Take action: Offer public comment on invasive police surveillance tech!

WA People’s Privacy Network (WA PPN) is asking folks across our state who are concerned about the overreach of police surveillance to take action!
We need to make sure that Seattle Police Department and the Seattle City Council hears questions, comments and recommendations directly from the people about the last 6 Seattle Police Department surveillance tools (of 29 total across city departments). Members of the Seattle Surveillance Ordinances’ Community Working Group have reviewed these technologies, and members of the public (from all over the state) need to add our comments by June 2nd, 11:45 p.m.!

We know that agencies in our state communicate and collaborate. It’s important to use this opportunity created by the Seattle Surveillance Ordinance for the public to weigh in on privacy-invading surveillance technologies that can be used not only by Seattle, but other police departments across Washington state

While all six technologies have potential harms, the four most concerning tools of these final six may be “Computer, cellphone and mobile device extraction tools,” “GeoTime,” “Tracking Devices,” and Covert “Camera Systems.”

Here’s the Call to Action: We’re asking folks to email your public comment, and then input those comment into our google form as a backup.
Instructions for the two steps:

1. Send an email to privacy@seattle.gov
Subject line: My Comments on 4b Surveillance Technologies to Include in SIR
Email Content: Copy-paste the template below. We have formatted it this way because public comment for each technology must be given in a clear and separate way for EACH of the six technologies. That being said, if you only want to comment on a few, you can delete whole technology sections – you don’t have to include all six technologies in your email.
We’ve listed our key questions, concerns, and recommendations underneath each technology. You’ll want to review those, and then you can use those/tweak language/add/expand/delete in order to personalize your comments!
Questions are for the Seattle Police Department to answer.
Comments and Recommendations are for the Seattle City Council to consider.

*We have created simple one-click pre-drafted email options for folks who just don’t have time to read about each technology and/or don’t want to customize their comments. We’ve used the take action network site. You’ll want to open each of the six actions – one for each technology – to send that quick email.

2. After you have emailed your comments, please go to the input page on our website (link removed, action finished!) and copy-paste your responses into our form.
This will help us count, review and ensure that the Seattle City Council sees all of the public comment we sent reflected in the report they receive from the SPD.
We will not collect any email addresses or names with your comments. If you want credit, and for us to see your name, you can certainly put your name in the fields with your comments. 🙂 You’ll be able to give consent or not on whether we can save any of your self-authored comments to share on WA PPN platforms in the course of our advocacy and organizing work.

Draft-it-Yourself (DiY) EMAIL TEMPLATE:
Choose your own adventure – please do not copy-paste the whole thing into an email – your email would be way too long.
We’ve drafted an intro + the full list of technologies for you to copy-past from, and customize. If you don’t want to write any of your own content, that’s OK, just go through this list thoughtfully and choose your top two or three Questions, Key Concerns, and Recommendations you want in your email for each technology.
Tell your own stories and perspectives on these technologies if you have those to offer!
❤️Thank you to all of the folks who submit public comment! It’s such an important part of “doing” democracy, and it can make a big difference!

Privacy tip! When you email the City of Seattle with public comment, your name (if included), and email address, and associated data becomes part of the public record, and is subject to public records requests and searches. *Thus, to ensure the safety of our marginalized community members who are most at risk of the harms of police surveillance, we offer a privacy tip:
When emailing public comments: some folks choose to use an email account that is expressly set up for public records communications, and not for their personal communications.
People can offer anonymous public comments, but between today’s technologies and Washington State’s lack of robust people’s privacy laws: unless you have taken steps to ensure your privacy, your anonymity is not ensured simply by omitting a name from a comment that you submit online, via email, in a survey or an agency or “community engagement portal.”

Dear Seattle IT Department;
I am writing to add my public comment to the review process for the list of Group 4b Surveillance Technologies in by the Seattle Police Department. Please include my public comment for each technology that I have listed below in the SIR.

1. Surveillance Tech: ”Computer, cellphone and mobile device extraction tools (Police)”

Questions:

Is any of the data from device extraction tools shared or accessed by Fusion Centers? Does the Fusion Center access SPD data, and is a warrant?
What are the names of the specific manufacturers and their individual product names of the computer, cellphone and mobile device extraction tools (physical tools and software) that SPD is using, has or plans to purchase, and used in the past?
Is legal representation required in order for a person to give consent to the use of these tools on their device?

