a compilation of the Surveillance technology Impact Reports approved by the City Council on February 24, 2020

February 24, 2020 To the Honorable, the City Council: Re: Additional Surveillance Technology Impact Reports Pursuant to the Surveillance Technology Ordinance, Chapter 2.128 of the Cambridge Municipal Code (the “Ordinance”), I am submitting the following to the City Council for review and discussion at the February 24, 2020 Council Meeting: • Three (3) new Surveillance Technology Impact Reports (“STIRs”), describing Surveillance Technologies which are subject to the Ordinance, which require City Council approval. The attached new STIRs were not previously submitted. They concern new Surveillance Technology the City is seeking to acquire and existing Surveillance Technology that – considering feedback from the Public Safety Committee – I am reporting to the Council in new, consolidated STIRs: • Digital Evidence Management System, a new Surveillance Technology requested by the Emergency Communications Department. • IP Address Collection Platforms, existing Surveillance Technology previously reported to the Council in two separate STIRs from the Information Technology Department. (See “Checkpoint Firewall” and “Web server access and error logging” STIRs submitted at the December 9, 2019 Council Meeting.) This new STIR clarifies the use of IP Address Collection Platforms throughout the City. • Atlas RMV Portal, existing Surveillance Technology previously reported to the Council in two separate STIRs from the Finance Department and the Traffic, Parking and Transportation Department. (See “Atlas Database (RMV)” and “ATLAS: Massachusetts RMV Website Portal” STIRs submitted at the December 9, 2019 Council Meeting.) This new STIR clarifies the use of the Atlas RMV Portal throughout the City and incorporates the Assessing Department’s use of the Portal. In a separate communication, I will also submit the following to the City Council for review and discussion at the February 24, 2020 Council Meeting: • Revised Surveillance Technology Impact Reports (“STIRs”), describing Surveillance Technologies which are subject to the Ordinance, which require City Council approval.

The original STIRs were submitted to the City Council at the December 9, 2019 Council Meeting or to the Public Safety Committee at a January 22, 2020 committee meeting and were reviewed and discussed at the January 22, 2020 committee meeting. The revised STIRs will address feedback from the Public Safety Committee. • Summary of STIRs submitted to the City Council during the past year. The Summary of STIRs will include a summary of all STIRs submitted to the City Council to date, including what action the City Council took on same, and reference all revised STIRs for ease of review by the Council. Those STIRs previously submitted to the City Council at the December 9, 2019 Council Meeting or to the Public Safety Committee at a January 22, 2020 committee meeting, were discussed in detail at the January 22, 2020 Public Safety Committee meeting and referred to the City Council by the Public Safety Committee with a recommendation that they be approved by the City Council. I look forward to reviewing these documents in detail with you at the February 24, 2020 City Council meeting and to answering any questions you may have. Sincerely, Louis A. DePasquale City Manager Enclosures

SURVEILLANCE TECHNOLOGY IMPACT REPORT Department: Emergency Communications Department Division or Unit (if applicable): Submitted by: Walter Heffernan/Christina Giacobbe Date: 2/24/2020 Surveillance Technology: Digital Evidence Mangement System 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • A Digital Evidence Management System is similar to a document management solution. The Digital Evidence Management System is a repository of currently collected data such as 911 calls, Police Records Management System, Evidence, Computer Aided Dispatch, Crime Scene Photos, Interview Room Recordings, Lab Reports and Shot Spotter data. • The purpose of this technology is to provide a centralized storage location for the existing data from our current disparate systems in the Emergency Communications and Police Departments and store it in one central repository to facilitate the management of investigations and digital evidence in a secure cloud-based system for authorized users. This technology will store copies of existing protected Criminal Justice Information Services (CJIS) information and will be compliant as required by the CJIS security requirements for federal, state and local governments. Additionally, this technology will provide a secure electronic connection to the Cambridge Police Department’s Court Prosecutors Office and the District Attorney’s Office. This technology will automate the delivery of documentation that is currently required by the court. Currently, there are over 4,000 cases assigned annually that we process for court. • This technology also provides a secure automated evidence upload feature for citizens who voluntarily provide evidence to the police department. For example, a witness of a crime may have a photo of a car and license plate that fled the scene. This information could be uploaded to increase solvability factors as well as increased citizen participation. In addition, business owners could voluntarily register their closed-circuit television systems through the technology, so that the Police Department does not have to canvas the neighborhood to locate these devices. • The impact of this technology on the departments will increase business operations and effective data collection. This will also reduce the risk of errors in manual data gathering and therefore provide more effective evidence collection. In addition, there

