a report from Councillor Dennis J. Carlone and Councillor Craig A. Kelley, Co-Chairs of the Ordinance Committee, for a public hearing held on August 13, 2018 to discuss revisions to the proposed Municipal Code amendment to create a new chapter 12.22 entitled “Surveillance Technology Ordinance;” said revisions were submitted to the City Council on June 25, 2018

ATTACHMENTA i 1.13.a Assistant Cly Solicitors Nancy E. Glowa PaulS. Kawai City Solicitor amuel A. Ayleswort eplin K. U. Allwale Arthur J. Goldberg Sean M. McKendry Depuly City Solicitor degan B. Bayes rian A. Schwart Vali Buland First Assissant City Solicitor Public Records Access Officer Jennifer Simpsor CITY OF CAMBRIDGE Office of the City Solicitor 795 Massachusetts Avenue Cambridge, Massachusetts 02139 June 25, 2018 Louis A. DePasquale City Manager City Hiali draft of Surveillance Technoloy Ordinance) 795 Massachusetts Avenue Cambridge, MA 02139 Surveillance Ordinance - Explanatory Comments and Responses to Issues proposed Rei Raised by the ACLU at the 4/17/18 Public Safety Committee Meeting Dear Mr, DePasquale: I am pleased to submit to you revisions to the proposed draft Surveillance Technology Ordinance (the "Ordinance"), both redlined and clean drafts of which are attached hereto for your review and submission to the City Council for its consideration. By way of background, and as you are aware, City staff including you, Deputy City Manager Lisa Peterson, Police Commissioner Branville Bard, and members of this office have been meeting and conterring with Kade Crockford of the American Civil Liberties Union of Massachusetts (the "ACLU'") on several occasions over the last year and a hali, including numerous teleconferences with Ms. Crockford in order to discuss the concerns the ACLU and Digital Fourth have expressed with regard to the Ordinance. The ACLU had submitted questions concerning the Ordinance during the October 18, 2017 Public Safety Committee hearing to which the City responded in meètings and telephone • to CM 062518 FINAL (CMA 2018 #170 : revised conferences thereafter. During the April 17, 2018 Public Safety Committee hearing the Committee requested that a revised version of the Ordinance be prepared for a City Council meeting to be heid in late May or early June. At the April 17, 2018 Committee Hearing, the ACLU also submitted a number of specific questions related to the Ordinance; City staff met with the ACLU on June 14, 2018 to discuss those questions as well as other questions that had previously been submitted to City staff, and City staff then had a teleconference with Ms. Crockford on June 18, 2018 to discuss the proposed revisions City staff made to the Ordinance in order to address the ACLU's questions. Surveillance Ord NEG Set forth in detail below are questions and issues raised by the ACLU together with our responses to the same and further explanation, if any, regarding the City staff's recommendations as to those issues. Attachment: Facsimile (01 7) 349-4134 TTY/TTD [phone removed] Telephone [phone removed] Packet Pg. 89

• 1.13.a A. DEFINITIONS. 1. Section 12.22.020(E) Definitions—-Exigent Circumstances: Whether to Include Significant Property Damage or Loss in the Detinition of Exigent Circumstances (p. 2 of the redlined Ordinance). The ACLU suggested that "significant property damage or loss" should be removed from the Ordinance's definition of Exigent Circumstances in Section 12.22.020(B). • City staff do not recommend that "significant property damage or loss" be moved from the definition of Exigent Circustances in Sectic .22.020(B) of the Ordinance. By way of example, in the event that tt Police Department receives a tip that a large property may be destroyed by one or more individuals, and such property destrction poses public health or similar risk to the generai public, the Police Department needs the ability, under Section 12.22,040 of the Ordinance, to acquire and use on a temporary basis Surveillance Technology not previously approved by the Council, in order to mitigate or remove the risk that such property destruction poses. Indeed, other Surveillance Ordinances recently adopted in Berkeley and Davis, California, contain "property damage" in their definition of exigent circumstances. Moreover, there may be circumstances where the Police Department receives a tip that someone intends to destroy property used for emergency response purposes, i.e., someone could target all of the City's fire trucks or ambulances, and in so doing, hamper the City's ability to respond to fire and health emergencies, leading to loss of life. Given those risks, City staff strongly recommend that this language not be altered. However, in order to address the ACLU's concerns, City staff bava added the following language to the definition of Exigent Circumstances in Section 12.22,020(B): "The use of Surveillance Technology in Exigent Circumstances shall not infringe upon an individual's right to peacefully protest." 2. Section 12.22.020(F)(3)(c)—Definitions—Exomption for Cameras Installed In or On a Police Vehicle: Excluding Cameras with License Plate Reading Technology from the Exemption for Cameras Installed In or On a Police Vehicle (0.5). The next suggestion of the ACLU's is to add "except license plate readers" to 12.22.020(F)(3)(c) which exempts cameras installed in or on a police vehicle from the requirements of the Ordinance, in other words, making "license plate readers" subject to the provisions of the Ordinance. • That change is agreeable to City staff, and City staff have revised 12.22.020(F)(3)(c) to include: "cameras installed in or on a police vehicle, except cameras with license piate reading technology", so that cameras with Page 2 of 9 Attachment: Surveillance Ord NEG Itr to CM 062518 FINAL (CMA 2018 #170 : revised proposed draft of Surveillance Technoloy Ordinance) Packet Pg. 90

1.13.a such technology will not be exempt from the requirements of the Ordinance. 3. Section 12.22.020(L)—Definitions-Technolory-Speeific Surveillance Use Policy: Adding a Definition of Technology-Specifie Surveillance Use Policy (p. 8). Because the ACLU suggests that a City department should be required to submit & specific Surveillance Use Policy as to a specific technology when the City department is seeking Council approval of the specific Surveillance Technology, City staff have added a new definition for a "Technology-Specific Surveillance Use urveillance Technoloy Ordinance) Policy" in Subsection (E) of 12.22.020. B. ACQUISITION AND USE OF SURVEILLANCE TECHNOLOGY. 1. Sections 12.22.030—Acquisition of Surveillance Technology and 12.22.040- Temporary Acquisition and Use of Surveillance Technology in Exigent Circumstances: Adding the Requirement that a Technology-Specific Surveillance Use Policy be Submitted with a Surveillance Impact Report (P.p. 8-12). As noted in the preceding paragraph, the ACLU has suggested that a City department should be required to submit a Surveillance Use Policy when the department is seeking Council approval of acquisition and use of a specific Surveillance Technology under 12.22.030(A) and (B), or when the department is submitting an Aunual Surveillance Report to the Council under 12.22.060(A). • That change is agreeable to City staff, and City staff have thus included the requirement that a Technology-Specific Use Policy be submitted along with a Surveillance Impaet Report required in Sections 12.22.030(A) aud (B), and 12.22.040 where the specific technology for which approval is sought is not already covered under the City's Surveillance Use Policy. 2. Section 12.22.030(C) City Council Approval of Acquisition of Surveillance Technology: Language Revision (p. 9). Section 12.22.030(C) provides that "in approving, and/or disapproving any acquisition of Surveillance Technology, the City Council shall balance the safeguarding of individuals' right to privacy against the investigative and prosecutorial functions of the Police Department and promoting and ensuring the safety and security of the general public." The ACLU suggested that the City use the word "consider" in place of "balance." In addition, during the June 14, 2018 meeting, the ACLU also suggested that the word "against" be replaced with the phrase "as well as." Surveillance Ord NEG Itr to CM 062518 FINAL (CMA 2018 #170 : revised proposed draft of S • Those changes are agreeable to City staff, and City staff have revised Section 12.22.030(C) as well as Section 12.22.050 (B) to read: "In Page 3 ot 9 Attachment: Packet Pg. 91

1.13.a approving, and/or disapproving any acquisition of Surveillance Technology, the City Council shall consider the safeguarding of individuals' right to privacy as well as the investigative and prosocutorial functions of the Police Department and promoting and ensuring the safety and security of the general public." 3. Sections 12.22.030(D) and 12,22.040: Sarveillance Impact Report and Technology-Specific Surveillance Use Polley to be Made Available No Fewer than ? Days Prior to Council Meeting (p.p. 9-10). The ACLU also stated that the Ordinance does not allow for enough public input as written. • In response, City staff have added the foliowing language to the Ordinance: i. A new section has been added to Section 12.22.030 as follows: "(D) Any Surveillance Impact Report, and, if necessary, Technology- proposed draft of Surveillance Technoloy Ordinance) where it shall be discussed." ii. City staff also added the following language to 12.22.040: "Any Surveillance Impact Report, and, if necessary, Technology- Specific Surveillance Use Policy submitted to the City Council under this Section shall be made publicly available no fewer than seven (7) calendar days prior to the date of the Council meeting where it shall be discussed." C. SURVEILLANCE USE POLICY. 1. Section 12.22.050(A)-Submission of Surveillance Use Policy to the City Council: Surveillance Use Policy Shall be Made Publicly Available No Fewer than 7 Days Prior to Council Meeting (p. 10). As part of the revisions City staff made in order to address the ACLU's concern that there is not enough opportunity for public input in the Ordinance as written, City staff have also revised the language of the Ordinance with respect to the submission of the Surveillance Use Policy. • City staff added the following language to 12.22.050(A): Any Surveillance Use Policy submitted under Section 12.22.050 shall be made publicly available no fewer than seven (7) calendar days prior to the date of the Council meeting where it shail be discussed. Page 4 of 9 Attachment: Surveillance Ord NEG It to CM 062518 FINAL (CMA 2018 #170 ; revised Packet Pg. 92

1.13.a Ice) 2. Section 12.22.050(B)- Council Approval of the Surveillance Use Policy: ACLU Concern re "Unlawfully Obstruct" Language (p. 10). The ACLU suggested that the following sentence be removed from Section 12.22.050(B) regarding the Council's authority to approve or disapprove a Surveillance Use Policy: "To the extent the City Manager determines that approving or disapproving the Surveillance Use Policy would unlawfully obstruct the investigative or prosecutorial functions of the Police Department, the City Council shall simply receive and discuss the applicable portions of the Surveillance Use P'olicy." • This change is not recommended, as it would allow the City Council to have ultimate decision making authority over critical decisions relating to of Surveillance Technoloy he investigative and prosecutorial functions of the Police Department rathe han the Police Commissioner and the City Manager, It also potentially run afoul of the provisions of the City's Plan F. Charter, as it appears to relate more to operational issues and the discretion provided under the charter to the City Manager than to the broadet policy making role of the City proposed draft: Council. City staff discussed the ACLU's suggested change with Ms. Crockford during the June 14, 2018 meeting with her and explained that this was not acceptable to the City. City staff also believe that this concern is addressed in Section 12.22.060(B)(1), which gives the City Council an opportunity to "recommend modifications to the Surveillance Use Policy that are designed to address the City Council's concerns to the City Manager for his consideration." Therefore, to the extent the City Council has a concern over a provision in the Surveillance Use Policy, the City Council will have an opportunity to recommend that the City Manager revise same accordingly. D. ANNUAL SURVEILLANCE REPORI. 1. Section 12.22.060(A)--Submission of Annual Surveillance Report Approval: Language Revision (p.p. 10-11) The ACLU stated that the following language in the second sentence of Section 12.22.060(A) is confusing and should be removed: "Similarly, if the City Council received but did not approve a Surveillance Inpact Report from the Police Department because of concerns over obstructing the Police Department's investigative or prosecutorial function, the Police Department must still submit an Annual Surveillance Report within twelve (12) months of the City Council's receipt of the Surveillance Impact Report, and annually thereafter on or before March 1." • City staff is agreeable to revising the language of that section, After review, City staff suggest revising Section 12.22.060(A) by separating it into three subsections as follows: Page 5 of 9 Attachment: Surveillance Ord NEG Itr to CM 062518 FINAL (CMA 2018 #170 : revis Packet Pg. 93