Key Concerns:

It’s unclear whether the deployment of this technology is disproportionately used against marginalized and minority individuals and communities.
Consent for SPD to use these tools may be coerced from low-level offenders, for instance as a bargaining chip to avoid detention or arrest, or as a threat.
Note: Based on Upturn’s PRA records from 2017-2019, the majority of SPD’s consent-based searches were limitless, with no date or data type limitation; whereas only a quarter of all warrant-based searches were limitless (66% of consent-based searches were limitless compared to 24% of warrant-based searches).
The SPD uses extractive tools that access ALL DATA on a device, scooping up many people’s data from their electronic devices, including cell phones, smart phones, tablets, computers and other devices.
Data collected via extraction tools can include contacts, call logs, messages, GPS locations, images, apps, files and possibly anything else on the device. Computer extraction collects an entire copy of a computer’s hard drive at a specific point in time.

Recommendations:

Scoping – City Council should restrict the use of these extraction tools to only cases involving an event type flagged in the system as a violent and/or serious offense involving a non-property crime.
Coercion – City Council should prohibit the use of these tools with consent without legal representation present, the next best would be to at least prevent such for minors.
Restricted use – City Council should restrict the covert use of SPD’s deployment of device extraction technology to cases that are serious and violent offenses, and must provide evidence of such in warrant applications for their use. The use of covert technologies, being major intrusions into privacy, must be proportional to the seriousness of the suspected offense (UNODC, United Nations Office of Drug and Crime).
Remedies/Penalties – City Council should state that the use of digital extraction device except pursuant to that defined in the final SIR exposes the user to criminal or civil liability.
Regulation and Transparency Report – City Council should require that each use of such technology be registered with the city and compiled into monthly transparency report, accessible on the City’s website, to include the following details: Make and Model of technology, reason for use (type of offense being investigated), length of use, the number of parties’ and devices’ data captured and/or searched; when the extraction(s) occurred and whether the extraction mechanism is/was ongoing or taken as a snapshot in time; whether the extraction(s) resulted in an arrest or conviction; whether those searches (by extraction device) were by consent (though consent searches should be banned), or through a warrant (and include warrant numbers associated with searches, if legal and applicable); whether the extraction(s) were related in any way with political protest, demonstration or other public assembly; whether the extraction data is/was shared with or uploaded to any other software program, entity, company, agency or person, outside of the SPD officer employing the technology, and, the name of such shared with.
Contractual – City Council should request the Purchase orders and contracts for each of the extractive tool vendors SPD has used, is using, or plans to use in the future, and update the SIR to include this information.
Prohibition – City Council should disallow the installation and use of spyware and/or key-logger-type functionality from any MDFT onto a suspect’s device, and must instead rely on the process of judicially compelling the suspect to provide the passcode.
Prohibition – City Council should disallow SPD from signing an NDA with any manufacturer, vendor, or reseller of a surveillance technology (as defined in the SSO). [Note that some other cities’ CCOPS ordinances include prohibition of NDAs, but the SSO does not have that language.]
Process and Data Deletion – City Council should:
a) require that any information obtained through the execution of a warrant that is unrelated to the objective of the warrant (unless it is exculpatory information) be destroyed within thirty days after the information is seized and be not subject to further review, use or disclosure.
b) City Council should require that any MDFTs used by SPD have detailed audit logs and automatic screen recording, so that judges, defenders & other involved parties would be able to obtain a better understanding of the “precise steps that law enforcement took when extracting and examining a phone.”
c) City Council should also require that if charges are dismissed or do not result in a conviction, all MDFT data is promptly deleted.

2. Surveillance Tech: “GeoTime (Police)”
Questions:

Is any of the data from Geo Time shared or accessed by the Fusion Center(s)? If so, does the Fusion Center access Seattle Police Department data, and would that be via a warrant required for other law enforcement agencies to access data collected by SPD?

Key Concerns:

It’s unclear whether the deployment of this technology is disproportionately used against marginalized and minority individuals and communities.
This technology takes in a huge amount of data in order to connect data points in relation to police searches and crime investigations, but many uninvolved people’s data may be included. If the technology is not taking in data selectively, this technology is posed to violate the rights to privacy of both targeted and non-targeted people.
Data sucked into GeoTime can be used as evidence in court and to obtain warrants, but the public has very little information or transparency about its data collection, data retention, and any other technologies that may be used alongside GeoTime, and what other entities may have access.
Data collection is not perfect, clocks can be wrong, cell towers can be buggy, words, concepts, and cultural or situated references may be misconstrued via algorithmic bias. What happens if the data is incorrect or inaccurately processed?
What recourse does an accused person, or any member of the public whose data is sucked into GeoTime, have to correct the record or clarify incorrect data?
If the data from GeoTime stored in an investigation file can be requested from SPD by other agencies, including agencies in other states; that data could be used to pursue arrest or conviction of any uterus-having person planning to come here for care, or having already accessed abortion healthcare, gender-affirming care, and/or any other healthcare tests/records in WA state.

