Jonathan

Issue 12 • Wednesday, June 3, 2026

A concise weekly scan of surveillance, privacy, cybersecurity, and the safeguards public officials should keep in view.

At a glance

• ALPR oversight reached Congress, but the first sweeping federal restriction failed in committee.
• EFF’s new mission-creep examples show why purpose limits need technical enforcement, not just policy language.
• Vendor platforms are expanding after purchase, making release notes part of the oversight record.
• New location, platform, and device-signal examples show surveillance moving through access pathways, not just cameras.

ALPR oversight reached Congress, but the first sweeping restriction failed

Automated license plate readers are no longer only a city-contract or police-policy issue. This month, ALPR oversight reached Congress. WIRED reported that Representatives Scott Perry and Jesús “Chuy” García introduced a bipartisan amendment to a federal highway bill that would have barred recipients of Title 23 federal highway funds from using ALPRs for any purpose other than tolling. ACLU and partner groups urged the Committee to support the amendment; EPIC joined a coalition pressing the same case. Demand Progress later reported that the committee rejected it.

Why it matters for public officials: Congress did not settle the question. Local and state governments still have to decide what rules apply before ALPR systems are purchased, renewed, expanded, or connected to larger networks.

Mission creep shows why purpose limits matter

EFF’s latest ALPR analysis documents the practical reason purpose limits matter: ALPR networks have been used for school residency verification, employment background checks, and noise or loud-music complaints — uses that do not feature in most public debates over whether to deploy plate readers. Once a location database exists, more users and more purposes will try to reach it. If the rules are vague, a system’s actual use can drift far beyond the original public explanation.

Why it matters for public officials: Purpose limits should be written before deployment and enforced technically. A policy that says “serious investigations only” is weak if the software still permits broad searches for administrative, civil, or low-level purposes.

Bend and Oregon show why policy must match permissions

Bend and Oregon remain useful case studies, but the lesson is broader than either jurisdiction. Earlier reporting from The Source Weekly found that ICE, CBP, and Homeland Security Investigations queried Bend Police Department Flock Safety data 279 times in the first three weeks after the cameras went live. Separately, OPB reported that a lawsuit alleges Oregon State Police allowed federal immigration authorities to query Oregonians’ data through shared law-enforcement databases for years, despite Oregon’s sanctuary laws. OSP denies wrongdoing. The Oregon Capital Chronicle reported the same allegations.

Those examples should not be repeated as old news. They should be treated as a practical reminder: a privacy rule only works if the database permissions, access settings, and audit logs match the rule.

Why it matters for Bend and Deschutes County: Written policy matters, but it is only one layer. Contract terms, vendor settings, sharing permissions, system configuration, audit logs, and public reports all have to point in the same direction.

“If it is law, it will be found in our books. If it is not to be found there, it is not law.”
— Lord Camden, Entick v. Carrington (1765)

Policy 428 appears stronger, but oversight still needs proof

Bend Police Department’s updated Policy 428 appears to add stronger ALPR safeguards, including shorter retention for non-investigatory plate data, search logging, audit and reporting requirements, prohibited-use language, and vendor-contract requirements. That matters. It is a real improvement over a weaker policy baseline.

But a policy is not the whole oversight system. The next questions are whether the publicly posted version is final, whether any contract or add-on incorporates the same limits, whether system settings enforce them, and whether audit reports will be usable enough for Council and residents.

Why it matters for public officials: A policy states the rule. A contract binds the vendor. A system configuration prevents improper access. Audit logs show what happened. Public reports let elected officials verify the result. All five layers matter — and they should align before deployment, not after.

Shared pattern

The strongest stories on this page point in the same direction: surveillance power expands through access pathways. A local camera, a vendor database, a federal search request, a shared records system, or a platform setting can each change who can reach sensitive data. Oversight has to follow the path the data actually takes.

Commercial location data is a national-security problem

Reuters reported that U.S. military personnel deployed to war zones have reportedly been targeted using commercially available location data, with lawmakers warning such data can reveal troop movements and patterns of life.

The reminder applies at every level: data collected for advertising can become useful for intelligence, enforcement, stalking, coercion, or political pressure. Public policy should treat commercial location data as sensitive infrastructure, not a marketing issue.

Online speech, anonymity, and age checks are becoming enforcement surfaces

Bloomberg Law reported that the Justice Department used grand-jury subpoenas to seek identifying and financial information from Reddit and X in investigations involving anonymous criticism of ICE tactics. The Verge summarized the reporting in similar terms.

Age verification belongs in the same warning pattern. Child safety online is a legitimate policy goal, but systems that require identity documents, facial scans, third-party verification, or persistent proof of age can reduce the ability to read, speak, browse, or associate online without creating an identity trail. EFF has warned that age-check systems can become privacy infrastructure for everyone, not only children.

The safe framing is narrow but important: when platform records, financial information, age checks, and identity-verification vendors can all be used to identify anonymous users, data minimization and legal-process rules become free-speech safeguards. Lawmakers should separate child-safety goals from systems that normalize persistent identity checks for ordinary lawful speech.

“The makers of our Constitution undertook to secure conditions favorable to the pursuit of happiness. They conferred, as against the Government, the right to be let alone.”
— Justice Louis Brandeis, dissenting in Olmstead v. United States (1928)

Warning Signals

These items point toward where surveillance systems, vendor platforms, identity infrastructure, and data governance may be heading next.