• 1.13.a "(1) A City department head who has obtained approval for the use of Surveillance Technology or the information it provides under Section 12.22.030 ot Section 12.22.040 of this Chapter, must submit an Annual Surveillance Report within twelve (12) months of City Council approval, and annually thereafter on or before March I. (2) Where the Police Department submitted & Surveillance Impact Report, and, if necessary, a Technology-Specific Surveillance Use Policy that the Council did not approve prior to the Police Department's use of the Surveillance Technology, the Police Department must still submit an Annual Surveillance Report within twelve (12) months of the City Council's receipt of the Surveillance Impact Report, and annually thereafter on or before March 1. (3) Any Annual Surveillance Report submitted under this section shall be made publicly available no fewer than seven (7) calendar days prior to the date of the Council meeting where it shall be discussed." Section 12.22.060(A)(3) is also discussed in Section 2 below. 2. Section 12.22.060(A)(3)—Submission of Annual Surveillance Report: Annual Surveillance Report Shall be Made Publicly Available No Fewer than 7 Calendar Days Prior to Council Meeting (p. I1). In response to the ACLU's concern about allowing enough opportunity for public comment, City staff have revised Section 12.22.060(A) of the Ordinance to require that Annual Surveillance Report be submitted at least seven (7) calendar days prior to the date of the Council meeting where it shall be discussed. "(3) Any Annual Surveillance Report submitted under this section shail be made publicly available no fewer than seven (7) calendar days prior to the date of the Council meeting where it shall be discussed." 3. Section 12.22.060(B)—Council Review of Annual Surveillance Reports: Enforcement (p. 11): The ACLU stated that Section 12.22.060(B) is insufficient for enforcement purposes, and suggested that the language be revised to provide that. Section 12.22.060(B) currently reads: *... If the benefits or reasonably anticipated benefits do not outweigh the financial and/or operational costs or civil liberties or civil rights are not reasonably safeguarded, the City Council may consider (1) recommending modifications to the Surveillance Use Policy that are designed to address the City Council's concerns to the City Manager for his consideration; urveillance Ord NEG Itr to CM 062518 FINAL (CMA 2018 #170 : revised proposed draft of Surveillance Technoloy Ordinance) and/or (2) requesting a report back from the City Manager regarding steps taken to address the City Council's concerns." Page боf9 Attachment: Packet Pg. 94

• 1.13.a • In order to address the ACLU's concern, City staff have added the ollowing language to Section 12.22.060(B): "and/or (3) recommend to th city Manager that use of the Surveillance Technology cease.' E. ENFORCEMENI OF THE ORDINANCE. 1. Section 12.22.070Enforcement: Right of Action and Penalties for Violation (p.p. 11-12). The ACIU submitted a comment stating that the Ordinance should provide for a rivate right of action, the award of attorneys' fees to successful litigants, an vhistleblower protection • City staff do not recommend that the City provide suck a private right of action for a variety of reasons, which City staff have explained to Ms. Crockford, and as explained below. In cases where a City employee violates the Surveillance Use Policy or parts of the Surveillance Ordinance, the City Manager has the authority to discipline such an employee, including terminating the employee. Furthermore, the City's Employee Manual and Collective Bargaining Agreements contain provisions for disciplining employees, up to and including termination, where the employec violates a City policy or a municipal ordinance. In addition to the policy considerations that mitigate against the City providing for individuals to bring private causes of action against the City or City employees personally for alleged violations of a City ordinance, such a provision in a municipal ordinance would likely conflict with the provisions of the Massachusetts Tort Claims Act ("Chapter 258"') which irrumunizes Massachusetts municipalities and their officials and employees from liability in, among others, claims based upon an act ot omission of a public employee when the employee is exercising due care in the execution of any regulation of a public employer, or any municipal ordinance or by-law. The Legislature of the Commonwealth enacted Chapter 258 to act as a limited waiver of the common law doctrine of sovereign immunity, and thus, enabled the Commonwealth and its political subdivisions (i.e., cities and towns) to be sued in courts in limited circumstances. The Supreme Judicial Court has held that sovereign immunity is still in effect unless consent to suit has been expressed by the terns of a statute, or appears by necessary implication from them. Io provide for a private right of action under the Surveillance Ordinance would be a significant deviation from Chapter 258, and would mean that any City employee or elected or appointed offcial could be subject to personal liability in actions stemming from alleged violations of the Ordance regardless of whether the alleged violation was intentional. To the extent a City employee may commit an intentional tort or violate civil rights, there are existing remedies under state and federal laws which, depending on the allegations, pernit individuals to file lawsuits against the City and City Page 7 of'9 Attachment: Surveillance Ord NEG Itr to CM 062518 FINAL (CMA 2018 #170 : revised proposed draft of Surveillance Technoloy Ordinance) Packet Pg. 95

1.13.a employces for civil rights violations and intentional torts. For instance, ar individual who was subject to surveillance without a warrant may file a lawsuit in state or federal court against both the City and the City employee for the alleged civil rights violation, and collect damages if successful, for such civil rights violation. After careful consideration of this matter, however, and having reviewed the provisions of the Surveillance Technology ordinances adopted in Davis, California and Seattle, Washington, City staff recommend that the following language be included in Section 12.22.070 of the Ordinance. City staff believe that the below language meets the appropriate balance between the existing remedies available to individuals under state and federal law, the protections afforded to municipalities under Chapter 258, and providing members of the public with the ability to seek redress under this Ordinance: (A) Enforcement Officials. This Chapter shall be enforced by the City Manager or his/her designee. (B) Violation. Any person injured by a violation of this Chapter may institute proceedings for injunctive relief, declaratory relief, or a court order in a court of competent jurisdiction to enforce the provisions of this Chapter subject to the provisions of Subsection (C) below. Any action instituted under this Subsection (B) shall be brought against the City of Cambridge, but not against City employees. No monetary damages ot award of Horneys' fees shall be allowed in any legal proceeding for any alleger injuries arising out of any alleged violation(s) of this Chapter. (C) Notice and Procedure. (1) No legal proceeding under Subsection (B) above shall be brought unless the City has first been given written notice within thirty (30) days of the alleged violation(s) addressed to the City Clerk and specifying: (a) the name and address of the person(s) allegedly injured; (b) the date(s), time and placo(s) of the alleged violation(s); and (c) a detailed description of the alleged injury. (2) Prior to the initiation of any legal proceeding under Subsection (B) above, the City shall be permitted minety (90) days from the date of the City's receipt of the written notice of the alleged violation(s) within which to investigate such alleged violation(s) and, if substantiated, to correct such alleged violation(s). (3) If the alleged violation(s) is substantiated and subsequently cured, the Surveillance Ord NEG Itr to CM 062518 FINAL (CMA 2018 #170 : revised proposed draft of Surveillance Technoloy Ordinance) City shail so notify the person(s) allegedly injured by such alleged violation(s) and a notice shall be posted on the City's website that Page 8 of 9 Attachment: Packet Pg. 96

1.13.a describes the corrective measure(s) taken to address the violation(s) and no legal proceedings to remedy the alleged violation(s) shail be allowed pursuant to Subsection (B) above. (D) Nothing in this Chapter shall be construed to limit or affect any individual's rights under state or federal laws. Very truly yours, Nancy B. Glowa City Sotteitor Attachments: Clean and Redlined Revised Drafts of Surveillance Ordinance Page 9 of 9 Attachment: Surveillance Ord NEG Itr to CM 062518 FINAL (CMA 2018 #17D : revised proposed draft of Surveillance Technoloy Ordinance) Packet Pg. 97

Draft 6/25/18 redlined 1.13.b Surveillance Technology Ordinance Chapter 12.22 Section 12.22.010 Purpose The purpose of this Chapter is to provide for the regulation of Surveillance Technology acquisition or use by the City of Cambridge, to safeguard the right of individuals to privacy, to balance the public's right to privacy with the need to promote and ensure safety and security, to provide protocols for use of Surveillance Technology that include specific steps to mitigate potential impacts on the civil rights and liberties of any communities or groups including communities of color or other marginalized communities in the City balance any decision 1o use Surveillance Technology with an assessment of the costs and actection of privacy, civil a deploying Surveillance liberties and civil rights, to allow for informed public discussio and to minimize the risks Technology, 10 provide for transparency, oversight, and accountability posed by use of Surveillance Technology in the City. Section 12.22.020 Definitions The following definitions apply to this Chapler: (A) "Annual Surveillance Report"® aeans a written report concerning specific Surveillance Technology that ine Call of the follow (1) A description of how the Suryeilla scinglogy has been used, including whether it captured ges, soun or information regarding members the public who arenot suspected of engaging in unlawful conge Whether ande fed through the use of the Surveillance (2) ogy was shared with ottside entities, the name of any recipient entity, data disclosed, under what legal standard(s) the type(s) information las disc ., and the justification for the disclosure; (3) summary of community complaints or concerns about the Surveillance schnology, The resta (4) of any non-privileged internal audits. any information about violations of the Surveillance Use Policy, and any actions taken in response; Whether the Surveillance Technology has been effective at achieving its (5) identified purpose; (6) Statistics and information about public records requests: Attachment: Surveillance Ord RL 06-25-18 (CMA 2018 #170 : revised proposed draft of Surveillance Technoloy Ordinance) (7) Total annual costs for the Surveillance Technology. including personnel and Packet Pg. 98

