HomeMy WebLinkAboutStaff Report 2606-6456CITY OF PALO ALTO
CITY COUNCIL
Special Meeting
Monday, August 24, 2026
Council Chambers & Hybrid
5:30 PM
Agenda Item
2.Semi-Annual City Council Discussion with the Independent Police Auditor (IPA) Public
Comment, Staff Presentation
City Council
Staff Report
From: City Manager
Report Type: STUDY SESSION
Lead Department: City Manager
Meeting Date: August 24, 2026
Report #:2606-6456
TITLE
Semi-Annual City Council Discussion with the Independent Police Auditor (IPA)
RECOMMENDATION
This Study Session is a semi-annual opportunity for City Council discussion with the
Independent Police Auditor. There is no recommended action.
BACKGROUND AND ANALYSIS
This is the study session with the City’s Independent Police Auditor (IPA) from the
representatives of the OIR Group, the City’s contracted consultant for the Independent Police
Auditor function. It is the first discussion in this calendar year. The previous discussion took
place with the City Council in 2025.
Discussion Purpose: In the amended contract scope with the OIR group, it states the following
related to the IPA meetings with the City Council:
Beginning in the second half of 2021, CONSULTANT shall meet with the City Council two
times per year to discuss trends in criminal justice and policing, policy and training
matters, recommendations made by CONSULTANT, and other City Council concerns.
CONSULTANT’S conferences with City Council are not for the purpose of elaborating on
published reviews of specific incidents and shall not include discussion of personnel
matters prohibited by law. Semi-annual conferences shall be scheduled after publication
of the CONSULTANT’S report, according to availability of City Council and the
CONSULTANT.
Consistent with the description above, the City Council discussion with the IPA is based on City
Council agenda availability and is not focused on the most recent report from OIR Group.
However, for ease in reference, the most recent OIR Group report was issued as an
Informational Report in the June 15, 2026 City Council packet.1
Additionally, the City Council, on June 1, 2026 asked the next IPA discussion to also include a
discussion with the IPA about an independent assessment scope related to Flock automated
license plate recognition (ALPR).2 The June report shared that the goal of the IPA’s review will
be to conduct an operational assessment of Flock’s policies and procedures around security,
transparency, sharing compliance, and reporting of system features and changes. In addition,
though the Police Department (PAPD) has training, a surveillance use policy, 30-day data
retention period, and a requirement of an MOU for each agency with which it shares data, the
IPA will also assess PAPD’s internal policies and procedures with an eye toward areas where it
may be able to do even better. The City Council asked for more information about the scope
and asked to discuss this with the IPA at this study session. OIR reviewed the June City Council
meeting and heard the public comments. Attachment A provides OIR‘s proposed assessment
topics. OIR will begin the work identified in the scope of work after the City Council discussion,
incorporating any agreed upon scope changes.
FISCAL/RESOURCE IMPACT
No additional funds are needed for this study session.
STAKEHOLDER ENGAGEMENT
The discussion with the City Council is an opportunity for the public to also share feedback
related to issues covered by the IPA. Members of the public interested in this discussion may
have submitted comments to the City Council inbox for consideration.
ENVIRONMENTAL REVIEW
Not a project.
ATTACHMENTS
Attachment A: OIR Group Review of Palo Alto ALPRs - Proposed Topics
APPROVED BY:
Ed Shikada, City Manager
1 June 15, 2026 staff report: https://www.paloalto.gov/files/assets/public/v/1/police-
department/accountability/ipa-reports/november-2025-independent-police-auditor’s-report-and-papd-use-of-
force-report.pdf
2 June 1, 2026 City Council meeting, Item #2:
https://cityofpaloalto.primegov.com/Portal/Meeting?meetingTemplateId=18727
TO: Palo Alto City Council
CC: City Manager Ed Shikada
Chief James Reifschneider, PAPD
FROM: Michael Gennaco, Stephen Connolly & Teresa Magula
Auditing Team for ALPR Review
DATE: August 11, 2026
RE: City of Palo Alto’s Review of Automated License Plate Recognition
Program
Background
OIR Group has been advised that Council intends to hold a session on August 24,
2026, and potentially request us to conduct an audit of PAPD’s use of its Automated
License Plate Recognition (ALPR) Program. We have been also advised of the
Council’s intention to provide input on the scope of that audit.
To assist in that process, we have framed potential topics that could be considered as
the audit’s parameters are discussed at that meeting. These suggestions are based on
our familiarity with issues of concern and our related review projects involving ALPR
systems for the Counties of Santa Clara and Santa Cruz, the City of Pasadena, and
other jurisdictions with which we have been engaged. We look forward to the
discussion and Council’s ultimate direction.
