a report from Councillor Craig Kelley, Chair of the Public Safety Committee, for a public hearing held on April 17, 2018 to discuss a proposed Surveillance Ordinance

ATTACHMENT A PUBLIC SAFETY COMMITTEE COMMITTEE MEETING -AGENDA~ 2:00 PM Tuesday, April 17, 2018 Sullivan Chamber CALL OF THE MEETING The Public Safety Committee will conduct a public hearing to discuss a proposed surveiliance ordinance. PUBLIC COMMENT CITY STAFF Review of the City's current thoughts on the possible ordinance. ACLU Hear from the ACLU and other interested parties. DISCUSSION Move to a discussion of possible ordinances, the goal of a Cambridge ordinance and a discussion of next steps. ADJOURNMENT Last Updated: 4/17/2018 7:49 AM City of Cambridge cambridgema, gov

ATTACHMENTB Draft 4/13/18 • Chapter 12.22 Surveillance Technology Ordinance Section 12.22.010 Purpose The purpose of this Chapter is to provide for the regulation of Surveillance Technology acquisition or use by the City of Cambridge, to safeguard the right of individuals to privacy, to balance the public's right to privacy with the need to promote and ensure satety and security, to provide protocols for use of Surveillance Technology that include specific steps to mitigate potential impacts on the civil rights and liberties of any communities or groups including communities of color or other marginalized communities in the City, to-balance any decision to use Surveillance Technology with an assessment of the costs and protection of privacy, civil liberties and civil rights, to allow for informed public discussion before deploying Surveillance Technology, to provide for transparency, oversight, and accountability, and to minimize the risks posed by use of Surveillance Technology in the City. Section 12.22.020 Definitions The following definitions apply to this Chapter: (A) "Annual Surveillance Report" Teans a written report concerning specific Surveillance Technology that includes all of the following (1) A description of how the Suryeillance Technology has been used, mages, soung or information regarding including whether it captured members of the public who aretmot suspecfed of engaging in unlawful condu (2) Whether and hop often, data acquifed through the use of the Surveillance Technology was shared with outside entities, the name of any recipient entity, the type(s) of data disclosed, under what legal standard(s) the information was disclos i, and the justification for the disclosure; (3) Asummary of community complaints or concerns about the Surveillance any; echnology, (4) The results of any non-privileged internal audits, any information about violations of the Surveillance Use Policy, and any actions taken in response; (5) Whether the Surveillance Technology has been effective at achieving its identified purpose: (6) Statistics and information about public records requests; (7) Total annual costs for the Surveillance Technology, including personnel and

Draft 4/13/18 other ongoing costs, and what source of funding will fund the technology in the coming year; and (8) whether the civil rights and liberties of any communities or groups, including communities of color or other marginalized communities in the City are disproportionately impacted by the deployment of the Surveillance Technology. (B) or his/her designee's "Exigent circumstances" means the Police Commissioner's ih, physical injury, or good faith belief that an emergency involving danger of deat significant property damage or loss requires use of the Survillance Technology or the information it provides. (C) "Surveillance" means to observe or analyze the movements, behavior actions of identifiable individuals in a manner that is reasonably likely to raise concers about civil liberties, freedom of speech of association, racia equity or social justice. Identifiable individuale also inelude individuals whose identity can be revealed by license plate data when combined with any other record. It is not surveillance if an individual knowingly and voluntarily consented to provide the information, or had a clear and conspicuous opportunity to opt out of providing the informati (D) "Surveillance Data" means any electronic data colleetes, captured, recorded, retained, processed, intercepted, or analyzed by Surveillance Technology acquired by ine City or operated at the direction of the City. (E) "Surveillance Impact Report" means a publičly-released written report including at a minimum the following Information describing the Surveillance Technology and how it works; Information on the proposed purposes) for the Surveillance Technology; (3) The location(st it may be deployed and when; (4) The potential impacts) on privacy in the City; the potential impact on the civil rights and liberties of any communities or groups, including, but not limited to, communities of color or other marginalized communities in the City, and a description of whether there is a plan to address the impacts); and (5) The fiscal costs for the Surveillance Technology, including initial purchase, personnel and other ongoing costs, and any current or potential sources of funding. Page 2 of 11

•Draft 4/13/18 (F) "Surveillance Technology" means any electronic surveillance device, hardware, or software that is capable of collecting, capturing, recording, retaining, processing, intercepting, analyzing, monitoring, or sharing audio, visual, digital, location, thermal, biometric, or similar information or communications specifically associated with, or capable of being associated with, any specific individual or group; or any system, device, or vehicle that is equipped with an electronic surveillance device, hardware, or software. 1. "Surveillance Technology" includes, but is not limited to: (a) international mobile subscriber identity (IMSI) batchers and other cell site simulators; (b) automatic license plate reade (c) electronic toll readers; (d) closed-circuit television cameras except as otherwise provided herein; (e) biometric Surveillance Technology, including facial, voice, iris, and gait-recognition sofavare and databases; (f) mobile DNA capture technology; (g) gunshot dejection and location hardware and services; X-cay vans (i) video and audie monitoring and/or recording technology, such as surveillance cameras and wearable body cameras; surveillance enabled or capable lightbulbs or light fixtures; (k) tools, including software and hardware, used to gain ¿inauthorized access to a computer, computer service, or computer network; (1) social media monitoring software; (m) through-the-wall radar or similar imaging technology; (n) passive scanners of radio networks; Page 3 of 11