• Draft 6/25/18 redlined 1.13.b other ongoing costs. and what source of funding will fund the technology in the coming year; and (8) #Whether the civil rights and liberties of any communities or groups, including ommunities of color or other marginalized communities in the City a isproportionately impacted by the deployment of the Surveillance Technolog (B) or his/her designee's "Exigent Circumstances" means the Police Commissiong good faith belief that an emergency involving danger of death, physical injury, or significant property damage or loss requires use of the eillance Technology or the information it provides. The use of Surveillance Teenolog Exigent ully protest. Circumstances shali not infringe upon an individual's ight to "Surveillance" means to observe or analyze the movements, behavior, o (C) actions of identifiable individuals in a manner that is reasonably likely to Rech g association, racią raise concerns about civil liberties, freedom of nclude individuals equity or social justice. Identifiable individuals als hap combined with whose identity can be revealed by license plate data any other record. It is not surveil if an individual cowingly and isrand nation, or had ac voluntarily consented to provide the conspicuous opportunity to opt out of providing the information. (D) "Surveillance Datat means any electronic data collected, captured, 7, processco, intercepted recorded, retainer or analyzed by Surveillance acquired by the City or operated at the direction of the City. Technology "Surveillance Impo means a publicly-released written report including (E) at a muarthe followi Information describing o Surveillance Technology and how it works; information on the proposed purpose(s) for the Surveillance Technology; (2) 06-25-18 (CMA 2018#170 : reviced proposed draft of Surveillance Technoloy Ordinance) (3) RL The Jacation(&yit may be deployed and when; Ord (4) aptial impact(s) on privacy in the City; the potential impact on the civil rights and liberties of any communities or groups. including, but nor limited to, communities of color or other marginalized communities in the City, and a description of whether there is a plan to address the impacts): and urveillance nt: (5) The fiscal costs for the Surveillance Technology, including initial purchase, personnel and other ongoing costs, and any current or potential sources of funding Attachme Page 2 of 13 Packet Pg. 99

Draft 6/25/18 redlined 1.13.b (F) "Surveillance Technology" means any electronic surveillance device. hardware, or software that is capable of collecting, capturing, recording, retaining, processing. intercepting, analyzing, monitoring, or sharing audio, visual, digital, location, thermal, biometric, or similar information or communications specifically associated with, or capable of being associated with, any specific individual or group; or any system, device, or vehicle that is equipped with an electronic surveillance device, hardware. or software. 1. "Surveillance Technology" includes, but is not limited to: IMSI) catshers and (a) #International mobile subscriber identit other cell site simulators; (b) #Automatic license plate rea (C) eElectronic toll readers; (d) e Closed-circuit television cameras exceptas otherwise provided herein; proposed draft of Surveillance Technoloy Ordinance) bBiometric Surveillanee Technol (e) By including facial, voice, avare an iris, and gait-recognitio ibases: Mobile B (f) A capture tecanology: (g) gunshot detection and locauon hardware and services: -ray band aue (i) Monitoring and/or recording technology; such surveillance cameras and wearable body cameras; sSurveilance enabled or capable lightbulbs or light fixtures; (k) ols, including software and hardware, used to gain mauthorized access to a computer, computer service. or computer network; Social media monitoring sofiware; (1) (m) *Through-the-wall radar or similar imaging technology; ePassive scanners of radio networks: (n1) Attachment: Surveillance Ord RL 06-25-18 [CMA 2018 #170 : revised Page 3 of 13 Packet Pg. 100

Draft 6/25/18 redlined 1.13.b (0) ‡Long-range Bluetooth and other wireless-scanning devices; (p) *Radio-frequency identification (RFID) scanners; and §Software designed to integrate or analyze data from (4) Surveillance Technology, including surveiltance target tracking and predictive policing software. For the purposes of this Chapter, "Surveillance Technology" does not include the following deviceter nardware, become unless they have been equipped with, or are modified or include, a Surveillance Technology as definee above (a) televisions, compute *Routine office hardware, such and printers, that are in widespread publig use and will no -related be used for any surveillanee or surveillan functions; Parking Ticket Devices ("PTDs") and related databases: (b) none (c) mManually-operated arable, handheld digital carccorders that are not cameras, audio recorders, and designed to be used suraptitously and whose functionality is used tor manually capturing and mañually downloading ¡deo and/er audio recordings; (d) *Surveillance revices that cabriot record or transmit audio or videa o be remate obessed, such as image stabilizing binoculare ds night vision goggles; (CMA 2018 #170 : revised proposed draft of Surveillance Technoloy Ordinance) (e) Cily databases do not and will not contain any data or other informatjen collected, captured, recorded, retained. processed, intercepted, or analyzed by Surveillance Technology; (f) danually-operated technological devices that are used primarily for internal City communications and are not designed to surreptitiously collect Surveillance Data, such as radios and email systems; (g) *Parking access and revenue control systems, including proximity card readers and transponder readers at City- owned or controlled parking garages: and Attachment: Surveillance Ord RL 06-25-18 Page 4 of 13 Packet Pg. 101

Draft 6/25/18 redlined 1.13.b (h) eElectronic card readers and key fobs used by City employees and other authorized persons for access to City- owned or controlled buildings and property. 3. For the purposes of this Chapter, the following Surveillance Technology is exempt from the requirements of this Chapter: a) Information acquired where the individual knowingly and voluntarily consented to provide the information, sueb as submitting personal information for the recei Prof City services; Information acquired where the individuat was presented with a clear and conspicuous onfortunity to opt out of o providing the information: c) Cameras installed in or on a police le, except cameras. with license plate sading technology: IG state law auth cation in or Cameras installed piresuan ghi-of-way solely to on any vehicle or along a pubbe record traffic violations ameras ir alled on City e) property solely for security urposes, including closed ocut television cameras INst Ted by the City to moniter entryways and outdoor arcas d or contolled buildings and property or the putt așe of controling access, maintaining the Employees and visitors to City buildings, and protecting property; security cameras including closed circuit television cameras installed by the City to monitor cashiers' windows and offer cash-handling operations and to maintain the ty of City employees and visitors to such areas; g) Cameras installed solely to protect the physical integrity of City infrastructure; or Technology that monitors only City employees in response to complaints of wrongdoing or in order to prevent waste. fraud. or abuse of City resources. Attachment: Surveillance Ord RL 06-25-18 (CMA 2018 #170 : revised proposed draft of Surveillance Technoloy Ordinance) Page 5 of 13 Packet Pg. 102

Draft 6/25/18 redlined 1.13.b 4. The following situations are exceptions to the requirements ofthis Chapter: Surveillance conducled pursuant to a warrant using previously approved Surveillance Technology. Surveillance conducted pursuant to a warrant using previously approved Surveillance Technology is excepted from the requirements of 12.22.030(B) and 12.22.060(A) where: i) the City is prohibited from publicly releasing federal or information pertaining to the surveillance unde the Police state law, or pursuant to a Court Order; or y Casa Commissioner has determined that the r information pertaining to the surveillance would compromise public safety and security provided that the Annual Surveilland information is released in the ne Report following the Police Commissioner's determinatio that public safety and security concerns p staining to the release of such information no lor poses an In the event of an emergency situation imminent risk of do Or bodily harn or nificant ath the damage or loss. a City dep: aent head may ine Survefilance approval of the City Manager, Courel Technology without prior approval, for the for mitigating such risk, if the sole purpose of preventing department agad reasonably believes the acquisition of unveillance fechnology wid result in reduction of the risk he department's use of Surveillance Technology Whenste longer exists or the use of the must end Surveillance Technologs can no longer reasonably reduce isk. Then he must be documented in the department's (CMA 2018 #170 : revised proposed draft of Surveillance Technoloy Ordinance) Annual Survent jee Report, and any future acquisition or use o sach Suppeillance Technology must be approved by the Cily Council as set forth in this Chapter. A Ciyy department head may, with the approval of the City gadger, apply a technical patch or upgrade that is necessary to mitigate threats to the City's environment. The department shall not use the new surveillance capabilities of the technology until the requirements of Section 12.22.030 are met, unless the City Manager letermines that the use is unavoidable; in that case. th lepartment head shall request City Council approval a soon as possible. The request shall include a report to the City Council of how the altered surveillance capabilities Attachment: Surveillance Ord RL 06-25-18 Page 6 of 13 Packet Pg. 103

• Draft 6/25/18 redlined 1.13.b were used since the time of the upgrade. "Surveillance Use Policy" means a publiciy-released policy for the City's use of the (G) Surveillance Technology, approved bythe City Solicitor and the City Manager, and submitted to and approved by the City Council. The Surveillance Use Policy shall at a minimum specify the following: (1) Purpose: The specific purpose(s) for the Surveillance Technology. es and processes Authorized Use: The uses that are authorized, the a (2) required before that use, and the uses that are prohibite (3) Data Collection The information that c ecollected by the Surveillance Technology. (4) Data Access: The individuals who can ise the collected red before access or use of the information, and the rules and processes ret information. on from unauthorized rotect informa (S) Data Protection: The safeguards tha ss-control, and access- phon, ace access, including, but not limited to, e oversight mechanisms. Data l (6) Many, for which information collected by ention: time period. the Surve Hance Technology will bevoutinely retained, the reason that retention period is appropria if fusther the plfpose(s), the process by which the information is Her that period lapses, and the conditions that Sularly deleted must met to rel information beyond that period. lt and Public Access W collected information can be accessed by members of the public, including criminal defendants. (8) Third Party Duta-Sharing: If and how other City or non-City entities can a or use the information, including any required justification and legal standard necessary to do so, and any obligations) imposed on the recipient of the information. (9) Training: The training, if any, required for any individual authorized to use the Surveillance Technology or to access information collected by the Surveillance Technology, including whether there are training materials. Oversight: The mechanisms to ensure that the Surveillance Use Policy is (10) Attachment: Surveiliance Ord Rl. 06-25-18 (CMA 2018 #170 : revised proposed draft of Surveillance Technoloy Ordinance) Page 7 of 13 Packet Pg. 104