6510 Spring Street #613
Long Beach, CA 90815
323-821-0586
OIRGroup.com
OIR Group – Proposed Topics for Palo Alto ALPR Review
Page 2 of 4
Potential Focus Areas for Audit Review
1. Concerns About the Current ALPR System in Palo Alto
How PAPD arrived at the current situation
Data sharing concerns
Other concerns about ALPR installation, placement, and use
Concerns regarding Flock’s remediation efforts
2. Internal Access and Appropriate Use
Who has access to the system and whether access is appropriately restricted
Whether queries are tied to a legitimate law enforcement purpose
Use of case numbers and offense types to validate searches
How the system is used in practice (e.g., investigative tool vs. broader
exploratory use)
3. Data Sharing and External Access
Which outside agencies have access to Palo Alto data and under what
agreements
Whether current MOUs adequately define and limit access and use
Whether partner agencies are conducting their own audits or oversight
Whether additional safeguards (e.g., reciprocal audit requirements) are feasible
What searches are outside agencies conducting using Palo Alto data
4. Data Retention and Storage
Current retention period and whether it aligns with policy and best practices
How and where data is stored (e.g., cloud environment)
Whether data deletion practices are automatic, verified, and consistently applied
OIR Group – Proposed Topics for Palo Alto ALPR Review
Page 3 of 4
5. System Security and Auditability
What security controls are in place to protect data (e.g., authentication, access
restrictions)
Whether audit logs are complete, reliable, and sufficient to monitor system use
Whether the system allows for identifying and addressing errors or misuse
6. Vendor Governance and Platform Evolution
Significant platform changes, upgrades, and new features implemented during
the review period
How product changes may have affected data sharing, access controls,
retention, auditing, or security
How Flock communicates product updates, policy changes, identified issues, and
compliance-related developments to customers
Whether Palo Alto has adequate processes for reviewing and responding to
vendor communications
Review of contracts, amendments, and other agreements related to:
o Data ownership
o Retention
o Audit rights
o Security requirements
o Notification obligations
o Compliance with California law
Evaluation of vendor-provided reporting, auditing, and oversight tools available to
the City
Review of significant vendor-identified issues, corrective actions, and resulting
safeguards
Assessment of whether City governance practices keep pace with platform
changes and evolving capabilities
7. Policy, Procedures, and Oversight
Whether existing policies and procedures adequately govern system use,
access, and sharing
OIR Group – Proposed Topics for Palo Alto ALPR Review
Page 4 of 4
Whether training, supervision, and internal audit practices are in place and
effective
Alignment with applicable legal requirements and best practices
8. Effectiveness and Value
How the system is being used across different types of cases
Whether it contributes meaningfully to investigative outcomes (e.g., arrests,
recoveries)
Distinction between cases where ALPR use is central vs. supplemental
Overall assessment of the system’s value relative to its use and impact(s)
9. Best Practices and Benchmarking
Identification of opportunities to strengthen safeguards, accountability, and
effectiveness
From:Hamilton Hitchings
To:Council, City
Cc:Reifschneider, James; Perron, Zachary; Shikada, Ed
Subject:Flock Audit Scope - Requesting 6 Additions
Date:Friday, August 21, 2026 10:13:07 AM
CAUTION: This email originated from outside of the organization. Be cautiousof opening attachments and clicking on links.
I support OIR’s proposed ALPR audit scope. Many residents have raised legitimate
privacy concerns about Flock. I’m asking the City Council and PAPD to make six
specific questions explicit within the audit.
Under Section 2, Internal Access and Appropriate Use, please add:
1.Review prohibiting PAPD from searching historical travel data for traffic
citations, infractions, other low-level offenses, and exploratory use.
Under Section 3, Data Sharing and External Access, my biggest concern is outside-
agency searches. Palo Alto plates are searched up to 200,000 times a month, often
through partner-system searches that may include minor offenses. A traffic stop
should not expose someone’s travel history. Flock recently added offense-specific
filters, which PAPD is reviewing.
2.Review the outside-agency search settings and recommend how searches
can be limited, as narrowly as practical, to felonies, sex crimes, and
narrowly defined crimes of regional concern, such as organized retail
theft.
Under Section 4, Data Retention and Storage, Flock now defaults new customers to
seven days.
3.Review the impact of reducing Palo Alto’s retention period from 30 days to
7 for data not preserved for a specific investigation.
Under Section 7, Policy, Procedures, and Oversight, the public search logs are useful
but need more detail.
4.Review adding the offense type by name to Palo Alto’s online search logs.
Finally, under Section 9, Best Practices and Benchmarking, I’m asking the audit to
evaluate Genetec as an alternative vendor that, to date, does not carry Flock’s history
of privacy controversies and access problems. Stanford recently switched to Genetec,
which can keep data on Sheriff-controlled servers.