Recommendations:

Scoping – City Council should prohibit the use of GeoTime’s Social Media Analysis.
Predictive policing – City Council prohibit the use of GeoTime for the purpose of predictive policing, and prohibit using GeoTime with other predictive policing tools.
Scoping – City Council should restrict the use of GeoTime to only cases involving an event type flagged in the system as a violent and/or serious offense involving a non-property crime.
Data lifecycle governance – City Council should prohibit the storing data on Uncharted servers.
Contractual & Inventory – SPD should make the contract or customer agreement and the list of related products that they are integrating, or plan to integrate, with GeoTime available to the public.
Data sharing – City Council should prohibit sharing data or facilitating an investigation of a crime in another state when that crime is not illegal in WA state and is related to accessing healthcare.
Regulation and Transparency Report – City Council should require that for as long as GeoTime (or similar) technology is used, records of its use must be registered with the city and compiled into monthly transparency reports, accessible on the City’s website, to include the following details: make and model or version of the technology, reason for its use, dates and times used, number of parties’ and devices’ and types and sources of data that was accessed, whether the use of GeoTime (or similarly capable tech) resulted in an arrest or conviction, whether and how often its use generated a new lead unrelated to the original purpose of its use; thoroughly reported demographic data regarding the targets of its use; whether the extraction data is/was shared with or uploaded to any other software program, entity, company, agency or person, outside of the SPD officer employing the technology; and, the name of such shared with (excluding of course, from the publicly available report any specific names of other officers, but retaining those records pursuant to public records requests law as well as internal records for auditing purposes).

3. Surveillance Tech: “Undercover Camera Systems (Police)”
Questions:

Is any of the footage shared or accessed by Fusion Centers, or any other entities or agencies? If so, is a warrant required for fusion centers or other entities or agencies to access data collected by SPD?
Do these camera systems include audio recording capability? Is SPD using that feature?
Are these camera systems and their collected footage used or imported into biometric recognition, predictive policing, or other analytic or algorithmic software tools?
What are the names of the specific manufacturers, and the individual product names of the undercover camera systems, that SPD is using, has or plans to purchase, and used in the past? (The public has a right to understand the full capabilities of the surveillance tools SPD uses.)

Key Concerns:

It’s unclear whether the deployment of this technology may be disproportionately used in situations and cases involving marginalized and minority individuals and communities.
It’s unclear how easy it is to turn on and off the camera systems. Thus, there are concerns as to whether extra video may be captured which could include bystanders or other persons.
It’s unclear whether the TESU personnel or the Detective/Officer is responsible for accessing and editing out extra footage that cameras may have captured; what guidance there is regarding trimming and reviewing video; and whether there may be confidentiality or conflict of interest issues with regards to that process and access to potential evidence.
The idea that these technologies can be deployed in “public places, where there is no expectation of privacy” in an unlimited fashion is highly problematic. Yes, a person walking down a street does not have an absolute expectation of privacy, however; they do have an expectation of “non permanence” of any data documenting their walk down that street. If a persons’ face or license plate or likeness will be collected and added to a dataset which can or does create a profile of their movements over time, that is problematic and potentially harmful.

Recommendations:

Coercion – City Council should prohibit the use of these cameras with consent without legal representation present, provided by the city for all those Indigent < 200% FPL.
Coercion – City Council should prohibit the use of these cameras with consent without legal representation present for minors.
Biometrics – City Council should prohibit the use of biometric functionality in combination with camera footage, including face recognition, gait analysis, emotional or other AI, among others.
Predictive policing – City Council should prohibit the resultant footage from these cameras from being used with predictive policing tools.
Scoping – City Council should restrict the use of SPD’s deployment of these covert cameras to cases that are serious and violent offenses, and require evidence of such in warrant applications for their use. The use of covert technologies, being major intrusions into privacy, must be proportional to the seriousness of the suspected offense. (UNODC, United Nations Office of Drug and Crime)
Contractual & Inventory – City Council should request the Purchase orders and contracts for each of the undercover camera systems, and vendors SPD has used, is using, or plans to use in the future, and update the SIR to include this information.
Remedies/Penalties – City Council should state that the use of a covert camera device, except pursuant to that defined in the final SIR, exposes the user to criminal or civil liability.
Regulation and Transparency Report – City Council should require that each use of covert camera deployment be registered with the city and compiled into monthly transparency report, accessible on the City’s website, to include the following details: make and model of devices used; reason for use; length of use; number of involved and uninvolved parties data/footage captured; whether and which use of covert camera systems was consent-based per an informants’ consent or a victim’s consent – if such persons are distinct in that event; whether the covert camera surveillance is/was ongoing for a period of longer than one 24-hour period, and the full duration that ongoing surveillance has been sustained up to the time of the submitting the report; whether covert camera systems were used to surveil a large group of people of a number greater than five in total engaged in a protest, demonstration, public assembly, religious or other gathering; whether the covert camera surveillance resulted in an arrest or conviction; whether the recorded imagery (and audio, if collected) is/was shared with or uploaded to any other software program, entity, company, agency or persons, outside of the SPD officers necessary to employ the technology for a particular and stated purpose, including the sharing as still video frames (photographs); and, the names of any such shared with.