• Draft 6/25/18 redlined 1.13.b followed, including, but not limited to, identifying personnel assigned 10 ensure compliance with the policy, internal record keeping of the use of the technology or access to information collected by the Surveillance Technology, technical measures to monitor for misuse, any independent person or entity with oversight authority, and the sanctions for violations of the policy. (H) governing a City "Technology-Specific Surveillance Use Policy" means a polis departments)'s use of a specific Surveillance Technology nothready covered under the City's Surveillance Use Policy. approved by the City Solide ad the City Manager. and submitted to the City Council with a Surveillance Impact Pabort bil A Section Blogy-Specific 12.22.030(A), 12.22.030(B), or 12.22.040 of this Chapier: A Tee My provision of the d's Surveillance Surveillance Use Policy shail not conflict with Use Policy:. Section 12.22.030 Acquisition of Surveillance T (A) City Departments Other that the Police Departient. Unless it is not reasonably possible or feasrole to do so (e.g., Exig en Circumstances, a natural event it, etc.), disaster, or technological probleins. y department head other oval under Section 12.22.030 of this than the Police Commissioner seeking Chapter must submit to the City Council a Site allance Impact Report, and. if necessary. gy-Specific rveillance lose Policy pertaining to the specific ce Techno Surveillar any for which approval is sought and obtain City Council ore doing any of the fo oying: approvat (1) ne funds for Surveilance technology: including but not limited to, applyma or a grat for accepting state or federal funds, or in-kind or other donations! (2) Acquiring net Surveillance Technology, including but not limited to racuring that Surveillance Technology without the exchange of monies or othet consideration; (3) Using Surveillance Technology for a purpose, in a manner, or in a location not previously approved; or (4) Entering into an agreement with a non-City entity to acquire, share, or otherwise use Surveillance Technology or the information it provides. (B) Police Department. Other than with respect to Surveillance Technology limited to use in Exigent Circumstances in law enforcement investigations and prosecutions as Attachment: Surveillance Ord RL 06-25-18 (CMA 2018 #170 : revised proposed draft of Surveillance Technoloy Ordinance) Page 8 of 13 Packet Pg. 105

• Draft 6/25/18 redlined 1.13.b specifically defined in Section 12.22.040 of this Chapter, the Police Commissioner must submit a Surveillance Impact Report, and. if necessary. a Technology- Specific Surveillance Use Policy pertaining to the specific Surveillance Technology for which approval is sought to the City Council and obtain City Council approval. before doing any of the following: (A) Seeking funds for Surveillance Technology, including but not limited to, or in-kind or other applying for a grant, or accepting state or federal funde donations; (B) ingluding out not limited to Acquiring new Surveillance Technology, procuring that technology without the exchange of momes or other consideration; acation a manner, or (3) Using Surveillance Technology urpose, not previously approved; or (4) y to acquire, share, or Entering into an agreement with a non-City otherwise use Surveillance echnology. (C) misition of Surveiltance In approving, and/or denying disapproving lee-con the safeguarding of Technology, the Gity Council shal Las the investigative and prosecutorial 2 against-as individuals' rightso pri functions of the Police Depament and promoting and ensuring the safety and security of the general pu Any (D). Report. ane ce Impas necessary: Technology-Specific Surveillance ded to th Une Policy sued Sity Council under Section 12.22.030(A) or 12.22.030(B). fall be made puty ty availa no fewer than seven (7) calendar days prior to the date Shall be discussed. s Council meetes where Section 12.22 Temporary Acquisition and Use of Surveillance Technology in Exigent Circumstances Notwithstanding the provisions of this Chapter, the Police Department may temporarily acquire or temporarily use Surveillance Technology in Exigent Circumstances without following the provisions of this Chapter before that acquisition or use. However, if the Police Department acquires or uses Surveillance Technology in Exigent Circumstances under this Section. the Police Commissioner must (1) report that acquisition or use to the City Council in writing within 90 days following the end of those Exigent Circumstances; (2) submit a Surveillance Impact Report: and. if necessary. a Technology= Specific Surveillance Use Policy tothe City Council regarding that Surveillance Attachment: Surveillance Ord RL 06-25-18 (CMA 2018 #170 : revised proposed draft of Surveillance Technoloy Ordinance) Page 9 of 13 Packet Pg. 106

Draft 6/25/18 redlined 1.13.b Technology within 90 days following the end of those Exigent Circumstances: and (3) include that Surveillance Technology in the Police Department's next Annual Surveillance Report to the City Council following the end of those Exigent Circumstances. If the Police Commissioner is unable to meet the 90-day timeline to submit a Surveillance Impact Report, and. if necessary, a Technology-Specific Surveillance Use Policy to the City Council, the Police Commissioner may notify the City Council in writing Ordinance) of his or her request to extend this period. The City Council may grant extensions beyond the original 90-day timeline to submit a Surveillance Impact Reg d. and. it necessary. a Technology-Specific Surveillance Use Policy._Any A Surveillance Use Policy Surveillance Impact Report, and. if necessary. Technology-Spe submitted to the City Council under this Section shall be made publicly available no fewer Meeting than seven (7) calendar days prior to the date of the Counci ere it shall be discussed. Compliance for Existing Section 12.22.050 urveillances Technologies (A) Council for its review and The City Manager shall submit to the applicable to each City approval a proposed Surveillance Use Po er uses Surveillaned department that posses Technology before the guisition of Surveillance effective date of this Chapte on future use and sor le-hunde Technology, no later than on eighty (180 days following the effective date of this Chapter, dropproval by the City Council. If the City Manh feet this rger is unable yoo-day timeline, he or she may notify the City Council in writingof his or her request to extend this period. Council The B nay grant an extension to the City Manager to submit a proposed Surveillance Use Policy. Any Surveillance Use Policy submitted under Section fade publicly available no fewer than seven adar day arior to the date of the Council meeting where it shall be discusse (CMA 2018 #170: revised proposed draft of Surveillance Technoloy In approving ondenying the Surveillance Use Policy, the City Council shall alance the safeguarding of individuals* right to privacy against-as well as the stigative and prosecutorial function of the Police Department and promoting and ensuring the safety and security of the general public. To the extent the City of a court of law determines that approving or denying disapproving. the Surgellance Use Policy would unlawfully obstruct the investigative or prosecutorial functions of the Police Department, the City Council shall simply receive and discuss the applicable portions of the Surveillance Use Policy. Section 12.22.060 Oversight Following City Council Approval (A) (1)A Cily department head who has oblained approval for the use of Surveillance Technology or the information it provides under Section Attachment: Surveillance Ord RL 06-25-18 Page 10 of 13 Packet Pg. 107

Draft 6/25/18 redlined 1.13.b 12.22.030 or Section 12.22.040 of this Chapter, must submit an Annual Surveillance Report within Iwelve (12) months of City Council approval, and annually thereafter on or before March 1. Similarly, (2) Where the Police Department has submitted a Surveillance Impact Report. and, if necessary, a Technology-Specific Surveillance Use Policy that the Council has not approved prior to the Police Department's use of the Surveillance Technology.ff the City Council receired but did not specifically. om the Police- approve or disepprore a Surveilance Impact Repor Department because-of concerns over obstructing ¿Potica Department's artment must still submit investigative or prosecutorial funetion; the Polica months of the City an Annual Surveillance Use-Report within Ayelve Council's receipt of the Surveillance Impact and annually thereafter Report. on or before March 1- on shall be submitted under this s (3) Any Annual Surveillance Repo Sr to the seven 7) calendar day made publicly available no fewer. ll ba stussed. date of the Council meeting where a Surveillance Report, the Based upon informatiof provided in the An (B) whether the beneti City Council shall deterre do the impacted City department(s) and the cont of the Surveillance Technology iah costs and whether reasonable outweigh the financial and opera sonable conc safeguards exist to address ree as regarding privacy, civil liberties, tights impacted by deployment of the Surveillance Techoe gy. If the benefits or reasonably anticipated benefits do not rational costs or civil liberties or civil finangial and/or op outweigh rights are ro Is safeguaried, the City Council ma y aeril) recommending modifications to the Surveillance Use Policy that are signed to address the City Council's concerns to the City (CMA 2018 #170 : revised proposed draft of Surveillance Technoloy Ordinance) or ais conside ration; and/or (2) requesting a report back from the Manager s City Mand er regarging steps taken to address the City Council's boncerns: anter (3) recommend to the City Manager that use of the xeillance Technology cease. (C) No later than May 31 of each year, the City Council shall hold a meeting to discuss the City departments' Annual Surveillance Reports, and shall publicly release a report that includes a summary of all requests for approval of Surveillance Impact Reports received by the City Council during the prior year pursuant to Section 12.22.030 or Section 12.22.040 of this Chapter, including whether the City Council approved, rejeeteddisapproved, or required modifications to the Surveillance Impact Report. Attachment: Surveillance Ord RL 06-25-18 Page 11 of 13 Packet Pg. 108

• Draft 6/25/18 redlined 1.13.b Section 12.22.070 Enforcement (A). Enforcement Officials. This Chapter shall be enforced by the City Manager or his/her designee._ (B) Violation. Any person injured by a violation of this Chapter may institute proceedings for injunctive relief. declaratory relief, or fourt order in a court of competent jurisdiction to enforce the provisions of is Chapter. subiect to the provisions of Subsection (C) below. Any action e Inted under this Subsection Not against City (B) shail be brought against the City of Camberge, bu emplovees. No monetary damages or awar of attorneyst feas shall be allowed in any legal proceeding for any alleged rurits arising out c Say alleged violation(s) of this Chapter (C) Notice and Procedure. (I No legal pr miler Subsection B) above shall be brought unless the City has first b given written notice within thirty. (30) days of the alleged riolation(s) addresse a the City Clerk and specifying: (a) the name and address person(s) allege injured: (b) the date(s). time S: and (c) a de and placets) of the alleged fed description of the. alleged injury. proct (2) Prior to the initiation of an under Subsection (B) above. the City S ermitted nines (90) days from the date of its receipt of the writter Motice o malleged viola ion(s) within which to investigate such alleged slation(Stand, if substandated. to correct such alleged violation(s). (3) If the - Drien(s) is substántiated and subsequently cured, the City so notify personal dly injured by such violation(s) and a notice Shas rosted the City's website that describes the corrective measure(s) taken toy (CMA 2018 #170 : revised proposed draft of Surveillance Technoloy Ordinance) Jocess the relation(s) and no legal proceeding to remedy the alleged violation(st pall be a wed pursuant to Subsection (B) above. (D). Nothing in the Chapter shall be construed to limit or affect any individual's its under ite or federal laws. RL 06-25-18 Ord Section 12.22.080 serability The provisions in this Chapter are severable, If any part or provision of this Chapter, or the application of this Chapter to any person or circumstance, is held invalid by a court of competent surveillance jurisdiction, the remainder of this Chapter shall not be affected by such holding and shall continue to have full force and effect. Section 12.22.090 Effective Date Attachment: Page 12 of 13 Packet Pg. 109

: Draft 6/25/18 redlined 1.13.b its ad after This Chapter shall take effect nine months loption. DRAFT Attachment: Surveillance Ord RL 06-25-18 (CMA 2018 #170 : revised proposed draft of Surveillance Technoloy Ordinance) Page 13 of 13 Packet Pg. 110