will be a reduction in staff resources for data collection from various units and departments. 2. What is the purpose of the Surveillance Technology? • The current process for gathering data is very manual and labor intensive. The Police and Emergency Communications Department receive requests daily from the Middlesex Attorney’s Office for all existing discoverable information for related cases prior to the initial court date. They use this information to properly assess the facts of the case and determine prosecution. This technology will automate the process reducing the manual effort of pulling this information, transporting case files and providing copies of 911 calls for review via discs. • The purpose of a Digital Evidence Management System is to consolidate data from siloed applications and data sources. The technology provides an automated solution for gathering evidence of violations of any criminal or civil law, administrative actions and collected records such as 911 audio, Police Records Management System, Evidence, and Computer Aided Dispatch (CAD). In addition, the technology provides secure connection to transfer required case evidence to the court. • The technology also provides a secure connection for residents and registered business owners to upload case evidence including pictures and videos. This application allows the police department to communicate with residents effectively and efficiently in obtaining additional information that will assist in solving crimes. 3. Where will the Surveillance Technology be deployed? When? • The technology will be deployed in the data center at 125 6th Street so that it can connect to the existing systems that support the Police Department and Emergency Communications. • If a cloud-based solution is chosen, then it will be deployed to both 125 6th Street data center and the Microsoft Azure Government Cloud. Microsoft Azure Government Cloud is a commercial infrastructure cloud platform contractually committed to meeting the CJIS security requirements for federal, state and local governments. It will then transmit the data over Virtual Private Network (VPN) connections that will be configured to meet the CJIS security requirements. This will be used to send and receive data from court and residents and/or registered businesses. • The target date for procuring this technology is spring 2020. 4. What privacy impact will the Surveillance Technology have?

• The privacy impact of this technology is consistent with federal, state and local government policies for the purposes of law enforcement and public safety efforts. With the implementation of this technology, the authorized personnel performing law enforcement duties will have electronic access to records that currently exist in various systems. The department continues to maintain those data sources and deliberately chose not to expand access to additional data from what it is today. Therefore, there is no additional privacy impact from the utilization of this technology. • This technology will be configured with similar role-based access to the existing data in disparate systems to ensure protection of the data. Therefore, only authorized users will have access for performing their duties in accordance with their role in the respective departments. This technology will provide an electronic version of the same data set to the court that exists today in our systems that we use to gather information on case files. • Because this technology provides an opportunity for citizens and business to engage and participate in sharing media, there may be a greater impact on privacy of the individuals or businesses who voluntarily provide such information to law enforcement officials. The Police Department will address these privacy impacts by limiting access to the information to assigned investigators and/or authorized users, similarly to current department policy. All access will be password protected and there will be a change log identifying all users who access each record and data source. In addition, we will conduct detailed training on the use of the system and best practices for protecting personal information as well as quality assurance measures for compliance. Lastly, the department will ensure appropriate communications are visible on the portal and/or department webpage so that residents and business owners are aware of the use of this technology and shared media. • This technology does not have the capacity to access residents or business owners’ devices. Anyone who wishes to share information through the system will upload the media that they wish to share. In addition, the technology will only record the information provided by the sender. Business owners who voluntarily register on the technology platform may be asked by law enforcement to provide media for a specific date and time related to a case. The business owner can voluntarily provide the media if they choose, but law enforcement cannot access the media without their consent. The benefits of the business registration program allow for investigators to request media directly without having to canvass the area saving valuable time during investigations. • Currently, citizens and business owners volunteer data in person and/or on the scene of an incident. We receive a tremendous amount of support and cooperation in obtaining media related to incidents. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds?

