The Flock Floor

On June 23, a Flock Safety camera somewhere in Malden recorded twenty-four ordinary hours of passing traffic — the kind of footage that piles up by the thousands of hours a day across the roughly 6,000 communities that now rent this system from the company.

Three weeks later, someone asked to see it anyway. It took Malden two weeks just to acknowledge that request — citing "the current volume of incoming requests, staffing limitations, and other operational challenges" as grounds to claim the full 25 business days state law allows — and by then, the footage had already expired on Flock's own servers, five days before the city ever wrote back.

That gap — between how long a camera company keeps your city's footage and how long the law says your city has to produce it — is now the subject of an open appeal before the Massachusetts Supervisor of Public Records. It is also, this newsroom found in reviewing retention law across the country, a gap that Massachusetts has quietly already solved once before, for a different camera but not this one.

A Nine-Day Window

The timeline is short enough to digest.

On July 14, 2026, the transparency group OpenCommonwealth.org filed a public records request with the City of Malden under M.G.L. c. 66, §§10–10A, seeking a full export — native format, full metadata — of every Flock Safety camera image captured citywide during the 24 hours of June 23. At the time, Flock's standing policy was to auto-delete ALPR data on a rolling 30-day basis¹, which meant the June 23 footage was still sitting on Flock's servers, and still freely downloadable by the department, through on or about July 23.

Malden did not respond substantively in that window. On July 28 — two weeks after the request — the city's records office sent an acknowledgment invoking the 25-business-day extension Massachusetts law allows for complex requests, without addressing the substance. On August 13, the department's actual answer arrived: "the Malden Police Department does not maintain, store or preserve this type of specific record," and so could not fulfill the request.

OpenCommonwealth petitioned the Supervisor of Public Records on August 16, arguing that Malden "deleted, or allowed the deletion of, specifically requested public records during the pendency of a properly made public records request" — and that the footage was downloadable from Flock's own infrastructure for the first nine days after the request landed. On August 31, Supervisor of Records Manza Arthur issued a determination. It didn't resolve the dispute; it ordered Malden to resolve it.

Within ten business days, the department must clarify whether the requested footage existed and was permissibly destroyed, or whether it never existed in the first place — and if it was destroyed, to demonstrate that proper retention protocol was actually followed.

Whether the requested records existed and were permissibly destroyed, or whether the records did not initially exist.

Read quickly, that order looks like it hands Malden a clean binary — never existed, or properly destroyed — and leaves out the possibility OpenCommonwealth actually alleged: that the footage did exist, was retrievable, and was lost only because the city used its full statutory allowance on a request tied to a data source it knew was on borrowed time.

But the order doesn't really skip that scenario. It folds it into the second branch. "Permissibly destroyed"? The department isn't just being asked to confirm a deletion happened, it's being ordered to show its retention protocol was actually followed in letting it happen. If the imagery was sitting there, retrievable, while a live request for exactly such records was pending, "permissible" needs explaining.

Two Regimes, One Camera

Is this happening across the United States — not just in Malden, but in city after city that has adopted Flock's cameras? How does Massachusetts keep two entirely different bodies of law straight, when they point in opposite directions?

One is general public-records retention law: in Massachusetts, the Public Records Law and the Municipal Records Retention Schedule maintained by the Secretary of the Commonwealth's Records Management Unit. This is a floor. It tells a city the minimum time it must keep a record, and requires the Supervisor of Public Records' written permission before that record can be destroyed early — the same regime that put Malden on the hook to explain itself.

The other is a narrower, newer body of law written specifically for automated license plate readers, aimed not at preserving records but at limiting how long police can track people. This is a ceiling. Only a handful of states have written one. Massachusetts is not among them.

Where States Draw the Ceiling

We've found about five states which have legislated a maximum for ALPR data specifically. Virginia purges system data after 21 days. Maine sets the same 21-day cap and makes a violation a Class E crime. Illinois archives data after 90 days, extendable to five years if it's tied to an open investigation. New Hampshire purges within roughly three minutes unless a scan produces a hit. California bars selling the data or sharing it outside public agencies, without a fixed statewide ceiling on how long it can be kept.

Massachusetts has never written a number into this side of the ledger either.

The Supreme Judicial Court addressed ALPR use once, in Commonwealth v. McCarthy², holding that a sufficiently dense camera network could invade a constitutionally protected expectation of privacy under Article 14 of the state Declaration of Rights — but that the four-camera network in that case didn't cross the line. The Court noted, in passing, that the State Police kept their own ALPR data for a year under internal policy. That's a police policy, not a state statute — nothing requires it, and nothing caps it either.

The Floor Precedent Already on the Books

Here is the part that makes Malden's situation look less like an inevitable gap in the law and more like an unfinished one. Massachusetts has already legislated a retention floor for a camera very much like Flock's — just not this one.

The 2020 police reform law, formally An Act Relative to Justice, Equity, and Accountability in Law Enforcement in the Commonwealth, created a Law Enforcement Body Camera Task Force and charged it with recommending minimum retention standards for body-worn camera video. Its final report set the floor at not less than 180 days for routine footage, extending to three years or more for footage tied to a complaint, and matching the court's own retention practice for anything connected to a proceeding³.

In other words, the Legislature already knows how to tell a police department, in a statute, exactly how long a specific category of camera footage must survive before anyone is allowed to delete it. It did that work for body cameras. It has not done it for Flock cameras — which, unlike the body cameras an officer wears, are running continuously, are owned and configured by a private company, and are subject to a retention clock that vendor can reset with a single company-wide policy announcement, as Flock did on August 13, 2026, when it cut its own recommended default from 30 days to 7¹.

What Washington Already Learned the Hard Way

Massachusetts isn't the first state to run into this. Washington got there first, and paid for it.

Starting in 2025, an Oregon resident named Jose Rodriguez filed 53 public-records requests across Washington municipalities for narrow, 30-minute windows of Flock footage. Because Flock's cloud storage was on a rolling 30-day deletion cycle with daily download limits, several agencies simply couldn't retrieve and produce the footage before it disappeared on its own⁴. Fifteen governments ultimately settled for amounts between $5,000 and $40,000 each — more than $300,000 total, with at least two cases still in litigation⁵.

Along the way, a Skagit County Superior Court judge rejected the argument several Washington cities tried first: that footage stored on Flock's servers, rather than the city's own, wasn't really something the city "possessed" for public-records purposes. The court found the images were public records regardless of who hosted them, reasoning that they served a governmental purpose and were paid for with public money⁴. That is close kin to the very defense Malden has now offered — "the Malden Police Department does not maintain, store or preserve this type of specific record" — and it's exactly the claim the Supervisor's August 31 order is now asking Malden to substantiate rather than simply accept.

Washington, notably, had already written an answer to this exact fact pattern into its own code well before any of this Flock wrangling began in Malden. RCW 42.56.100 states plainly that if a record subject to a pending public-records request is scheduled for destruction, the agency "may not destroy or erase the record until the request is resolved" — a specific rule sitting inside the broader Chapter 40.14 RCW preservation-and-destruction framework already cited in the retention table above.

Malden's Answer Is Due Soon

The Supervisor's order gives Malden ten business days from August 31 to respond — putting the department's deadline in mid-September. Whatever the city says, the underlying question won't go away with this one request: Malden pays for a camera system whose retention clock is set, and can be reset, by a company headquartered in Atlanta, and the city has no local rule, and the Commonwealth has no statute, that tells anyone how long that clock is supposed to run.

Massachusetts wrote that rule once already, for the camera on an officer's chest. Nobody has yet written it for those cameras on the pole or what we referred to in our July 15th article as "birds on the wire."