17 The Chief confirmed NCRIC has Benicia's data, and said nobody knew where it went nextnew

Corrected 2026-08-28. Three statements in this finding were reversed by the PR-2026-181 production of that date: that there was no record of the Chief’s research, that the Flock email he named was not produced, and that the chain ended at 11:34. The research exists, both records are published, and the day runs to 16:56. Details and documents are on the Corrections page. The corrected passages are marked below.

On June 17, 2026 the San Francisco Police Department disclosed that its Flock network had been queried 299 times on behalf of federal and out-of-state agencies. The route was not a break-in. NCRIC — the Northern California Regional Intelligence Center — had lawful access, and granted night-hour access to analysts at the Western States Information Network, who ran the queries for other agencies. SFPD cut NCRIC off.

Benicia shares its ALPR data with NCRIC. That much the archive already showed: NCRIC holds a signed data-sharing acknowledgment letter, filed under SAN FRANCISCO PD - NCRIC, one of the 82 agencies on the roster.

What this production adds is the morning the City found out, in its own words. It runs from 10:38 to 11:34 on June 18, 2026 — fifty-six minutes — and then stops.

The chain

10:38:59 — Mayor Steve Young forwards the San Francisco Chronicle story to Deputy Chief Edward Criado, copying Chief Mark Menesini and City Manager Mario Giuliani. His question is one line:

“Can you confirm whether or not flock access is made available to NCRIC and WSIN referenced in the article?”

10:42:52 — Menesini forwards it to Senior Management Analyst Wendy Stratton Monahan.

10:45:55 — Stratton Monahan replies to Menesini with the full text of the Chronicle article. Not an answer to the Mayor’s question; the article itself, pasted in.

10:47:26 — Criado replies to the Mayor, copying Menesini and Giuliani. The body of his reply, in full, is:

“Get Outlook for iOS”

That is the auto-appended signature of a mobile mail client and nothing else. This should not be read as a refusal. The rendered page shows no redaction over the body — the only black boxes are the Mayor’s personal address — so nothing was withheld there. An empty send from a phone is the ordinary explanation, and the Chief answered the same question 47 minutes later.

10:52:14 — A Benicia resident emails Menesini, copying all five members of the Council, asking four questions: whether the Department shares with NCRIC or any fusion centre; whether it has audited its Flock access logs to determine whether federal or out-of-state agencies have queried Benicia’s data; what state the national-lookup and statewide-search settings are in; and whether the Department will commit to a public-facing audit of access logs. The same question had now arrived from inside and outside the City within fourteen minutes of each other.

11:34:37 — Menesini answers the Mayor, copying Criado and Giuliani:

“Steve, Yes, for NCRIC.. No to WISN. I’m going to forward you an email from Flock that specifically talks about the current restrictions that have been made limiting NCRIC’s ability to share data. We need to do some research to see if NICRIC shared our Benicia cameras with WISN who in return shared with outside federal agencies. This may take some time to dissect.”

11:35 — Menesini forwards the Flock email he had just promised, to Young and Giuliani, copying Criado.

13:15:17 — Young replies, asking whether the City can cut NCRIC off entirely.

16:56:59 — Criado sends his findings to Menesini, Heinemeyer and Stratton Monahan.

(Those last three entries were added on 2026-08-28. As first published, this section ended at 11:34 with the words “The production ends there.” See Corrections.)

What that establishes

Benicia gives NCRIC access to its ALPR data. This is the Police Chief confirming it in writing, in answer to a direct question from the Mayor. It corroborates the acknowledgment letter already on file, and it is the Department’s own characterisation rather than an inference from a roster.

“No to WISN” is not the reassurance it looks like. The whole substance of the SFPD disclosure is that WSIN did not need direct access. It reached SFPD’s data through NCRIC. A department that shares with NCRIC and not with WSIN is in precisely the position SFPD was in the day before this email was written. The Chief plainly understood this — it is why his next sentence is about research.

As of June 18, 2026, the Department did not know whether Benicia’s data had travelled that route. “We need to do some research to see if NICRIC shared our Benicia cameras with WISN who in return shared with outside federal agencies.” That is a candid answer, and it is the right question. It is also, on this record, the last time anyone is recorded asking it.

