minneapolis alpr public comment on temporary classification to ipad

Tony WebsterP.O. Box 11394

Minneapolis, MN 55411Phone 612-223-7776Fax 612-568-5994

[email protected]@tonywebster.com

________________________________________________________________

January 30, 2013

VIA E-MAIL

Commissioner Spencer Cronk

Minnesota Department of Administration

201 Administration Building

50 Sherburne Avenue

Saint Paul, MN 55155

Re: Public Comment on Temporary Classification of Government Data

Data obtained by law enforcement with Automated License Plate Readers (ALPR)

Dear Commissioner Cronk:

I’m writing with a public comment on the Application for Temporary Classification of

Government Data submitted by the City of Minneapolis and received by your o!ce on December

18, 2012, in regard to data captured by Automated License Plate Recognition (“ALPR” or

“LPR”) cameras in use by the Minneapolis Police Department (“MPD”).

Since Minneapolis Mayor R.T. Rybak and MPD administration have decided to store data

on where every vehicle drives in Minneapolis without instituting departmental policies or waiting

for the state legislature to act on issues surrounding data retention or privacy classification, I

strongly support a partial approval of a temporary classification to the extent that individual

ALPR-sourced data stored in MPD tracking databases be temporary classified as private.

Unfortunately, the City’s Application included a request for temporary classification on

several other extraneous, non-individualized points of data on MPD’s use of ALPR that—if

temporary classified by you as anything other than public—would jeopardize transparency,

accountability, and the legislative intent of the Minnesota Government Data Practices Act. The

City failed to meet the statutory requirements for an application for temporary classification on

these items. As such, I support your partial disapproval of the Application for Temporary

Classification.

A. Background on ALPR and the Minneapolis Police Department’s use of ALPR

ALPR is a method of surveillance that uses cameras permanently mounted on structures

throughout the city (“fixed cameras”), mounted on numerous moving MPD police and tra!c

control squad cars (“mobile cameras”), and possibly mounted on mobile camera trailers parked

on public property or streets ("stationary cameras"). These systems capture photographs of

vehicles and use optical character recognition technology to read mass amounts of license plate

numbers.

ALPR is incredibly useful technology when operated by an actual police o!cer in a

moving squad car, in real-time. The original intended use of ALPR was to scan license plates

against pre-defined lists of wanted criminals and stolen vehicles. The information captured by

ALPR systems is most useful in real-time, and increases o!cer safety through enhanced access to

information without looking down at a keyboard while driving.

An example of ALPR’s benefit in real-time can be seen in this public police report1:

“As [the arrested individual] drove past me, the [Automated] License Plate Reader on

my squad alerted me to the fact that the [vehicle] [the individual] was driving had stolen

plates displayed. I followed [the individual] until backup arrived and stopped him as he

pulled over ... [The individual] was taken into custody without incident. The plates on

the car were stolen in St. Paul ... I found a glass meth pipe in his pocket ...”

Public Comment on Minneapolis ALPR Data January 30, 2013 of 19

1 State of Minnesota v. Gao Yang, Case No. 27-CR-12-30457, Minneapolis Case Control No. 12-288434

There are several separate concepts to ALPR systems that should be defined: license plate

‘reads’ are when an ALPR camera captures any license plate, a ‘hit’ occurs when a license plate

number matches a pre-defined ‘hotlist’ of wanted criminals or stolen vehicles, and an ‘evidentiary

hit’ occurs when a hit results in law enforcement action like a tra!c stop or arrest.

Unfortunately, Mayor Rybak and MPD decided to log and store all license plate

reads of individuals not wanted for any crime into a central police tracking database. This

database contains photographs of vehicles, license plate numbers, dates, times, and geographical

coordinates from a GPS system. The e"ect of this was the creation of a government database of

where every vehicle in Minneapolis regularly drives and parks without having received any input

from the public, from the Minneapolis City Council, or the state legislature.

The Minnesota Government Data Practices Act (“MGDPA”, Minnesota Statutes,

Chapter 13) presumes all government data to be public unless otherwise classified, so in creating

this central police tracking database before state law could be written, Mayor Rybak and MPD

exposed all license plate reads to the public. That is, any individual could request from MPD the

location of any other vehicle.

B. MPD failed to create policies and procedures for ALPR operation and data

Law enforcement agencies around the country have adopted ALPR systems, realizing the

benefit of real-time license plate reads without storing non-hit captures of innocent drivers into

any tracking databases. Generally, when police obtain new technology and processes, procedures

and policies are created guiding the use of that technology. The Minneapolis Police

Department’s policy manual as posted on the City of Minneapolis website includes no references

to ALPR technology, and MPD maintains no separate policies or procedures.

As a good example of a City’s responsible law enforcement leadership and policy, the

Sioux City Police Department in Iowa recently acquired ALPR cameras and created a

comprehensive Standard Operating Procedure (See Exhibit 1, “Sioux City SOP”) guiding


authorized and prohibited uses, administration, information storage, and reporting of ALPR

systems. In the Sioux City SOP:

• Policies prohibit operation of the ALPR on private property not exposed to public view,

for harassment, personal use, infringing on First Amendment rights, or solely on the basis

of a protected class;

• The submission of a form with supervisor approval is required to modify a hotlist;

• Quarterly auditing of the hotlist is required;

• Monthly reports to police administration are required as to data on manual license plate

submissions, number of hits, number of successful uses of the system, data purging

information, data dissemination information, and procedure compliance;

• Reads are not stored at all, hits are stored for 90 days, and evidentiary hits are stored for 36 months or as required by the justice system;

• ALPR hits alone are clearly defined in policy as not constituting a reasonable suspicion or

probable cause for a stop;

• Law enforcement action taken as a result of a hit are required to be documented.

These policies allow ALPR to be operated by police with the general public’s trust by

establishing clear guidelines to ensure the accountable operation of ALPR systems and Sioux City

isn’t the only city doing so2.

The only policy that the Minneapolis Police Department has instituted is a soft,

undocumented data retention policy. Initially MPD stated that they would store data captured by

ALPR systems for one year, which they later claimed to reduce to 90 days3.


