jonathanwestmoreland.com

Tag: data retention

  • What Reasonable Safeguards Would Look Like in Bend

    What Reasonable Safeguards Would Look Like in Bend

    Part 9 of the Bend Surveillance Oversight series.

    This does not have to be a yes-or-no fight over police technology.

    Bend can support legitimate public safety tools while still requiring strong public oversight.

    The real question is not whether technology should ever be used.

    The real question is whether powerful systems are governed by clear public rules before they expand.

    Body cameras, fleet cameras, ALPRs, drones, traffic enforcement cameras, digital evidence systems, AI tools, and real-time information platforms all raise different questions.

    But they also share a common issue:

    They collect, store, search, analyze, or share public data.

    That means Bend should have a citywide surveillance technology policy.

    Not a vague promise.

    Not vendor assurances.

    Not scattered contract language.

    Not internal rules that residents cannot easily find.

    A clear public framework.

    1. Public inventory of surveillance technologies

    Bend should publish a plain-language inventory of all police surveillance technologies.

    That inventory should identify:

    • the technology name,
    • the vendor,
    • the department using it,
    • the purpose of the system,
    • what data it collects,
    • where the data is stored,
    • how long the data is retained,
    • who can access it,
    • whether outside agencies can access it,
    • whether vendors or subcontractors can access it, and
    • whether any AI, biometric, analytics, or automated decision features are enabled or available.

    Residents should not need to search scattered agendas, contracts, staff reports, and vendor documents to understand what systems exist.

    2. Council approval before acquisition or expansion

    Bend should require Council approval before any department acquires, renews, expands, or materially changes surveillance technology.

    That should include new tools, new vendors, major software modules, AI features, biometric capabilities, data-sharing expansions, and contract amendments that materially change what a system can do.

    Public approval should happen before deployment, not after the system is already operating.

    3. Public use policy before deployment

    Every surveillance technology should have a public use policy before it is deployed.

    That policy should explain:

    • the approved purpose,
    • allowed uses,
    • prohibited uses,
    • data collection rules,
    • retention rules,
    • access rules,
    • sharing rules,
    • audit procedures,
    • disciplinary consequences for misuse, and
    • how residents can find annual reports.

    The public should be able to read the rules before the technology is used.

    4. Short retention for non-evidence data

    Data retention should be limited.

    For non-evidence data, the default should be deletion after a short period unless the data is tied to a specific, documented case.

    For ALPR data, I would support a default rule like this:

    Non-hit ALPR data should automatically delete within 72 hours unless it is tied to a documented case, warrant, stolen vehicle, active investigation, or legally valid evidentiary need.

    Short retention allows legitimate use while reducing the risk that ordinary residents’ movements become long-term searchable records.

    5. Logged searches with case numbers

    If a system can be searched, every search should be logged.

    The log should identify:

    • who searched,
    • when they searched,
    • what they searched,
    • why they searched,
    • the case number or incident number,
    • whether the search produced a result, and
    • whether the result was shared.

    Search logs protect the public from misuse.

    They also protect officers who use the system properly.

    6. Limits on federal, out-of-state, private, and vendor access

    Local surveillance data should not become outside-agency data by default.

    Bend should limit access by federal agencies, out-of-state agencies, private companies, vendors, subcontractors, fusion centers, and other third parties.

    Access should require a documented purpose, legal authority, written authorization, and an auditable record.

    Broad sharing, informal access, and bulk access should be prohibited unless explicitly approved through a public process and consistent with law.

    7. No facial recognition or biometric identification without explicit approval

    Bend should prohibit facial recognition, biometric identification, biometric analytics, or similar identity-matching tools unless Council explicitly approves them after public notice, public debate, legal review, and technical assessment.

    If a system is technically capable of biometric analysis but the City says the feature is disabled, that should be independently verified.

    Disabled features should not become active through a quiet software update or vendor configuration change.

    8. AI report-writing rules

    If Bend ever uses AI to help draft police reports, the City should require strict auditability.

    The basic rule is simple:

    No AI-generated police report without an audit trail.

    That means preserving original AI drafts, officer edits, source transcripts, timestamps, final reports, supervisor edits, and disclosure that AI was used.

    Prosecutors and defense attorneys should be able to obtain relevant records through normal legal processes.

    9. Independent technical audits

    Bend should not rely only on vendor assurances.

