Getting your Trinity Audio player ready... A Flock license plate reader in Ladera on Nov. 9, 2023. License plate readers have been cropping up all over the Peninsula. Photo by Angela Swartz. As concern grows around federal immigration enforcement in the Trump era, the town of Atherton is sharing sensitive surveillance data with police departments that do not conform with California law and Atherton’s own policies. The town has around 50 cameras from Atlanta-based surveillance company Flock Safety, including 30 privately funded cameras, that capture the license plates of passing cars. An estimated 45 million vehicles pass by the cameras annually, although the system only retains license plate numbers for 30 days. While Atherton has used the license plates to investigate cases of stolen vehicles and burglaries, the town also allows 295 outside agencies to search its automated license plate data. Police agencies now have the ability to search a growing network of cameras across the state to track individuals — and federal authorities and immigration officials may be able to as well. Through the California Public Records Act, this news organization obtained logs showing outside agencies conducted millions of searches of Atherton’s license plate reader network. While its policy requires the police commander to review every search request Atherton receives, it has not been followed since at least January. The policy also requires outside agencies to specify the reason for the request — something missing from thousands of requests. While Atherton claims it does not share the license plate data with federal agencies, thousands of searches were done on behalf of federal authorities by partner agencies. History The town’s network of cameras came after months of deliberation over balancing the public safety benefits and residents’ right to privacy. In response to a rash of burglaries in 2018 and 2019, Atherton bought its first fixed automated license plate readers to test at Holbrook Palmar Park. After the test, Atherton purchased 16 additional fixed license plate readers in May 2020. At the time, some councilmembers were concerned about infringing on the privacy of residents. “I worry a lot about the civil liberties side of this,” then-Councilmember Mike Lempres said. “You put these up and people’s reasonable expectation of privacy goes down.” Lempres also said calling them just license plate readers was misleading as the cameras capture a still image including people’s faces and surrounding areas. At other meetings, members of the Peninsula chapter of the American Civil Liberties Union also spoke against the cameras. In response to privacy concerns, Police Chief Steven McCulley pointed out Atherton’s strict policy that requires annual audits and requirements for sharing data. McCulley also used Atherton’s policy to address concerns regarding sharing its data with outside agencies. While the ALPR policy was based on one from Lexipol, a company that provides template municipal policies, the council reviewed and edited the policy for several months to ease concerns of residents about unnecessary surveillance. Now, the Atherton Police Department says its policy is unrealistic. “When Atherton first implemented its ALPR program, we were among the early adopters in California. At the time, there was no large-scale network of shared ALPR cameras, and our policy was written with that limited scope in mind,” Atherton police Cmdr. Dan Larsen said in an email. “That said, we recognize that our written policy—particularly sections 469.8(a) and (b)—should be updated to reflect the operational realities of network sharing.” “While the policy currently states that the commander or designee will review every external request, that provision was drafted before the automated network model was in place. Given the volume of searches that occur across the network, it is no longer feasible to manually approve each one, and we are in the process of updating our policy accordingly,” Larsen added. From Jan. 1 to July 15, 2025, outside agencies searched Atherton’s ALPR database over 2.9 million times. With 11,300 people conducting those searches, the average user searched 40 times per month. Some users searched over 4,000 times per month. Section 469.8(a) of the Atherton Police Department Policy Manual requires that any agency requesting to search its database provides the name of the agency, the name of the person making the request and the intended purpose of the request. Section 469.8(b) requires the commander approve every request. Larsen also denied that its policy applies to outside agencies. “It’s important to note that Atherton’s ALPR policy governs only our agency’s use of the system and access to data. When other agencies search the network, they are responsible for ensuring compliance with their own policies and California law,” Larsen said. State law, however, requires any agencies that share its ALPR data to “require that ALPR information only be used for the authorized purposes described in the usage and privacy policy” of the agency that runs the camera. Atherton is also required