Mountain View Ends Flock Safety Contract After Unauthorized Data Access by Federal, State Agencies
On February 24, the Mountain View City Council unanimously voted to terminate its contract with Flock Safety, a provider of automated license plate readers (ALPRs), following revelations that city camera data had been accessed by federal and state agencies without permission.
The decision came after months of scrutiny and public pressure, with residents from Mountain View and neighboring cities urging the council to reject Flock’s system and any replacements. The controversy began on February 2, when Mountain View Police Chief Mike Canfield announced the shutdown of the city’s 30 Flock cameras, citing a loss of confidence in the vendor due to undisclosed data breaches.
Two major incidents were uncovered. Between August and November 2024, shortly after the first camera was installed, a "national lookup" setting was activated without the city’s knowledge, allowing federal agencies including the ATF (Kentucky and Tennessee offices) and Air Force bases in Virginia and Ohio to search the data. While U.S. Immigration and Customs Enforcement (ICE) was not involved, the access violated California’s ban on sharing ALPR data with federal agencies or out-of-state entities. Flock Safety later disabled the national lookup feature for all California agencies in March 2025 but could not explain how the setting was enabled or disabled.
A second breach occurred when a "statewide lookup" feature was turned on in August 2024, granting other California agencies access to Mountain View’s license plate data without the required city approval. The issue was discovered in January 2026 and promptly disabled. Chief Canfield stated that neither the statewide nor nationwide lookup tools were ever disclosed during Flock’s onboarding process.
Despite the breaches, the system proved operationally effective. Over its duration, the ALPR program assisted in 87 commercial burglaries, 65 car break-ins, and 42 residential burglaries, leading to the identification or arrest of 41 suspects. It also aided in high-profile cases, including a domestic violence-carjacking arrest in San Francisco and the rescue of a kidnapping victim in San Jose. The city spent $154,650 on the program.
Flock Safety maintained that its clients retain control over system settings, though the city’s investigation found no evidence of intentional misuse. The termination of the contract marks the end of Mountain View’s pilot program, leaving the future of ALPR use in the city uncertain.
Source: https://padailypost.com/2026/02/24/mountain-view-council-votes-to-get-rid-of-license-plate-cameras/
Flock Safety TPRM report: https://www.rankiteo.com/company/flock-safety
City of Mountain View TPRM report: https://www.rankiteo.com/company/city-of-mountain-view
"id": "citflo1772001588",
"linkid": "city-of-mountain-view, flock-safety",
"type": "Breach",
"date": "2/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Residents and visitors of '
'Mountain View',
'industry': 'Public Sector',
'location': 'Mountain View, California, USA',
'name': 'City of Mountain View',
'type': 'Government'},
{'industry': 'Security Technology',
'location': 'Atlanta, Georgia, USA',
'name': 'Flock Safety',
'type': 'Private Company'}],
'attack_vector': 'Misconfigured System Settings',
'customer_advisories': 'Public disclosure of unauthorized data access and '
'contract termination.',
'data_breach': {'personally_identifiable_information': 'License plate numbers '
'(indirectly linked to '
'individuals)',
'sensitivity_of_data': 'High (location tracking, potentially '
'linked to individuals)',
'type_of_data_compromised': 'License plate data'},
'date_detected': '2026-01',
'date_publicly_disclosed': '2026-02-24',
'date_resolved': '2026-02-24',
'description': 'Mountain View City Council terminated its contract with Flock '
'Safety after discovering that federal and state agencies '
'accessed city camera data without permission. The '
"unauthorized access violated California's ban on sharing ALPR "
'data with federal agencies or out-of-state entities.',
'impact': {'brand_reputation_impact': "Loss of public trust in city's data "
'privacy practices',
'customer_complaints': 'Public pressure from residents',
'data_compromised': 'License plate data',
'financial_loss': '154650',
'legal_liabilities': "Potential violations of California's ALPR "
'data sharing laws',
'operational_impact': 'Termination of ALPR program, loss of '
'investigative tool',
'systems_affected': 'Flock Safety ALPR System (30 cameras)'},
'investigation_status': 'Completed',
'lessons_learned': 'Need for stricter vendor oversight, transparency in '
'system settings, and compliance with state data sharing '
'laws.',
'motivation': 'Surveillance, Law Enforcement Operations',
'post_incident_analysis': {'corrective_actions': 'Termination of contract, '
'review of future ALPR use '
'in the city',
'root_causes': 'Undisclosed system features, '
'misconfigured access controls, '
'lack of vendor transparency'},
'recommendations': 'Conduct thorough vendor audits, ensure clear disclosure '
'of system features, and implement robust access controls '
'for sensitive data.',
'references': [{'date_accessed': '2026-02-24',
'source': 'Mountain View City Council Meeting'},
{'date_accessed': '2026-02-02',
'source': 'Mountain View Police Department Statement'}],
'regulatory_compliance': {'regulations_violated': ["California's ban on "
'sharing ALPR data with '
'federal agencies or '
'out-of-state entities']},
'response': {'communication_strategy': 'Public disclosure by Mountain View '
'Police Chief and City Council',
'containment_measures': 'Shutdown of Flock cameras, disabling of '
'national and statewide lookup features',
'remediation_measures': 'Termination of contract with Flock '
'Safety'},
'stakeholder_advisories': 'City Council and residents advised on termination '
'of ALPR program.',
'threat_actor': ['Federal Agencies (ATF, Air Force)',
'State Agencies (California)'],
'title': 'Unauthorized Data Access by Federal and State Agencies via Flock '
'Safety ALPR System',
'type': 'Unauthorized Data Access',
'vulnerability_exploited': 'Improper Access Controls, Undisclosed System '
'Features'}