2 The American Civil Liberties Union of Iowa has created a model policy for ALPR systems. See Exhibit 2, “ACLU Model Policy”

3 MPD released data on December 10, 2012, which included data from as early as August.

The Saint Paul Police Department keeps ALPR read data for 14 days, and the Minnesota

State Patrol keeps their ALPR data for only 48 hours4.

C. Potential for abuse of disseminated ALPR data

In the past several months, individuals have been able to obtain ‘read’ data via

government data practices requests of logs of everywhere a vehicle had been captured by MPD’s

ALPR tracking system. The Star Tribune reported that a vehicle repossessor had submitted a

data practices request to MPD for ‘read’ data captured on a vehicle financed by his company.

MPD released data responsive to his request — photographs, dates, times, and geographical

coordinates — and the repossessor found the vehicle at one of the locations MPD identified the

vehicle was repossessed.

Although it’s questionable that a business is using a taxpayer-funded police tracking

database for personal and business financial gain, this is perhaps an innocent example of the

potential for misuse and abuse by the public.

On December 10, 2012, I wrote to Mayor Rybak to ask him to cease the collection and

storage of ‘read’ data on people not wanted for any crime. Ceasing the storage of ‘read’ data

would not interfere with the active and real-time use of ALPR. I further asked Mayor Rybak to

submit an Application for Temporary Classification to IPAD to stop any collected ‘read’ data

from being exposed to the public. I provided Mayor Rybak with these potential privacy issues

that his ALPR tracking database has created:

• A victim of domestic abuse could have their daily activities monitored by their abuser;

• Government o!cials and diplomatic cars could be tracked as they go around the city;

• A vehicle could be located at a shelter or reproductive health center;

• An attacker or thief could target disabled persons by the special license plate formatting;


4 “Cops move to protect license plate data” Minneapolis Star Tribune http://www.startribune.com/local/minneapolis/177120451.html

• An armored or hazardous material truck’s regular route could be tracked and analyzed;

• License plates captured in police parking lots could be searched to find o!cers’ homes.

Mayor Rybak did not respond to me, nor the concerns of others. In fact, the only action

that Mayor Rybak took was in response to a Star Tribune article published August 17, 2012, which

published a map of everywhere Mayor Rybak’s city-owned car was spotted over the past year5,

which the Star Tribune obtained by making a data practices request. He then swiftly asked MPD

to “make a recommendation for a new policy about data retention,” which was simply a departure

from 12 months of storage of all ‘read’ data to 90 days of storage.

D. Data practices request for all ALPR ‘read’ data and the City’s Application for

Temporary Classification

Given Mayor Rybak’s insistence on storing ‘read’ data on individuals not wanted for a

crime in a police license plate tracking database and his further failure to protect the privacy of

residents and visitors of Minneapolis, I submitted a data practices request for the full contents of

the MPD license plate tracking database to illustrate and underscore the problem with storage of

‘read’ data.

MPD released to me and at least 13 other individuals a USB drive containing 2.1 million

tracking data points. Each record contains a license plate number, date, time, and geographical

coordinates6. In reviewing the data, I searched my license plate numbers and found my vehicles

were in the database at the precise geographical coordinates of my home, the homes of friends

and colleagues, and several restaurants and cafés that I frequent.

Plotting these points on a map, one can clearly view license plates parked at shelters,

reproductive health centers, police stations, and more.


5 Star Tribune: “City cameras track anyone, even Minneapolis Mayor Rybak” http://www.startribune.com/local/minneapolis/166494646.html?refer=y

6 MPD redacted the geographical locations of fixed cameras

I wrote an analysis of MPD’s ALPR data storage policy, which was covered by the

Minneapolis City Pages with the headline “MPD’s license plate data allows stalkers to track their

victims using public data,” a copy of which the City attached to their Application for Temporary

Classification made to you.

In response to the negative attention from MPD releasing these 2.1 million license plate

records, Mayor Rybak did not cease the storage of ‘read’ data but partially did what I asked,

which was to submit the Application for Temporary Classification which would immediately

protect individual data from being received and potentially misused by the public.

Regrettably, instead of only taking action to protect ‘read’ data and the privacy of innocent

drivers captured in MPD’s license plate tracking database, the City included requests for

temporary classifications on a number of extraneous non-individualized data elements. If this

data is made anything other than public, it would subvert transparency, accountability and the

legislative intent of the MGDPA.

While there is a clear and compelling reason and a su!cient legal basis to keep the

individualized ‘read’ data captured by ALPR systems and stored in central tracking databases out

of the view of the general public, there’s also an overwhelming need to preserve transparency and

accountability on the use of ALPR systems, which the City has used without guidance from the

legislature.

E. Law enforcement has several statutory avenues to preempt disclosure on a case-by-

case basis if any part of the application is disapproved

Before detailing legal basis for temporary classifications as to each element of the City’s

Application for Temporary Classification, it’s important to acknowledge that law enforcement has

broad and sweeping authority to withhold public data as criminal investigative data pursuant to

Minn. Stat. § 13.82, subd. 7; or if “...public access would be likely to endanger the physical safety

of an individual or cause a perpetrator to flee, evade detection or destroy evidence” pursuant to


Minn. Stat. § 13.82, subd. 14; or to protect identities for a variety of reasons pursuant to Minn.

Stat. § 13.82, subd. 17.

F. Legal basis to partially approve the Application for Temporary Classification for individualized ALPR reads as private data, and disapprove individualized ALPR

evidentiary hits under existing law (Request Nos. 3, 5, 6, 7)

Pursuant to Minn. Stat. § 13.06, subd. 3, an application for temporary classification

“...shall include and the applicant shall have the burden of clearly establishing that no statute

currently exists which either allows or forbids classification as not public; and ... public access to

the data would render unworkable a program authorized by law.” Additionally, “[the] applicant

must also clearly establish that a compelling need exists for immediate temporary classification,

which if not granted could adversely a"ect the health, safety, or welfare of the public, or the data

subject’s well-being or reputation.”

To that end, the City’s Application for Temporary Classification as it relates only to

individualized ALPR reads speaks for itself and includes a number of statutory references as

su!cient legal basis to find that read data be classified as private data on individuals.