Draft 4/13/18 (0) long-range Bluetooth and other wireless-scanning devices; (p) radio-frequency identification (RFID) scanners; and (q) software designed to integrate or analyze data from Surveillance Technology, including surveillance targer tracking and predictive policing software. 2. For the purposes of this Chapter, "Surveillance Technology" does not include the following devices or hardware. unless they have been equipped with, or are modified to become or include, a Surveillance Technology as defined above. (a) routine office hardware, such as televisions, computers. and printers, that are in widespread public use and will not be used for any surveillance of surveillance related functions; (b) Parking Ticket DEvices ("PTDs") and telated databases; (c) manually-operated, non-wearable, handheld digital cameras, audio recorders, and yideo recorders that are not designed to be used surteptitiously and whose functionality is used manually capturing and manually downloading video and or audio recordings; (d) survelance devices that cannot record or transmit audio or video or be remotely accessed, such as image stabilizing binoculars or night vision goggles; (e) City databases tha do not and will not contain any data or other information collected, captured, recorded, retained, processed, intercepted, or analyzed by Surveillance Technology; (f) manually-operated technological devices that are used rimarily for internal City communications and are not designed to surreptitiously collect Surveillance Data, such as radios and email systems; (g) parking access and revenue control systems, including proximity card readers and transponder readers at City- owned or controlled parking garages; and Page 4 of 11

- Draft 4/13/18 electronic card readers and key fobs used by City (h) employees and other authorized persons for access to City- owned or controlled buildings and property. For the purposes of this Chapter, the following Surveillance Technology is exempt from the requirements of this Chapter: Information acquired where the individual knowingly and voluntarily consented to provide the informatión, sueh as submitting personal information for the recei t of City services; b) Information acquired where the in luat was presented with a clear and conspicuous opportunity to opt out of providing the information; Cameras installed in or on a police vehicle: d) uaat to state law authorization in or Cameras installed p on any vehicle or along a public right-of-way solely to record traffic violations Cameras e) mstalled on City property solely for security purposes, Including closed circuit television cameras installed by the City to moniter entryways and outdoor areas of City-owned or controlled buildings and property for the purpose at controlling access, maintaining the Safety of City employees and visitors to City buildings, and protecting City property; security cameras including closed circuit television cameras installed by the City to monitor cashiers' windows and otaer cash-handling operations and to maintain the safety of City employees and visitors to such areas; g) Cameras installed solely to protect the physical integrity of City infrastructure; or h) Technology that monitors only City employees in response to complaints of wrongdoing or in order to prevent waste, fraud, or abuse of City resources. 4. The following situations are exceptions to the requirements of this Chapter: Page 5 of 11

Drait 4/13/18 a) Surveillance conducted pursuant to a warrant using previously approved Surveillance Technology. Surveillance conducted pursuant to a warrant using previously approved Surveillance Technology is excepted from the requirements of 12.22.030(B) and 12.22.060(A) where: i) the City is prohibited from publicly releasing information pertaining to the surveillance under federal or state law, or pursuant to a Court Order; or il) the Police of commissioner has determined that the releas information pertaining to the surveillance wo compromise public safety and security, provided that th nformation is released in the nex Report following the Police Commissioner's determination that public safety and security concerns pertaining to the release of such information no longer exis In the event of an emergency situation that poses an imminent risk of death or bodily harm or significant damage or loss, a Crly department head may, with the approval of the City Manager, acquire Surveillance counci approval, for the Technology without prior City sole purpose of preventing et mitigating such risk, if the department head reasonably believes thé acquisition of Surveillance Technology will result in reduction of the risk. The department's use of Surveillance Technology must end when such risk no longer exists or the use of the Surveillance Technology can no longer reasonably reduce the risk. "The use must be documented in the department's Annual Surveillance Report, and any future acquisition or use of such Surveillance Technology must be approved by the City Council as set forth in this Chapter. A City department head may, with the approval of the City «Manager, apply a technical patch or upgrade that is necessary to mitigate threats to the City's environment. The department shail not use the new surveillance capabilities of the technology until the requirements of Section 12.22.030 are met, unless the City Manager determines that the use is unavoidable; in that case, the department head shall request City Council approval as soon as possible. The request shall include a report to the City Council of how the altered surveillance capabilities were used since the time of the upgrade. Page 6 of 11

Draft 4/13/18 (G) "Surveillance Use Policy" means a publicly-released policy for the City's use of the Surveillance Technology, approved by the City Solicitor and the City Manager, and submitted to and approved by the City Council. The Surveillance Use Policy shall at a minimum specify the following: (1) Purpose: The specific purpose(s) for the Surveillance Technology. (2) Authorized Use: The uses that are authorized, the rules and processes required before that use, and the uses that are prohibi Data Collection: The information that can be (3) Nected by the Surveillance Technology. (4) Data Access: The individuals whgocan access or use the collected information, and the rules and processes required before access or use of the information. (5) Data Protection: The safeguards that protect information from unauthorized access, including, but not limited encryption, acc g-control, and access- oversight mechanisms. (б) Data Retefition: if any, for which information collected by he time period. the Surveillance Technology will routinely retained, the reason that retention period is appropriate to further the purpêse(s), the process by which the information is regularly deleted after that period lapses, and the conditions that must be met toretain information beyond that period. Public Access: If and how collected information can be accessed by members ofthe public, including criminal defendants. (8) Third-Party Data-Sharing: If and how other City or non-City entities can access oruse the information, including any required justification and legal standard necessary to do so, and any obligation(s) imposed on the recipient of the information. (9) Training: The training, if any, required for any individual authorized to use the Surveillance Technology or to access information collected by the Surveillance Technology, including whether there are training materials. (10) Oversight: The mechanisms to ensure that the Surveillance Use Policy is followed, including, but not limited to, identifying personnel assigned to Page 7 of 11