There is no record of the research. CORRECTED — the research exists, and it was done the same day. As published on 2026-08-08 this read: “There is no record of the research. Nothing in this production shows it being started, assigned or completed.” That was true of the production it was written from and false of the world. On 2026-06-18 at 16:56:59, three hours and twenty-two minutes after saying it “may take some time to dissect,” Deputy Chief Criado sent his findings to the Chief, Captain Jake Heinemeyer and Wendy Stratton Monahan. See Corrections.

What remains true is the narrower point about the other requests: PR-2026-180 returned no Flock Network Audit log and no NCRIC notification trail, and PR-2026-155 told the requester on 2026-08-07 that the City “has not been able to access an export or system report” showing the current on/off state of national lookup, nationwide and statewide search, and “has not been able to identify” any log of changes to those settings.

What the research found

Criado’s memo is the answer to the Chief’s question, and it is not reassuring.

“In this instance, WSIN had two analysts assigned to NCRIC as part of the fusion center, like a task force… They were aware they could not share or search for any data related to reproductive investigations or immigration investigations, but they did not fully understand the restrictions on any out of state or federal sharing due to SB34. Although Benicia cameras were included in some of these searches that were conducted for out of state agencies or federal agencies (DEA), none of their inquiries or searches were related to immigration or reproductive rights.”

And on the finding itself:

“They had two analysts assigned to their fusion center that had not been properly trained to completely understand SB34 and its restrictions. This knowledge gap resulted in a violation of policy and SB34.”

That is the Department’s second-in-command stating in writing that Benicia camera data was included in searches run for out-of-state and federal agencies, and characterising it as a violation of SB 34. It answers, in the affirmative, the question the Chief posed that morning.

Three limits on how far it goes. It is not a Benicia audit: Criado is relaying what NCRIC and WSIN told him, and nothing in the memo says he examined the underlying search logs. The immigration denial rests on the stated purpose of each search, which is a claim about what analysts typed into a reason field, not about where results travelled afterwards. And “federal agencies (DEA)” is written as an example; whether DEA was the only one is not stated. ICE is not named anywhere in the memo, and the memo says the opposite, that no search was immigration-related.

A week later it went to records. On 2026-06-25 at 16:29 Criado forwarded the memo to Police Records Supervisor Suzie Kaluza with a one-line note: “I looked into the issue surround Flock and the reports from a news article. Attached are my findings. I wasn’t looking for anything in particular related to a FOIA. We can discuss.” PR-2026-181 was filed on 2026-07-11, sixteen days later. The memo was not in the 2026-08-08 production of 34 records. It arrived on 2026-08-28.

What NCRIC says, asked directly

NCRIC was asked the same questions on 2026-07-17, and answered on 2026-07-23 — five days, inside the ten §7922.535 allows. Four of its answers bear on this finding.

It holds no agreement with Benicia. Asked for the executed MOU or data-sharing agreement, NCRIC replied that no responsive record could be located. Benicia’s roster shows NCRIC holding a one-page acknowledgment letter. Finding 6 is now confirmed from both ends of the arrangement.

Except that the City’s own Deputy Chief says otherwise. Criado’s 2026-06-18 memo states: “We have clear expectations of the agencies we share our data with and NCRIC has a signed MOU with Benicia.” NCRIC says it holds none; the department said in 2022 it had no formal MOU; the Deputy Chief says one is signed. No party has produced it. This is logged as an open dispute on the Corrections page rather than resolved here, because nothing in the record settles it.

It does not hold Benicia’s data; it reaches into it. NCRIC “does not provide any systems that store, retain, transmit, or make searchable any ALPR data from Benicia Police Department,” and separately has “query-based access, using standard Flock web interfaces, to ALPR data from agencies that have elected to share with NCRIC.” Those are not in tension. The data stays in Flock’s system and NCRIC queries it there. That is the architecture, and it explains why Benicia holding no copy of an access log is unremarkable — the log, if it exists, is Flock’s.

Queries are logged. Hits are not attributable. This is the crux, and it takes both documents to see. NCRIC’s ALPR Policy, §7.1, requires that access to ALPR data be logged with the user’s name, their agency, the date and time, the case number, and “license plate queried, regardless of any discovered matching results.” But asked for records of pulls involving Benicia data, NCRIC answered that none “exists, could be located, or could be created,” because “no such report can be created which identifies if a Flock ALPR query returned matching search results from a specific Flock customer, agency, camera, or location.”