• Technology Purchase: The initial cost and ongoing maintenance for the purchase of the technology are estimated in the table below, based on a 3-year license: Estimated Fee Schedule Initial Subscription Term Total Fees Year 1 Fees Year 2 Fees Year 3 Implementation Services Fees $92,900 $92,900 Software license and support $140,000 $145,000 $285,000 Server(s), OS, Certificates, Support $4,000 $4,000 $96,900 $140,000 $145,000 $381,900 • Personnel Costs: Estimated to be one (1) System Admin and one (1) Application Developer for sixty (60) hours to implement this application. On-going support is estimated at five (5) hours per month; we expect this time will be used researching any system or application issues and performing system maintenance. There should be a reduction in on-going personnel costs as this application consolidates all the required data gathering and documentation for court and organizes it in one place for reference which will increase resources to support other areas of the department. • Source of funds: Initial $92,900 EGov/Free Cash appropriation on December 16, 2019. Anticipate further funding through EGov/Free Cash.

SURVEILLANCE TECHNOLOGY IMPACT REPORT Department: IT Department Division or Unit (if applicable): Submitted by: Eric Belford, Mike Dugas Date: 02/24/2020 Surveillance Technology: IP Address Collection Platforms (Multiple) 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • The City of Cambridge uses various platforms that collect IP addresses from internal and external connections and connection attempts, e.g., the City website, Find It Cambridge, the City firewall and the City’s web servers. While the platforms vary, the surveillance capabilities and functionality are the same. IP address information is used to limit and protect the City network from malicious sites and unauthorized access. • The identification of a device's IP address can be used to determine the country, city, or postal/ZIP code of the device, determining an object's generalized geographical location. • The City’s Microsoft web server software records IP addresses, as well as date & time, referring URL (if provided by the browser), and user agent string (again, if provided by the user’s browser) at the time of the request for connection to the server. It also records connection errors. The data is written to log files on disk for future reference and analysis. • The firewall uses the same information to protect City of Cambridge users and Data. When malicious activity occurs from a certain IP or region, we are able to adequately protect or defend city data. We do not use this information to identify individuals only as a means to protect City employees, City data infrastructure, and personal information. • This information is not sent to any third parties. 2. What is the purpose of the Surveillance Technology? • Maintaining the safety and security of City Data, Infrastructure, Employees, Students, Customers, and City-owned or controlled buildings. • Analyzing and managing service delivery.

• The City of Cambridge collects information about visitors to public websites. This information is used for analytical and statistical purposes to help better manage the sites. Information that is collected includes the date and the type of browser being used. We use this information to learn how many visitors we have, the websites they are coming from, which parts of our web site are of most interest to users and other facts that will help us improve the web site and the services we offer. • Identifying IP addresses is critical to the City’s network security. The City is a member of the Multi-State Information Sharing & Analysis Center, an organization dedicated to improving cybersecurity for state and local governments. Through this membership, ITD receives regular reports listing the top malware IP addresses. Identifying the IP addresses connecting to the City’s platforms allows ITD to protect against malware IP addresses and similar threats. (See attached report example.) 3. Where will the Surveillance Technology be deployed? When? • All City web servers; firewall. • The log files have been collected on these devices for over 20 years. They are located at the Healy Building in Cambridge and on the Microsoft Azure Government Cloud. The Microsoft Azure Government Cloud is a commercial infrastructure cloud platform contractually committed to meeting privacy and security requirements for federal, state and local governments. 4. What privacy impact will the Surveillance Technology have? • The identification of a device's IP address can be used to determine the country, city, or postal/ZIP code of the device, determining an object's generalized geographical location. • Access to all collected IP addresses is password protected, and authorized employees receive annual training on best practices for protecting personal information. • This information is not sent to any third parties. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? Firewall • $300,000 implementation cost • $20,000 ongoing training • $50,000 annual maintenance Website(s)

• Hosted on a Virtual Host which contains many servers, making a cost estimate difficult to pinpoint but we estimate about $50,000.