1.13.0 Draft 6/25/18 clean Surveillance Technology Ordinance Chapter 12.22 Section 12.22.010 Purpose The purpose of this Chapter is 1o provide for the regulation of Surveillance Technology acquisition or use by the City of Cambridge, to safeguard the right of individuals to privacy, to balance the public's right to privacy with the need to promote and ensure safety and security, to provide protocols for use of Surveillance Technology that include specific steps to mitigate potential impacts on the civil rights and liberties of any communities or groups including balance any decision 1o communities of color or other marginalized communities in the City use Surveillance Technology with an assessment of the costs and protection of privacy, civil liberties and civil rights, to allow for informed public discussio before deploying Surveillance Technology, to provide for transparency, oversight, and accountability, agg to minimize the risks posed by use of Surveillance Technology in the City. Section 12.22.020 Definitions The following definitions apply to this Chapter: means a written repoi "Annual Surveillance Report"» (A) concerning specific proposed draft of Surveillance Technoloy Ordinance) Surveillance Technology that ind all of the follow yeilla ology has been used. (1) A description of how the Str ges, soun including shether it captured or information regarding members the public who are not suspected of engaging in unlawful Whether and (2) quited through the use of the Surveillance nology was lared with outside entities, the name of any recipient type(s) or data disclosed, under what legal standard(s) the entity, Ther and the justification for the disclosure; information das discha (3) summary of community complaints or concerns about the Surveillance any; chnology, The res (4) y of any non-privileged internal audits, any information about violations of the Surveillance Use Policy, and any actions taken in response: Whether the Surveillance Technology has been effective at achieving its (5) identified purpose: Attachment: Surveillance Ord CL 06-25-18 (CMA 2018 #170 : revised Statistics and information about public records requests; (6) (7) Total annual costs for the Surveillance Technology, including personnel and Packet Pg. 111

• Draft 6/25/18 clean 1.13.c other ongoing costs, and what source of funding will fund the technology in the coming year; and (8) Whether the civil rights and liberties of any communities or groups, including communities of color or other marginalized communities in the City are disproportionately impacted by the deployment of the Surveillance Technology. (B) this/her designee's "Exigent Circumstances" means the Police Commissione good faith belief that an emergency involving danger of d h. physical injury, or lance Technology or the significant property damage or loss requires use of the information it provides. The use of Surveillance Technolog i Exigent Circumstances shall not infringe upon an individua sully protest. right to pr (C) "Surveillance" means to observe or analyze the movements, behavior a actions of identifiable individuals in a manner tbat is reasonably likely to raise concerns about civil liberties, freedom of speech a erociation, racia aclude individuals equity or social justice. Identifiable individuals also draft of Surveillance Technoloy Ordinance] on combined with whose identity can be revealed by license plate data eif an individual any other record. It is not surveil ovingly and voluntarily consented to provide the mation, or had a cleand conspicuous opportunity to opt out de provi fuse informasion. (D) "Surveillance Datal" Theans any electronie data colleged, captured, recorded, retainer L processed, intercepted or analyzed by Surveillance quired by the City or operated at the direction of the City. Technology "Surveillance Impe (E) neaps a publicly-released written report including alan mum the follow (CMA 2018 #170 : revised proposed Information describing ta Surveillance Technology and how it works; (2) dnformation on the proposed purpose(s) for the Surveillance Technology; The locations)it may be deployed and when: (3) Ord CL 06-25-18 the potential impacts) on privacy in the City: the potential impact on the civil (4) rights and liberties of any communities or groups, including. but noi limited to, communities of color or other marginalized communities in the City, and a description of whether there is a plan to address the impacts); and Surveillance (5) The fiscal costs for the Surveillance Technology, including initial purchase. personnel and other ongoing costs, and any current or potential sources of funding Attachment: Page 2 of 12 Packet Pg. 112

Draft 6/25/18 clean 1.13.c (F) "Surveillance Technology" means any electronic surveillance device, hardware, or software that is capable of collecting, capturing, recording, retaining, processing, intercepting, analyzing, monitoring, or sharing audio, visual, digital, location, thermal, biometric, or similar information or communications specifically associated with, or capable of being associated with, any specific individual or group; or any system, device, or vehicle that is equipped with an electronic surveillance device, hardware, or software. to: "Surveillance Technology" includes, but is not lim International mobile subscriber identit IMSI) ebers and (a) other cell site simulators; (b) Automatic license plate read Electronic toll readers; (c) (d) Closed-circuit telarision cameras except us otherwise provided herein: Biometric Surveillance Techno (e) including facial, voice, :.: iris, and gait-recognition softsvare and databases; (f) lobile DIA capture technology: (g) Gunshot defection and location hardware and services; a ray van Videb and audio (i) ponitoring and/or recording technology, such a surveillance cameras and wearable body cameras: Surveiftance enabled or capable lightbulbs or light fixtures; (k) ols, including software and hardware, used to gain arauthorized access to a computer, computer service. or computer network; (1) Social media monitoring software: (m) Through-the-wall radar or similar imaging technology; (л) Passive scanners of radio networks; Attachment: Surveillance Ord CL 06-25-18 (CMA 2018 #170 : revised proposed draft of Surveillance Technoloy Ordinance) Page 3 of 12 Packet Pg. 113

Draft 6/25/18 clean 1.13.0 (0) Long-range Bluetooth and other wireless-scanning devices; (p). Radio-frequency identification (RFID) scanners; and (9) Software designed to integrate or analyze data from Surveillance Technology, including surveillance target tracking and predictive policing software. 2. For the purposes of this Chapter, "Surveillance Technology" does not include the following device O become unless they have been equipped with, or are modified ¿ above or include, a Surveillance Technology as defin (a) Routine office hardware, such televisions, computer and printers, that are in wides read public use and will no related be used for any surveillaned or surveillan functions; (b) Parking Ticket Datices ("PTDs") and velated databases; (C) Manually-operated, Hon-wearable, handheld digital Forecorders that are not cameras, audio recordes, and Mose functionality designed to be used surreptinously an 151 manually captering and manually downloading fideo andlor audio recordin BS: Sur cillance devices that canoot record or transmit audio (d) or video or be remor bessed, such as image stabilizing binocula it night vision goggles; (CMA 2018 #170 : revised proposed draft of Surveillance Technoloy Ordinance) City databases I'do not and will not contain any data or (e) otherinformation collected, captured, recorded, retained, procesteel, intercepted, or analyzed by Surveillance Technology; (f) Mentally-operated technological devices that are used primarily for internal City communications and are not "designed to surreptitiously collect Surveillance Data, such as radios and email systems: (g) Parking access and revenue control systems. including proximity card readers and transponder readers at City- owned or controlled parking garages; and Attachment: Surveillance Ord CL 06-25-18 Page 4 of 12 Packet Pg. 114

: Draft 6/25/18 clean 1.13.c (h) Electronic card readers and key fobs lised by City employees and other authorized persons for access to City- owned or controlled buildings and property. For the purposes of this Chapter, the following Surveillance Technology is exempt from the requirements of this Chapter: a) Information acquired where the individual knowingly and , sush as voluntarily consented to provide the informat submitting personal information for the rec Lof City services; ted Information acquired where the individuat was pres with a clear and conspicuous opportunity to opt out o providing the information; Cameras installed in or on a pollo except cameras with license plate reading technolog rut to state law an Cameras installed aLization in or on any vehicle or ald blis right-of-way solely to record traffic violation stalled on City property sofely for security urposes, Tipluding closed aircuit television cameras catalled by the City to monitor entryways and outdoor areas of Ci owned or controlled buildings and property for the purpose of poi ung access, maintaining the safety of Cily employees and visitors to City buildings, Protecting City property; (CMA 2018 #170 : revised proposed draft of Surveillance Technoloy Ordinance) cameras including closed circuit television secunty cameras installed by the City to monitor cashiers' windows and otbar cash-handling operations and to maintain the safety of City employees and visitors to such areas: ameras installed solely to protect the physical integrity of City infrastructure: or h) Technology that monitors only City employees in response to complaints of wrongdoing or in order to prevent waste, fraud, or abuse of City resources. 4. The following situations are exceptions to the requirements of this Chapter: Attachment: Survelllance Ord CL 06-25-18 Page 5 of 12 Packet Pg. 115

• Draft 6/25/18 clean 1.13.0 a) Surveillance conducted pursuant to a warrant using previousiy approved Surveillance Technology. Surveillance conducted pursuant to a warrant using previously approved Surveillance Technology is excepted from the requirements of 12.22.030(B) and 12.22.060(A) where: i) the City is prohibited from publicly releasing information pertaining to the surveillance under federal or state law, or pursuant to a Court Order; or ii) the Pofice Commissioner has determined that the rele sof information pertaining to the surveillane sWOu at the compromise public safety and security information is released in the nex 1a% Surveilla Report following the Police Coramissioner's determin that public safety and securit concerns pertaining to the release of such informatiof no b) In the event of an emergency situatron that poses an significant imminent risk of death or bodily harm damage or loss, a epartment head ma witha the approval of the City Managut, acquire Survellenice proposed draft of Surveillance Technoloy Ordinance) Technology without pror City ancil approval, for the Amitiga sole purpose of preventing Stich risk, if the read reasonabry believes the acquisition of urveillance Technology will result in reduction of the The department's use of Syrveillance Technology mus a such risk no longer exists or the use of the Surven ce Teenng sm no longer reasonably reduce e risk. he use must be documented in the department's nual Surveilance Report, and any future acquisition or • (CMA 2018 #170 : revised use of such Sum Hance Technology must be approved by the C Council as set forth in this Chapter. A Cityjaepartment head may, with the approval of the City Mana er, apply a technical patch or upgrade that is essary to mitigate threats to the City's environment. He department shall not use the new surveillance capabilities of the technology until the requirements of Section 12.22.030 are met, unless the City Manager determines that the use is unavoidable: in that case, the department head shall request City Council approval as soon as possible. The request shall include a report to the City Council of how the altered surveillance capabilities were used since the time of the upgrade. Page 6 of 12 Packet Pg. 116

Draft 6/25/18 clean 1.13.0 (G) "Surveillance Use Policy" means a publicly-released policy for the City's use of the Surveillance Technology, approved by the City Solicitor and the City Manager, and submitted to and approved by the City Council. The Surveillance Use Policy shall at a minimum specify the following: (1) Purpose: The specific purpose(s) for the Surveillance Technology. (2) Authorized Use: The uses that are authorized, the rules and processes required before that use, and the uses that are prohibi (3) Data Collection: The information that can be g Hected by the Surveillance Technology. (4) Data Access: The individuals who cafraccess or use the collecte the information, and the rules and prog required before access or information. (5) Data Protection: The safeguards that protect information from unauthorized s-control, and access- access, including, but not l to, encryption, a oversight mechanisms. (6) Data Retentien The time perio Any, for ich information collected by the Surveitlance cahnology will be routinely fetained, the reason that retention pero appropriato furher the urposes), the process by which the as regularly deleted atter tant period lapses, and the conditions thal must be met to reta intermation beyond that period. Pubhe ess: liana how collected information can be accessed by members of (CMA 2018 #170 : revised proposed draft of Surveillance Technoloy Ordinance) the puble, mcleding criminal defendants. (8) Third-Party Data-Sharing: If and how other City or non-City entities access or e the information, including any required justification ant egal standard necessary to do so, and any obligation(s) imposed on the prént of the information. (9) Training: The training, if any, required for any individual authorized to use the Surveillance Technology or to access information collected by the Surveillance Technology, including whether there are training materials. (10) Oversight: The mechanisms to ensure that the Surveillance Use Policy is followed, including, but not limited to, identifying personnel assigned 1o ensure compliance with the policy, internal record keeping of the use of the Attachment: Surveillance Ord CL 06-25-18 Page 7 of 12 Packet Pg. 117