Both are true at once. Who searched, when, for which plate, and under what case number is recorded. Whose cameras answered is not. That is precisely the distinction SFPD’s Chief Lew drew in public — “there’s a difference between a query and a hit. So we don’t know, of those queries, what actually generated a real hit.”

So the Chief’s research was half-possible, and Benicia had a route to it. NCRIC’s policy provides that audit reports “will be provided quarterly and on request to supervisory personnel at the NCRIC and partner agencies.” Benicia is a partner agency. Under NCRIC’s own policy it could have asked, in June 2026, for the log of who had been querying the pool its cameras feed — and nothing produced under any request shows that it did.

What that would not have told the Department is whether any of those queries touched a Benicia camera. What it would have told them is who was searching, from which agency, and whether WSIN analysts appeared in the log at all. That is most of the question, and it was available for the asking.

Two further points from the policy documents. NCRIC’s §4.2 states that it “may only share, disseminate, or provide access to ALPR information to California state or local law enforcement agencies” and “will not share, disseminate, or sell any law enforcement data to law enforcement agencies outside California, federal law enforcement” — the 2024 policy already forbidding exactly what SFPD’s audit found happening in June 2026, and expressly extending to “ALPR data from other sources that have elected to share their information with the NCRIC.” And on retention: NCRIC supports up to 365 days, but records that “the NCRIC’s chosen ALPR technology vendor imposes a 30 day maximum retention period.” The window in which any of this could have been reconstructed was thirty days wide, and it closed in July 2026.

The assertion that cannot be checked

Asked which federal agencies or fusion-centre partners can query data originating from Benicia, NCRIC answered: “No external agencies have any access to data from the Benicia Police Department either directly or through NCRIC.”

That is a statement of position, not a record, and “external” is left undefined. It sits in the same letter as item 7, which says no record could be created showing whether a query reached Benicia’s cameras. NCRIC is asserting that something did not happen, and in the same reply saying that the record which would show whether it happened cannot be built. The assertion may well be right. It is simply not checkable against anything NCRIC has said it can produce — and for SFPD, the equivalent assurance did not survive an audit.

A specific record was named and not produced. CORRECTED — both records are now published. As published on 2026-08-08 this said the Flock email the Chief named was “not in this production, and neither is the forward the Chief said he was about to send.” The 2026-08-28 production contains both. He sent the forward at 11:35 AM, one minute after the email in which he said he would. The Flock message inside it is from Chris Colwell, SVP Customer Experience, sent 2026-06-05 at 8:00 AM to Wendy Stratton Monahan, saying Flock had “identified instances where user accounts associated with the NCRIC organization did not align with our current account provisioning requirements” and had “taken steps to restrict access to accounts that could not be validated.” See Corrections.

The Mayor read it and was not satisfied. At 13:15 the same day he wrote back:

“I am not sure how to interpret this. That they are still using NCRIC? … Do we have the ability to eliminate participation by NCRIC from access to our data?”

Criado’s findings memo followed at 16:56.

Stated fairly

A production is bounded by what the request asked and what the City’s search found. The absence of the research from this release is not proof the research did not happen. It may have been done by telephone, in a meeting, or in records the search did not reach. The finding here is narrower and firmer: the Department identified the question in writing within an hour, called it something that “may take some time to dissect,” and no record of an answer has been produced in any of the four requests that would be likely to contain one.

Nor does anything here show that Benicia’s data was improperly accessed. SFPD found 299 improper queries against its own network. Whether Benicia’s cameras were among those searched is exactly what the Chief said needed research, and it remains unestablished in either direction. NCRIC says flatly that no external agency has had access to Benicia’s data, and nothing contradicts that. The difficulty is only that NCRIC also says the record which would test it cannot be built, and that the vendor’s thirty-day retention has long since closed the window in which it might have been.

NCRIC met its deadline and answered plainly. It replied in five days, gave a direct negative where the answer was negative rather than saying a record had “not been located,” and attached its policies unprompted. That is the standard the City’s own “has not been able to identify” and “has not located” replies are being measured against, and it is worth saying that an agency with far more reason to be guarded managed it.

The one-line answers from Criado and the article-paste from Stratton Monahan are not evidence of evasion. They are what a busy morning looks like. The Chief answered the substantive question within the hour, and answered it honestly, including the part he did not know.