The Manager's report back on a request that the City Manager consult with relevant departments about the implications of deploying license plate readers and provide recommendations as to whether adjustments in plans for deployment should be made in light of changes since approval in February

The Department is deeply committed to public safety, transparency, and maintaining the trust of our community. We fully recognize and share the City Council’s concerns regarding data privacy, the misuse of surveillance technology, and the importance of ensuring Cambridge remains a welcoming and safe city for all residents—regardless of immigration status or other legally protected activities.

Although the technology was originally approved before the most recent updates to the City’s Welcoming Ordinance, our ALPR policy was developed in alignment with those updated protections as well as with the Commonwealth’s Shield Law. Our implementation framework was deliberately designed to ensure that ALPR technology is not used to support or assist in any immigration enforcement efforts or in investigations related to activities that are legally protected in Massachusetts, including reproductive or gender-affirming care.

The intended use of ALPR technology is solely for legitimate public safety purposes—such as locating stolen vehicles, investigating violent crimes, identifying vehicles connected to missing persons, and improving traffic safety.

A comprehensive review is currently underway with relevant City departments to assess the legal, operational, and community implications of ALPR deployment. This review will specifically focus on the following areas:

Data Privacy and Security

Flock Group Inc. performs an annual SOC 2 Type 2 audit. The purpose of this audit is to ensure that the Flock Safety Solution System has the proper organizational and system controls in place and practices such controls to ensure relevant security, availability and confidentiality. This audit also verifies that employee access to sensitive systems and data is appropriately restricted and monitored in alignment with security best practices. In review of their most recent audit, which covers February 16, 2024, to February 15, 2025, there were no exceptions noted. The audit is conducted by Moss Adams, which is a reputable firm in the accounting industry.

ADDRESS ALL COMMUNICATIONS TO 125 SIXTH STREET, CAMBRIDGE, MASSACHUSETTS 02142 The Public Safety IT Team has deliberately not implemented single sign-on for the Flock Safety Solution System; by doing this the system is isolated from our network and facilitates limiting user access. It is also important to note that there are no data feeds to or from the Flock Safety Solution System for any of the systems in the public safety network.

The City of Cambridge owns all data collected by the ALPR system. Section 4.1 of our contract (Customer Data) explicitly states that all data is retained solely by the City.

Flock’s role is limited to providing technical services. It has no ownership of or open access to Cambridge data. Any use of anonymized, non-identifiable information (Section 4.3) is limited to improving system functionality, such as identifying new vehicle models.

The Cambridge Police Department does not share data with external agencies, including federal immigration enforcement, except when legally required through a subpoena or court order. Flock is required to notify the City if such a request is made.

The Department has activated restrictive administrative settings that prohibit access to data related to immigration enforcement, gender-affirming care, and reproductive health care.

Data may be shared only with the Office of the District Attorney for court-mandated discovery in criminal cases or through proper legal process (e.g., subpoena, warrant, or court order).

Requests from external agencies (e.g., for a missing person, Amber or Silver Alert, or stolen vehicle) are reviewed on a case-by-case basis, with consideration of legal authority and community impact.

Community Impact and Transparency

Quarterly audits will regularly assess data accuracy and policy compliance. Public transparency reports will summarize audit outcomes, including data access, sharing instances with the reason, and policy adherence. All ALPR data access is fully logged, with metadata tracking user identity, date, time, and purpose. The Department will host community information sessions and public forums to explain how the system works, how data is protected, and how privacy safeguards are enforced.

Policy Oversight and Governance

The ALPR policy will be updated to reflect community feedback, changes in law, or evolving best practices. Access to ALPR data is strictly limited to authorized personnel with role-based permissions. All data is encrypted, stored securely, and automatically deleted after 30 days if not actively used in an authorized investigation. After 30 days, the data is not retrievable.

Contractual and Operational Review

Law Dept -The City and Police Department are reviewing contractual terms with Flock to ensure continued alignment with the City’s Welcoming Ordinance and community values.

The Cambridge Police Department appreciates the City Council’s continued oversight and partnership in ensuring that public safety tools are deployed responsibly, ethically, and transparently. Our shared goal remains to enhance safety, protect victims, and uphold the privacy and rights of everyone in our community.

Respectfully,

Christine Elow

Police Commissioner