    The City should require independent technical audits of surveillance systems.

    Audits should verify:

    • enabled features,
    • disabled features,
    • retention settings,
    • sharing settings,
    • access controls,
    • security controls,
    • vendor access,
    • subprocessor access, and
    • compliance with City policy.

    Trust is strongest when systems can be independently checked.

    10. Annual public transparency reports

    Bend should publish annual surveillance transparency reports.

    Those reports should include:

    • what systems were used,
    • what new systems were acquired,
    • how many searches occurred,
    • how many outside requests were received,
    • how many requests were approved or denied,
    • how many audits were performed,
    • whether misuse was found,
    • whether any new features were activated,
    • whether policies changed, and
    • what the total annual costs were.

    Transparency reports do not need to reveal sensitive case details.

    They should provide enough aggregate information for residents and elected officials to know whether the rules are working.

    11. Contract terms that match public policy

    Contracts should not undermine policy.

    If Bend adopts public rules, vendor contracts should match those rules.

    Contracts should prohibit vendors from changing settings, enabling features, expanding sharing, using data for product development, or using local public safety data for AI training unless the City explicitly approves it through the required public process.

    Good policy should be backed by enforceable contract language.

    12. Public review before renewal

    Surveillance technology should not renew automatically without public review.

    Before renewal, the City should publish a report explaining how the system was used, whether it met its stated purpose, what it cost, whether misuse occurred, whether audits were completed, and whether stronger safeguards are needed.

    Renewal should be a public decision, not an automatic default.

    The basic framework

    A reasonable Bend surveillance policy could be summarized like this:

    • Tell the public what systems exist.
    • Require approval before expansion.
    • Limit retention.
    • Log searches.
    • Restrict sharing.
    • Control vendor access.
    • Ban biometric use without explicit approval.
    • Audit AI tools.
    • Verify systems independently.
    • Report to the public every year.

    That is not anti-police.

    That is responsible governance.

    Powerful public safety tools should answer to public rules.

    Further reading

    Series links

  • ALPRs: License Plate Scans Are Location Records

    ALPRs: License Plate Scans Are Location Records

    Part 6 of the Bend Surveillance Oversight series.

    An automated license plate reader does not just capture a plate number.

    It creates a time-and-place record.

    And when many scans are collected over time, those records can reveal patterns about where a vehicle has been, when it was there, and how often it appeared in certain places.

    That is why ALPR data should be treated as location data.

    It is not “just a plate.”

    It is a record of movement.

    What an ALPR scan actually records

    An ALPR system typically captures:

    • the license plate number,
    • the date and time of the scan,
    • the location of the camera,
    • an image of the plate or vehicle, and sometimes
    • additional metadata about the scan.

    One scan by itself may not say much.

    But multiple scans over time can create a much richer picture.

    If a vehicle is scanned near a home, workplace, school, clinic, place of worship, political event, protest, or support meeting, the scans may reveal sensitive patterns about a person’s life.

    That is why ALPR data deserves careful limits.

    Patterns matter more than single scans

    The privacy issue is not only the plate number.

    The privacy issue is the pattern.

    A series of scans can show where a vehicle travels, how often it visits certain places, what route it takes, when it leaves, when it returns, and whether those movements change over time.

    That is a form of location tracking.

    Even if each individual scan appears routine, the system as a whole can become highly revealing.

    That is why retention periods, search rules, and sharing rules matter so much.

    This post does not claim Bend currently uses fixed ALPR technology

    This post does not claim that Bend currently uses fixed automated license plate reader technology.

    The point is broader: if Bend adopts fixed ALPRs in the future, or if related systems create similar location records, the City should have clear rules in place before deployment.

    Oversight should come first, not later.

    Short retention should be the default

    If ALPR data is retained for long periods, it becomes easier to reconstruct a person’s travel history.

    The longer the data is kept, the more it can be searched, shared, or misused later.

    A reasonable rule would be:

    Delete ALPR scans quickly unless they are tied to a legitimate, documented case.

    I would support a default retention period as short as 72 hours unless the scan is associated with a specific investigative need such as a stolen vehicle, warrant hit, active case, or clearly documented law enforcement purpose.

    That kind of rule allows legitimate use while reducing unnecessary long-term accumulation.

    Every search should be logged

    If ALPR data can be searched, every search should leave a record.