Additionally, there are a number of situations as identified above and in the City’s Application

that without question adversely a"ect the health, safety, or welfare of the public.

I respectfully request that you find that individual ALPR ‘read’ data that identifies an

individual license plate number in combination with a date, time, number of times a vehicle was

captured by ALPR systems within a period of time, camera device number or identifier, location

data, pictures of license plates, vehicles, or surrounding areas, and/or the date span of a report be

partially approved and classified as private data on individuals.

This finding and temporary classification would safeguard the privacy of individuals

against third-party data practices requests or other government disclosures, but it would preserve

individual rights as data subjects to request and inspect ‘read’ data captured by police on


themselves or their vehicles, further preserving the accountability and transparency of law

enforcement ALPR use.

However, I also respectfully request that your Findings of Facts and Conclusion define

separately the concepts of reads, hits, and evidentiary hits, and further partially disapprove the

application for individualized data on evidentiary hits, to be classified under existing law and

handed similarly to squad car video. I discuss general hits later in this public comment.

As clearly established, MPD has failed to create any policies or procedures on ALPR use

and the City’s Application for Temporary Classification did not meet the statutory requirement

to establish that “... no statute currently exists which ... forbids classification as not public.”

Evidentiary hits are hits where ‘reads’ obtained or sourced from ALPR systems were the

start to, cause, contributing factor, or other reason why a peace o!cer initiated a tra!c stop,

arrest, or law enforcement encounter. Pursuant to Minn. Stat. § 13.82, subd. 2, et seq., arrest data,

request for service data, and response or incident data are all clearly classified as public

information. It is in the interests of government accountability and transparency to ensure this

data remain public. Specifically, Minn. Stat. 13.82, subd. 2, would clearly forbid evidentiary hits

as being ‘not public data’:

“... data created by law enforcement agencies which document any actions taken by them

to cite, arrest, incarcerate or otherwise substantially deprive an adult individual of

liberty shall be public at all times ...”

There’s a compelling reason to maintain public discoverability of evidentiary hit data as

described above, as hits and the resulting law enforcement actions are (a) documentation of arrest

data, response or incident data, and/or request for service data, and (b) the single indicator of the

success and viability of ALPR as a program funded with taxpayer dollars and run by a government

agency.


I further incorporate by reference the aforementioned broad and sweeping authority law

enforcement has to withhold public data under a variety of instances on a case-by-case basis,

which further demonstrates that the City has not established “... that a compelling need exists for

immediate temporary classification ...” as it relates to evidentiary ALPR hits.

G. Legal basis to disapprove request for temporary classification on the name of a

person running a report, and the date and time of any report run from ALPR data (Request No. 1)

The City requested a temporary classification on the “date and time of any report run

from ALPR data” and “the name of the person running the report.7” There’s no valid reason to

conceal report dates and times or names of individuals running those reports. This information is

“metadata” and does not reveal any information about the contents of any report including

individualized ALPR data about specific license plates.

Reports are only generated in response to internal or statutorily-authorized requests. If

you approve the City’s request to make private individualized license plate reads private, the

contents of a report would only be accessible to police and data subjects. If evidentiary hit reads

were public, the timestamp of a report and the employee making a report would not jeopardize

individual privacy, but only serve to ensure accountability, legal discovery, and public trust.

The City failed to meet the statutory requirement to establish that “... no statute currently

exists which ... forbids classification as not public.” MPD employee names are clearly classified as

public personnel data pursuant to Minn. Stat. § 13.42, subd. 2, and under the presumption of

openness of government data, it’s in the best interests of the public to be able to discover who is

using ALPR data to preserve accountability and transparency. Additionally, the City failed to

meet the statutory requirement to establish that “...public access to the data would render

unworkable a program authorized by law...”


7 The City’s request for temporary classification on date spans of reports is addressed as individualized ALPR data.




immediate temporary classification ...” as it relates to the name of a person running a report and

the date and time of any report run from ALPR data.

As such, I respectfully request that you partially disapprove the application as it relates to

as it relates to the name of a person running a report and the date and time of any report run from

ALPR data, and require the City to rely on existing law as data classification.

H. Legal basis to disapprove request for temporary classification for non-individualized

and summary ALPR data

The City did not submit a request for temporary classification specifically on summary

ALPR data, but it’s important not to mince individualized ALPR ‘read’ data with summary data,

and to preserve the public’s right to inspect summary data.

“Summary data” is defined pursuant to Minn. Stat. § 13.02, subd. 19, as “...statistical

records and reports derived from data on individuals but in which individuals are not identified

and from which neither their identities nor any other characteristic that could uniquely identify

an individual is ascertainable.”

I respectfully request that you find in your Findings of Fact and Conclusion that summary

data based on ALPR data be classified as ‘public data.’

I. Legal basis to disapprove request for temporary classification on locations of

stationary and mobile ALPR cameras (Request No. 2)

The City’s Application for Temporary Classification included a request for temporary

classification on “the locations of any ALPR camera, whether mobile or stationary.” The City’s


procedure previous to this temporary classification was to release the location of mobile, squad-

mounted cameras but not release the location of fixed-position cameras.

This data is only on the location of cameras, and is not in relation to any specific,

individualized ALPR read or hit. To that end, the locations of fixed-position, permanently-

mounted cameras should be public.

The locations of mobile cameras is a complex subject. If an individual were to submit a

data request for the history log of all of MPD squad car ALPR location histories, it wouldn’t

reveal any information on individual vehicles, but it would allow tracking of an MPD squad car

over time. However, MPD has a GPS tracking device in each and every MPD squad car and there

is no classification on that data as it stands right now, nor was one requested in this temporary

classification.


exists which ... forbids classification as not public.” Squad car locations are covered under Minn.

Stat. §§ 13.82, subd. 3, 6. The City also failed to meet the statutory requirement to establish that

“...public access to the data would render unworkable a program authorized by law...”

J. Legal basis to partially approve and disapprove request for temporary classification

for pictures of license plates, vehicles, and areas surrounding vehicles (Request No.

6)

The City submitted a temporary classification request for “Pictures of license plates,

vehicles, and areas surrounding the vehicles.”