Draft 4/13/18 ensure compliance with the policy, internal record keeping of the use of the technology or access to information collected by the Surveillance Technology, technical measures to monitor for misuse, any independent person or entity with oversight authority, and the sanctions for violations of Section 12.22.030 Acquisition of Surveillance Technology (A) City Departments Other than the Police Department Unless it is not reasonably possible or feasible to do so (e.g., Exigent Circumstances, a natural disaster, or technological problems prevent it, etc.), any depariment he cad other than the Police Commissioner seeking approval under Section 12.22.030 of Chapter must submit to the City Council a Surveillance Impact Report and tain City Council approval before doing any of the following: (1) Seeking funds for Surveillance Technolo cluding but not limited to, applying for a grant, or accepting state or f ederal funds, or in-kind or other donations; (2) Acquiring new Surveillances Technology, including but not limited to procuring that Surveillance Technology without the exchange of monies or other consideration; (3) Using Surveillance Technology or a purpose, in a manner, or in a location not previously approved; or (4) ntering into an agreement with a non-City entity to acquire, share, or otherwise use Surveillance Technology or the information it provides. (B) Palice Department. Other that with respect to Surveillance Technology limited to use fa Exigent Circumstances in law enforcement investigations and prosecutions as specifieally defined in Section 12.22.040 of this Chapter, the Police Commissioner must submit a Surveillance Impact Report to the City Council and obtain City Couney approval, before doing any of the following: (1) Seeking funds for Surveillance Technology, including but not limited to, applying for a grant, or accepting state or federal funds, or in-kind or other donations; (2) Acquiring new Surveillance Technology, including but not limited to procuring that technology without the exchange of monies or other consideration; Page 8 of 11

Draft 4/13/18 (3) Using Surveillance Technology for a purpose, in a manner, or in a location not previously approved; or (4) Entering into an agreement with a non-City entity to acquire, share, or otherwise use Surveillance Technology. (C) in approving, and/or denying any acquisition of Surveillance technology, the City Council shall balance the safeguarding of individdals' right to privacy against the investigative and prosecutorial functions of the Polio bertment and promoting and ensuring the safety and security of the general public. Section 12.22.040 Temporary Acguisition and Use of Surveillance Technology in Exigent Circumstances Notwithstanding the provisions of this Chapter, the Police Department may temporarily acquire or temporarily use Surveillance Technology in Exigent Circumstances without following the provisions of this Chaptel before that acquisitiom or use. However, if the Police Department acquires or uses Surveillance Technology in Exigent Circumstances under this Section, the Police Commissioner must (1) report that acquisition or use to the City Council in writing within 90 days following the end of those Exigent Circumstances; (2) submit a Surveillance Impact Report tothe City Counell regarding that Surveillance Technology within 90 days following the end of those Exigent Circumstances; and (3) include that Surveillance Technology in the Police Department's next Annual Surveillance Report to the City Cuneil following the end of those Exigent Circumstances. If the Police Commissioner is unable to meet the 90-day timeline to submit a Surveillance ice Commissioner may notify the City Impact Report to the City Council, thi Council in writing of his or her request to extend this period. The City Council may grant extensions beyond the original 90 day timeline to submit a Surveillance Impact Report. Section 12.22.050 Compliance for Existing Surveillance Technologies (A) The City Manager shall submit to the City Council for its review and approva, a proposed Surveillance Use Policy applicable to each City department that possesses or uses Surveillance Technology before the effective date of this Chapter or for future use and acquisition of Surveillance Technology, no later than one-hundred eighty (180) days following the effective date of this Chapter, for review and approval by the City Council. If the City Manager is unable to meet this 180-day timeline, he or she may notify the City Council in writing of his or her request to extend this period. The City Council may grant an extension to the City Manager to submit a proposed Surveillance Use Policy. Page 9 of 11

