20 The "California only" rule held. The data reached the DEA anyway.new

The November 2025 community-meeting deck told residents, under “policy”, that Benicia would share ALPR data “with agencies (Legal/law enforcement) within California.” Finding 14 examines the second half of that slide, the MOU claim, which is now in dispute. This finding is about the first half, which is not in dispute at all. It is true, it was followed, and it did not work.

The roster is exactly what the City said it would be

The Flock transparency portal publishes the list of organizations granted access to Benicia’s cameras. Captured on 2026-08-28, it names 75 organizations. Every one is a California entity: municipal police departments, county sheriffs’ offices, five district attorneys, the California Highway Patrol, the California Department of Corrections, and NCRIC.

There is no out-of-state agency on it. There is no federal agency on it. Measured against the promise made to residents, the roster is clean.

And the data still went to the DEA

On 2026-06-18 Deputy Chief Edward Criado reported the results of his investigation to Chief Menesini:

“Although Benicia cameras were included in some of these searches that were conducted for out of state agencies or federal agencies (DEA), none of their inquiries or searches were related to immigration or reproductive rights.”

And:

“This knowledge gap resulted in a violation of policy and SB34.”

How both are true at once

The route is one hop past where the rule stops.

NCRIC is #37 on the roster. It is a California fusion centre, so granting it access satisfies the California-only rule completely. NCRIC then had two Western States Information Network analysts working inside its fusion centre, and those analysts ran Flock queries on behalf of out-of-state and federal agencies. Criado’s account is that they “did not fully understand the restrictions on any out of state or federal sharing due to SB34.”

So Benicia’s control operated on the first hop, and the failure happened on the second. The department chose its partners carefully and had no mechanism, and no visibility, over what those partners did with the access afterwards.

This is not a loophole someone exploited. It is a control that was never designed to reach the thing that went wrong. A policy phrased as a list of permitted recipients cannot constrain onward transfer, and nothing in the record suggests anyone noticed the gap before June 2026.

Why it could not be caught locally

Three separate limits compound:

Benicia cannot see who queried its cameras. NCRIC told the requester on 2026-07-23 that no record “exists, could be located, or could be created” identifying whether a Flock query returned results from a specific customer, agency, camera or location. Queries are logged; whose cameras answered is not.

The window was thirty days wide. NCRIC records that its vendor imposes a 30-day maximum retention. Benicia’s own portal reports the same retention figure. Whatever happened in April and May 2026 was unreconstructable by July.

The finding came from the vendor, not from an audit. Criado’s memo relays what NCRIC and WSIN told him. Nothing in it indicates he examined search logs himself, and there is no record of Benicia requesting the quarterly audit report that NCRIC’s own policy §7.1 makes available to partner agencies on request.

Stated fairly

Nothing here shows Benicia broke its own rule. The roster demonstrates the opposite. Nothing here shows immigration enforcement touched Benicia data either; Criado’s memo says the searches were for homicide, child sexual abuse material and fentanyl trafficking, and ICE is not named anywhere in it.

What this finding says is narrower and harder to dismiss. The assurance given to residents was kept, and it was not sufficient. “We only share within California” describes the first transfer and nothing after it, and the record now contains the Department’s own second-in-command writing that the result was a violation of SB 34.

Whether the searches were as described is, on the present record, unverifiable by anyone in Benicia. It rests on what analysts at another organization typed into a reason field, in a system whose logs the City has said it cannot obtain and whose retention window has long since closed.