Pictures of license plates and vehicles are ALPR data that is individualized and if you find

that individualized ALPR read data is private, I respectfully request that you partially approve the

request for temporary classification as private data on pictures of license plates and vehicles with

respect to reads and hits, as earlier discussed.


However, I respectfully request that you partially disapprove the request as it relates to

evidentiary hits. These images and data should be classified the same way that squad car video is

classified, and that data is public.

However, the City is seeking to make areas surrounding vehicles non-public to conceal the

location of those cameras. This data should be considered along with the location of cameras and

be partially disapproved under existing law or as public data. The City failed to meet the

statutory requirements for a temporary classification.

K. Legal basis to disapprove request for temporary classification for hit information

without reference to individual ‘read’ data (Request No. 8)

The City’s Application for Temporary Classification included a request for temporary

classification for:

“Any hit information, including but not limited to, the following categories: stolen vehicle, stolen

license plate, wanted person, Canadian Police Information Center data, protection order,

missing person, violent gang and terrorist organization, supervised release, convicted sexual

o!ender registry, immigration violator files, Keep Our Police Safe (“KOPS”), Minnesota

warrants, suspended driver’s license, revoked driver’s license, canceled driver’s license,

disqualified driver’s license, Be On The Lookout (“BOLO”), Hotsheet (stolen vehicles in

Minneapolis), and sco"aw (5 or more outstanding parking tickets).”

The City’s Application for Temporary Classification is vague in requesting a temporary

classification for “any hit information.” Did the City intend to request that individual ALPR

reads resulting in hits be classified as ‘not public,’ or did the City intend to request that the ‘hot

list’ or ‘hit list’ — that is, the list of license plates that would trigger a hit — be classified as ‘not

public?’ I’ll address both.

An individualized ALPR read resulting in a hit that does not result in law enforcement

action being taken (e.g., it’s not an evidentiary hit) should be classified as private data under a


temporary classification, which is addressed earlier in this public comment. Summary data

should be public.

The ‘hot list’ or list of license plates that would trigger a hit should be disapproved and

classified according to existing law. Many of the specific categories listed in the City’s application

already have strong and clear classifications in statute and further interpreted in law enforcement

publications8 and do not require any additional temporary classification within the context of

ALPR:

• Stolen vehicle, stolen license plate

Motor vehicle registration data and driver’s license data is subject to Minn. Stat. §

168.346 and the Driver’s Privacy Protection Act (“DPPA”, 18 U.S.C. § 2721, et seq.), and

data may additionally be classified as arrest data, request for service data, or response or

incident data pursuant to Minn. Stat. § 13.82, subds. 2, 3, and 6.

• Protection orders

Data from domestic abuse no contact orders and Orders for Protection are already

classified as private data pursuant to Minn. Stat. § 299C.46, subd. 6. No additional

classification is necessary.

• Missing person

Missing persons and unidentified persons data are maintained and disseminated by the

FBI as public information to the media, and could easily be withheld by police under the

broad and sweeping discretion discussed earlier.

• Violent gang and terrorist organization

Data in the criminal gang investigative data system is classified as confidential pursuant to

Minn. Stat. § 299C.091, subd. 3, and homeland security information relating to terrorist


8 The Minnesota Bureau of Criminal Apprehension’s Integrated Search Services Business Service Description document outlines the BCA’s determinations on data classifications for several types of law enforcement data https://sps.x.state.mn.us/sites/bcaservicecatalog/Shared%20Documents/Integrated%20Search%20Services%20Business%20Service%20Description%20v1%201.pdf

organizations would be considered criminal investigative data and private pursuant to

Minn. Stat. § 13.82, subd. 7.

• Supervised releaseCriminal history data from the Bureau of Criminal Apprehension is classified as private

pursuant to Minn. Stat. § 13.87, subd. 1. Court services data is classified under Minn.

Stat. § 13.84, et seq.

• Convicted sexual o!ender registryData in the predatory o"ender registration system is classified as private data pursuant to

Minn. Stat. § 299C.093, and related data is classified pursuant to Minn. Stat. § 609.3457,

subd. 2. Criminal justice data is classified under Minn. Stat. § 13.87.

• Immigration violator filesThis data originates from the FBI National Crime Information Center (“NCIC”) and

distributed by the BCA, so it would likely be classified the same as criminal history data

under Minn. Stat. § 13.87. However, it should be noted that the City of Minneapolis has a

separation ordinance prohibiting police from engaging in immigration enforcement9 10.

• Keep Our Police Safe (“KOPS”) and Be On The Lookout (“BOLO”) data

KOPS data are “security information” and private pursuant to Minn. Stat. § 13.37, subd.

1, et seq. The KOPS system encompasses the BOLO system.


9 This data was considered by the legislature last session and it did not pass the Senate. HF 358 / SF 2433, “Immigration law enforcement noncooperation ordinances and policies prohibited, and immigration-related data use provided” https://www.revisor.mn.gov/bills/bill.php?b=house&f=HF358&ssn=0&y=2012

10 MPD stated that involving police in immigration issues “...will expose the City to significant civil liability due to the expectations of immigration enforcement which is in direct contradiction to our current policies, thereby creating an opportunity for racial profiling.” http://www.beta.mmb.state.mn.us/doc/budget/impact-note/2011/HF-358.pdf

• Warrants

Warrants are public court records. Minn. Stat. § 13.87.

• Driver’s License statusesDriver’s License statuses in and of themselves are public information (status is solely the

response “valid” or “suspended” or “revoked”). Motor vehicle registration data and

driver’s license data is subject to Minn. Stat. § 168.346 and the Driver’s Privacy

Protection Act (“DPPA”, 18 U.S.C. § 2721, et seq.).

• Hotsheet

This data is classified as arrest data, request for service data, or response or incident data

pursuant to Minn. Stat. § 13.82, subds. 2, 3, and 6. To the extent that this data contains

motor vehicle registration data, it would be subject to Minn. Stat. § 168.346 and the

Driver’s Privacy Protection Act (“DPPA”, 18 U.S.C. § 2721, et seq.).

• Sco"aw

Parking tickets and citations are public data. Minn. Stat. §§ 13.82, subd. 6; 13.87.




immediate temporary classification ...” as it relates to hot list data.

