ACLU of Massachusetts Launches Toolkit to Uncover Police Surveillance Tech Use

The American Civil Liberties Union of Massachusetts says it’s releasing an online toolkit this week for criminal defense attorneys designed to uncover whether police used surveillance technologies—facial recognition, automatic license plate readers, gunshot detection systems, and more—to build the cases against their clients in secret.

The toolkit, which the group describes as the first of its kind, is built around handcrafted legal motions that, when granted by a judge, will force prosecutors to reveal whether surveillance technology was used against a defendant. It covers an array of technologies, from “stingray” phone trackers and location data sold by commercial brokers to AI-drafted police reports and forensic tools that crack phones and siphon data from car infotainment systems.

It also includes preservation motions—demands that surveillance data be saved before it is deleted automatically—aimed at government agencies and private vendors alike. The filings rest on a bedrock rule of American criminal law, established in 1963, that prosecutors are required to turn over all evidence that could help the defense. The motions will be distributed through a password-protected library, the ACLU of Massachusetts says, available only to verified defense attorneys.

The group is fighting a war against unregulated surveillance tools on two fronts, says Jennifer Herrmann, a staff attorney at the ACLU of Massachusetts and one of the toolkit’s authors. One front is pressuring cities to drop tools like Flock, the license plate reader network, and ShotSpotter, the gunshot detection system, outright. The other is arming defense lawyers to expose the surveillance in court.

“The amount of time that it can take for that initial use of technology and investigation to actually get to a court and constitutional challenge is long,” Herrmann says—so the motions give attorneys a way to “challenge what has already happened in the past,” building a record that carries over to whatever tool comes next.

The project responds to what its authors describe as a chronic lag between the moment police adopt a new surveillance tool and the moment courts finally decide whether using it is legal. Most Americans carried cell phones by the late 1990s, but the United States Supreme Court did not require police to get a warrant for cell phone location records until 2018. The lag isn’t just the result of slow-moving courts. The technologies with the worst disclosure records have faced the fewest court rulings precisely because a defendant cannot challenge a tool they were never told about.

In materials accompanying the launch, the ACLU of Massachusetts says police deploy these tools “sometimes without even disclosing their use to the prosecutors handling the case.” For years, the FBI required local police departments to sign secrecy agreements before using cell-site simulators—suitcase-sized devices, commonly called stingrays, that impersonate cell towers to secretly locate phones. In Baltimore, one such agreement instructed prosecutors to drop criminal cases entirely rather than reveal the device in court, even as the city’s police used it more than 4,300 times between 2007 and 2015. FBI records later obtained by the ACLU show the agreements persisted until at least 2020.

When Missouri investigators used Fog Reveal, a commercial tool that maps people’s movements using app-harvested location data, in the investigation of a 2017 murder, the Associated Press found no trace of it in the trial exhibits that helped convict the victim’s wife. And when Louisiana authorities obtained an arrest warrant in 2022 for Randal Quran Reid—a Georgia man misidentified by facial recognition and jailed for nearly a week—the warrant attributed his identification not to software but to “a credible source,” according to The Washington Post. The very document that authorized his arrest actively obscured how police came to suspect him.

The toolkit’s authors frame the problem slightly differently: Their central worry is not only evidence hidden from prosecutors but defendants who are never told a surveillance tool touched their case at all, and defense lawyers who don't know to ask.

Gideon Epstein, a Technology for Liberty policy counsel at the civil liberties group and the toolkit’s other author, points to Massachusetts's own leading license plate reader case, Commonwealth v. McCarthy, in which the defense sought records for only a handful of cameras rather than the statewide network. “A lot of the time they're not asking for the full scope of surveillance technologies in use,” Epstein says. The motions, he adds, are as much about prompting lawyers to demand everything as about forcing the government to cough it up.

The preservation motions target a separate and subtler problem: surveillance evidence that destroys itself. Axon's Draft One, an AI tool that writes police reports from body camera audio, discards the machine-written first draft by design. An Axon product manager told the Electronic Frontier Foundation in July 2025 that the choice avoids creating “disclosure headaches” for police customers and prosecutors. California legislators saw the matter differently and enacted a law last year that requires agencies to keep the original drafts.

Elsewhere, Flock Safety’s license plate reader network deletes its footage after 30 days by default, and Chicago’s contract for the ShotSpotter gunshot detection system declared the gunfire data the vendor's own property, not the city’s. In each case, the digital material a defendant would need to fight back against a claim can vanish—or sit beyond the government's reach—before a defense attorney is ever appointed to the case.

Flock Safety spokesperson Paris Lewbel says the company has procedures to preserve the integrity and authenticity of data stored in its system, and tools to confirm that an ALPR image or investigative report has not been altered since it was pulled from the platform.

Lewbel says Flock complies with legal demands for customer data. Requests that don't legally bind Flock it refers to the customer, whom it also notifies.

A spokesperson for SoundThinking, maker of ShotSpotter, says the company complies with subpoenas and court orders regardless of which side issues them, and cooperates with “reasonable requests” for data in criminal proceedings. When a subpoena covers material the company considers confidential, such as its own trade secrets, it asks courts to restrict that material's dissemination.

Epstein is careful to note the ACLU still generally wants this data to quickly disappear. It’s lobbying Massachusetts to cut license plate reader retention to as little as two days, from Flock's default of 30. But once someone is facing charges, he says, that same data can be the evidence that clears them, which is what the preservation motions are designed to protect.

If the approach sounds theoretical, Massachusetts's highest court has recently proven otherwise, twice. In 2024, the state’s Supreme Judicial Court permanently threw out drug and firearm charges against a Boston man—barring prosecutors from ever refiling them—after police defied a court order to turn over records of fake social media profiles that officers used to surveil him, built with predominantly Black and brown avatars. Last year, the same court ruled that defendants can demand a hearing forcing prosecutors to prove ShotSpotter actually works before its evidence reaches a jury. The rulings help explain why the toolkit is built on Massachusetts law, which the ACLU says can be adapted for other states: The state’s high court has run years ahead of the US Supreme Court on digital privacy, requiring warrants for cell phone location data back in 2014.