Draft 4/13/18 (B) In approving or denying the Surveiliance Use Policy, the City Council shall balance the safeguarding of individuals' right to privacy against the investigative and prosecutorial function of the Police Department and promoting and ensuring the safety and security of the general public. To the extent the City Manager or a court of law determines that approving or denying the Surveillance Use Policy would unlawfully obstruct the investigative or prosecutorial functions of the Police Department, the City Council shall simply receive and discuss the applicable portions of the Surveillance Use Polie Section 12.22.060 Oversight Following City Council Approval (A) A City department head who has led approval tor the use of Surveillance Technology or the information it provides under Section 12.22.030 or Section 12.22.040 of this Chapter, must submit an Anhual Surveillance Report within twelve (12) months of City Council approval, and annually thereatter on or betore Marched Similarly, if the City Council received but did not approve a Surveillance Impact Report from the Police Department because of cöncerns over obstructing the Police Department's investigative or prosecutorial function, the Police Department must still submit an Annuai Surveillance Use Report within twelve, (12) months of the City Council's receipt of the Surveillance Impact Report, and annually thereafter on or before March 1. (B) Based upon information provided in the Annual Surveillance Report, the City Council shall determine whether the benefits to the impacted City departments) and the community of the Surveillance Technology outweigh the financial and operational costs and whether reasonable safeguatds exist to address, reasonable concerns regarding privacy, civil liberties, and civil rights impacted by deployment of the Surveillance Technology. If the benefits or reasonably anticipated benefits do not outweigh the tiancial and/or operational costs or civil liberties or civil rights are not reasonably safeguarded, the City Council may consider (1) , recommending modifications to the Surveillance Use Policy that are "designed to address the City Council's concerns to the City Manager for his consideration; and/or (2) requesting a report back from the City Manager regarding steps taken to address the City Council's concerns. (C) No later than May 31 of each year, the City Council shall hold a meeting to discuss the City departments Annual Surveillance Reports, and shal! publicly release a report that includes a summary of all requests for approval of Surveillance Impact Reports received by the City Council during Page 10 of 11

Draft 4/13/18 the prior year pursuant to Section 12.22.030 or Section 12.22.040 of this Chapter, including whether the City Council approved, rejected, or required modifications to the Surveillance Impact Report. Section 12.22.070 Enforcement This Chapter shall be enforced by the City Manager or his/her designee. Section 12.22.080 Severability The provisions in this Chapter are severable. If any part or provision of this Chapter, or the application of this Chapterto any person or circumstance, is held invalid by a court of competent jurisdiction, the remainder of this Chapter shall not be a continue to have full force and effect. Section 12.22.090 Effective Date its ado This Chapter shall take effect nine months after Page 11 of 11

ATTACHMENT C April 17, 2018 ACLU MA ACLU TESTIMONY IN SUPPORT OF SURVEILLANCE OVERSIGHT ORDINANCE On behalt of our over 100,000 members and activists statewide, the ACLU of Massachusetts writes in strong support of an ordinance to require surveillance oversight. We thank the City Manager, City Solicitor, Mayor, pecific feedback on how to streng specific rei far then ok the heart donth dad hind of prody sugar to de Council here co today's hearing. A strong oversight ordinance, if enacted, will address a disturbing national trend—local police departments' increased use of surveillance equipment without appropriate checks and balances—by requiring a commonsense oversight approach. The ordinance will strengthen local democracy by engaging elected officials and members of the public in critical conversations about technology, civil rights, and civil liberties in an increasingly digital world marked by racial disparities at every level of the criminal justice system.! Crucially, a strong oversight ordinance is not prescriptive, in the sense that it will not impose an outright ban on the use of any specific technology. Rather, it would merely institute a process to ensure Cambridge's government functions transparently, and with the support of the majority of the people who live in the community. Similar local laws have been passed in communities across the country, and currently over 50 cities and towns nationwide, including Lawrence and Boston, Massachusetts, are considering them. Last year, the City of Somerville enacted an executive order mandating mayoral approval of and public transparency regarding surveillance technology acquisitions. Cambridge should join these communities and pass a strong ordinance requiring commonsense oversight and checks and balances. The problem: Unchecked, secret government surveillance Any time a government uses advanced surveillance technology, civil rights and civil liberties are put at risk.? But the use of these tools especially risks violating the rights of historically marginalized communities like people of color, immigrants, Muslims, and the poor. These risks are exacerbated by the presence of a federal administration that has demonstrated a commitment to a bigoted, authoritarian agenda, marked by outright hostility to immigrants, people of color, and Muslims. While Cambridge-not President Trump—is in charge of its police department, the City receives federal grant monies from the Trump administration for law enforcement activities, and also participates in information sharing programs and task force operations that involve federal agencies, including through the Metro Boston Homeland Security Region and the Boston Regional Intelligence Center.+ Cambridge is home to two world-class research institutions, and a vibrant and ' Andrew Khan and Chris Kirk, "What it's like to be Black in the criminal justice system," August 9, 2015, Slate. http://www.slate.com/articles/news_and politics/crime/2015/08/racial disparities_in_the_criminal justice_system_ei ght_charts_illustrating.html. 2 Neil M. Richards, "The Dangers of Surveillance," May 20, 2013, Harvard Law Review. https://harvardlawreview.org/2013/05/the-dangers-of-surveillance/. 3 Malkia Amala Cyril, "Black America's State of Surveillance," March 30, 2015, the Progressive. http://progressive.org/magazine/black-america-s-state-surveillance/. + See, for example, "Mayor Walsh Announces $18m in Homeland Security Funding for Boston," describing the Metro Boston Homeland Security Region, which includes Cambridge. https://www.cityofboston.gov/oldnews/Default.aspxPid=20059.