4. Surveillance Tech: “Undercover location Tracking Devices (Police)”

Questions:

The SIR articulates the steps for evidence to be admissible in court, but does not define what individuals may do with these devices. So, what measures are in place, or needed, to prevent improper use of a tracking device? (e.g. for personal and/or stalking purposes)
What are the names of the specific manufacturers and their individual product names of the undercover location tracking devices that SPD is using, has or plans to purchase, and used in the past?
What measures are in place to track which officers use these devices, the types of purposes or incidents they are used for; the periods of time or frequency of each officers’ use of these tools; and the race, ethnicity, religious affiliation, gender, age and economic demographics of the people being tracked by such officers using these devices?
What systems, reporting measures, and oversight does SPD have in place to ensure that these devices are not being used for nefarious purposes, and/or to disproportionately profile immigrants, BIPOC, muslim, lgbtq+, activist, or houseless individuals? Is there a way for the public to review reports with these details?
Is there any SPD policy prohibiting the use of TESU equipment for personal purposes?

Key Concerns:

It’s unclear whether the deployment of this technology is disproportionately used against marginalized and minority individuals and communities.
What measures would prevent or detect the improper use of a tracking device, such as such as the device being borrowed (perhaps in return for a favor done by the officer for the TESU personnel) and then placed on the vehicle owned by an ex-wife/ex-girlfriend of an SPD officer so that that officer – outside the confines of a case or legal investigation, could use the device for personal purposes?
It seems important to minimize deployments of tracking devices to when it’s absolutely necessary and to narrow the situations in which they are permitted to be deployed in order to protect the privacy of non-suspects. For instance, the use of tracking devices on vehicles that are used primarily as taxi cabs/ride-share vehicles, or on a vehicle either not owned by a suspect – or owned by a suspect but frequently used by other individuals (family members, spouse, significant other(s), teenage children, friends, etc) could endanger and violate the privacy of people who are not suspects. It seems like there should be a process that ensures that tracking devices are not employed in situations where a vehicle is shared, or used for the purpose of employment (ride & food delivery gig-workers, etc).

Recommendations:

Remedies/Penalties – City Council should state that the use of a location tracking device except pursuant to that defined in the final SIR exposes the user to criminal or civil liability.
Scoping – City Council should restrict the use of SPD’s deployment of these covert cameras to cases that are serious and violent offenses, and must provide evidence of such in warrant applications for their use. The use of covert technologies, being major intrusions into privacy, must be proportional to the seriousness of the suspected offense. (UNODC, United Nations Office of Drug and Crime)
Contractual & Inventory – City Council should request the Purchase orders and contracts for each of the undercover location tracking devices vendors SPD has used, is using, or plans to use in the future, and update the SIR to include this information.
Regulation and Transparency Report – City Council should require that each use of covert location tracking devices and associated software systems be registered with the city and compiled into monthly transparency report, accessible on the City’s website, to include the following details: Make and Model of tracking device, reason for use, length of use; number of parties’ and/or devices, items and/or vehicles tracked, whether the tracking is/was ongoing, and for what duration – up to of the time of reporting – tracking devices remained on or with a target, or, whether employed as part of a singular investigative incident lasting no longer than 24 hours; and whether the employment of such tracking device resulted in an arrest, conviction, harm, injury, fatality or other physical or economic accident, injury or burden on an individual or group; whether the data gathered from the employment of tracking device(s) is/was shared with or uploaded to any other software program, entity, company, agency or person, outside of the SPD officer employing the device, and, the name (make/model) of such shared with.

