Editor’s note: This article is part of ALPRs in Focus, a Police1 editorial series examining how agencies use automated license plate reader technology, the investigative value it can provide, and current concerns surrounding privacy, data access, retention and misuse.
By Chief Brandon Gurley
A suspect went on a shooting spree that reached into my city. Data from a privately owned license plate camera, shared with us in real time under a formal data-sharing agreement with the camera’s owner, gave us the lead we needed to identify the suspect’s vehicle and link it to two other shootings outside our jurisdiction. Officers located the vehicle more than 80 miles away and took the suspect into custody less than two hours later. The case demonstrated how cross-jurisdictional information sharing can help police respond quickly to a serious threat.
I have shared that story before because it demonstrates the public-safety value of license plate reader technology. But technology alone did not produce that outcome. Training, policy and human judgment made the difference.
Every agency running powerful technology right now is one bad week away from a headline, a records request, or a question from an elected official they weren’t ready to answer. The chiefs best prepared for that week aren’t the ones with the best tool. They’re the ones who already had the answers before anyone asked the question.
This isn’t a debate over whether one platform is good or bad. That debate misses the point. The tools will keep changing. What has to hold steady is the leadership work underneath them: who can touch the data, how long you keep it, who’s watching and what happens when someone crosses the line. That work belongs to the chief. It always has. Here’s the framework I use to make sure my own department can account for how we use these tools, and the one I’d encourage any chief to apply to their own.
Who can touch it, how long you keep it, where it goes
Start with access. Every user should work under an individual login, never a shared one, and every search should require a documented, legitimate reason before it happens, not after someone asks why.
My department currently retains license plate reader data for 30 days, but we don’t treat that number as settled. We continually study our own search data to see how old a read typically is by the time it’s pulled for an investigation. If that data shows reads aren’t regularly serving a case beyond 15 days, or even seven, that may be a sign to consider shortening the window. The right retention period shouldn’t be set by a vendor’s default configuration. It should be driven by your own data within whatever legal requirements apply in your jurisdiction. Every agency’s caseload looks different, so let yours drive the decision.
Sharing license plate reader data deserves the same discipline. Breaking down jurisdictional lines is one of the real benefits of this kind of technology, because criminal activity doesn’t stop at a city limit sign. But that benefit only holds up if accountability crosses those same lines. Before you agree to share data with another agency, ask what standards it holds its own users to. Request its policy, audit process and a sample of a recent audit. If you wouldn’t accept “trust us” from a vendor, don’t accept it from a partner agency either. The Brennan Center and the ACLU have documented how loosely some of these sharing arrangements are governed.
Real auditing looks like this
“We audit regularly” isn’t an answer. It’s a placeholder for one. A real audit process identifies a frequency, a minimum sample size and the person responsible for conducting it. In my department, that means a monthly review of every ALPR the system flags for additional scrutiny, along with a randomly selected sample of at least 5% of all other ALPR searches. Every audited search has a documented outcome, ranging from no action to retraining or referral for further inquiry. Those findings are then compiled into a report I personally review. We also conduct an annual cumulative review to identify patterns or concerns that may not be visible in the smaller monthly samples.
Platforms are beginning to build AI-assisted auditing into their product, flagging unusual patterns for human review rather than relying solely on random sampling. That’s capability is worth using carefully, with a person always making the final determination. AI-assisted review supplements a risk-based audit program; it does not replace one. Automated tools may scan all activity, but they can identify only the conduct their rules or models are designed to detect. Agencies still need human review and sampling to look for what the system may miss.
ALPRs are not the only place to consider this approach. Agencies also need to audit activity across systems such as body-worn cameras, records management platforms, GCIC and NCIC access, mobile data terminals and, in some departments, facial recognition. If your agency hasn’t considered where AI-assisted review could strengthen that work, put it on this year’s list instead of next year’s.
Your community deserves answers before they have to ask
Historically, agencies explain this kind of technology only after something goes wrong. That’s backwards. Your community and elected officials deserve plain-language answers, in advance, to the questions they’re eventually going to ask: What hardware and software are deployed? How long is the data retained? Who has access to it? What happens if someone misuses it?
A 2025 report out of Iowa raised concerns that local officials were making decisions about ALPR technology without fully understanding how the systems work or the risks they may pose. That’s not just a failure of the council. Agencies have a responsibility to clearly explain the technology they’re asking elected officials to approve. Use your own data here too. Don’t lean on hypotheticals to explain your policy. Show your community the real numbers behind your retention decisions and share aggregate audit findings without disclosing sensitive personnel or investigative information. Specifics build trust in a way reassurance never does.
The chief owns this, not the vendor
A vendor can sell you a platform, but a vendor cannot own your governance. That responsibility doesn’t transfer, no matter how good the product is.
The American Association of Motor Vehicle Administrators’ (AAMVA) 2025 best practices guide says AI should assist decision-making, not make decisions for the user. That principle should apply to every system in your agency, not just whichever one is making headlines this year.
Writing for Police1, Dr. Joseph J. Lestrange makes the same case: Chiefs have to own the accountability structure around a technology rather than hand it off to IT or assume a vendor’s default settings are good enough. Reviewing your retention period against your own data and checking a partner agency’s audit practices before sharing data are responsibilities no one else can own for you.
What changed for me
My department’s policy was already strong before national misuse stories started making headlines. We revised it anyway. We increased our audit frequency to monthly, defined clearer role-based access levels so what someone can search is tied to their actual assignment, and restricted who can access shared data, a step we’re still reviewing for further tightening. Our own retention data is now helping us determine whether the period we chose is still the right one. We’ve increased training where we’ve identified a need, rather than simply adding more training across the board. Several other areas still rely on traditional manual auditing, including property and evidence, pursuit and use-of-force records, and GCIC access. We’re exploring how AI-assisted review could extend our audit capacity in those areas.
None of that is about distrust of my officers. It’s about making expectations clear before anyone is in a position to test them. Consistent training, meaningful oversight and clear consequences reinforce the standards we expect people to follow. That structure protects the integrity of the program and gives officers a clear framework for making the right decision.
Closing
The agencies that earn the public’s trust with these tools won’t be the ones with the most cameras or the newest platform. They’ll be the ones that can clearly explain how the technology is used, governed and reviewed before concerns arise. That’s not a technology problem. It’s a leadership one, and it’s ours to answer.
About the author
Brandon Gurley is a sitting Chief of Police with the Brookhaven Police Department in Georgia and the founder of BRG Leadership, where he provides executive coaching and advisory consulting to law enforcement leaders working through high-stakes technology decisions, governance, and public trust.