diverse community made up of citizens and immigrants. It is therefore all the more important that the City of Cambridge makes sure it is only collecting and sharing information about people when absolutely necessary for public safety purposes. Unfortunately, decisions regarding the acquisition and use of surveillance tools that capture sensitive information about residents and visitors are often made in secret, so that community members and officials do not have the opportunity to weigh in or provide meaningful oversight—or learn, for example, if the police intend to share surveillance data with the federal government. The lack of appropriate checks and balances in this area has enabled the expansion of unchecked surveillance throughout the United States, including in the Boston area, with often devastating consequences for core civil rights and civil liberties, particularly for oppressed peoples. The solution: Comprehensive, commonsense community oversight A comprehensive surveillance oversight ordinance will strengthen civil rights and civil liberties for all people in Cambridge, without adversely impacting public safety. Among other things, a strong ordinance aims to achieve three primary goals: transparency, democratic oversight, and ongoing accountability. First, it will give the public a voice in the City government's decisions about when, how, and if to use surveillance equipment. Under the terms of a strong ordinance, the Cambridge City Council will hold a public hearing or solicit public input whenever any government entity seeks: funding for surveillance technology; to acquire or borrow surveillance technology; to use surveillance technology in a new way; and/or to implement an agreement to share surveillance data with outside entities. Members of the community will have the opportunity to testify in an open public debate about their views on these matters. Second, in order to obtain the City Council's approval for use or acquisition of surveillance technology, a government entity must first publicly publish a Surveillance Impact Report. The report must explain the purpose of using the surveillance equipment, how the equipment functions, and how it will be used and why. It must also detail the training that the agency will provide to the people who will use the technology, as well as disclose whether it will share the surveillance equipment or surveillance data with any other government body-and if so, with whom and under what circumstances. 1 hird, the requesting government entity must also publish a Surveillance Use Policy. The policy must describe the authorized and prohibited uses of the surveillance equipment, the kind of data it will collect, how the agency will use the data, and what the agency will do to protect the data. It will also describe its data retention policies, and disclose what kinds of data may inadvertently be collected and how that data will and will not be used. Additionally, if the agency seeks to share collected data, it will explain why it wishes to share that information, how it will share the data, and how it will ensure that the other entities will protect the shared information. Further, the requesting entity must also describe its oversight and auditing system, to ensure the technology and surveillance data is not misused or abused. Then the Council will decide whether or not the technology or information sharing agreement and the policy to govern them are a good fit for the City, and vote to approve or deny them. If one or both are denied, the City may not acquire or use the technology. Finally, a strong ordinance will ensure democratic accountability over the surveillance activities of City agencies. Any government entity using surveillance equipment prior to the passing of the ordinance must obtain approval for the continued use of that technology in a manner consistent with the practices laid out in the ordinance. The ordinance requires each agency that uses approved surveillance equipment to produce an Annual Surveillance Report, and make the Report available to the City Council and on its public website. The Report must include information about how the technology was used, whether surveillance data was shared 5 See, for example, "Boston Police used social media surveillance for years, without informing City Council," February 2, 2018, Privacy Matters. https://privacysos.org/blog/new-report-shows-boston-police-used-social-media-surveillance- years-without-informing-city-council/.

with outside entities (and if so, whom, for what purposes, and under what legal authorizations), the results of any internal audits, and the total aunual cost for the surveillance technology, to include future budget plans for its continued usc. Ultimately, this ordinance mandates good, democratic, open government. It does not prohibit the use of any specific type of surveillance technology, but rather ensures the community makes decisions in an open, transparent, and democratic manner, and that any approved technology is only used in ways the community consents to in advance. ACLU recommendations for strengtbening the City draft ordinance Again, we are grateful for the substantial work that has been done to produce the draft ordinance before your committee today. We see it as a solid basis for a comprehensive ordinance, and offer some suggestions to strengthen the language, to ensure it achieves the goal of establishing community oversight of surveillance technology acquisitions and use in Cambridge. The following recommendations will ensure the ordinance achieves these goals: 1. In section 12.22.020 (F) 3 c., the draft exempts "cameras installed in or on a police vehicle" from the requirements of the ordinance. This exemption could be read to include license plate reader cameras. The language should be modified to read, "cameras installed in or on a police vehicle, not to include license plate reader cameras." 2. In sections 12.22.030 (A) and (B), the draft ordinance requires city agencies to "submit to the City Council a Surveillance Impact Report and obtain City Council approval before" acquiring or using surveillance technologies. The language should read, "submit to the City Council a Surveillance Impact Report and a Surveillance Use Policy and obtain City Council approval of both before" acquiring or using surveillance technologies. Similarly, section 12.22.060 (C) should be modified to read: "..including whether the City Council approved, rejected, or required modifications to the Surveillance Impact Report and/ or Sureillance Use Policy." 3. In section 12.22.030 (C), the draft states that the Council "shall balance" a number of factors in making its decisions. We recommend the language state: "..the City Council shall consider the safeguarding of individuals' rights to privacy, freedom of speech, and freedom of association, as well as the investigative responsibilities of the Police Department." 4. In section 12.22.050 (B), the draft states: "To the extent the City Manager... determines that approving or denying the Surveillance Use Policy would unlawfully obstruct the investigative or prosecutorial functions of the Police Department, the City Council shall simply receive and discuss the applicable portions of the Surveillance Use Policy." This sentence is a loophole that swallows the entire ordinance, and should be removed in its entirety.6 5. In section 12.22.060 (A), the draft states: "Similarly, if the City Council received but did not approve a Surveillance Impact Report from the Police Department because of concerns over obstructing the Poice Department's investigative ot prosecutorial function, the Police Department must still submit an Annual Surveillance Use Report..." This sentence is confusing and should be removed in its entirety. The ordinance should require that, except in exigent circumstances, the City Council has the final say over surveillance technology acquisitions. 6. In section 12.22.060 (13), the mechanism for ongoing oversight is insufficient. The current draft states: "If the benefits or reasonably anticipated benefits of the technology] do not outweigh the financial and/or operational costs or civil liberties or civil rights are not reasonably safeguarded, the City Council may consider (1) recommending modifications to the Surveillance Use Policy that are designed to address ". The language about "investigative and prosecutorial funcrions" does not appear in any city surveillance oversight ordinance in the country. It only appears in the Santa Clara Conny, California ordinance, because that ordinance governs county government. The language was included in Santa Clara to ensure the ordinance did not impact the Santa Clara District Attorney or the Santa Clara SherifF, both of whorn are elected officials. None of the city ordinances in California or Washington state include this provision, and it should be removed from the Cambridge draft, because Cambridge is a cily not à county.