SURVEILLANCE TECHNOLOGY IMPACT REPORT Department: Finance Department – Revenue & Assessing; Traffic, Parking, and Transportation – Parking Management Division or Unit (if applicable): Submitted by: Revenue – Michele Kincaid, Angela Brathwaite; Assessing – Gayle Willett; TPT – Joe Barr, Brooke McKenna, Stephanie McAuliffe Date: 2/24/20 Surveillance Technology: Atlas RMV Portal 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • The Atlas RMV Portal is a web application provided by the Commonwealth of Massachusetts to access the RMV system. The Atlas Database holds information on all the registered/licensed drivers in the Commonwealth of Massachusetts. These records are created and maintained by the RMV. Information is collected by the RMV and is accessible to municipalities when users log in to view a driver or dealer’s profile. The City is not able to save or store any of this information internally, it is only available on the Database. When logged in, City users are connected directly to the RMV system. Any changes made by the City are also updated at the RMV in real time. Departments access different types of data through the Portal, depending on their purpose for using the system: • Finance/Revenue – The Portal allows staff to access a driver’s personal identifiable information as reported on their Massachusetts licenses: address, birth date, height, gender, eye color, etc., in order to administer the Commonwealth’s Motor Vehicle Excise Tax. This tax is required by Massachusetts General Laws and is levied by the city or town where the vehicle is principally garaged. The Portal is used when a driver contacts the Revenue office and requests to have a hold lifted from their account. Per City policy, in order to receive a release, drivers are required to pay all outstanding Excise bills to the City, regardless of which bills are on hold. In certain circumstances, the Finance Department will allow for a payment plan to aid drivers who are experiencing financial hardships.

Payment plans are granted on a case by case basis and require approval from the Treasurer. • Finance/Assessing – The Portal allows staff to create excise tax bills for billing car dealerships with dealer plates. The RMV provides a list of all dealer plates registered in Cambridge which are then billed for excise taxes. • Traffic, Parking, and Transportation – The portal allows staff to access a driver’s name, address, license plate number, registration status, vehicle details, vehicle addresses and garage code. This information is used to issue resident parking permits; view handicap placard information and clear holds on licenses and vehicle registrations. 2. What is the purpose of the Surveillance Technology? • Enforcing obligations to the City. • Executing financial transactions between the City and any individual engaged in a financial transaction with the City. • Finance/Revenue – The Portal is used in a very limited capacity to release the Non- Renewal hold at the RMV for a taxpayer who has paid a delinquent Motor Vehicle Excise tax bill via credit card or cash. The City provides this service to accommodate those taxpayers who need a release relatively quickly. For instance, a taxpayer may not even realize they are on RMV hold until they go to the registry to renew their license or registration. The taxpayer will pay the outstanding bill on-line via credit card and then call the Finance Office for a release. • Finance/Assessing – The RMV requires municipalities to use the Atlas Portal for accessing dealer plate information needed for excise tax billing. • Traffic, Parking, and Transportation – The Portal assists Parking Services staff in issuing resident parking permits, viewing handicap placard information, and clearing holds on licenses and vehicle registrations. 3. Where will the Surveillance Technology be deployed? When? • The Atlas RMV Portal is a web application accessed online, with individual usernames and passwords.

• An updated Atlas RMV Portal deployed in November 2019. A previous system had been in place since the early 2000s. 4. What privacy impact will the Surveillance Technology have? • Finance/Revenue – The Portal provides access to personal identifiable information about drivers registered in the Commonwealth of Massachusetts. The information that is found on a Massachusetts issued driver’s license is found on the Portal: address, birth date, height, gender, eye color, etc. When viewing a driver profile, City users are able to see any outstanding excise tax bills, parking tickets, and pay-by-plate tickets that are under the driver’s name. All drivers within the Commonwealth are subject to Excise tax. Students moving in and out of the city between semesters, and other individuals coming and going, may lose track of where their vehicle is registered and may not receive their bill to pay it on time. Revenue mitigates privacy impacts by only granting access to three employees. The system requires a username, password, and a unique security code that is sent via email each time a log in attempt is made. Users are automatically logged out after 10 minutes of inactivity and will be required to re-submit their username, password, and a new security code to re-enter. • Finance/Assessing – The Portal provides information that is not available to the public regarding the number of dealer plates any dealership has in Cambridge. The Assessing department has limited access to this database to three members of the department and has requested the least amount of information required for sending out bills. The Assessing department has requested only vehicle inquiry roles related to dealer plates and no additional information that could be provided through the Atlas RMV Portal, such as driver inquiry or access to driving records. • Traffic, Parking, and Transportation – The Portal allows TPT staff to access detailed personal information about Cambridge residents. The information accessed is not collected or stored and the public cannot access it. The information is only accessed by Parking Services staff when issuing resident parking permits, viewing handicap placard information, and clearing holds on licenses and vehicle registrations, all of which are requested by the customer. The data available on the Portal may have a greater impact on the privacy of those individuals who own a vehicle than those individuals who do not own a vehicle, since staff only access the vehicle registration data for resident who own cars. Access to the Portal is password protected and the Parking Services Staff who use ATLAS receive individual, detailed training which includes best practices for protecting personal information.