I respectfully caution the Commissioner, as the City has essentially submitted a request

for temporary classification on extremely broad and vague government ‘hotlists’ and ‘wanted’

lists without submitting any supporting detail or a basis in law.


exists which ... forbids classification as not public.” Additionally, the City failed to meet the

statutory requirement to establish that “...public access to the data would render unworkable a

program authorized by law...” Laws already exist for the entirety of the request.


L. Public policy surrounding ALPR tracking databases and retention of ‘read’ data

As an aside to the legal basis for a temporary classification of ALPR ‘read’ data, there are

major public policy issues at play in the operation of ALPR systems that may speak to the

legislative intent of the Minnesota Government Data Practices Act.

In some respects, ALPR hotlists are similar to the Transportation Security

Administration’s ‘No Fly’ or ‘Additional Screening’ lists. In maintaining a list of license plates

and investing in technology infrastructure and automation to detect and catch wanted drivers, law

enforcement is in essence creating a ‘No Drive’ list. If the TSA did not have an investigation and

redress program, travelers would be improperly inconvenienced or illegally denied travel without

any due process, policies, or procedures to correct it.

By creating the Minnesota Government Data Practices Act to ensure the right of the

public to request access to public government data, the legislature intended the MGDPA to be a

“sunshine law” to ensure accountability and public trust. Since ALPR reads, hotlist and hit data

is used as a basis for law enforcement tra!c stops and other adverse action, individuals should be

able to investigate and seek remedy to any injustices they find.

In a National Institute of Justice conference panel in 2010, Dale Stockton, Program

Manager for the Automated Regional Justice Information System in San Diego spoke of their

e"orts to expand regional ALPR tracking databases:

“We’re probably not going to have any centralized national giant bucket of license plate reader

data. It probably won’t stand the court of public opinion ... but we can develop regional sharing

capability ... [and] look beyond your region.”

Mr. Stockton described their system as “something akin to Google” for license plate

locations — “you can tell which vehicle was where, when” and “data can be pooled and queried

by multiple agencies ... feeding into a central server.”


ALPR is very new technology around the world, and especially new technology here in

Minnesota. It hasn’t been discussed by the legislature, considered in any temporary

classifications or advisory opinions in your o!ce, and there is very real and significant public

concern over the future of ALPR systems and the data they collect. The public overwhelmingly

deserves the right to make inquiry into ALPR engage in e"ective discourse and policymaking,

while preserving the individual privacy of residents and visitors to cities that use ALPR systems.

VI. Summary

I respectfully request that in your temporary classification and Findings of Fact and

Conclusions on the City of Minneapolis’ Application for Temporary Classification on ALPR data

reach the determination that:

1. The City’s request for temporary classification on ALPR ‘read’ data that identifies an

individual license plate number in combination with a date, time, number of times a

vehicle was captured by ALPR systems within a period of time, camera device number or

identifier, location data, pictures of license plates, vehicles, or surrounding areas, and/or

the date span of a report be approved and classified as private data on individuals;

2. The City’s request for temporary classification on ALPR ‘evidentiary hit’ data be

disapproved and classified according to existing law or as public data.

3. The City’s request for temporary classification on the name of a person running a report

based on ALPR data, and the date and time of any report run from ALPR data be

disapproved and classified according to existing law or as public data;

4. The City’s request for temporary classification on the locations of stationary ALPR

cameras without reference to any specific individual license plate number, and pictures of

areas surrounding a vehicle (that doesn’t identify a specific vehicle) be disapproved and


classified according to existing law or as public data;

5. The City’s request for temporary classification on the locations of mobile ALPR cameras

without reference to any specific individual license plate number or individualized ALPR

data be disapproved and classified according to existing law or as as public data;

6. The City’s request for temporary classification on pictures of license plates and vehicles

be partially approved and classified as private data on individuals with respect to

reads and hits, and be disapproved and classified according to existing law or as public data with respect to evidentiary hits.

7. The City’s request for temporary classification on hotlist data be wholly disapproved and classified according to existing law or as public data.

8. The application for temporary classification “...involves data which would reasonably be

classified by all government entities similar to the one which made the application” and

that the temporary classification a"ect all similar government entities within the State

pursuant to Minn. Stat. § 13.06, subd. 4.

I further respectfully request that you forward a copy of this public comment in full to the

Minnesota Attorney General when you submit your Findings of Fact and Conclusion in this

temporary classification to her pursuant to Minn. Stat. § 13.06, subd. 5(b).

Thank you for your consideration of this public comment. If you have any questions,

please don’t hesitate to e-mail or call.

Best regards,

Tony Webster


Exhibit 1

Exhibit 2

!!

!505 Fifth Ave., Suite 901, Des Moines, IA 50309!

www.aclu-ia.org

Subject: Model Policy: [law enforcement agency] Mobile License Plate Reader (“LPR”)

System !

Date: September 19, 2012 !!

I. PURPOSE !

The purpose of this [name of policy/order] is to establish a policy and procedures to ensure the proper use of Mobile License Plate Readers (LPR) by members of the [law enforcement agency].

!II. POLICY

!A LPR system is a computer–based system that utilizes special cameras to capture license plate information. The LPR system captures an infrared image of a license plate and converts it to a text file using Optical Character Recognition (“OCR”) technology. The text is compared to various hot lists generated by various law enforcement agencies, including the National Crime Information Center (“NCIC”) and the [law enforcement agency], and generates an alert when there is a hit. The LPR system will identify a license plate and /or a motor vehicle. The LPR system will not identify the person operating the motor vehicle. The Department may, as a separate step and for legitimate law enforcement purposes as set forth in this [name of policy/order], undertake to identify the owner of a vehicle in the event the LPR system generates an alert, such as by running the license plate number through the database of the Iowa Department of Transportation Registry of Motor Vehicles (“RMV”).