the City Council's concerns to the City Manager for his consideration; and/ or (2) requesting a report back from the City Manager regarding steps taken to address the City Council's concerns. "This framework leaves ongoing oversight up to the City Manager, whereas a strong oversight ordinance empowers the City Council to revoke authorization for use of a surveillance technology if the Council determines the technology has been used in ways that do not benefit the City and its people. Crucially, this draft provides no mechanism whereby the Council may revoke authorization. In order to ensure ongoing accountability and oversight, the Council must have this authority. 7. The draft ordinance does not establish a process for requiring public input in the City Council's deliberations over Surveillance Impact Reports or Surveillance Use Policies, and it must. The ordinance should stipulate that the Council hold public hearings to discuss every Surveillance Impact Report and Use Policy before the Council votes to approve or deny them. At minimum, in cases where the Council determines it is necessary because of time or resource constraints, the Council must allow for a public comment period before approving or denying any Impact Report or Use Policy. 8. Finally, in section 12.22.070, the draft ordinance states that the City Manager shall enforce the ordinance. This is insufficient. The ordinance should include a right of private action, at minimum, as well as a provision mandating the awarding of successful litigants reasonable attorneys' fees. The ACLU also recommends including whistleblower protections, as outlined in Section 9 of the attached ACLU model surveillance oversight ordinance.? We hope the Council will support a strong surveillance oversight ordinance, and we welcome the opportunity to answer questions and be a resource to the City throughout this process. Thank you. Kade Crockford Director Technology for Liberty Program ACLU of Massachusetts [email removed] 7 The ACLU's model ordinance is also available online. https://www.aclu.org/files/communitycontrol/ACLU-Local- Surveillance-Technology-Model-City-Council-Bill-January-2017.pdf.

ATTACHMENT D Lopez, Donna From: Richard Stallman <[email removed]> Sent: Wednesday, April 18, 2018 12:04 AM To: Lopez, Donna Cc: [email removed] My comments on the surveillance draft Subject: IlL To any NSA and FBl agents reading my email: please consider I]] (Il whether defending the US Constitution against all enemies, 11] If foreign or domestic, requires you to follow Snowden's example. Ill Please forward this to the council members and others who may be interested. First of all, I support what Kade Crockford said. Now on to other points. Paper records are harder to centralize and scan through; that limits their harmful uses. So it makes sense to make special rules for digital surveillance. Perhaps replace "electronic" with "yielding digital data". Don't permit officials to maintain "exigent circumstances" in an unbounded and unaccountable way. There should be a time limit (one week?) after which they must ask the city council for approval to continue it, and again periodically (perhaps every month). When you hear "smart", think "spy". A "smart city" is a proposal for lots of surveillance. We need this ordinance to ensure that systems used for optimization of services are designed not to surveil people. Some points refer to "opting out". The question is, what price do you pay for opting out? If that price is high, the surveillance is effectively mandatory. Definition (C), of surveillance: the result of combining various kinds of data should be considered for all kinds of data, not only for license plate data. Definition (D) should be extended to cover surveillance done by cooperation between the city and others. I'd like to define "surveillance-safe". Calling a surveillance device surveillance-safe means 1. If it records surveillance data, that data must be made and kept locally only, so that accessing the data requires physical access to the device. 2. It cannot transmit surveillance data remotely or to other computers or devices. 3. The data are erased automatically in no more than two weeks, if it has not been collected. 4. The city does not access these data except for a specific stated reason pertaining to the location and a time period. 1

