Annual report · Cambridge, Massachusetts · March 9, 2026 (covering 2025)
Cambridge’s 2026 annual surveillance report
A hundred and one pages covering 37 technologies, from body cameras to a throwable robot. It names who received the data. It reports no audits, no violations, and no query counts for the plate readers it removed.
7
Meets
11
Partial
2
Fails
6
Missing
of 26 practices this document could address
Every March the Cambridge city manager files a report on each surveillance technology the council has approved. The 2026 filing covers 2025 and runs to 37 entries across departments. For the police it includes body cameras (63,740 videos), the GrayKey phone-unlocking tool (“used approximately 25 times ... only used after a search warrant had been issued”), ShotSpotter (nine confirmed shootings citywide, three with an activation), public safety cameras (five of six planned), LexisNexis Accurint ($33,377.40, described as “a search engine”), and the Flock plate readers.
The plate reader entry is the one to read. Sixteen cameras installed June 2025, a pilot from August to November, then: “Before the program could be fully evaluated for effectiveness, significant concerns were raised by members of our community regarding the vendor, Flock Safety. After reviewing both national reports and the concerns expressed locally, we made the decision to discontinue.” Footage was shared twice, with Medford and Boston police, and requests after the 30-day retention window “yielded no results.” No count of searches appears.
The report names recipients technology by technology: the Middlesex District Attorney, the Boston Regional Intelligence Center daily, CrimeTracer daily, the Metro Boston Homeland Security Region for ShotSpotter alerts. Every police entry answers “None” to complaints and “No” to policy violations. The department’s own policies require quarterly audits of the plate readers and the cameras; the report contains no audit results. And when a resident group requested the ShotSpotter agreement, the city sent them to the regional center and reports that “nothing was provided by the City of Cambridge.”
Primary source
City Manager Agenda 2026-44, Annual Surveillance Reports, 101 pages, referred to the Public Safety Committee 9 to 0 (mirror of the council filing)Read 2026-09-28
Practice by practice
What the document says, or does not say, on each practice in the Standard. Practices this kind of document has no business addressing are marked n/a. These marks are evidence for a jurisdiction’s grade; the document itself gets no score.
Stage 1
Decide
- Partial
The plate readers had an approved impact report. The program ended “before [it] could be fully evaluated for effectiveness,” which means the necessity case was never tested.
- Missing
- Meets
1.3Public notice and a recorded vote
Every technology in the report traces to a council approval, and the June 2026 summary lists the three impact reports filed in 2025 with their votes.
Stage 2
Acquire
- Partial
2.1Direct contract, no marketplace add-ons
ShotSpotter, the public safety cameras and the plate readers were funded through the Urban Area Security Initiative, and CLEAR licenses were “furnished ... at no cost” by it. The agreements live with the regional body, which is where records requests get sent.
- Meets
2.2Published use policy before deployment
Use policies exist and are posted: ALPR Policy 41-12 (August 2025) and Camera Policy 41-13 (June 2025), both committing to the ordinance.
- Partial
Annual review is real: the council disapproved ShotSpotter in June 2026 on this report, then temporarily restored it in August pending a civic assembly.
- Missing
2.4No irrevocable license to the vendor
The Accurint entry does not describe the contract terms or whether any city data is contributed.
Stage 3
Deploy
- Partial
3.1Purpose limitation in writing
Each entry states a purpose. Accurint’s is “a search engine”; GrayKey’s is tied to warrants; the plate readers’ was a pilot.
- Partial
Camera count and neighborhood are reported (Central Square, five of six). Plate reader locations are not listed.
- Partial
The report is public and was heard in committee on May 20, 2026. No signage is described.
Stage 4
Use
- Partial
4.1Logged justification for every query
GrayKey use is counted and tied to warrants. Body camera videos are counted. Plate reader searches are not counted at all.
- Meets
Flock installed two cameras in November 2025 after the city had removed sixteen. The city called it “a material breach of our trust and the agreement” and terminated the contract.
- Partial
4.4Misuse is reported like a near miss
Every entry reports no violations. The plate reader entry acknowledges “several concerns” raised at council meetings. No audit or investigation is described that would have found a violation.
Stage 5
Share
- Partial
5.1No sharing without a published policy
Sharing is disclosed narratively per technology. GrayKey data “could be shared with the U.S. Attorney’s Office.” The report does not state a policy on federal access; at the hearing the department said BRIC contributions are not accessible to federal agencies.
- Meets
Recipients are named: Medford PD, Boston PD, Middlesex DA, Suffolk DA, BRIC, CrimeTracer, MBHSR, FBI and State Police for live scan. What BRIC does with daily incident data after receipt is not in the report.
- Missing
At the hearing the department said BRIC removes data older than three years. The report does not say so.
- Fails
5.4Consortium and platform terms are public
The ShotSpotter agreement request was redirected to BRIC/UASI and “nothing was provided by the City of Cambridge.” A consortium contract the city cannot produce is a consortium contract that is not public.
Stage 6
Retain
- Meets
6.1Shortest retention that serves the stated purpose
Plate reader data 30 days, per the report and Policy 41-12 (14 to 30 days). Camera footage 30 days.
- Missing
Stage 7
Audit
- Fails
7.1Independent audit on a schedule
Policy 41-12 requires quarterly ALPR audits and Policy 41-13 quarterly camera audits. The report contains no audit results for any police technology.
- Partial
7.2Logs available to the oversight body
The council received the report, referred it 9 to 0, and held a hearing. Nobody outside the department has seen a log.
- Meets
7.3Annual public report with counts
Filed annually with use, sharing recipients, complaints, violations, effectiveness, records requests, cost and funding source per technology. The 2026 filing landed March 9, eight days past the ordinance’s March 1 deadline.
Stage 8
Retire
- Meets
Flock halted by unanimous vote in October 2025 and terminated in December. ShotSpotter disapproved June 1, 2026 under § 2.128.060(C).
- Partial
8.2Exit terms and certified destruction
Sixteen cameras were removed. The report says nothing about destruction of the reads Flock holds.
What to take from it
This is what an annual report looks like when an ordinance requires one, and it is better than what almost any other city produces. It also shows the limit of self-reporting. Thirty-seven entries, zero violations, zero audit results, and the one search count that residents most wanted, how often the plate readers were queried and by whom, is not on any of the hundred and one pages.