles on the city’s behalf.

And there is another problem with relying on contract terms to protect Costa Mesa data. While those terms may give Costa Mesa some assurance that Flock Safety will honor its promises, it turns out the city isn’t only sharing its information with Flock. Did you catch that reference to “unauthorized organizations” above? That sounds great, until you look at the organizations we do “authorize” to search our camera data:

… and so on, for over 350 California agencies.

So, in other words, it’s true that Flock hasn’t assembled a national database of the real-time movements of all vehicles. They’ve only done it on a statewide basis in the largest state in the union.

And while that’s bad enough from a privacy perspective, it also blows a very substantial hole in the idea that Costa Mesa “controls” its data. when 350+ other agencies also have “authorized access” to the city’s camera data, the protection of that data is only as good as the weakest authorized agency.

For example, let’s return to the public commenters’ concern about immigration data. Do I have faith that the CMPD would tell the Department of Homeland Security to pound sand if a DHS official wanted to log in to our Flock system and search for individuals subject to open immigration detainers?

Yes, I do. But do I have the same confidence that the Huntington Beach Police Department, which is subject to a local directive from its City Council to “employ and deploy every means and resource necessary to combat crime and protect the citizens of Huntington Beach, including coordinating and communicating
with federal law enforcement agencies and honoring ICE detainers,” would do the same? No, I don’t. Yet the HBPD is an “authorized organization”, meaning it could be accessing Costa Mesa data for this purpose and, from our perspective, nothing would appear amiss.

So, should the city end its relationship with Flock?

Returning to our concerned residents above, where does this leave the City’s Flock program?

One way or another, camera-based law enforcement is probably inevitable. The cost of employing flesh-and-blood public safety personnel climbs higher and higher every year, and our urbanizing city’s public safety challenges will only become more complex over time. Cameras are an obvious solution to this problem. And so far, they have proven to be a very useful tool: interdicting car thieves is a very good thing. And snagging at-large criminals with open felony warrants is enormously valuable.

But it is also rapidly becoming clear that the city’s desire to use these kinds of tools is rapidly outpacing its ability to really control them. While on a private business to manage sensitive data when its business model requires leveraging that data seems like a bad idea (to see what I mean, check out this Flock Safety market report, which states that “the company’s business model benefits from strong network effects – as more cameras are deployed across jurisdictions, the system becomes more valuable to law enforcement agencies who can access a broader network of surveillance data”), it may be the only practical choice. Cities are not in the position to purchase and maintain their own cameras, let alone the data centers that would be needed to store and process this information in-house.

But cities also don’t need to bend over backwards to help private companies build valuable mass surveillance tools, either. I would think that the first thing Costa Mesa should do is craft a robust digital privacy policy outlining how and when its city data is used — and then condition access to Costa Mesa’s data by other agencies on adhering to the same policy. While access to the statewide database is valuable, access to Costa Mesa’s data is valuable, too, and it shouldn’t be given away for nothing. At the very least the city should be demanding reciprocal privacy protections.

Next time: we’ll look at why Someone Cares Soup Kitchen, of all organizations, has been coming up repeatedly in public comments.