5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? • Finance/Revenue – The City is assessed an RMV fee on the Cherry Sheet Assessments. Massachusetts Statutes authorize an RMV Surcharge of $20.00 per each clear transaction made through the Atlas Database. The cost of the RMV Surcharge is built into the fees that are incurred on bills that have been paid late. • Finance/Assessing – All costs associated with Assessing’s use for dealer plate billing are covered by the RMV. • Traffic, Parking, and Transportation – There are no initial costs associated with Atlas and all maintenance costs are the responsibility of the Massachusetts RMV. There is a $20.00 RMV surcharge for clearing registration holds. In FY 2019, there were 17,973 chargeable clears for license and registration holds. Since FY2014, at the request of the Massachusetts RMV, the City provides an annual non-renewal reconciliation adjustment amount which is reported to the State Comptroller and then debited against municipalities’ local aid distributions.

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Consolidating STIRs Nos. 1 & 46 Submitted December 9, 2020) Department: Assessing & Police Division or Unit (if applicable): CPD – CID Submitted by: Assessing – Gayle Willett; CPD – Jim MulcahyCommissioner Branville Bard Date: 2/24/20 Surveillance Technology: LexisNexis 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • LexisNexis is a search engine. Users pay a fee to searchpublic records and other information compiled by the provider. • Assessing – Assesing is seeking to use LexisNexis to review information submitted by taxpayers seeking residential exemptions and personal exemptions. • CPD – CPD uses LexisNexis as a research tool to locate people, companies, businesses, phone numbers, properties and fragments of information; this information helps to create a more complete picture of what CPD is investigating (e.g., the Department enters the name and phone number of an individual who had been the victim of a scam, this search leads us to where the “scammer” found the victim’s information, potentially creating a solid investigative lead). 2. What is the purpose of the Surveillance Technology? • Assessing: Preventing waste, fraud, and abuse of City resources. This data will allow the Assessing department to vet information received from taxpayers in order to prevent fraud. • CPD – Identifying and preventing threats to persons and property and preventing injury to persons or significant damage to property. 3. Where will the Surveillance Technology be deployed? When? 1

• Assessing – Will be used in the Assessing Department. Anticipated start date spring 2020. • CPD – Crime Analysis and Criminal Investigations Division. Currently in use. 4. What privacy impact will the Surveillance Technology have? • This technology has a minimal impact since it is composed of public records. Anyone can access LexisNexis. The search engine offers various levels of information depending on subscription cost. • Assessing will limit access to LexisNexis to two staff members. These are staff who are currently part of the review process of the exemptions and access to this program should make their jobs easier. Additionally, the use of the software by the Assessing department is reviewed by LexisNexis to ensure that it is used only for department business. LexisNexis can audit the Assessing department to ensure that the data is being used only for business purposes. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? • Assessing - Assessing department budget will cover the costs for two licenses at $120.00 each, equaling $240.00 per year. • CPD – Part of Accurint cost. 2

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Revising STIR No. 2 Submitted December 9, 2019) Department: Emergency Communications Department Division or Unit (if applicable): Emergency Communications Center Submitted by: Christina Giacobbe Date: 2/24/20 Surveillance Technology: RapidSOS Emergency Data Integration System 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • RapidSOS Emergency Data Integration System (RapidSOS) is a web platform that provides life-saving data directly to 911 and first responders in an emergency, providing faster, more effective responses. Callers who contact 911 do so voluntarily seeking emergency services. RapidSOS integrates data from: personal devices such as smartphones and smartwatches, motor vehicles’ GPS and crash-detection systems, and home security systems, to provide real-time emergency data that supplements information provided during an individual 911 call. • RapidSOS is deployed by the Commonwealth of Massachusetts’ State 911 Department, which manages and oversees the Next Generation 911 system. This state system delivers 911 calls to the appropriate jurisdiction and RapidSOS technology functions as a clearinghouse to present the call to the Public Safety Answering Point (PSAP), or call center, for emergency response. ECC serves as a PSAP and is therefore required to access RapidSOS through the State 911 system. • In Cambridge, when callers contact 911 their call is directed to Emergency Communications on the state’s Next Generation 911 platform and RapidSOS provides secondary, data-based location information to ECC through the RapidSOS clearinghouse The data that is collected at the time of the call is the caller location and phone number. All 911 calls and caller information are required to be recorded. These records are kept according to record retention policies through the administrative portal of the Next General 911 System. • The State 911 Department is required by law to review and assess all technological and operational capability of wireless 911 calls being routed and handled directly by 3