5.Conduct a paper evaluation of Genetec as an alternative to Flock,
comparing security architecture, cost, capabilities, and tradeoffs, and
consulting with Stanford about its experience.
6. Evaluate switching Palo Alto’s cameras to Genetec while retaining Flock
only at Stanford Shopping Center to preserve access to regional Flock
searches.
These six requests fit directly within OIR’s proposed framework. I’m asking Council
and PAPD to make them explicit in the audit.
From:Jennifer Landesmann
To:Council, City
Subject:In support of 6 Additions to Flock Audit Scope and use of ALPRS
Date:Saturday, August 22, 2026 4:47:29 PM
CAUTION: This email originated from outside of the organization. Be cautiousof opening attachments and clicking on links.
Dear Council,
As some of you may recall, we invested a lot of thought and consideration, as a
community, to adding cameras and license plate recognition. My neighborhood
Crescent Park is one of the neighborhoods that sought this tool to support the efforts
of our PAPD. With a resource that the community worked hard to establish, my
overriding concern is that if you take anything away that helps the police, we will need
more resources such as more patrols.
Our household personally had a licence plate theft, and my neighbor's and my car
window were blown to pieces - which is nothing compared to the persistent vandalism
that became rampant at one point. One family in the neighborhood had their Catalytic
converter stolen 3 times in one year but the thieves stopped stealing once the city
installed Flock. Every report seems to confirm that ALPR is an effective tool - as a
crime deterrent; to investigate; and when used collaboratively with our northern
California local law enforcement partners. Per this PAO article "Police Chief James
Reifschneider told the council in June that the department has pinpointed more than
130 cases in which Flock has played an important evidentiary role in identifying and
arresting suspects. He also noted that the city has seen a 13% reduction in residential
burglaries and a 24% reduction in auto burglaries between 2025 and 2026." Every
case of recovering a stolen vehicle, or helping residents when faced with a crime or
crisis relies on this tool. Not to mention it supports elderly residents feeling safe
(myself included as the years pass), as well as to preserve safety for our youth.
I support Hamilton Hitchings' suggestions to Council, and hope that there will be no
neglect or deterioration in what can be achieved with these tools. Thank you,
Best,
Jennifer
---------- Forwarded message ---------
From: Hamilton Hitchings <hitchingsh@yahoo.com>
Date: Fri, Aug 21, 2026 at 10:12 AM
Subject: Flock Audit Scope - Requesting 6 Additions
To: City Council <city.council@paloalto.gov>
Cc: James Reifschneider <james.reifschneider@paloalto.gov>, Zachary Perron
<zachary.perron@paloalto.gov>, Ed Shikada <ed.shikada@cityofpaloalto.org>
I support OIR’s proposed ALPR audit scope. Many residents have raised legitimate
privacy concerns about Flock. I’m asking the City Council and PAPD to make six
specific questions explicit within the audit.
Under Section 2, Internal Access and Appropriate Use, please add:
1. Review prohibiting PAPD from searching historical travel data for traffic
citations, infractions, other low-level offenses, and exploratory use.
Under Section 3, Data Sharing and External Access, my biggest concern is outside-
agency searches. Palo Alto plates are searched up to 200,000 times a month, often
through partner-system searches that may include minor offenses. A traffic stop
should not expose someone’s travel history. Flock recently added offense-specific
filters, which PAPD is reviewing.
2. Review the outside-agency search settings and recommend how searches
can be limited, as narrowly as practical, to felonies, sex crimes, and
narrowly defined crimes of regional concern, such as organized retail
theft.
Under Section 4, Data Retention and Storage, Flock now defaults new customers to
seven days.
3. Review the impact of reducing Palo Alto’s retention period from 30 days to
7 for data not preserved for a specific investigation.
Under Section 7, Policy, Procedures, and Oversight, the public search logs are useful
but need more detail.
4. Review adding the offense type by name to Palo Alto’s online search logs.
Finally, under Section 9, Best Practices and Benchmarking, I’m asking the audit to
evaluate Genetec as an alternative vendor that, to date, does not carry Flock’s history
of privacy controversies and access problems. Stanford recently switched to Genetec,
which can keep data on Sheriff-controlled servers.
5. Conduct a paper evaluation of Genetec as an alternative to Flock,
comparing security architecture, cost, capabilities, and tradeoffs, and
consulting with Stanford about its experience.
6. Evaluate switching Palo Alto’s cameras to Genetec while retaining Flock
only at Stanford Shopping Center to preserve access to regional Flock
searches.