!It shall be the policy of the [law enforcement agency] that all Department members abide by the policy and procedures set forth in this [ name of policy/order] when using LPRs to scan, detect, and identify vehicles or persons of interest, thereby increasing the efficiency and effectiveness of its public safety efforts in a manner that safeguards the privacy concerns of law-abiding citizens. In addition to this [name of policy/order], the use of LPR technology by the [Name of Law Enforcement Body/Agency] shall comply with federal and state law governing criminal intelligence systems, including but not limited to Title 28, Part I, Chapter 23 of the Code of Federal Regulations as pursuant to 42 U.S.C. 3782(a) and 42 U.S.C. 3789g(c), intended to ensure conformance with the privacy and constitutional rights of individuals, as well as Iowa Admin. Code r. 661—81.4 (692), governing the purging of criminal intelligence files.!

!!!!

2 !

The LPR system shall be restricted to legitimate law enforcement uses for the purpose of furthering legitimate law enforcement goals and enhancing public safety. Such uses and goals include providing information to officers that will assist in on-going criminal investigations, crime prevention, crime detection, the apprehension of wanted persons, ensuring the safety of vulnerable individuals through the recovery of missing and endangered persons, and improving the quality of life in our community through the identification and removal of stolen, unregistered, and uninsured motor vehicles, the collection of overdue fines from parking scofflaws, and enforcement of certain parking rules and regulations.

!!!The Department shall utilize hot lists that further the above-specified goals of the LPR system where there is a legitimate and specific law enforcement reason for identifying a vehicle or a person reasonably believed to be associated with that vehicle, such as: persons who are subject to an outstanding arrest warrant; missing persons; AMBER Alerts; stolen vehicles; vehicles that are reasonably believed to be involved in the commission of a crime; vehicles that are registered to or are reasonably believed to be operated by persons who do not have a valid operator’s license or who are on the revoked or suspended list; vehicles with expired registrations; persons who are subject to a restraining order issued by a court or by the Parole Board, or who are subject to any other duly issued order restricting their movements; persons wanted by a law enforcement agency who are of interest in a specific investigation, whether or not such persons are themselves suspected of criminal activity; and when information has been received concerning a specific individual or individuals who pose a potential public safety risk to the [municipality/jurisdiction] area. !In summary the LPR system will aid officers in ensuring the safety of our community. !III. ACRONYMS AND DEFINITIONS !“Alert” shall mean a visual and /or auditory notice or alarm that is triggered when the LPR receives a potential hit on a license plate. !“Alert data” shall mean information captured by a LPR relating to a license plate that matches the license plate on a hot list. !“LPR” shall mean automated license plate reader. !“LPR data” shall mean scan files, alert data, and any other documents or other data generated by or through utilization of the LPR system. !“LPR system” shall mean the LPR camera and all associated equipment and databases. !“Hit” shall mean a read matched to a license plate that has previously been registered on an agency’s vehicle plates hot list, such as those associated with vehicles that have been stolen or that are unregistered or uninsured, vehicles wanted for specific crimes, vehicles associated with, or that may assist with the identification of, suspects involved in criminal activity, and vehicles associated with parking scofflaws.

3 !

“Hot list” shall mean data bases containing lists of license plate numbers of interest.

“Non-Encounter Alert” shall indicate to officers “Do not stop the vehicle based on this information alone. Only observe and report pertinent information to the requesting agency. “OCR” shall mean optical character recognition.

“Read” shall mean digital images of license plates and associated metadata (e.g., date, time, and geographic coordinates associated with the vehicle image capture) that are captured by the LPR system. !

“Scan file” shall mean data obtained by an LPR of license plates that were read by the device, including potential images of the plate and vehicle on which it was displayed, and information regarding the location of the police cruiser at the time of the LPR read. !IV. PROCEDURES !A. Management !The [Name of Law Enforcement Body/Agency], by and through its Chief, is solely responsible for the day-to-day operation and management of the LPR system and for all tasks ancillary to its operation and management. The Chief shall assign Department personnel to operate and manage the LPR system on a day-to-day basis. The Chief or his/her designee may assign civilian personnel (both from within and without the Department) to perform any function or duty related to the operation and management of the LPR system, including but not limited to, inventory, service, and maintenance work. !The Chief shall ensure that the LPR system is operated in conformity with this [name of policy/order] and other Department policies, procedures, rules and regulations. The Chief shall enforce this [name of policy/order] and shall act as the Department Head for all disciplinary and enforcement actions for any violations by Department personnel. !B. Operations !

1. Installation and Functioning. The LPR cameras will be mounted on a marked cruiser. The cruiser will engage in either directed patrol or random patrol depending on the assignment given. The LPR equipment will passively read the license plates of moving or parked motor vehicles using LPR optical character recognition technology and compare them against various hot lists uploaded or created by the [Name of Law Enforcement Body/Agency]. Scanned data files collected by an officer will, on an ongoing basis, be automatically uploaded from the LPR in the cruiser to the Department’s LPR server. The LPR system will not have sound recording capability.

!2. Hot Lists. Designation of hot lists to be utilized by the LPR system shall be made

by the Chief or his/her designee. Hot lists shall be obtained or compiled from sources as may be consistent with the purposes of the LPR system set forth in this [name of policy/order], which sources may include:

!a. National Crime Information Center (NCIC) Stolen Vehicle files, as available;

4 !

b. NCIC Stolen plates and Stolen Canadian plates, as available; c. NCIC Wanted persons, as available; d. NCIC Missing or Endangered person files, as available; e. NCIC Supervised Release (Federal Probationers), as available; f. NCIC Nationwide Domestic Violence Protection Orders, as available; g. NCIC Violent Gang and Terrorist Organization File, as available; h. NCIC Sexual Offender; i. RMV Records of Suspended/Revoked Registrations; j. [Name of Law Enforcement Body/Agency] Scofflaw List; k. [Municipality] Parking Permit System; and

!The Department shall regularly upload hot lists utilized by the LPR system so that these hotlists remain reasonably current.

!Whenever a license plate number is manually entered into the LPR system, the officer shall document the reason for doing so.

!!!

3. Regular Operation. The Commanding Officer on Duty will assign as staffing permits, at least one officer per shift to the police motor vehicle equipped with the LPR, which shall be utilized whenever available and operational.

!!!

4. Login/Log-Out Procedure. To ensure proper operation and facilitate oversight of the LPR system, officers assigned to the LPR vehicle shall login at the beginning of their shifts and log out at the end.

