City terminates Flock contract citing data sharing violations
Boston has terminated its contract with Flock, a company providing AI-powered surveillance cameras, after discovering the company shared its data nationwide, a direct violation of their agreement. The city’s Chief of Operations, Laura L. Phillips, announced the decision, stating that Flock enabled a feature allowing for "nationwide lookup" of recorded video footage. This capability was explicitly forbidden by the contract, which stipulated that Flock’s technology was to be used solely for Boston’s internal purposes and that data would not be shared or made accessible beyond the city’s control.
The contract, signed in October 2023, aimed to leverage Flock's network of automated license plate readers (ALPR) and other camera technologies to assist law enforcement in investigations. The core of the city's complaint lies in Flock's alleged circumvention of agreed-upon data access limitations. According to Phillips, the company provided access to a "nationwide lookup" function, effectively turning Boston's camera data into a resource for other entities without the city's explicit consent or knowledge. This functionality appears to go against the spirit and letter of the contract, which was designed to ensure data privacy and security within Boston's jurisdiction.
Contractual breaches and privacy concerns
The agreement with Flock stipulated that the company would not share, sell, or otherwise make available any data collected through its cameras to third parties. The discovery of a "nationwide lookup" feature suggests that Flock was potentially aggregating and cross-referencing data from multiple municipalities, using Boston's contributions without proper authorization. This raises significant privacy concerns, not only for Boston residents but for individuals whose license plates may have been captured and shared across different jurisdictions under the guise of a generalized lookup service. The implication is that Flock's business model might inherently rely on such data aggregation, a practice that many cities are understandably wary of, especially in an era of heightened data protection awareness.
Phillips’ statement highlighted that the contract required Flock to disable any features that would allow for a nationwide search of its database. The city’s review found that this was not the case, leading to the immediate termination. The decision underscores a growing tension between the desire for advanced surveillance technology to aid public safety and the critical need to maintain robust privacy protections and contractual integrity. Cities are increasingly scrutinizing the data-handling practices of technology vendors, particularly those involved in collecting sensitive information like ALPR data, which can paint a detailed picture of individuals' movements.
Flock's response and broader implications
As of the announcement, Flock had not publicly responded to Boston's allegations or the contract termination. However, the situation reflects a broader challenge for municipalities engaging with private technology companies for public safety solutions. Vendors often operate with sophisticated, proprietary systems, and cities must rely on trust and rigorous oversight to ensure compliance with contractual terms and privacy laws. The discovery of a feature that enables nationwide data access, if true, suggests a potential misrepresentation or a fundamental misunderstanding of the contractual obligations on Flock's part. This incident could serve as a cautionary tale for other cities considering similar partnerships.
The implications extend beyond Boston. Flock's technology is deployed in numerous cities across the United States. The revelation that a "nationwide lookup" feature might be active or accessible raises questions about the data privacy practices of Flock in all its other contracts. Other municipalities may now be compelled to review their own agreements and audit Flock's data handling to ensure their specific contractual terms are being met. The incident also highlights the difficulty in policing the use of data by technology providers, especially when the technology itself is complex and its capabilities are not always transparent to the contracting entity. For developers and security professionals, this case underscores the importance of meticulously defined data access controls and the potential for vendor overreach, even when explicit contractual clauses are in place.
What remains unclear is the extent to which this "nationwide lookup" feature was actively used by Flock or its other clients, and whether any data from Boston was indeed disseminated beyond the city’s purview. The city’s swift action, however, indicates a low tolerance for any perceived breach of trust or contractual violation, especially concerning sensitive public safety data. This termination will likely lead to increased scrutiny of Flock's operations nationwide and could influence how other cities approach similar surveillance technology contracts in the future, prioritizing transparency and strict data governance.