Privacy Advisory Commission - Thursday February 4, 2021

I have read through the two documents on ALPRs presented to the Commission for our meeting on February 4, 2021:
        "OAKLAND POLICE DEPARTMENT - Surveillance Impact Use Report for the Automated License
	Plate Reader"
and
        "DEPARTMENTAL GENERAL ORDER I-12: AUTOMATED LICENSE PLATE READERS"

The DGO completely ignored the clearly stated concerns of the PAC at the January meeting
regarding data retention criteria.  We specifically objected to items "(c) Research,
(e) Training and (f) Other Departmental Need" as being allowable, as they are loopholes
big enough to drive a Bearcat filled with a SWAT Team through.  The inclusion of these
items in the face of our strong objections indicates to me either incompetence or deliberate
intent on the part of those who created the document.

Data retention and data sharing are extremely important, since under normal use, about 100,000
reads of license plates are captured each month, out of which only about 2 may be related to
criminal or civil investigation (and 99,998 are not). Legislation is being introduced in
Sacramento to limit the retention of ALPR data for which no 'hits' are recorded to 24 hours,
yet OPD prefers to argue to hold on to these data for 24 MONTHS! Their own data show that a
very very small number of database enquiries happen after 2 months (and no data were presented
to show whether the enquiries that were done were either useful or effective).

Data sharing policies are crucial to limiting privacy harm from this vast data collection.
Unfortunately experience and history have shown that any data that are collected WILL be
misused.  In specifying access to the collected data we get the bland, vague "law enforcement
agencies".  Nowhere is this clarified. The collected data could go to any "law enforcement
agency", perhaps even to another country, but certainly no jurisdictional specifications are
given.  Careful reading of the "Restrictions on Use" (B-2)-1 could be used to authorize almost
anyone to have access.  There are no statements regarding the retention policies of those to
whom we may transfer data, so even if OPD has a fixed time retention policy, data could be
given to an agency that would keep those data forever.

ALPRs are a costly and invasive technology.  The Impact Use Report lists a grand total of 5
cases for the year 2020 where ALPR played a "pivotal" role. The funds for ALPRs mentioned in
this document come to approximately $400,000. Along with annual costs, this will come out to
over $50,000 per year, so the ROI is around $10,000 per case? The pie chart which is presented
for data retention shows all of 13 database accesses for data collected in the current month
and an additional 5 for the previous month, possibly making another 18 uses for querying
hundreds of thousands of normal personal activity. This does not make a case for data
retention measured in months. The document does contain the self-serving analysis by the
City Attorney trying to justify a 730 day retention but then admits that MAYBE they could
somehow do 12 months.  I am not a lawyer, but I would certainly want a second opinion.


The DGO also has statements which I would most charitably characterise as misleading:

"(A-1) ALPR technology works by automatically scanning license plates on vehicles that are
publicly visible" (Impact use report) "in the public right of way and/or on public streets"
yet it is asserted that "because such data contains investigatory and/or confidential
information, it is not open to public review".  This is inherently contradictory, as hundreds
of thousands of license plate images from the public streets cannot be characterised as
invstigatory or confidential.

With regard to its use "more intensely in certain areas", the fact that the ALPRs are not
affixed to poles or structures is irrelevant. Patrol cars do not cover the city uniformly.
I don't believe that I have seen a patrol car pass my house in the hills more than twice
last year.

ALPRs certainly can be useful tools for OPD and it should be possible to work out policies and
procedures that enable usefulness while protecting privacy. These documents do not.

Lou Katz
Commissioner, District 4