!!!!C. Authorized Usage/Police Action !

1. Authorized Users/Access. Only sworn officers trained in its use and this [name of policy/order] and who have signed the Certification contained at the end of this [name of policy/order] may operate the LPR system or access or use stored LPR data. Each authorized officer shall be issued an individual log-in ID and be required to utilize alphanumeric passwords consisting of a combination of upper and lower case letters, numbers, and symbols.

!2. Permitted/Impermissible Uses. The LPR system is the property of the [Name of

Law Enforcement Body/Agency]. Department personnel may only access and use the LPR system and may access, use, release and/or disseminate hot list and scan file data only for official and legitimate law enforcement purposes consistent with this [name of policy/order]. Only the Chief of Police may authorize dissemination outside of the [Name of Law Enforcement Body/Agency], and only to other law enforcement, for legitimate law enforcement purposes, and with the written authorization of the Chief or Chief’s designee. Written authorization must be obtained from the Chief, or designee, in advance of such dissemination, and a record of the written authorization (although not the data accessed), shall be public record.

5 !

The following uses of the LPR system are specifically prohibited: !!

a. Invasion of Privacy. Except when done pursuant to a court order, it is a violation of this [name of policy/order] to utilize the LPR to record license plates except those of vehicles that are exposed to public view (e.g., vehicles on a public road or street, or that are on private property but whose license plate(s) are visible from a public road, street, or a place to which members of the public have access, such as the parking lot of a shop or other business establishment).

!

b. Harassment / Intimidation. It is a violation of this [name of policy/order] to use the LPR system or associated scan files or hot lists to harass and/or intimidate any individual or group.

!

c. Use Based on a Protected Characteristic. It is a violation of this [name of policy/order] to use the LPR system or associated scan files or hot lists solely because of a person’s, persons,’ or group’s race, gender, religion, political affiliation, nationality, ethnicity, sexual orientation, disability or other classification protected by law.

!

d. Personal Use. It is a violation of this [name of policy/order] to use the LPR system or associated scan files or hot lists for any personal purpose.

!

e. First Amendment Rights. It is a violation of this [name of policy/order] to use the LPR system or associated scan files or hot lists for the purpose or known effect of infringing upon First Amendment rights.

!

Anyone who engages in an impermissible use of the LPR system or associated scan files or hot lists may be subject to:

!

• criminal prosecution, !

• liability, and/or !

• administrative sanctions, including termination, pursuant to and consistent with the relevant collective bargaining agreements and Department policies.

The names and sources of the hot lists (rather than their contents) utilized by the [Name of Law Enforcement Body/Agency] LPR system shall be public record.

!

3. Required Steps Preliminary to Police Action. Hot lists utilized by the Department’s LPR system may be updated by agency sources more frequently than the Department may be uploading them, and the Department’s LPR system will not have access to real time data. Further, there may be errors in the LPR’s read of a license plate. Therefore, an alert alone shall not be a basis for police action (other than following the vehicle of interest). Prior to initiation of a stop of a vehicle or other intervention based on an alert, an officer shall undertake the following:

!a. Verification of current status on hot list. An officer must receive confirmation,

from a [Name of Law Enforcement Body/Agency] Communications Dispatcher or other department computer device, that the license plate is still stolen, wanted, or otherwise of interest before proceeding.

!b. Visual verification of license plate number. Officers shall visually verify that

6 !

the license plate on the vehicle of interest matches identically with the image of the license plate number captured (read) by the LPR, including both the alphanumeric characters of the license plate and the state of issue, before proceeding.

!4. Stops. All stops of motor vehicles must be constitutionally valid and otherwise

comply with the [Name of Law Enforcement Body/Agency] policies. To assist with implementation of these obligations and in furtherance of the purposes of the LPR system, the following requirements apply to traffic stops:

!a. Completion of Preliminary Steps to Police Action. An officer must have

complied with Section IV(C)(3) of this [name of policy/order] prior to proceeding with a motor vehicle stop.

!b. Non-encounter alerts. In the event that an alert is designated as a non-

encounter alert, the officer shall follow any instructions included in the alert (e.g., notifying any applicable law enforcement agency).

!c. Persons of Interest. With regard to cases in which an alert may indicate a person

of interest (such as a wanted person), officers are reminded that in some cases, the driver or occupant of the vehicle may not be the person with whom the license plate is associated (since vehicles may be loaned, e.g.). Therefore, officers must develop a reasonable belief that the operator or occupant is the person of interest included in a hot list prior to initiating a stop (e.g., by comparing the person’s observed physical appearance with that of a physical description contained in the RMV database).

!d. Independent reason for traffic stop. An officer may stop a vehicle where he/she

has an independent reason for doing so, such as an unrelated traffic violation. !

e. Appropriate police action. Nothing in this [name of policy/order] shall restrict or prohibit an officer from taking appropriate police action based on facts or reasons obtained independently from LPR operation.

!5. Use in Connection With Serious Crimes/Incidents. The LPR should be

considered to conduct license plate canvasses in the immediate wake of any homicide, shooting, robbery, kidnapping, sexual assault or AMBER ALERT and / or other major crime or incident. Registration plates or partial plates potentially associated with any such major crimes or incidents should be entered into the LPR and compared against the scan file. Conversely, registration plate numbers may be used for exculpatory purposes (e.g., to corroborate a registrant's alibi).

!6. Mutual Aid Requests. The Chief of Police, or Chief’s designee, may approve a mutual

aid request for use of the LPR for purposes consistent with this [name of policy/order], as may be appropriate under the circumstances and as resources permit. The intent of the [Name of Law Enforcement Body/Agency] is to provide mutual aid to law enforcement from other communities when they become aware of a serious incident, as to which serious incident they reasonably believe the LPR may be useful. Examples of serious incidents include homicides, shootings, kidnappings, sexual assaults or AMBER alerts, or other serious or violent felonies as to which suspect vehicle information is

7 !

available. LPR data may be shared under this Section IV(C)(6) only as is consistent with this [name of policy/order] and to the extent necessary to supply duly approved mutual aid.

!!!D. Security/Authorized Stored Data Access/Confidentiality. !