5. Remotely Operated Vehicles (Police)

Questions:

Has SPD ever mounted such human-killing weapons on their ROVs? Is there anything in the SPD Manual to prohibit doing so?
Does the statement about not recording information, images, or audio by the SWAT and Arson/Bomb ROVs also include the ROVs’ remote controllers or tablets connected to them wirelessly, since the controllers & tablets can also support recording data, not just the ROV itself?
Do any of the SPD ROVs include X-ray or infrared (heat-imaging) devices?
The answer to item 3.1 in the ROV SIR does not describe any check-in/check-out process for the ROVs. Does this indicate that there is no check-in/-out procedure for any of the units’ ROVs?
If there is no process to regulate who/how/when ROVs are used, it seems to preclude the maintaining of records and logs that may be audited. Doesn’t this seem like an improper, dangerous, and high-liability/risk use of remotely operated technologies?
What measures are in place to track which officers use these devices, the types of purposes or incidents they are used for; the periods of time or frequency of each officers’ use of these tools; and the race, ethnicity, religious affiliation, gender, age and economic demographics of the people being targeted by such officers using these devices?
What systems, reporting measures, and oversight does SPD have in place to ensure that these devices are not being used for nefarious purposes, and/or to disproportionately profile immigrants, BIPOC, muslim, lgbtq+, activist, poor or houseless individuals? What public accountability measures are in place?

Key Concerns:

Some ROVs use “recoilless disrupters”, which are used to remotely render a bomb safe. These disrupters can shoot a variety of projectiles at the bomb (such as 12 gauge blank shotgun shells, among others). Unlike this bomb handling purpose, the SWORDS TALON ROV supports a diverse range of weapons that can be added on to it. Apparently one can mount a 12 gauge shotgun on the Pointman ROV; and for both these ROVs, the purpose of the weapons are to harm or kill humans, not to render an IED safe.
An SPD officer recording the livestream on the ROV controller.

Recommendations:

Weaponization – Council should prohibit SPD from affixing weapons on any ROV with the intent to harm or kill a living being.
Privacy & data governance – Even if most of SPD’s ROVs don’t support recording video, City Council should prohibit SPD police from using SPD-provided (or personal) cell phones to record the livestream on the ROVs’ displays.
Regulation and Transparency Report – City Council should require that each use of such technology be registered with the city and compiled into monthly transparency report, accessible on the City’s website, to include the following details: Make and Model of ROV, reason for use, and length of use; whether the use was part of a singular or ongoing matter; whether the use of ROV(s) resulted in any arrest, conviction, injury, fatality, major harm, accident, economic burden or inconvenience to any individuals or groups; whether the deployment of an ROV was used for search and rescue; whether ROVs were employed to surveil or otherwise act upon any large group of people, numbering greater than five in total, engaged in a protest, demonstration, public assembly, religious or other gathering; whether any information collected by the ROVs is/was shared with or uploaded to any other software program, entity, company, agency or person, outside of the SPD officer employing the ROVs, and, the name of such shared with.

6. Surveillance Tech: “Crash Data Retrieval (Police)”

Questions:

Are the warrants usually specific in regards to what data will be collected from the vehicle’s computer? E.g. Do the warrants specify that only EDR data is to be collected?
Does SPD always gather EDR data from vehicles in a crash, regardless of whether a citation has been issued, and even if no crime or significant physical harm has occurred?
Please clarify under what circumstances SPD would attain the location data from the vehicle’s computer?
Do certain car manufacturers include location history data to be collected by the EDR (which may not be required by law), or does SPD collect a broader range of data from a vehicle, and not just EDR data?
Under what circumstances does SPD collect all the data from infotainment systems, call logs, contacts, location history, and other personal data?

Key Concerns:

Possibly excessive personal data from the car’s computer (location history, call logs, contact lists, etc) being downloaded/accessed (either in addition to the EDR data due to overly broad warrants requested/approved or possibly if the car manufacturer’s EDR pulls in such excessive data).
Possible sharing of Personally Identifiable Information (PII) with researchers. It’s unclear whether gov entities can even be prevented or blocked from accessing PII.

Recommendations:

Privacy – Item 6.1 in the SIR indicates that “SPD shares data with authorized researchers…” City Council should require that the identity of the owner or driver is not disclosed in connection with retrieved data that is shared with researchers.
Scoping & Privacy – City Council should restrict SPD’s post-crash warrants to aspects of the car’s computer that are salient to the crash investigation (such as EDR data, if that is sufficient). If SPD does want the infotainment data, which may show a call log during the crash, or other personal data, they should be required to document and justify the need for that additional data. The intent of this restriction would be to prevent excessive data being gathered due to overly-broad warrants being requested/granted.