Flock Safety says it will make a suite of anti-abuse guardrails mandatory by Jan. 1 — but the failure that exposed nearly 300 improper searches of San Francisco's license-plate data wasn't a rogue officer. It was authorized analysts at a state fusion center, doing exactly what the new rules don't touch.

Under pressure after reports that officers used its cameras to stalk women, the $8.4 billion surveillance firm announced changes it frames as accountability: shorter data retention, automatic lockouts for "abnormal" searches, and a required case number on every query. For a company whose Bay Area contracts have been canceled city by city, it's a defensive move. But measured against San Francisco's own audit, the guardrails are aimed at the wrong failure mode — and the one change that might have mattered here is optional.

Flock Safety, whose automated license-plate readers blanket 49 states, announced Aug. 13 (external source, opens in a new tab) that guardrails once left to each police department's discretion will become mandatory by Jan. 1. CEO Garrett Langley told Semafor (external source, opens in a new tab) the company had "listened" and now believes the public expects more of it than he once did.

The package: retention drops from 30 days to seven; an audit tool flags unusual search behavior and locks the user out pending review; and officers must attach a records-management case number to each query before it runs. Per ABC7's account of the Associated Press report (external source, opens in a new tab), the changes trail a Washington Post investigation that counted roughly 50 officers charged or accused of running personal searches, many to track partners or family.

That is a real problem. It is not San Francisco's problem.

When SFPD released its audit in June, the breach it described looked nothing like a personal snoop. The Northern California Regional Intelligence Center (external source, opens in a new tab), a law-enforcement fusion center SFPD had authorized to query its cameras, handed that access to analysts at a third group — the West States Information Network — who ran overnight searches on behalf of out-of-state and federal agencies. California's 2015 law bars sharing plate data across state lines. The queries ran anyway, hundreds of times, until SFPD cut off both groups.

Here is the tell: Flock itself insisted the SF episode was not a software malfunction, platform issue, unauthorized access, or any failure of its system — that the searches came from authorized users at a California state agency. Read that against the new rules. An unusual-behavior lockout keys on suspicious patterns; a case-number requirement keys on individual officers cutting corners. Neither flags an authorized fusion-center analyst running lawful-looking queries whose only defect is where the answer travels. NCRIC director Mike Sena told KQED the analysts hadn't known the law, and their policies have since been "corrected."

The one new feature that could bear on the SF failure is the one Flock left optional: customers can now choose which offense types outside agencies may search their data for — in theory letting a city fence off immigration queries. Langley pitched it as control aligned with a community's values. But it is opt-in, department by department, layered onto a data-sharing architecture Flock still sells and, some agencies allege, has switched back on without their knowledge (external source, opens in a new tab).

Critics weren't sold. The ACLU allowed that the shorter retention window might be a step forward but dismissed the rest as retreads. Robert Frommer of the Institute for Justice, which has litigated against the technology, told the Associated Press (external source, opens in a new tab) the changes were merely cosmetic — the work of a company in retreat — and argued the core defect goes untouched: officers, not judges, still decide who gets searched.

NCRIC director Mike Sena told KQED the analysts hadn't known the law, and their policies have since been "corrected."

Brian Hofer, whose nonprofit Secure Justice has sued over illegal data sharing and plans another suit over the SF findings, has been making the narrower case for years: what critics once called speculative, he said, two-and-a-half years of audits have proven real. More than 50 agencies nationwide have dropped or suspended Flock this year. San Francisco's guardrail question isn't whether officers behave — it's whether the data should ever have left the state at all.