Flock's nationwide lookup returned Boston plate reads for three days after the city confirmed sharing was off

A contract clause that says sharing is off resolves, somewhere, to a setting in someone else's console. Boston's clause restricted access to trained Boston Police Department personnel, and Boston police said they confirmed with Flock Safety that data-sharing settings were off ^[4]. Three days in, the department learned that other law-enforcement agencies could reach the license-plate and vehicle information the cameras collected, through Flock's nationwide lookup function ^[5]. The city's surveillance report attributes that to a Flock "vendor error" ^[6], and it does not say how the department learned of it.

Boston had the lookup disabled, and after that agencies had to submit written requests for access ^[7]. Seventy-seven arrived over the rest of the pilot, from requesters including the Drug Enforcement Administration, the Bureau of Alcohol, Tobacco, Firearms and Explosives and the Massachusetts State Police, WBUR reported ^[8]. Across the remaining 153 days that is about one request every two days ^[3]. A written request is a slower control than an automatic query. The city's own report carries the count.

Boston's own logging comes out worse. Police ran 11,004 searches during the pilot and attached a crime-related case number only about half the time ^[9]. Over 156 days that is roughly 71 searches a day ^[1], with something near 5,500 of them lacking a stated case ^[2]. The city report found no complaints or documented misuse, and Boston deleted the data and removed the equipment within 30 days of the trial ending ^[10].

What Boston identified was an access-control failure, not documented abuse of Boston data ^[11]. That distinction is real. It is also why the cancellation is interesting: the boundary Boston negotiated and checked did not hold, and the check consisted of asking the vendor.

That setting is what Flock's revenue is priced on. Boston contracted it off. Flock's founders started with an Android phone inside a waterproof box, against commercial plate readers they put at roughly $25,000 each ^[13]. They made deployment cheaper, then made each deployment more useful by connecting it to other cameras and agencies ^[17]. Flock now sells a national plate-reader network alongside video cameras, gunshot detection, drones and investigation software ^[14]. Andreessen Horowitz led a $275 million round announced on March 13th, 2025, at a reported $7.5 billion valuation ^[15], and Flock told TechCrunch that annual recurring revenue had passed $300 million ^[16].

For a sharing-off term to be enforceable by the buyer, the buyer needs two things it can run without the vendor's cooperation: an export of every query that touched its own plate reads, including queries originating outside its tenant, and a probe from a foreign account that is expected to fail and is checked on a schedule. Boston had a clause and a confirmation. In my view that gap is the procurement lesson here. Writing the log export into the contract is cheaper than finding the setting wrong on day three.