Draft 6/25/18 clean 1.13.c technology or access to information collected by the Surveillance Technology, technical measures to monitor for misuse, any independent person or entity with oversight authority, and the sanctions for violations of the policy. (H) "Technology-Specific Surveillance Use Policy" means a policy governing a City departments)'s use of a specific Surveillance Technology not already covered under the City's Surveillance Use Policy, approved by the City Solicitor a e City Manager, and brider Section submitted to the City Council with a Surveillance Impact Report 12.22.030(A), 12.22.030(B), or 12.22.040 of this Chapte Technology-Specific MISIOn Surveillance Use Policy shall not conflict with any pre e City's Surveillance Use Policy. Section 12.22.030 Acquisition of Surveillance Technology City Departments Other than the Police (A) Eparters Unless it is not reasonably possible or feasible to do so (eg axigent Circumstances, a natural any department head other disaster, or technological Problems prevent it, than the Police Commissione cing approval un ¿Section 12.22.030 of this Cat oil a Surveillance Impact Report, and, if Chapter must submit to the Cy necessary, a Technology-Specile Surv Toe Use Policy pertaining to the specific pproval Surveillance Technology for which yght and obtain City Council approval before-doing any of the following: funds for Surveillance Ter (1) Seeking heblogy, including but not limited to, applying fo Faccepting state or federal funds, or in-kind or orher Acquiring new Surve ee Technology, including but not limited to procuring th Surveillance Technology without the exchange of Cmonies or other consideration; (3) Using Surveilance Technology for a purpose, in a manner, or in a location nol p sousty approved: or (4) Entering into an agreement with a non-City entity to acquire, share. or otherwise use Surveillance Technology or the information it provides. (B) Police Departmen. Other than with respect to Surveillance Technology limited to use in Exigent Circumstances in law enforcement investigations and prosecutions as specifically defined in Section 12.22.040 of this Chapter, the Police Commissioner must submit a Surveillance Impact Report, and, if necessary, a Technology- Attachment: Surveillance Ord CL 06-25-18 (CMA 2018 #170 : revised proposed draft of Surveillance Technoloy Ordinance) Page 8 of 12 Packet Pg. 118

Draft 6/25/18 clean 1.13.c Specific Surveillance Use Policy pertaining to the specific Surveillance Technology for which approval is sought to the City Council and obtain City Council approval, before doing any of the following: (A) Seeking funds for Surveillance Technology, including but not limited to, applying for a grant, or accepting state or federal funds, or in-kind or other donations; But not limited to (B) Acquiring new Surveillance Technology, including onies or other procuring that technology without the exchanged consideration; Using Surveillance Technology for a parpose, in a manner orin a location (3) not previously approved; or or Entering into an agreement with a non o acquire, shape, (4) otherwise use Surveillance Technology. veillance Technology. (C) acquisition of In approving, and/or disapproving ofs right to privacy as well the City Council shall consider thesafeguarding of individ the Poljee Department and promoting as the investigative and prosecutorial functions and ensuring the safety and security of the general Any Surveillas (D) ce impact Report, and, if necessary. Technology-Specific Surveillance Use Policy submi fled to the City Council under Section 12.22.030(A) or 12.22.030(B) shall be made puble alf no tewer lhan seven (7) calendar days prior to the date of the discussed. Condth meeting here it shal (CMA 2018 #170 : revised proposed draft of Surveillance Technoloy Ordinance) Temporary 22.22.040 Section quisition and Use of Surveillance Technology in Exigent Circumstances Notwithstanding the provisions of this Chapter, the Police Department may temporarily acquire or temporatity use Irveillance Technology in Exigent Circumstances without this Chapter before that acquisition or use. However, if the following the provisio Police Department requires or uses Surveillance Technology in Exigent Circumstances under this Section, the Police Commissioner must (1) report that acquisition or use to the City Council in writing within 90 days following the end of those Exigent Circumstances: (2) submit a Surveillance Impact Report, and, if necessary, a Technology- Specific Surveillance Use Policy to the City Council regarding that Surveillance Technology within 90 days following the end of those Exigent Circumstances: and (3) include that Surveillance Technology in the Police Department's next Annual Surveillance Report to the City Council following the end of those Exigent Circumstances. If the Attachment: Surveillance Ord CL 06-25-18 Page 9 of 12 Packet Pg. 119

Drait 6/25/18 clean 1.13.0 Police Commissioner is unable to meet the 90-day timeline to submit a Surveillance Impact Report, and, if necessary, a Technology-Specific Surveillance Use Policy to the City Council, the Police Commissioner may notify the City Council in writing of his or her request to extend this period. The City Council may grant extensions beyond the original 90-day timeline to submit a Surveillance Impact Report, and, if necessary, a Technology-Specific Surveillance Use Policy. Any Ordinance) Surveillance Impact Report, and, if necessary, Technology-Specific Surveillance Use Policy submitted to the City Council under this Section shall be made publiety available no fewer than seven (7) calendar days prior to the date of the Council meeting where it shall be discussed. Section 12.22.050 Compliance for Existing Surveillan Technologies review and (A) The City Manager shall submit to the City Council for -City approval a proposed Surveillange be Policy applicable to reilland department that possesses or uses S Technology before the and acquisition of Surveillance effective date of this Chapter or for future Technology, no later than one-hundred eight $ 80) days following the effective date of this Chapter, for review and a pprovai by the City Council. meet this 180-8g If the City Manager is un timeline, he or she may notify the City Council in waiting of or her request to extend this period. The City Council may grant an ext ASIOND We city Manager to submit a rellance Use Po proposed Any Surgeillance Use Policy submitted under Section 1202:050 shall be made publicly available no fewer than seven (7) çal der days prior to the date of the Council meeting where it shall be discussed (B hrapprowing ordenying the Strveillance Use Policy, the City Council shall balance the safeguarding of individuats' right to privacy as well as the and prost investigative storial function of the Police Department and promoting sately and security of the general public. To the extent the City and ensuring Manager determines that approving or disapproving the Surveillance Use y would unlawfully obstruct the investigative or prosecutorial functions of the artment, the City Council shall simply receive and discuss the portions of the Surveillance Use Policy. applica Section 12.22.060 Oversight Following City Council Approval (A) (1) A City department head who has obtained approval for the use of Surveillance Technology or the information it provides under Section 12.22.030 or Section 12.22.040 of this Chapter, must submit an Annual Surveillance Report within twelve (12) months of City Council approval, and annually thereafter on or before March I. Attachment: Surveillance Ord CL 06-25-18 (CMA 2018 #170 : revised proposed draft of Surveillance Technoloy Page 10 of 12 Packet Pg. 120

Draft 6/25/18 clean 1.13.c (2) Where the Police Department has submitted a Surveillance Impact Report, and, if necessary, a Technology-Specific Surveillance Use Policy that the Council has not approved prior to the Police Department's use of the Survelliance Technology, the Police Department must still submit an Annual Surveillance Report within twelve (12) months of the City Council's receipt of the Surveillance Impact Report, and annually thereafter on or before March 1. is section shall be (3) Any Annual Surveillance Report submitted unde made publicly available no fewer than seven (7) calendar days prior to the issed. date of the Council meeting where it shall be (B) noce Report, the Based upon information provided in the Annag! Surve City Council shall determine whether fre benefits to the Impacted City departments) and the community ine Surgeillance Teched nable and whether f outweigh the financial and oper safeguards exist to address reasonable Ms Tegarding privacy, civil liberties, and civil rights impacted by deployment of the Surveillance coipated benefits do not Technology. If the benetits or reasonably an er operational de outweigh the financial a oracivil liberties or civil council may (1) rights are not reasonably safeguardor the City recommend modifications to the Sur Tance use Policy that are designed to address the Gily Council's Coneerns to the City Manager for his consideration; for (2) requesta report back from the City Manager tan to address is steps the City Council's concerns; and/or (3) regard recomme to the City Manager eit use of the Surveillance Technology cease. No later n May 3N of each year, the City Council shail hold a meeting to discuss City de ¿tients' Annual Surveillance Reports, and shall publicly relezse, a report that includes a summary of all requests for approval of Surveillance Impact Reports received by the City Council during prior dear pursuant to Section 12.22.030 or Section 12.22.040 of this Including whether the City Council approved, disapproved, or require Sodifications to the Surveillance Impact Report. Section 12.22.070 Enforcement (A) Enforcement Officials. This Chapter shall be enforced by the City Manager or his/her designee. (B) Violation. Any person injured by a violation of this Chapter may institute Attachment: Surveillance Ord CL 06-25-18 (CMA 2018 #170 : revised proposed draft of Surveillance Technoloy Ordinance) Page 11 of 12 Packet Pg. 121

Draft 6/25/18 clean 1.13.c proceedings for injunclive relief, declaratory relief, or a court order in a court of competent jurisdiction to enforce the provisions of this Chapter. subject to the provisions of Subsection (C) below. Any action initiated under this Subsection (B) shail be brought against the City of Cambridge, but not against City employees. No monetary damages or award of attorneys' fees shall be allowed in any legal proceeding for any alleged injuries arising out of any alleged violation(s) of this Chapter (C) et Subsection (B) above Notice and Procedure. (1) No legal proceeding un shall be brought unless the City has first been g ritten notice within thirty (30) days of the alleged violation(s) addressed to the Clerk and specifying: • person(s) aegedy inju (b) the date(s), time and hias ande airesed violation at es a detailed deiption of the alleged injury. roceeding under Subsection (2) Prior to the initiation of any leg B above, is fr the City shall be permitted ninety (90) 3 date of its repeipt of the written notice of the alleged violation(s) m which to investigate such alleged violation(s) andsif substantiated, to ect such alleged violation(s). is substantiated an (3) If the alleged violation ubsequently cured, the City violations) and a notice shall so notify the person(s ty injured by suc proposed draft of Surveillance Technoloy Ordinance) iyebsite shall be posted on the City's teescribesthe corrective measure(s) taken to address the violation and no lege roceeding to remedy the alleged violation! Ibe allowed pu stant to Subsection (B) above. (D) Nothing in this Chapter shall be construed to limit or affect any individual's rights under state ordederal laws. Section 11 reyerabe Thespio pable. If any part or provision of this Chapter, or the dions in this Chapten are sev application afthis Chapter to ay person or circumstance, is held invalid by a court of competent his Chapter shall not be affected by such holding and shall jurisdiction, heremainder of continue to havodull force arteffect. Section 12.22.090 lective Date This Chapter shall take effect nine months after its adoption. Attachment: Surveillance Ord CL. 06-25-18 (CMA 2018 #170 : revised Page 12 of 12 Packet Pg. 122