    That record should show:

    • who conducted the search,
    • when it was conducted,
    • what plate or data was searched,
    • the case number or incident number,
    • the reason for the search, and
    • whether the results were shared.

    Without logs, the public has to trust that the system is being used properly.

    With logs, the City can verify that the rules are being followed.

    Sharing should be limited and documented

    ALPR data should not flow freely to outside agencies, vendors, private companies, or federal systems without clear public rules.

    A strong policy would require:

    • a specific legal basis for sharing,
    • a documented case-related purpose,
    • written authorization,
    • an auditable record of what was shared and with whom, and
    • clear limits on bulk or informal access.

    The issue is not whether legitimate case-specific sharing can occur.

    The issue is whether local location data becomes broadly accessible by default.

    Public reports build trust

    If Bend ever uses ALPRs, the City should publish annual public reports showing:

    • how many cameras or systems were used,
    • how many scans were collected,
    • how long data was retained,
    • how many searches were conducted,
    • how many shares occurred,
    • how many outside-agency requests were received,
    • how many requests were granted or denied, and
    • whether any misuse or policy violations were found.

    These reports do not need to expose sensitive investigative details.

    They should provide enough information for residents and elected officials to understand how the system is working.

    The basic principle

    An ALPR scan is not just a plate number.

    It is a location record.

    And location records deserve strong safeguards.

    Short retention. Logged searches. Clear sharing limits. Public oversight.

    Those are not extreme demands.

    They are basic rules for a powerful system.

    Further reading

    Series links

  • What Happens to the Data?

    What Happens to the Data?

    Part 4 of the Bend Surveillance Oversight series.

    When people talk about police cameras, the conversation often focuses on the camera itself.

    But the camera is only the beginning.

    The more important question is what happens after data is collected.

    • Where does the video go?
    • Who stores it?
    • How long is it kept?
    • Who can search it?
    • Can it be shared?
    • Can vendors access it?
    • Can outside agencies access it?
    • Are searches logged?
    • Can the data be used later for a different purpose?

    These are the questions that turn a camera discussion into a public oversight discussion.

    Collection is only step one

    A body camera, vehicle camera, drone, traffic camera, or license plate reader may collect video, audio, images, license plate data, metadata, location information, timestamps, or other records.

    But collection is only the first step.

    After that, data may be uploaded to cloud storage, attached to case files, searched by officers, shared with prosecutors, retained for years, reviewed by supervisors, exported for court, or combined with other systems.

    A technology policy that says “we use cameras” is not enough.

    The real policy should explain what data is collected, where it is stored, how long it is retained, who can access it, when it can be searched, whether searches require a case number, whether searches are audited, whether vendors can access it, whether outside agencies can access it, whether data can be used for AI training or analytics, and whether new uses require public approval.

    Cloud storage changes the oversight question

    Many modern police technology systems rely on cloud storage and vendor-managed software.

    That can be useful.

    Cloud systems can make evidence easier to organize, share, redact, and preserve.

    But cloud storage also changes the oversight question.

    If public safety data is stored in a vendor-controlled system, residents should know what contractual rules apply.

    They should know whether the City owns the data, whether the vendor can access it, whether subcontractors are involved, whether data is encrypted, and whether the City can independently verify how the system is configured.

    This is why public policy should not rely only on verbal assurances.

    The City should publish the actual rules.

    Retention matters

    Retention is one of the most important privacy questions.

    A camera that records something and deletes it quickly is very different from a system that keeps searchable records for months or years.

    The longer data is kept, the more it can be searched later, shared later, misused later, breached later, or repurposed later.

    For Bend, a reasonable policy would be:

    Delete non-evidence data by default after a short period unless it is flagged for a specific, documented case.

    For ALPR data, I would support a default deletion period as short as 72 hours unless the scan is tied to a legitimate case, hit, warrant, stolen vehicle, or documented investigation.

    Search logs should be mandatory

    If a police technology system can be searched, the search should leave a record.

    That record should show who searched, when they searched, what they searched, why they searched, the case number or incident number, whether the search produced a result, and whether the result was shared.

    Without search logs, the public has to trust that the system is only being used properly.

    With search logs, the City can verify whether the system is being used properly.

    This protects the public.

    It also protects officers who are using the system appropriately.