LPR data shall be kept in a secure data storage system with access restricted to authorized persons only.

!a. Scan Files. Access to scan files will be secured and controlled by a login

password-accessible system, which shall document who accessed the information by identity, date and time. Officers may only access data stored in the LPR server based upon a reasonable belief that the scan file data may be related or useful as part of a specific official action or investigation. Requests for LPR server data access must be in writing and be expressly authorized by the Chief of Police, or designee(s), in advance of such access. Scan file data will be considered confidential information to the extent permitted by law.

!b. Hot lists. Security of the hot list data will be the responsibility of the

officer using the LPR or accessing the data. Hot list data will be considered confidential information to the extent permitted by law.

!c. Designated officers trained in the use of the LPR software shall have access

to LPR data to conduct analysis of said data in order to comply with legitimate law enforcement requests.

!E. Retention !

LPR data scan files will be retained for no longer than a period of seven (7) days, unless a longer period is required by the Department’s Evidence Policy, by court order, or by law. The files shall be recorded over thereby being deleted and are not to be stored in backup servers. Hits will be retained for no longer than necessary for legitimate law enforcement purposes.

F. Program Oversight / Evaluation / Audit Review !

1. Designated, trained personnel shall check equipment on a regular basis to ensure functionality and camera alignment. Any equipment that falls outside expected functionality shall be removed from service until deficiencies have been corrected. Officers shall not attempt to modify or change the LPR equipment or software unless authorized to do so.

!2. Damage or other malfunctions to the equipment will be reported to the

Commanding Officer on Duty or Chief of Police. !

3. All successful uses of the LPR shall be documented and forwarded to the Commanding Officer Traffic/Records Division or their designee. The Commanding Officer Traffic/Records Division, or their designee, will compile statistics of these uses and provide monthly updates on such uses to the Department's command staff. The

8 !

[Municipality City Council/ Agency Oversight Body] will be provided an audit report once per year, at twelve month intervals, which provide a complete accounting of the uses of the LPR System.

!4. The [Name of Law Enforcement Body/Agency] will be responsible for conducting,

reviewing, and retaining audits of the LPR system usage. Audits shall be completed on an annual basis and shall determine the Department’s adherence to this [name of policy/order] and the procedures it establishes, as well as the maintenance and completeness of records contemplated by this [name of policy/order]. At the completion of this audit, a full report on the outcome shall be forwarded to the [Municipality City Council/ Agency Oversight Body]. Audit reports shall be considered to be public record to the extent consistent with the Public Records Law. Audits shall include, but not be limited to, review of the following:

!a. Records of LPR operators and their LPR usage, including vehicles of interest

added to a hot list by individual officers. !

b. A listing of access to the police department's server, to include access, additions and/or searches of the scanned files, in order to verify security of that data and compliance with this [name of policy/order]. All written requests for scanned file access will be retained for comparison against this audit record.

!c. Records of sharing of LPR data pursuant to Section IV(C)(6) of this

[name of policy/order]. !

d. Records of reproduction of scan files pursuant to Section IV(G) below. !

e. Hot lists entries shall be checked to ensure entries made are in compliance with this [name of policy/order].

!5. Any officer becoming aware of a possible violation of this [name of

policy/order], including but not limited to the unauthorized access, use, release and/or dissemination of LPR data, shall refer the matter for an Administrative Investigation by the [Name of Law Enforcement Body/Agency] Office of Professional Standards [or equivalent department/office within the law enforcement agency].

!!G. Requests for Reproduction of Scan Files

!1. Authority to Request / Permissible Requests. Requests for reproduction may be

made in writing to the Chief, or the Chief’s designee, and shall be granted only for legitimate law enforcement purposes upon a documented showing of reasonable suspicion the data in question is associated with a crime in another jurisdiction, as part of normal procedures for investigations and the handling of evidence or in furtherance of the purposes for the LPR system stated in this [name of policy/order].

!

2. Prompt Request. All requests to reproduce a scan files shall be made promptly and in any event as soon as possible to ensure that needed data is available.

!

3. Reproduction Responsibility / Evidence. The [Name of Law Enforcement

9 !

Body/Agency] shall be solely responsible for making reproductions of scan files. It shall make two copies of any reproduction. One copy shall be logged into the evidence system following the Department’s Evidence Policy and shall be maintained in a manner consistent with the Evidence Policy and with maintaining the chain of custody for evidentiary materials. The second copy shall be reproduced to the requesting party utilizing the procedure described in Section IV(G)(4) below. The [Name of Law Enforcement Body/Agency] shall document all requests for copies of scan files.

!

4. Reproduction Request Procedures. !

a. Authorized Department Requests (see Section IV(G)(1) above): !

A scan file request may be made by submitting a completed Scan File Request Form to the [Name of Law Enforcement Body/Agency]. Only the Chief, or Chief’s designee, may authorize disclosure of a copy of scan files to any federal, state, or municipal law enforcement agency in connection with an open investigation. Reasonable suspicion that the data included in the scan file is related to a crime must be documented in writing to the Chief on the Scan File Request Form.

!

b. Court-Related Requests (e.g., Prosecutors, Defense Attorneys, Judges): !

Court-related request may be made by submitting a completed Scan File Request Form to the appropriate Department court liaison (for the applicable court), who shall forward a copy to the Chief’s Office, who shall send a copy of the requested reproduction to the court liaison, who shall send it to the requesting party.

!

c. Subpoena: !

Except in connection with an open investigation as set forth in Section IV(G)(4)(a) above, by submitting a completed Scan File Request Form to the Department’s Records Division, with responsibility for the reproduction falling to the Chief’s Office.

!

10 !

!

!

!

CERTIFICATION UNDER [LAW ENFORCEMENT AGENCY] [[NAME OF POLICY/ORDER]] [2012-XX]

!

!!!

(Re: [LAW ENFORCEMENT AGENCY] MOBILE LICENSE PLATE READER SYSTEM)

!!!!!!I, , certify that I have received a copy of and have read [name of policy/order]2012-xx], dated August , 2012, regarding the [law enforcement agency]’s Mobile License !Plate Reader System. !!!!!!!!(Name)

Date: !!!!(Signature)

!

!!!!!(Title)