5. As a limited exception, if the device detects a crime, it can report that immediately. Likewise if it detects people, cars or objects sought by court order. Also if it detects a problem that requires immediate attention from the city, such as a traffic jam, a collision, a fire, or a damaged building. The draft has several exceptions for certain cameras and systems. I think these exceptions should cover only devices that are surveillance-safe. This includes parking systems and traffic-monitoring systems, though one would hope the traffic-monitoring systems are designed so that they cannot identify individual vehicles and therefore are not surveillance tech. Cameras carried by city employees, such as cops, or their vehicles, should have an exception from these rules only if they are covered by other special rules to ensure that they do not do massive surveillance. Dr Richard Stallman President, Free Software Foundation (https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgnu.org&data=02%7C01%7Cdlopez%40cambridg ema.gov%7C8b4ff6b1е7dc4f5f8ae208d5a4e169e6%7Cc06a8be784794d73b35193bc9ba8295c%7C0%7C0%7C63659621 0411722524&sdata=3G7cрАКnf%2ВyFdrZхDwH5UІÑh2J1KJQxАjOХ%2F2bqpYc%3D&reserved=0, https://naO1.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffsf.org&data=02%7C01%7Cdlopez%40cambridge ma.gov%7C8b4if6b1e7dc4f5f8ae208d5a4e169e6%7Cc06a8be784794d73b35193bc9ba8295c%7C0%7C0%7C636596210 411722524&sdata=KFqZ%2В7yЕЗСUí1UjGHObxwZGZtHNL6q1kiQ|gTGoaF8Е%3D&reserved=0) Internet Hall-of-Famer (https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Finternethalloffame.org&data=02%7C01%7Cdlope z%40cambridgema.gov%7C8b4ff6b1e7dc4f5f8aе208d5а4e169e6%7Cc06a8be784794d73b35193bc9ba8295c%7C0%7C0 %7C636596210411722524&sdata=jbw%2FN9yLGUsaYLLUWLpN%2ВІAHfKbBb7qCFHYvEHIfCF1%3D&reserved=0) Skype: No way! See https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fstallman.org%2Fskype.htm|&data=02%7C01%7Cdl opez%40cambridgema.gov%7C8b4ff6b1e7dc4f5f8ae208d5a4e169e6%7CcD6a8be784794d73b35193bc9ba8295c%7C0% 7C0%7C636596210411722524&sdata=lefGbHxzYt6JUNDTZkTE11fz%2BvABjfiiAMnKFqRIEsU%3D&reserved=0. 2

including the City Manager, should have authority for surveillance deployment in this ordinance; only the City Council should and there must be public input. Ilan Levy, 48 Spring Street, stated that proposed supervision of technology surveillance should be in the hands of the public and the City Council and not the City Manager. He stated that exigent circumstances are defined well enough. He is disturbed about the property damage issue. A protest could do some damage on property and could the police use that damage to require surveillance. He cautioned about a smart city because the information can be misused and noted that it is important to try to understand what others are doing and how they might abuse information the City collects before it is collecter He spoke about technology influencing lives. He wanted the city to be tight and narrov with this ordinance because the technology changes so rapidly. Saul Tannenbaum, 16 Cottage Street, noted that a lot of city staff time has been devoted on this. He had 3 points. He as uncomfortable with the City Manager determining if something is unlawful; he stated that he is uncomfortable with this power residing in one individual and enforcement should be larger than the City Manager. This is about transparency. He spoke about private companies and that there are other police forces in the city that he would look at regarding surveillance before private companies. He has more concern with the private corporation of Harvard and MIT. He spoke about smart cities and stated that they are surveillance cities. He stated that MIT's proposal was for smart devices where the data would stay on the device and not move anywhere. He stated that we should move towards privacy protection. _, 625 Mass. Avenue, stated that he has a background on privacy rights. He stated that he understands the need to have access to surveillance technology but worries about its actual use. Once the equipment is purchased the City Council should have power over the licensure and suggested certification for the operators. This would ensure oversight and accountability of the operators. There can be a limit to who has access to the equipment. At 3:19 PM Councillor Kelley closed public comment. Councillor Kelley stated that he wanted something before the City Council before this summer. Is this possible? He suggested having one more Public Safety Committee hearing and a couple of working meetings. He stated that once referred to the Ordinance Committee this may not need to be vetted again. He wanted this before the Ordinance Committee before June. 6

Vice Mayor Devereux suggested one more Public Safety Committee hearing before sending the ordinance to the Ordinance Conmittee. It would be in a "close enough" version if not absolutely final. Mayor McGovern stated that this started in June 2016 with a discussion with ACLU and it has been before the City Council. He wanted to see this more forward. He would be fine going to the Ordinance Committee sooner rather than later. Councillor Zondervan supported sending the ordinance to the Ordinance Committee as soon as possible. Deputy City Manager Peterson noted that there are a lot of questions that have come up today. She wanted to get back to the committee in a month with the answer to the questions. She suggested a Public Safety Committee hearing at the end of May or early in June. Councillor Kelley stated that he does not want to give this back to City and then the City Council is not doing anything. He envisioned touching bases to ensure that this not drifting too far from what is supportable. Deputy City Manager Peterson stated it is hard not to do this in the Public Safety Committee. Councillor Kelley wanted a working group to meet. City Solicitor Glowa stated that she would have to investigate to ensure that it is a requirement of open meeting law. Mayor McGovern wanted the City to work with the ACLU. City Manager DePasquale stated that the City can work with ACLU and he would like to keep this as it has been going. This is the third revision and he wanted to get to a position where all are happy. He wanted to keep this in this format. Councillor Carlone noted that the Manager's suggestion made sense and asked that where there is disagreement that both positions be outlined. Vice Mayor Devereux stated that this is a healthy working relationship. She wanted the City staff to get closer to the ACLU's position. The City and ACLU can continue their discussion. This needs to be opened to the Ordinance Committee for their input. Councillor Kelley stated that the ball is with the city staff to continue working with the ACLU. He wanted to be kept abreast of these meeting. Councillor Kelley stated that the following communications that were made part of the record.