Axon Watch: release notes are part of the oversight record

Police-technology platforms do not remain frozen after purchase. Axon RMS June 2026 release notes include Records and Standards updates involving form rollback logging, validation, access-profile configuration, and Axon DataStore notes about physical-table read access for replication accounts.

That is not a scandal or a breach. It is a governance signal. Product updates can affect records workflows, database replication, audit visibility, search behavior, and who can reach what inside a public-safety records environment.

Oversight question: Does the agency provide elected officials with a periodic platform change log covering major software releases, enabled features, disabled features, database-access changes, audit-log changes, AI tools, and new integrations?

LPR systems are moving toward broader signal correlation

Leonardo’s ELSAG SignalTrace product shows where license-plate-reader ecosystems may be heading. The company describes a system that can collect electronic signals from phones, smartwatches, fitness trackers, RFID tags, Bluetooth, Wi-Fi, and vehicle components, then correlate those patterns with LPR data. Leonardo says the tool does not decrypt device content — but movement patterns can be inferred from the devices people carry, not just the plates on their vehicles.

Why officials should watch it: A procurement described as “license plate reader” today may sit inside a larger vendor ecosystem tomorrow. Public review should cover roadmaps, integrations, and adjacent capabilities, not only the first device installed.

Drone-first-responder programs are becoming routine infrastructure

Drone-first-responder programs continue moving from special-use tools toward routine 911 response. San Francisco Police Department now exceeds 600 drone flights per month, Dallas launched a drone-first-responder program tied to a larger public-safety technology platform, and Coral Springs approved an Axon-linked DFR expansion through an existing agreement. Meanwhile, Ohio is debating warrant and equipment rules.

Why officials should watch it: Drone programs can normalize faster than governance frameworks. The pilot stage is the best moment to define launch rules, livestream access, retention, evidence use, mutual-aid sharing, audit logs, and public reporting.

Direction of travel

This week’s signals point to a broader pattern: public-safety technology is becoming a platform environment. Plate readers can connect to device signals. Evidence systems can connect to records, AI tools, and partner sharing. Commercial location data can become intelligence. Online speech can become legal-process data. Drones can become routine response infrastructure.

The safeguard question is not only what the tool does on day one. It is what the system can connect to next.

“As with GPS information, the time-stamped data provides an intimate window into a person’s life, revealing not only his particular movements, but through them his familial, political, professional, religious, and sexual associations.”
— Chief Justice John Roberts, Carpenter v. United States (2018)

Safeguards

Good safeguards usually start with less data and clearer boundaries.

Define access before deployment, not after the first complaint

Before any camera, database, drone program, records platform, or evidence system is approved, the governing body should be able to answer in plain language: who can search this data? Can federal agencies reach it directly or indirectly? Can outside agencies search it? Can the vendor see, export, or reuse it? Can partner agencies receive alerts or shared results? If those questions do not have documented answers, the policy is not finished.

Troy, New York’s model — written limits on immigration and First Amendment searches, nationwide-lookup restrictions, and mandatory audits before cameras stayed live — offers a useful template.

Make the contract match the policy — and the software match the contract

A policy manual is not a safeguard if the vendor platform ignores it. Purpose limits should appear in account permissions, sharing settings, role-based access controls, retention configurations, vendor support restrictions, and integration rules. The practical test is simple: if the policy prohibits a use, can the system still do it with two clicks? If yes, the policy needs technical enforcement.

Axon RMS June 2026 release notes discussing physical-table read access for replication accounts are a reminder that routine product updates can change what a vendor can reach inside a records system — which is why contract language on data access should be reviewed at renewal, not just at procurement.

Require audit logs that elected officials can actually read

Audit logs should not be symbolic. Useful logs capture who searched, what agency they represented, what documented purpose they gave, whether a case number or legal process existed, what result was returned, and whether the data was exported or shared. Public audit reporting should protect sensitive investigative details, but it should still give elected officials and residents enough information to evaluate whether the system is being used as promised.

Keep identity and movement data from becoming permanent trails

Age-verification systems, account-linking tools, location analytics, ALPR networks, and device-signal systems should minimize data by design. A system built to answer a narrow question — such as whether a user meets an age threshold or whether a vehicle is connected to a specific investigation — should not create a permanent identity or movement trail. Good safeguards include short retention, no secondary use, no vendor reuse for advertising or product development, no unnecessary biometric or government-ID retention, and independent security review.

Before approval, renewal, or expansion, ask:

• What data is collected, and what data is deliberately not collected?
• How long is it retained, and who can search it?
• Can outside agencies, federal agencies, or immigration-enforcement agencies access it directly or indirectly?
• What can the vendor see, change, export, or use for support, training, demos, or product development?
• Are searches logged with user, agency, purpose, case number, result, and sharing activity?
• Are audit results published in a usable public format?
• Do the policy, contract, and system configuration require the same safeguards?
• Who approves new integrations, AI features, sharing settings, or platform expansions?
• What happens if the vendor changes the product after approval?

Bottom line: The best safeguards this week are disciplined ones: define access before deployment, make the contract match the policy, make the software enforce the contract, log every search, publish usable audit results, and collect less data than the technology makes possible. Surveillance oversight works best when restraint is built into the system before the data becomes too useful to give up.

“What a person knowingly exposes to the public, even in his own home or office, is not a subject of Fourth Amendment protection. But what he seeks to preserve as private, even in an area accessible to the public, may be constitutionally protected.”
— Justice Potter Stewart, Katz v. United States (1967)