ATTACHMENT B Massachusetts ACLU [email removed] OVERSIGHT Kade Crockford, ACLU of Massachusetts SURVEILLANCE

state, enabling new forms of surveillance and control. THREATENS DEMOCRACY Technology changes the balance of power between the people and the SECRETIVE SURVEILLANCE UNACCOUNTABLE,

Once now trivial. Justice Roberts, Supreme Court, Carpenter v. US ankle monitor to the phone's user. Moreover, the impossible, to retrace a person's whereabouts, subject only to the maintain records for up to five years. Critically, because this newfound tracking capacity runs against everyone." retention polices of the wireless carriers, which currently location information is continually logged for all of the 400 by a dearth of records and the frailties of recollection. With achieves near pertect surveillance, as if it had attached an category of information otherwise unknowable. In the past, to persons who might happen to come under investigation- attempts to reconstruct a person's movements were limited access to CSLI, the Government can now travel back in time million devices in the United States-not just those belonging retrospective quality of the data here gives police access to a *[W]hen the Government tracks the location of a cell phone it

• Drones • Predictive policing • Social media spying • License plate readers • Surveillance cameras • Info sharing databases • Audio recording devices • Face tracking technologies • Biometric fingerprint readers Federal grants, little local oversight

protesters • Info sharing with ICE information in secret Matter, Muslim groups people exercising religion Civil rights in the dark • Fusion centers collect and share • Use of facial recognition to track • Use of license plate readers to track • Social media surveillance of Black Lives violations occur BLACK [ODA) CLU

PROTECTING OPEN Engaging local elected officials, creating a process to solicit public input and feedback, and ensuring community control. CENTURY SOCIETY IN THE 21ST

Surveillance Use Policy. without fear of retribution. appropriate for the city, as well as how they will be used. Necessary changes to existing draft aware of violations of the law are able to alert the proper authorities • The ordinance must protect whistleblowers to ensure City employees • City council must have ultimate authority to revoke authorization for a the ordinance, should they discover any entity in the City has violated it. previously approved technology, as well as suggest modifications to any • Individuals must be able to take legal action to protect their rights under • City council must have ultimate authority to decide what technologies are

ATTACHMENTC CITY OF CAMBRIDGE OFFICE OF THE MAYOR mayor@cambridgema.gov Marc C. McGovern Phone: [phone removed] Mayor Fax: [phone removed] August 13, 2018 Amendments to Chapter 12.22 Surveillance Technology Ordinance To the Honorable, the City Council: Please find below two amendments to Chapter 12.22 Surveillance Technology Ordinance. The first offers changes to Section 12.22.070 "Enforcement" to adopt key portions of the ACLU's amendments while retaining compromise language offered by the City in their latest draft. This includes preserving a court's ability to award attorney's fees if it finds the City did injure a person in violation of the surveillance ordinance, and inserting a so-called "Whistle-blower" provision, both recommended by the ACLU. The second simply removes all gender references and replaces "his/her" with "their." Improving Enforcement Section Enforcement Section 12.22.070 (A) Enforcement Officials. This Chapter shall be enforced by the City Manager or his/her designee. (B) Violation. Any person injured by a violation of this Chapter may institute proceedings for injunctive relief, declaratory relief, or a court order in a court of competent jurisdiction to enforce the provisions of this Chapter, subject to the provisions of Subsection (C) below. Any action initiated under this Subsection (B) shall be brought against the City of Cambridge, but not against City employees. No monetary damages or award of atterneys' fees shall be allowed in any legal proceeding for any alleged injuries arising out of any alleged violation(s) of this Chapter. (C) Notice and Procedure. (1) No legal proceeding under Subsection (B) above shall be brought unless the City has first been given written notice within thirty (30) days of the alleged violation(s) addressed to the City Clerk and specifying: (a) the name and address of the person(s) allegedly injured; (b) the date(s), time and place(s) of the alleged violation(s); and (c) a detailed description of the alleged injury. (2) Prior to the intiation of any legal proceeding under Subsection (B) above, the City shall be permitted ninety (90) days from the date of its receipt of the written notice of the alleged violation(s) within which to investigate such alleged violation(s) and, if substantiated, to correct such alleged violation(s). (3) If the alleged violation(s) is substantiated and subsequently cured, the City shall so notify the person(s) allegedly injured by such violation(s) and a notice shall be posted on the City's website that describes the corrective measure(s) taken to address the violation(s) and no legal proceeding Page 1 of 2

to remedy the alleged violation(s) shall be allowed pursuant to Subsection (B) above. (D) No municipal entity or anyone acting on behalf of a municipal entity may take or fail to take, or threaten to take or fail to take, a personnel action with respect to any employee or applicant for employment, including but not limited to discriminating with respect to compensation, terms. conditions, access to information, restrictions on due process rights, privileges of employment, or civil or criminal liability, because the employee or applicant was perceived to, about to, or assisted in any lawful disclosure of information concerning the funding, acquisition, or deployment of Surveillance Technology or sharing of surveillance data to any relevant municipal agency, municipal law enforcement, prosecutorial, or investigatory office, or City Council member, based upon a good faith belief that the disclosure evidenced a violation of this Act. (E) (D) Nothing in this Chapter shall be construed to limit or affect any individual's rights under state or federal laws. Making Chapter 12.22 Surveillance Technology Ordinance Gender-Neutral Replacing "his," "his or her," and "his/her" wherever they may appear with "their," including but not limited to the following references: • 12.22.020 Definitions (B) "Exigent Circumstances" • 12.22.040 Temporary Acquisition and Use of Surveillance Technology in Exigent Circumstances • 12.22.050 Compliance for Existing Surveillance Technologies (A) • 12.22.060 Oversight Following City Council Approval (B) • 12.22.070 Enforcement (A) Best Regards, Nine Mle Page 2 of 2

AMACHMONTD ACLU August 13, 2018 MA ACLU TESTIMONY IN SUPPORT OF SURVEILLANCE OVERSIGHT ORDINANCE On behalf of our over 100,000 members and activists statewide, the ACLU of Massachusetts writes in support of an ordinance to require City Council oversight of City surveillance. The ACLU thanks the City Manager, City Solicitor, Mayor, and Council for the work they have done to get us closer tr a strong ordinance, and here offers specific feedback on how to strengthen the draft ordinance the City submitted to the Council in advance of today's hearing. ACLU recommendations for strengthening the City draft ordinance Again, we are grateful for the substantial work that has been done to produce the draft ordinance before your committee today. We see it as a solid basis for a comprehensive ordinance, and offer some specific suggestions to strengthen the language, to ensure it achieves the goal of establishing community oversight ot survellance technology acquisitions and use in Cambridge. The following language adjustments, if enacted by this Committee, will ensure the ordinance achieves its goals: 1. On page 1, section 12.22.010 could be tightened to read: "The purpose of this Chapter is to provide City Council oversight and regulation of Surveillance Technology acquired or used by the City of Cambridge; to safeguard civil rights and civil liberties, advance racial justice, and protect public safety; and to provide residents of Cambridge with the opportunity to meaningfully contribute to decision-making processes related to the acquisition and use of Surveillance Technology by the City of Cambridge." 2. On page 8, section 12.22.030 (A): strike "Unless it is not reasonably possible or feasible to do so..." and begin that sentence with "Any department head other than the Police Commissioner seeking approva..." 3. On page 9, section 12.22.030 (C) should be changed to read: "In approving or denying any proposal to use or acquire Surveillance Technology, the City Council shall consider the safeguarding of civil rights and civil liberties as well as public safety." 4. On page 10, section 12.22.050 (B) should be changed to read: "In approving or denying the Surveillance Use Policy, the City Council shall consider the importance of safeguarding individuals' civil rights and civil liberties, as well as the Police Department's responsibility to ensure public safety."

5. On page 11, section 12.22.060 (B) should be changed to read: "Based on information provided in the Annual Surveillance report, the City Council shall determine whether any specific Surveillance Technology is a benefit to the City. In making this determination, the Council shall consider the Surveillance Technology's operational, financial, and civil rights and civil liberties costs, as well as any public safety or other benefits to the City. If the benefits do not outweigh the costs, or the Council determines the use of the Survellance Technology infringes on civil rights or civil liberties, the Council may (1) withdraw Council authorization for use of a Surveillance Technology; (2) request modifications to the Surveillance Use Policy designed to address the Council's concerns; and/or (3) request a report from the City Manager addressing the Council's concerns." 6. On page 12, section 12.22.070 should be changed to read: "(A) Any violation of this Act, including but not limited to funding, acquiring, OI deployment of Surveillance Technology that has not been authorized pursuant to this Act or utilizing Surveillance Technology in a manner or for a purpose that has not been approved pursuant to this Act, constitutes an injury and any person may institute proceedings for injunctive relief, declaratory relief, writ of mandate, or evidence suppression in any court of competent jurisdiction to enforce this Act. (B) A court shall award costs and reasonable attorneys' fees to the plaintiff who is the prevailing party in an action brought to enforce this Act. (C) Municipal employees or agents shall not use any Surveillance Technology except in a manner consistent with policies approved pursuant to the terms of this Act, and may in no circumstances utilize Surveillance Technology in a manner which is discriminatory, viewpoint-based, or violates the Massachusetts Declaration of Rights or United States Constitution. Any municipal employee who violates the provisions of this Act, or any implementing rule or regulation, may be subject to disciplinary proceedings and punishment. For municipal employees who are represented under the terms of a collective bargaining agreement, this Act prevails except where it conflicts with the collective bargaining agreement, any memorandum of agreement or understanding signed pursuant to the collective bargaining agreement, or any recognized and established practice relative to the members of the bargaining unit. (D) No municipal entity or anyone acting on behalf of a municipal entity may take or fail to take, or threaten to take or fail to take, a personnel action with respect to any employee or applicant for employment, including but not limited to discriminating with respect to compensation, terms, conditions, access to information, restrictions on due process rights, privileges of employment, or civil or criminal liability, because the employee or applicant was percelved to, about to, or assisted in any lawful disclosure of information concerning the funding, acquisition, or deployment of Survelliance Technology or sharing of surveillance data to any relevant municipal agency, municipal law enforcement, prosecutorial, or investigatory office, or City Council member, based upon a good faith belief that the disclosure evidenced a violation of this Act."

