objectives of a successful City Surveillance Ordinance

CAMBRIDGE CITY COUNCIL CITY HALL, CAMBRIDGE, MASSACHUSETTS 02139 ckelley@cambridgema.gov Phone: [phone removed] Craig A. Kelley City Councillor Fax: [phone removed] MEMORANDUM T0: Cambridge City Council From: Craig A. Kelley, Councillor Date: January 8, 2017 Subject: Objectives of a Successful City Surveillance Ordinance The Public Safety Committee held a meeting on October 18, 2017, at 6:30 p.m., to "discuss the City's recommendation on a surveillance ordinance broadly, and to evaluate a proposed surveillance ordinance first submitted in November 2016," and to hear public comment. At the meeting, several speakers noted that other cities around the United States have passed surveillance ordinances during the past year. In the opinion of this office, these ordinances provide a more comprehensive approach to municipal surveillance than the draft version that was submitted in 2016, and would place the Council further along in a process to draft an ordinance for Cambridge. Therefore, we recommended that the draft version submitted in 2016 be used for reference purposes only in future conversations. This recommendation was received favorably by City Staff, and our partners in the American Civil Liberty Union (ACLU). To help guide the Council's drafting process, and inform a more robust public conversation, we are transmitting a list of possible objectives for a municipal surveillance ordinance. A successful ordinance will address the following issues. 1. Provide a clear definition for what constitutes surveillance and supporting technology. Detinitions for surveilance should clearly and comprehensively capture data-collecting activities and technologies, but not be so limited as to require constant Council amendments to expand the ordinance scope with each technological advancement. Definitions should also reflect the need to promote civil liberties, racial equity, social justice, and privacy. As an example, an ordinance "Surveillance" or "surveil" means to observe or analyze the movements, behavior, or actions of identifiable individuals in a manner that is reasonably likely to raise concerns about civil liberties, freedom of speech or association, racial equity or social justice…..It is not surveillance if an individual knowingly and voluntarily consented to provide the information, or had a clear and conspicuous opportunity to opt out of providing information. "Surveillance capability" means the ability to collect, capture, transmit, or record data that could be used to surveil, regardless of whether the data is obscured, de-identified, or anonymized before or after collection and regardless

of whether technology might be used to obscure or prevent the capturing of certain views of types of information. "Surveillance data" means any electronic data collected, captured, recorded, retained, processed, intercepted, or analyzed by surveillance technology acquired by the City or operated at the direction of the City. "Surveillance technology" means any electronic device, software program, or hosted software solution that is designed or primarily intended to be used for the purpose of surveillance. 2. Require the City to submit surveillance im pact reports to the Council, and provide guidance on what information is to be included. Each time the City makes a surveillance request to the Council, it should prepare a surveillance impact report (SIR) with the following information: a. a description of the surveillance technology to be acquired, its present capabilities and any reasonably foreseeable capabilities, and the type of data that will be collected; b. how and when technology will be used, and whether it is to be used permanently or temporarily; c. a description of the surveillance's purpose; d. a description of the data management policy; e. how the data will be shared with third parties and the public; f. how personnel are instructed on responsibilities for using and acquiring data to ensure compliance; g. any comments raised during a community engagement process; and h. the costs associated with the surveillance technology. 3. Promote transparency by creating a regular reportine process. Decisions about City surveillance programs, technology, and data management policies should be made exceptionally public prior to implementation. For example, they could be reported to the Council before the acquisition of any new surveillance capabilities, and be made available online. Reporting should also allow the public and the Council to review ail surveillance-based decisions and protocols in advance, and provide an opportunity for comment the one of the following manners, either: a. Initiate a department-led public commenting process before submitting a SIR to the Council; b. Requiring that any SIR be posted on the Regular City Council agenda for a set number of meetings before it may be acted upon; or c. Stipulate that a SIR may not be acted on before a set number of days after the report was made available. Surveillance devices placed in or on publicly owned property should clearly identify the responsible department. The City should also prepare a yearly assessment to include the following information: d. compliance with ordinance; e. improvements to the city's data management and retention policies; f. how technologies were used, and whether they achieved their stated purpose; how data collected was shared; and

h. complaints or concerns raised throughout the year. 4. Establish the Council as the final arbiter regarding what constitutes surveillance and related activities. For example, the City Manager could receive Council approval by a vote of the majority before acquiring or deploying technologies with surveillance capabilities. The Council should have authority to review surveillance technologies used by the City retroactively, nd also exempt certain technologies. The Council may ask for a recommendation from a Boar r Committee designated to evaluate surveillance technologies prior to taking action on a SIR 5. Place special scrutiny on surveillance with the potential to adversely impact disadvantased minority groups or communities. As part of any request to the Council, the City should evaluate whether the surveillance technology or its use may disproportionately impact disadvantaged groups or communities. 6. Establish data management protocols. The City should report on how data will be securely stored, managed, shared, and deleted in accordance with Public Record Laws. 7. Allow for emergeney uses of surveillance with clearly defined limitations. In such cases, a threat should be imminent, and pose a serious risk to life or bodily harm. Use of surveillance during such situations should end immediately after the threat has pasted, and be documented in a report to the Council. 8. Require review of surveillance capacities, impacts, and data generation through third-party technolories offered by the City. When the City enters into a contract with a third party for services or technology equipment, such as with Hubway or Commonwealth Connect, the City must retain ownership of all data generated through the partnership, and ensure compliance with the ordinance. 9. Create a process for addressing injuries as a result of surveillance activity in violation of ordinance. Allow for persons injured in violation of the ordinance to institute proceedings against the City for relief. 10. Allow current department operations and uses of technology to continue until compliance can be achieved. An ordinance should define which technologies or uses constitute surveillance, but that would be exempted from the provisions of the ordinance. Such examples might include body-worn cameras, and cameras placed for the protection of City property. 11. Task an advisory body with assisting the Council on decisions involving surveillance technology requests. This communication is being forwarded to Ms. Donna Lopez, City Clerk, with instructions to place it on the Monday, January 22, 2018, Regular Meeting agenda as a Communication from City Officer. A copy of the surveillance ordinance adopted by the City of Seattle is also attached.