the PSAP in which the caller is located. The State 911 Department is responsible for ensuring such capability exists and they establish the standards, by which our PSAP receives wireless calls. 2. What is the purpose of the Surveillance Technology? • The purpose of this technology is to provide ECC Call Takers and Dispatchers with an accurate phone number and location information of wireless callers who contact 911 in our jurisdiction. This is necessary to provide aid to the caller, dispatch emergency personnel and provide emergency services. This information also allows Call Takers and Dispatchers to contact the caller if the call gets disconnected or for additional follow up. • This technology supports our ability to maintain the safety and security of City employees, students, and residents when experiencing an emergency situation. In addition, this technology allows us to communicate life saving information to first reponsders. 3. Where will the Surveillance Technology be deployed? When? • The RapidSOS technology is deployed by the State 911 Department to all PSAPs in the Commonwealth as part of the Next Generation 911 System. The RapidSOS technology is housed on the State 911 system located in Middleboro and a local server for our PSAP is located at 125 Sixth Street. • This technology was implemented in 2018. 4. What privacy impact will the Surveillance Technology have? • The privacy impact of this technology is consistent with federal, state and local government policies for the purposes of law enforcement and public safety efforts. Records of 911 calls received through traditional call processing have previously included location and phone information provided by cellular carriers, and RapidSOS provides the same information. However, with the rapid advancement of location- based technology, our reliance on cellular carriers’ location information has decreased. The RapidSOS technology provides more accurate location information. The Next Generation 911 System administered by the State provides also provides subscriber information, i.e., the name of the person to whom the phone is registered, as well as the phone address and number. Currently, all callers that contact 911 are informed that the call is being recorded as required by law. 4

• The State 911 Department provides role-based access to the data to ensure protection of caller information. In ECC/our PSAP, Call Takers and Dispatchers have access to caller information during the call and for thirty minutes after the call has been disconnected. Authorized users will have access for performing their duties in accordance with their role during call processing, quality assurance and investigative matters. • Because this technology provides an opportunity for citizens and business to access emergency services, there may be a greater impact on privacy of the individuals or businesses who voluntarily provide information to law enforcement officials during emergencies. The Emergency Communications Department will address these privacy impacts by limiting access to the information to assigned investigators and/or authorized users, similarly to current department policy. • All access to the RapidSOS administrative portal is limited to managers of the ECD and is password protected. • The State 911 Department reviews and assesses new communications technologies that may serve as Next Generation 911 technology platforms, consistent with FCC decisions and federal law. RapidSOS technology has been thoroughly vetted by the State to provide life-saving information during emergencies. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? • There are no associated costs with RapidSOS technology as it is deployed by the State 911 Department as part of the State Next Generation 911 system. 5

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Revising STIR No. 3 Submitted December 9, 2019) Department: Emergency Communications Department Division or Unit (if applicable): Police Submitted by: Christina Giacobbe Date: 2/24/2020 Surveillance Technology: Trespass Tracking database 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • In Massachusetts, trespassing is a crime. G.L. c266, §120 provides private entities and departments within the City of Cambridge to obtain a no trespass order against individuals after providing appropriate posted notice on the property or providing notice to the person directly by the Cambridge Police Department. • Information about no trespassing notices/letters provided to individuals through this process are recorded in the Trespass Tracking database during a call for service. The Trespass Tracking database is part of CPD & ECC’s Computer Aided Dispatch (CAD) database. (The CAD is itself a component of CPD’s complete QED/Records Management System.) • The information recorded is the trespasser’s name, location of the trespass, and other identification information if known such as address, who served the order, driver’s license number and date of the notice’s issue and expiration. The Police Department is required to maintain these notices. All notices and the information in the notice are recorded in our Trespass Tracking database so that the information can be made readily available to first responders during calls for service. 2. What is the purpose of the Surveillance Technology? • The purpose of the database is to have a centralized record of all active trespass notices. The recording of this information is to ensure public safety, in particular the safety of those impacted by the notice as well as officer safety. In addition, the Trespass Tracking database allows us to maintain an electronic record of all active trespass notices in the City in one database in CAD. 6