We hope the Ordinance Committee and the full Council will support a strong surveillance oversight ordinance, and we welcome the opportunity to answer questions and be a resource to the City throughout this process. Thank you. Kade Crockford Director Technology for Liberty Program ACLU of Massachusetts [email removed]

AttACHmeNTE THE ATTACHED FORM LETTER IN SUPPORT OF THE ACLU'S PREFERRED MODIFICATIONS TO THE CITY'S SURVEILLANCE DRAFT ORDINANCE WAS RECEIVED FROM THE FOLLOWING PERSONS FOR ORDINANCE COMMITTEE HEARING HELD ON AUGUST 13, 2018: Thomas Chen, 1105 Massachusetts Avenue Ryan Houlette, 11 Newman Street April Stone, 304 Harvard Street Louise Hogan, 51 Museum Street Robb Johnson, 20 Fairmont Avenue Toni Tiemann, 64 North Beacon Street, Allston, MA Rebecca Popp, 698 Green Street Aviva Musicus, 18 Amory Street Sam Auciello, 2 Norfolk Terrace Marydale DeBor, 217 Lexington Avenue Barbara Cowan, 5 Roberts Road Caitlin Dickerson, 295 Harvard Street Alisha Jansky, 6 Winslow Street Anita McClellan, 50 Stearns Street Pankaj Mehta, 217 Harvard Street Alice lam, 149 Bishop Allen Drive Veronica Saltzman, 10 Agassiz Street Christine Cooper, 124 Oxford Street Paul Titchener, 17 Richard Avenue Louisa Kania, 175 Brattle Street Lori Glass, 52 Washburn Avenue Mary Ni, 18 Parkvale Avenue, Allston, MA Eleanor Jones, 2 Sacramento Street Deborah Sommer, 1530 Cambridge Street Jeffrey Baron, 174 Garden Street Namita M., 1156 Cambridge Street Tara Anderson, 32 Suffolk Street Susanna Chivian, 21 Cottage Street Clara Hendricks, 6 Rice Circle Robert Peterson, 975 Memorial Drive Sarah Block, 24 Shepard Street Susan Corcoran, 75 Cambridge Parkway Justin Pagano, 39A Lee Street Jessica Schmidt, 17 Laurel Street

AtTACHMENT F August 13, 2018 Dear Cambridge City Council Ordinance Committee, In advance of tonight's hearing, I would like to suggest several recommendations to strengthen the proposed ordinance: 1. Page 2: the definition of surveillance seems to rely on the notion of personally identifiable information (PII) as the definition of identifiability, with its discussion of "identifiable individuals." But there are many ways for people to be re-identified and tracked from superficially anonymous data, such as MAC address location records. Many scholars have written about the failures of PIl as a privacy framework, and my report "Open Data Privacy," published in 2017 through the Berkman Klein Center for Internet and Society at Harvard, describes these issues in detail. I recommend replacing the specific discussion of license plate readers with a more general statement, such as "Identifiable individuals also include individuals whose identity can be revealed by data when it is analyzed and/or combined with any other record." 2. Page 5: I recommend broadening out the exemption on 3c to include police dashboard cameras (which are in many ways equivalent to body cameras), any use of biometrics, and any footage that is retained for investigatory or other purposes. These latter two points hold for d-g as well; these cameras are fine under the current conditions and specifications of their use, but any alterations should remove the exemption and prompt the same requirements as any other surveillance technology. Page 6, point b. The requirement for "emergency situation" should be made more stringent and require a balancing act, not simply the reduction of risk. The sentence that concludes with "reasonably believes the acquisition of the Surveillance Technology will result in reduction of the risk," should be appended to include "when considered with the public's right to privacy, the potential impacts on the civil rights and liberties of any groups..., and the public's right to protest and free expression." It would also be good to add the sentence that was added to the definition of Exigent Circumstances as well, "The use of Surveillance Technology shall not infringe upon an individual's right to peacefully

protest". The phrasing of "can no longer reasonably reduce the risk" should similarly be phrased as a balancing test against the potential harms of the surveiliance. Also, there seems to be no limit on the window for which these emergency situations can remain in place, potentially allowing the surveillance to continue without review and approval for a long time. I recommend adding a time limit, such as 30 days, after which continued use of the surveillance technology in emergency or exigent circumstances requires approval. 4. Page 6, point c. Specify that "the City's environment" means "the City's IT security environment." That would more explicitly limit any updates w/o prior approval to security issues. Page 11. In point (1) of B, change the "his" in reference to the City Manager to his/her or another gender-neutral term. Thank you, Ben Green Fellow, Berkman Klein Center for Internet and Society at Harvard PhD Candidate, Harvard School of Engineering and Applied Sciences

ATTACNMENT G-1 Lopez, Donna From: Richard Stallman <[email removed]> Sent: Monday, August 13, 2018 2:29 PM To: Cc: [email removed]; Kelley, Craig; Zondervan, Quinton For the ordinance committee about the surveillance ordinance (1) Subject: Please forward this to the ordinance committee, and to the whole council, in the ways that are appropriate. To the ordinance committee and the whole City Council, Section F.4(b) about "emergencies", as written, is an unlimited loophole that would permit city employees to set this ordinance at naught, on their own sole discretion, with no accounatbility unless they someday choose to inform the council. Section 12.22.040 has the weakness that the period for reporting the "emergency" to the City Council starts only after the police decide the emergency is over. If they never end the "temporary" use, they can keep it secret forever. Damage to our privacy is real damage, as real as damage to our persons or our physical property, and it can make us vulnerable to damage to our persons or property. To make an emergency exception acceptable at all, it must be subject to firm limits that are not at the discretion of the staff that create and eexcercise the exception. I propose these limits: The emergency use of surveillance technology may not continue more than three days without a specific court order specifying the technology to be authorized and the targets it will be used on. Within two months of the _start_ of the emergency use, the City Council must be asked to approve the acquisition of that surveillance technology.

If 5 months of the _start_ of the emergency use, the City Council has not approved that technology. use must stop immediately. When the City Council considers the use fo a specific surveillance, and decides against it, it has the option to order that that technology may, or may not, be used on an emergency basis after that time. Real accountability means substantially limiting the power of the state, especially the police. Please do not allow extra surveillance on the strength of a vague, unlikely and imponderable worst case threat scenarios. Worst case surveillance threats are important, too, which is why we need the Fourth Amendment. Richard Stallman 303 Third St Cambridge MA -- Dr Richard Stallman President, Free Software Foundation (https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgnu.org&a mp;data=02%7C01%7CDLopez%40Cambridgema.gov%7Cec4a90ff3c8d483d91bd0 8d6014aa379%7Cc06a8be784794d73b35193bc9ba8295c%7C0%7C1%7C63669781 [phone removed]&amp;sdata=fT5MGx|wFya09VfE8%2FQezwYjdFWGCfpOP0%2Be4Mn EqQ1%3D&amp;reserved=0, https://na01.safelinks.protection.outlook.com/P?url=https%3A%2F%2Ffsf.org&amp ;data=02%7C01%7CDLopez%40Cambridgema.gov%7Cec4a90ff3c8d483d91bd08d6 014aa379%7Cc06a8be784794d73b35193bc9ba8295c%7C0%7C1%7C63669781742 4900330&amp;sdata=sYsCly0Aiu%2В%2Fq1eeNL%2FrYmw%2FdPyN646fMt14xSрo ADk%3D&amp;reserved=0) Internet Hall-of-Famer (https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Finternethall 2

offame.org&amp;data=02%7C01%7CDLopez%40Cambridgema.gov%7Cec4a90ff3c 8d483d91bd08d6014aa379%7Cc06a8be784794d73b35193bc9ba8295c%7C0%7C1 %7C636697817424900330&amp;sdata=wOrRFSxOgfLvvG5f228azEn0ХVDJx%2F06 mrfr47XTatY%3D&amp;reserved=0) 3

Lopez, Donna ATTACHMENT G-2 From: Richard Stallman <[email removed]> Sent: Monday, August 13, 2018 3:30 PM To: Cc: [email removed]; Kelley, Craig; Zondervan, Quinton Subject: For the ordinance committee about the surveillance ordinance (2) Please forward this to the ordinance committee, and to the whole council, in the ways that are appropriate. To the ordinance committee and the whole City Council, The City Manager asks for a revision to the surveillance ordinance that would, in effect, make compliance with the ordinance optional on the part of the city staff. That change would make the ordinance ineffective -- more an act of theater than a legal act. It behooves Cambridge to insist on real limits on surveillance. The City Soilicitor saya that the Plan E government system makes real control over the city's surveillance impossible. If that is the case, itfollows that Cambridge must change to another plan for its city government, so as to recover democratic control for the citizens. However, the situation may not be as bad as claimed. Reportedly Plan E includes this provision: Section 106 Officers and employees of the city appointed by, or under the authority of, the city manager shall perform the duties required of them by the city manager, under general regulations of the city council. Perhaps this permits a real surveillance ordinance. When a professional tells you "it can't be done" , it is wise to seek a second opinion. I suggest that the City Council engage an expert lawyer for the specific 1

task of developing legal arguments to assert that the Council can indeed adopt a surveillance ordinance with real authority over the actions of the city government. Richard Stallman 303 Third St Cambridge MA Dr Richard Stallman President, Free Software Foundation (https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgnu.org&a mp;data=02%7C01%7CDLopez%40Cambridgema.gov%7Ca06e00e9898e4ccd27370 8d601532e68%7Cc06a8be784794d73b35193bc9ba8295c%7C0%7C1%7C63669785 [phone removed]&amp;sdata=0ZFUroL|sox%2Bi2EPZJqeKeqloFUCPR1SdbhTiz09dC4%3 D&amp;reserved=0, https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffsf.org&amp ;data=02%7C01%7CDLopez%40Cambridgema.gov%7Ca06e00e9898e4ccd273708d 601532e68%7Cc06a8be784794d73b35193bc9ba8295c%7C0%7C1%7C6366978540 99087567&amp;sdata=q|OUCBcD%2ВDSNXYgvsxf1EaONHF6DmхEjFZvERkgWWwA %3D&amp;reserved=0) Internet Hall-of-Famer (https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Finternethall offame.org&amp;data=02%7C01%7CDLopez%40Cambridgema.gov%7Ca06e00e98 98e4ccd273708d601532e68%7Cc06a8be784794d73b35193bc9ba8295c%7C0%7C 1%7C636697854099087567&amр;sdata=aX014h%2F7Gk7nK15%2BiSVlsKm21uAg vCc%2B6k3d0eQuvoQ%3D&amp;reserved=0) 2