Two weeks ago, the Bend Privacy Alliance didn’t have a Facebook group, a public petition, or a community showing up to two government meetings on the same day. Today we do. Here’s what happened, what it produced, and where we go from here.
How it started
In mid-May, Deschutes County quietly scheduled a vote on Contract No. 2026-0327 — a five-year, $2,412,669 agreement with Axon Enterprise for body-worn cameras, Tasers, and fleet cameras for the Deschutes County Sheriff’s Office. The contract included the Axon Fleet 3, a camera with integrated license plate reader capability, along with Auto-Tagging and Auto-Transcribe software licenses. The two-page staff report said nothing about whether the ALPR capability would be activated or what policy would govern it.
We submitted written comment. The Board deferred the item. A second meeting was scheduled for June 3.
In the two weeks between those dates, the campaign grew beyond one person with a laptop.
The numbers
Combined views across Reddit and jonathanwestmoreland.com reached approximately 100,000 over the two-week period — roughly 70 percent from Reddit, 30 percent from the website. A Facebook group dedicated to the campaign reached 71 members in about a week. Someone independently built a website on the topic, unconnected to this organization — a sign the issue had taken on a life of its own.
None of those numbers include shares from other groups, organic Facebook reach, or the petition signatures. We can’t fully measure what we started.
June 3 — the county
Seven people spoke at the Deschutes County BOCC meeting — four in person, three online. Written comment submitted before the meeting addressed six specific asks grounded in Oregon law and the contract itself:
- Confirmation of whether ALPR capability would be activated
- A published SB 1516-compliant ALPR policy before deployment
- Board-level authorization required for ALPR activation
- A written SB 1587 attestation from Axon
- Production of the missing Data Processing Agreement
- A status report on all seven recommendations from the December 2025 Internal Audit
Of those six asks, four were addressed. The Board adopted a meaningful condition: the Fleet 3’s integrated ALPR capability may not be activated unless DCSO returns to the Board for a separate authorization vote. That condition did not exist before this campaign raised the issue.
On SB 1587, Axon’s attorneys stated through DCSO that Axon does not meet Oregon’s definition of "data broker" — meaning the law’s attestation requirement, in their view, does not apply. That is Axon’s legal position, not a judicial or agency determination. It will be revisited.
The audit status report was not addressed.
The contract passed unanimously.
One more detail worth noting: the Data Processing Agreement — the governing document for how Axon handles all footage and metadata under the contract — was not in the Board’s original packet. It was transmitted to BOCC staff at 8:07 AM the morning of the vote and handed to attendees as a printed paper document before the meeting began. The Board voted on a $2.4 million contract without having seen that document during their review period. That procedural gap is now on the record.
June 3 — the city
Eight people spoke in person at Bend City Council that evening, with two online. Speakers raised surveillance technology oversight broadly, called for policy before deployment, and named a surveillance ordinance as a goal. The Council committed on the record that any stationary ALPR expansion will come before them for a vote and public comment.
The petition filed under Bend Code 1.30.005(C) requesting Council review of Police Department Policy 428 — the department’s ALPR policy — was submitted the same day and confirmed received by the City Recorder.
Policy 428 governs ALPR use by Bend PD, which has deployed the Axon Fleet 3 in more than 70 patrol vehicles since July 2023. The petition asks the Council to review whether the policy meets the requirements of SB 1516, which took effect March 31, 2026.
What the contract review found
A full review of the contract packet produced findings the staff report never disclosed.
The Axon Service Level Agreement gives Axon authority to push firmware updates to all devices — body cameras, fleet cameras, Tasers — without DCSO authorization. The same SLA defines "Axon Cloud Services" to include Fusus, Axon’s real-time crime center platform. The staff report mentioned neither.
The privacy notice attached to the contract designates Axon as the independent Data Controller — not DCSO — for all operational metadata generated under the contract. Oregon’s own State Chief Information Security Officer confirmed in writing that Axon holds the encryption keys to all data stored on its platform, not the agency. At the meeting, DCSO cited Axon’s SOC 2 Type II certification in response. SOC 2 audits whether a vendor’s controls work as the vendor describes them — it does not require end-to-end encryption and does not address who controls access to data under a federal legal process. The CISO’s finding stands unrebutted.
Primary source documents from this proceeding — the BOCC meeting packet, the December 2025 Internal Audit, and the Oregon State CISO letter — are in the source library at jonathanwestmoreland.com/source-library-bend-surveillance-oversight.
What comes next
The city fight is the longer one. Bend PD’s ALPR system has been operating in more than 70 patrol vehicles for nearly three years. The Council’s commitment to a public vote before any stationary ALPR expansion is an important line. Holding it requires the governance framework to be in place before the next technology decision arrives.
The next steps are: understanding the full inventory of surveillance technology Bend PD currently operates, completing the surveillance ordinance and procurement framework, and bringing both before the Council.
That work is underway.
More to come.
Leave a Reply