ATTACHMENT E Lopez, Donna From: Nancy Murray < [email removed]> Sent: Monday, April 16, 2018 3:06 PM To: Lopez, Donna Subject: Testimony attached Attachments: Testimony Hearing on Surveillance.docx Please make the attached testimony available to members of the Public Safety Committee hearing on surveillance for the hearing being held on April 17 at 2pm. Thank you, Nancy Murray 204 Erie Street Cambridge, MA 02139

Testimony for Public Safety Committee Hearing on Surveillance In November 2016 and again in April 2017, I testified before the City Council on a Surveillance Ordinance that would establish public buy-in before potentially invasive surveillance technologies are acquired and installed, and would require reporting to the public on how the technologies are used. A year later I strongly reiterate my support for making the purchase and implementation of surveillance technology transparent and accountable to the public, with City Council approval playing an essential role in the process. By ensuring community control over police surveillance, the City Council would be demonstrating that here in Cambridge, democracy matters, and civil liberties and civil rights are taken seriously. Since the Surveillance Ordinance was first considered by the City Council two years ago, we have had ample opportunity to reflect on how unchecked surveillance endangers personal privacy and the well-being of residents across the country and here in Massachusetts. Facial recognition and biometric technology, social media monitoring systems, giant inter-connected databases and Fourth Amendment-evading drones are all now being utilized by various law entorcement agencies. From the high tech monitoring of protests to the use of surveillance technologies to detect, detain and deport immigrants, evidence abounds that the United States is fast losing any claim it might have had to be considered "the Land of the Free." What will the future bring? Recent revelations about how commercial companies like Facebook and Google have monitored, stored and shared our Internet data and current Congressional efforts to make it even simpler to obtain user data stored by US technology companies leave little doubt about the scope of the threats to personal privacy. At a time when the US seems to have lost its way in so many respects, it is easy to see how people can lose faith in government institutions and become cynical about the rights and protections guaranteed by the Constitution. The City Council now has the opportunity to help dispel this cynicism. Of all levels of government, local government, which serves as the foundation of our

trust in our institutions, can and should be most sensitive to the concerns of residents. It is here that accountability and transparency - and their lack - are most visible. By passing the Surveillance Ordinance you will be applying a cautionary brake to a process that seems increasingly out of control, as more and more private companies are seeking to sell their surveillance technologies to government entities. I urge the City Council to demonstrate that in Cambridge, elected officials believe a different future is possible. By involving the public in decisions about the tunding and use of particular technologies, you will be engaging Cambridge residents in a critically important civics lesson and might well inspire other municipalities to take a similar stand. You will also be demonstrating that public safety and constitutional rights and protections can and should co-exist. Nancy Murray 204 Erie Street Cambridge MA 02139 [phone removed]

ATTACHMENT F Lopez, Donna From: Sarah Vincent <[email removed]> Sent: Monday, April 16, 2018 5:50 PM To: Lopez, Donna Subject: Cambridge Hearing on Surveillance Info Dear Committee Clerk Lopez, I live at 11 Cogswell Avenue Unit 14, Cambridge, MA 02140. I am unable to attend the hearing on April 17 but this issue is important to me, so I'm writing to express my support for a strong surveillance oversight ordinance. Specifically, I want the ordinance to require city council approval of surveillance technologies in use and under consideration by city agencies, including the police. I want the council to give the public a voice each time a specific surveillance technology is considered. I also want the ordinance to require council approval of policies to govern how the technologies are used, and for each agency using approved technology to report back to the council and the public at least once a year about how they used the approved tools. Technologies like facial recognition and drones are coming, and we need to establish strong oversight now to ensure technologies like this aren't acquired or used in ways the community disapproves of. Cambridge should be a model for Massachusetts and pass a strong ordinance. I am an ACLU supporter, and l urge you to listen to the ACLU's voice on the specifics of the ordinance. It's important to me not only that we do this, but that we get it right. Thank you. Sarah G. Vincent

Lopez, Donna ATTACHMENTG From: Olivia Santoro < [email removed]> Sent: Tuesday, April 17, 2018 10:32 AM To: Lopez, Donna Subject; Testimony on Surveillance Oversight Ordinance To: Public Safety Committee Re: Surveillance Oversight Ordinance I am writing to express my support for the proposed surveillance oversight ordinance for the City of Cambridge. Although surveillance technologies may be purchased with the intention of enhancing public safety, we see more and more every day, that without proper oversight, they can have dangerous consequences for our privacy and liberties. Our city is home to people of many difference races and ethnicities. All too often we see how such technology can be turned against our immigrants communities and communities of color, and I want all residents of Cambridge to know that their rights and privacy matter and are respected I encourage the committee to pass an ordinance that would require the city council to approve the acquisition of surveillance technology by city entities, including the police. The ordinance should also require city entities to report on how they've used these tools. As a resident of Cambridge, I want to know when city entities are considering purchasing new equipment, and have an opportunity to offer comment. Cambridge has the opportunity to be a model for other cities in Massachusetts and across the country on this issue. I urge the committee 1o move forward with the ordinance and to look to the ACLU for continued guidance on this matter. Thank you. Sincerely, Olivia Santoro 224 Concord Avenue Cambridge, MA 02138