by law to collect the information mentioned in section 469.8(a) of its policy. Outside agencies Atherton’s data appears to be being searched on behalf of immigration enforcement and federal agencies. In February, the Bakersfield Police Department searched Atherton’s and 758 other law enforcement agencies’ Flock ALPR systems 18 times with the reason of “HSI.” Homeland Security Investigations, referred to as HSI, is a division of Immigration and Customs Enforcement. HSI investigates child exploitation, trafficking and smuggling of goods and people, transnational gangs and enforcing labor law involving undocumented and documented immigrants, among other things. Bakersfield did not respond to requests for comment. State law bars state and local agencies from working with federal authorities for immigration purposes, but that does not mean it never happens. Some sheriffs openly admit to being willing to violate state law for immigration enforcement purposes. For example, according to Hearst television affiliate KCRA 3, Amador County Sheriff Gary Redman says he will proactively reach out to ICE for immigration enforcement when he believes the suspects are a danger to the public. Atherton shares its ALPR data with the Amador Sheriff’s Office, which searched Atherton’s database 13 times this year so far. In all cases, it provided only a case number, not a reason. The Anaheim Police Department searched Atherton’s ALPR database 14 times with the reason “ICE.” Anaheim Sgt. Matt Sutter told this news organization the searches were not on behalf of ICE, but were for an investigation related to the ICE protests in Anaheim. The Newport Beach Police Department searched Atherton’s database four times with the reason of “CBP,” a common acronym for Customs and Border Patrol. The department received $170,000 from the Department of Homeland Security which it plans to use to purchase cameras and surveillance equipment in order to “raise the level of U.S. border and California coastline security amongst law enforcement agencies” as part of DHS’ Operation Stonegarden. Newport Beach did not respond to requests for comment. Between Jan. 1 and July 15, 2025, Atherton’s ALPR network was searched 832 times for reasons that included HSI, ICE or CBP. While some searches cited non-immigration purposes, many did not. The network was also searched hundreds of times on behalf of federal agencies — both identified and unidentified — and for federal warrants. None of these searches targeted Atherton specifically but were for thousands of cameras across the state. When asked about some of these requests, Larsen said: “If you’ve identified specific requests with ‘ICE’ or ‘CBP’ as the stated purpose, please provide those examples. We will investigate and, if necessary, revoke access for any agency not in compliance with policy or law.” This news organization provided several examples to both Larsen and McCulley. Neither have responded. Larsen is out of office until after The Almanac’s deadline. Larsen also said Flock prevents searches containing key words including “ICE.” Privacy California is not the only state where Flock’s ALPR network may have been used for immigration enforcement in violation of state law. 404 Media previously reported that in Illinois, where there is a law that prevents local law enforcement from working with immigration enforcement, local agencies from around the country were searching a town’s Flock ALPR cameras on behalf of ICE and Homeland Security for immigration enforcement. While ICE can’t directly search Flock’s database, departments would conduct a search on its behalf informally. Atherton is not part of the national database. Agencies do not need a warrant nor any suspicion of a crime to conduct a search. One civil liberties organization is currently suing a Virginia city arguing surveillance using Flock without a warrant violates the fourth amendment, which protects against unreasonable search and seizure by a government agency. By law, Atherton is required to mandate agencies provide a “purpose for accessing the information” when requesting to search its ALPR database. In June alone, Atherton allowed agencies to view its database 466 times even though their only provided reason was “crime.” This news organization emailed Atherton Mayor Elizabeth Lewis and councilmembers Bill Widmer and Rick DeGolia about Atherton’s ALPR policy that they approved while on town council: none responded. Not the only agency The Atherton Police Department is not the only agency that operates ALPR cameras and shares its data with hundreds of departments across the state. The San Mateo County Sheriff’s Office, Menlo Park police and Redwood City police also use Flock to share data with many of the same agencies. The Almanac has sent Public Records Act requests to the Redwood City and Menlo Park police departments and the San Mateo County Sheriff’s Office. Menlo Park says it is still processing the request, while this news organization is disputing Redwood City’s redactions that hide the reasons for searches. The Sheriff’s Office has failed to respond within the law’s required 10-day deadline.