• This technology supports our ability to maintain the safety and security of City employees, students, and residents in Cambridge. In addition, this technology allows us to communicate life saving information to first reponders. With this vital information, police officers are able to identify and prevent threats to persons and property and prevent injury to persons or significant damage to property. • The Police Department is able to identify, apprehend, and prosecute criminal offenders and gather evidence of violations of any law in criminal, civil, and administrative actions. Providing information to emergency personnel and enforcing obligations to the City is required to ensure a safe community. Therefore, this information must be accessed with ease during emergency responses. 3. Where will the Surveillance Technology be deployed? When? • The technology is deployed in the data center at 125 6th Street so that it can connect to the existing CAD/RMS systems that support the Police Department and Emergency Communications. The information is maintained in the CAD/QED system that is deployed in the Emergency Communications Center, Police, and Fire Departments. • The department has been utilizing this database for the past ten years. 4. What privacy impact will the Surveillance Technology have? • The individuals who are recorded in the Trespass Tracking database are notified verbally and in writing of the notice to not trespass at the said location, and that notice contains all information stored in the Trespass Tracking database. Therefore, there is no additional privacy impact through the utilization of this technology as it is an electronic database of trespass notices that have already been served. • The records are available electronically through the CAD/QED system to authorized personnel performing law enforcement duties. However, there are restictions and access to this database is managed by ECC. There is no public access to this database and only authorized employees can review on a secure connection. • This technology stores copies of existing protected Criminal Justice Information Services (CJIS) information and complies with mandatory CJIS security requirements for federal, state and local governments. The privacy impact of this technology is consistent with federal, state and local government policies for the purposes of law enforcement and public safety efforts. 7

5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? • There are no distinct costs for the Trespass Tracking database as it lives in the CAD/QED system. 8

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Revising STIR No. 4 Submitted December 9, 2019) Department: Executive/City Manager Division or Unit (if applicable): Public Information Office & Communications/Community Relations staff in: Arts Council, Community Development, Department of Human Service Programs, Library, Police Department, and Public Works Submitted by: Lee Gianetti Date: 12/9/1902/24/2020 Surveillance Technology: Media Monitoring - Meltwater 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • Meltwater is a software as a service (SaaS) company that monitors media channels and social media platforms to identify relevant content based on keyword search terms. Meltwater monitors digital and print media coverage, broadcast and radio coverage, and social media sites including Twitter, Facebook, YouTube, and blogs. The platform collects information through its content partnerships and aggregates results into different search channels for authorized City users. Additionally, the platform provides access to its media influencers (media contacts) database, and is used to distribute city media releases to the public and media. • Meltwater is used to monitor coverage of the City of Cambridge and key topic areas of interest (i.e. sustainability, construction, transportation, and Visionzero) to compile weekly reports to share with internal staff. 2. What is the purpose of the Surveillance Technology? • Communicating among City employees, with citizens, or with third parties • Monitoring various digital media sites for publications and information about the City of Cambridge • Conducting outreach with members of the media • Distributing media releases and summary reports • Conducting analysis on trends 3. Where will the Surveillance Technology be deployed? When? • Meltwater is a web based platform used by authorized city employees. 9

• Meltwater has a mobile application for use by authorizes city employees. 4. What privacy impact will the Surveillance Technology have? • Meltwater media searches collectscollect publicly available content, both open access and paywall access. Meltwater social media searches pull from the respective channelschannels’ “firehoses” and only providesprovide content that is allowed by the individual user or sitessite’s privacy settings. • The platform also provides various metrics on each search result and tracks open rates for media release emails. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? • Initial costs: Just annual subscription cost; no additional set-up costs • Source of Funds: Funds come from the Public Information Office’s OOM budget. • Ongoing costs: Annual subscription cost is $23,100. • Personnel costs: N/A 10