These six requests fit directly within OIR’s proposed framework. I’m asking Council
and PAPD to make them explicit in the audit.
From:Aram James
To:City Attorney; Dave Price; supervisor.abe-koga@bos.sccgov.org; Vicki Veenker; Gennady Sheyner; Emily Mibach;
Shikada, Ed; Braden Cartwright; Diana Diamond; <michael.gennaco@oirgroup.com>; Preminger, Steve; Sean
Allen; Council, City; Reifschneider, James; Brandon Pho; EPA Today; board@pausd.org; Board of Directors; Jeff
Rosen; Carla Torres; planning.commission@cityofpaloalto.0rg; Supervisor Susan Ellenberg; Supervisor Otto Lee;
Supervisor Betty Duong; district1@bos.sccgov.org
Subject:Conflict OIR and flock surveillance technology??
Date:Sunday, August 23, 2026 12:39:40 PM
CAUTION: This email originated from outside of the organization. Be cautiousof opening attachments and clicking on links.
here’s my best-supported answer
If your question is:
“How many cities/counties has OIR Group recommended using ALPR/license-plate-
reader technology?”
I can currently substantiate 3 jurisdictions where OIR has had a documented substantive
role concerning ALPR:
Vallejo, Eureka and Palo Alto.
But I can substantiate 0 where OIR specifically recommended Flock Safety.
If you ask:
“How many jurisdictions have both OIR Group and Flock Safety?”
The number is higher than 3. Santa Rosa, for example, clearly belongs in that category. There
are additional jurisdictions that need to be checked against contracts and OIR records rather
than simply assuming OIR recommended the technology.
One potentially important lead
I also found that in Palo Alto, OIR’s contract was separately associated with the city’s ALPR
technology contract management work. A 2023 council agenda lists both an OIR Group
contract amendment and an Office of City Auditor task-order change specifically identified as
“ALPR Technology Contract Management.”
That deserves a deeper look because it may tell us exactly when OIR became involved with
Palo Alto’s ALPR procurement/oversight and what its scope was.
And there is a broader surveillance-oversight context: in 2025, Michael Gennaco was
participating nationally in discussions about how civilian oversight bodies should handle
surveillance technologies including ALPRs, drones, gunshot detection and real-time video
.
My current evidence map is therefore:
Flock recommendation by OIR: 0 confirmed
ALPR-specific OIR involvement: 3 clearly documented
OIR + Flock jurisdictions: more than 3
OIR recommendation later used by a government entity to justify Flock: 1 — Vallejo
And importantly, I have not found evidence of OIR Group receiving money directly from
Flock Safety or being a Flock vendor/consultant. The contracts I’ve located are between
OIR and the municipalities/agencies, not between OIR and Flock.
If you’re investigating a possible institutional relationship between Gennaco/OIR and
Flock, the next thing I’d examine is Palo Alto’s OIR contract and the ALPR contract-
management records, followed by Santa Rosa’s OIR/Flock contracts. Those are likely to
tell us much more than the published OIR reports.
PALO ALTO CITY COUNCIL: IPA
SEMI-ANNUAL REPORTS FOR 2025
August 20, 2026
1
OIR GROUP
•IPA for the City of Palo Alto
•Semi-Annual Audit Reports re PAPD
internal review systems
•Last Council appearance in April of 2025
2
Public Reports for 2025 Cases
Part A: One misconduct case (internal) One use of force 3 weapon-pointing incidents Published in November 2025
Part B: Four misconduct cases (two sustained) Five uses of force Four weapon-pointing incidents Published in June 2026
3
Second Report from 2025:
Investigations into Alleged Misconduct
•PAPD process appropriately thorough and objective
•2 sustained cases; other complaint allegations
“unfounded.”
•Notification re detention
•Inadvertent disruption of court proceeding
•Holistic review of “peripheral”conduct issues, and
appropriate interventions
4
Second Report from 2025: 5 “Use of
Force” incidents
• Review based on “Medical attention beyond mere
clearance in the field.”
• Significant injury in 2 cases
•Control hold and broken arm
•K-9 bite
•Recommendations
5
Second Report from 2025: Pointed
Firearm Incidents
•4 documented events
•All instances were evaluated and found to be consistent
with training and policy
•Enhanced supervisory evaluations of these events
(“holistic review”)
•Ongoing issues with BWC activation
6
2025 Reports: Recommendations
• Warnings and other de-escalation before force
deployments
•Adjustments to K-9 protocol
•BWC: equipment and activation
•Improving intake interviews by supervisors
7
ALPR Audit
•Ideas for potential audit scope (Attachment A) on
Automated License Plate Recognition (ALPR)
•Prior experience addressing these issues
8
Questions/Discussion
9