    Sharing rules should be explicit

    Data-sharing rules should not be vague.

    A policy that says data may be shared “for law enforcement purposes” may sound reasonable, but it can be very broad.

    A stronger policy would say that surveillance data may not be shared with federal agencies, out-of-state agencies, private companies, or other third parties unless there is a specific legal basis, a documented case number, written authorization, and an auditable record.

    The point is not to prevent legitimate case-specific cooperation.

    The point is to prevent broad, informal, or automatic access to local surveillance data without clear public rules.

    Vendor access should not be a black box

    Vendor access is also a form of third-party access.

    If a private company hosts police data, manages software, provides analytics, troubleshoots systems, stores video, or controls user permissions, the public should know what limits apply.

    Vendor access should be limited, logged, and auditable.

    Contracts should make clear that vendors cannot use local public safety data for unrelated purposes, product development, AI training, or secondary analysis without explicit public approval.

    Public reports build trust

    The City should publish annual transparency reports for police surveillance systems.

    Those reports should include:

    • what systems were used,
    • how many searches were conducted,
    • how many times data was shared,
    • how many outside-agency requests were received,
    • how many requests were approved or denied,
    • how many audits were conducted,
    • whether any misuse was found,
    • whether any new features were activated, and
    • whether any policies changed.

    These reports do not need to expose sensitive case details.

    They should provide enough aggregate information for residents and elected officials to understand whether the rules are working.

    The basic principle

    The goal is not to prevent every use of technology.

    The goal is to make sure powerful tools answer to public rules.

    A camera policy should not stop at collection.

    It should follow the data.

    Where it goes, how long it stays, who can search it, who can share it, and how the public can verify the rules are being followed.

    Further reading

    Series links

  • This Is Not Just About Cameras

    This Is Not Just About Cameras

    Part 1 of the Bend Surveillance Oversight series.

    Most people hear “police cameras” and imagine a simple device: a body camera on an officer, a camera in a patrol car, or a license plate reader mounted near a road.

    Cameras are a tool of modern policing, but modern policing was never just about cameras.

    They are often part of a much larger technology ecosystem involving cloud storage, evidence management software, artificial intelligence tools, automated license plate readers, vehicle cameras, drones, real-time crime center platforms, third-party vendors, and future software features that may be added after the original purchase.

    That distinction matters.

    A camera records what happens in front of it. A connected surveillance system can collect data, store it, search it, analyze it, share it, and combine it with other systems. Once that happens, the public policy question changes.

    The question is no longer only:

    Should police have cameras?

    The better question is:

    What rules govern the data those cameras create?

    For example:

    • Where is the data stored?
    • How long is it kept?
    • Who can search it?
    • Are searches logged?
    • Can outside agencies access it?
    • Can vendors access it?
    • Can new AI or biometric features be activated later?
    • Does the City Council have to approve expansions?
    • Are residents told when capabilities change?

    These are not anti-police questions.

    They are basic public oversight questions.

    Body cameras, patrol vehicle cameras, and evidence systems can serve legitimate public safety and accountability purposes. But when those systems are connected to vendor-controlled cloud platforms, AI tools, automated license plate readers, and broader data-sharing networks, the public deserves clear rules before the technology expands.

    This is especially important because cities often start with one tool and later add more tools from the same vendor.

    A city may begin with body cameras, then add fleet cameras, then cloud evidence storage, then license plate readers, then drones, then AI report-writing tools, then real-time crime center software.

    Each step may be presented as a small upgrade.

    But together, those upgrades can create a powerful surveillance infrastructure.

    That is why the issue is not just the camera.

    It is the ecosystem.

    Bend residents should not have to dig through dense procurement packets, legal agreements, and technical appendices to understand what surveillance tools are being used or considered.

    The City should provide a plain-language public inventory of police technology systems, including hardware, software, cloud storage, AI tools, third-party vendors, data retention rules, data-sharing rules, audit procedures, and any future capabilities that can be activated through software.

    This does not require the City to abandon useful technology.

    It simply requires public oversight to keep pace with the technology being purchased.

    Before Bend expands police surveillance systems, residents should be able to answer a simple question:

    Are these tools governed by clear public rules, or are we relying mostly on vendor assurances and internal department policies?

    That is the conversation Bend should have now, before the system becomes larger, more expensive, and harder to change.

    Further reading

    Series links