Most people don’t think much about how the City buys technology. But some of the tools cities now use — cameras, license plate readers, drones, data dashboards — can quietly record where you go, who you’re with, and what you do, long before anyone suspects you of anything. Once a city owns a system like that, what it can do tends to grow over time through software updates and new features, often without anyone outside the vendor noticing.
I’ve submitted two documents to the Bend City Council that are meant to put residents back in control of that process: a Surveillance Technology Accountability, Privacy, and Civil Rights Ordinance and a companion Surveillance Procurement and Contracting Framework. Here’s what they would actually do for the people who live here.
You get a say before the City buys surveillance tools
Under the proposed ordinance, no City department could acquire, borrow, pilot, subscribe to, or deploy surveillance technology without prior City Council approval at a public hearing — with the required reports released at least 30 days in advance so residents can read them and weigh in. That approval has to be specific: approving one tool doesn’t automatically approve another, approving hardware doesn’t approve hidden software features, and any ambiguity is resolved in favor of requiring public approval. The decision about whether Bend adopts a surveillance tool belongs to the community and its elected representatives — not to a vendor’s sales pitch or a quiet administrative purchase.
Surveillance can’t quietly expand after it’s approved
One of the biggest real-world risks is “mission creep” — a system bought for one narrow purpose gradually gaining new powers through updates, add-on analytics, or AI modules. The ordinance treats any meaningful expansion as a “material change” that requires fresh public approval, and it specifically says automatic, vendor-pushed, or bundled updates can’t switch on capabilities the public never approved. A camera approved as a camera doesn’t silently become a facial-recognition system.
Protected and private activities are shielded
The ordinance bars using surveillance to monitor or map constitutionally protected activity — protest, worship, journalism, labor organizing, political activity, legal advocacy — absent a warrant. It also protects “sensitive locations”: medical and reproductive care facilities, addiction-treatment centers, domestic-violence shelters, immigration legal-aid offices, libraries, newsrooms, polling places, and places unhoused residents rely on for shelter and survival. The City couldn’t build registries, heat maps, or profiles tracking unhoused people or anyone’s visits to these places.
Your data can’t be sold or fed to corporate AI
The rules prohibit the City — and its vendors — from selling, renting, or commercially exploiting surveillance data, and from using residents’ data to train or improve a vendor’s products or algorithms. They also bar using City surveillance for civil immigration enforcement except where the law specifically requires it. Data collected about Bend residents stays in service of Bend residents.
The City — not a private company — holds the keys
A system being “encrypted” doesn’t mean it’s secure if the vendor can still read the data. The ordinance requires that sensitive stored police data use “Exclusive Agency Key Control,” meaning no vendor, cloud host, or subcontractor can unilaterally decrypt it. License plate data that isn’t a hit gets automatically deleted within 72 hours, hot-list entries expire quickly, and bulk databases can’t be kept around for speculative future use.
Real accountability you can check
Every access to sensitive surveillance data has to be logged. High-risk programs get independent annual audits, and the City must publish an annual public report covering how often tools were used, how many searches were run, any misuse or breaches, and any expansions proposed or discovered. There’s a public complaint process, automatic suspension when something goes seriously wrong, and a hard rule that no existing contract is grandfathered in forever — legacy systems have to be brought into compliance or discontinued.
The companion framework makes the promises stick
Strong policy can still be undermined by weak contract language buried in vendor agreements. The Procurement and Contracting Framework translates these principles into the actual contracts: baseline terms requiring City ownership of data, no secondary vendor use, no silent feature activation, audit rights, deletion certification, and renewal conditioned on compliance — with even stronger terms for high-risk technologies. It also gives the City practical tools to review the contracts it already has, so the protections aren’t just aspirational.
The bottom line
None of this stops Bend from using technology that genuinely serves public safety. What it does is make sure that when surveillance tools are used, the public knew about it, approved it, can see how it’s working, and can shut it down if it’s misused. It puts residents — not vendors, and not default settings — in charge of decisions that affect everyone’s privacy and civil liberties.
Leave a Reply