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Revising STIR No. 5 Submitted December 9, 2019) Department: Executive/City Manager Division or Unit (if applicable): Public Information Office & Communications/Community Relations staff in: Arts Council, Community Development, Library, Police Department and Public Works Submitted by: Lee Gianetti Date: 12/9/1902/24/2020 Surveillance Technology: Social Media Monitoring - Meltwater Engage (Powered by Sprout Social) 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • Meltwater Engage, which is powered by Sprout Social, is a software as a service (SaaS) that allows the City to schedule posts, respond to messages, deploy bots (on Twitter Direct Messages and Facebook messenger and private messages), store assets, access customizable analytics reports, and use social listening across networks and profiles (Twitter, Facebook, Instagram, Pinterest, and LinkedIn). Additionally, Meltwater Engage allows for direct connection to external help solutions (to open service request tickets) and provides a social CRMcustomer relationship management (CRM) for staff within the platform. 2. What is the purpose of the Surveillance Technology? • Documenting and improving performance of City employees • Analyzing and managing service delivery • Communicating among City employees, with citizens, orand with third parties • Surveying and gathering feedback from constituents 3. Where will the Surveillance Technology be deployed? When? • Meltwater Engage is a web based platform that used by authorized city employees. • Meltwater Engage has a mobile application for use by authorizes city employees. 4. What privacy impact will the Surveillance Technology have? 11

• Meltwater Engage can monitor conversations based on keywords, search operators, hashtags, geographic area, and user profile name, in addition to the monitoring direct interactions with city-maintained accounts. Its searches collect publicly available content and direct private messages sent to City accounts in the platform. Only content that is allowed by the individual user privacy settings areis visible in the platform. The platform provides various metrics for measuring content and campaign performance. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? • Initial costs: Just annual subscription cost; no additional set-up costs • Source of Funds: Funds come from the Public Information Office’s OOM budget. • Ongoing costs: Annual subscription cost is $33,500. • Personnel costs: N/A 12

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Revising STIR Submitted January 22, 2020) Department: Cambridge FireFire Division or Unit (if applicable): EMS Paramedics Submitted by: Acting Chief Gerard E. Mahoney, Acting Chief Date: 1/222/24/2020 Surveillance Technology: Verathon Corporation's Glidescope Go video laryngoscope. 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • Cambridge FireFire proposes to use the Verathon Corporation's Glidescope Go video laryngoscope. This is a medical device that facilitates critical medical care by capturing video of the back of the throat of an unconscious person in order to place an endotracheal tube (breathing tube). • A laryngoscope is a medical device, essentially a curved tongue depressor with a light at the end, that lifts the tongue out of the way and allows a paramedic to look through the patient's mouth and see the patient's tracheal opening in order to place a breathing tube in the trachea (also known as intubation). • Patients who require breathing tubes are the most critical patients we see, and usually are not breathing at all. In order to facilitate faster and more accurate breathing tube placement and improve outcomes, video laryngoscopy has been developed, which places a camera at the end of the device and a small video screen attached so the paramedic can see the tracheal opening better. • Glidescope GO records video only.on a mini SD card. There is no audio or data recording. 2. What is the purpose of the Surveillance Technology? • Documenting and improving performance of City employees. 13

• The purpose of the technology is to improveImproving critical health care processes and outcomes in order to provide the best available medical care to the residents and visitors of the City of Cambridge. 3. Where will the Surveillance Technology be deployed? When? • This technology will be on the CFD's Paramedic units, and will also be used in training with manikins. The video laryngoscopes will be acquired before June 30,2020 and deployed in or around May 2020as soon as is practicable. 4. What privacy impact will the Surveillance Technology have? • The privacy impact will be zero. There are no patient identifiers associated with thedevice is a simple video in the camera that stores the video on a removable mini SD card. The instrument. itself does not have the capacity to capture or store any images or data. If the device is used, the SD card will be secured until the video is uploaded into a HIPAA- compliant server, then the file on the SD card will be deleted. • There is a slight chance that the camera could catch a very quick, low resolution image (~1.25 ip/mm according to the engineers) of part of the patient’s face while being inserted or removed. The operator will be moving fast because the patient is not breathing and the paramedic will be focused on placing the endotracheal tube quickly. Therefore, the probability of capturing a stable image of the full face is slim. • When the video is uploaded into a patient’s chart or other data storage, itany image of the face will be considered protected health information and access will be severely limitedProtected Health Information (PHI) in accordance with the Health Insurance Portability and Accountability Act (HIPAA). Access to PHI is password protected with several levels of access, and each user has only the access they absolutely need (quality improvement, billing, etc.). • If the video is used in case review or training, there will be no patient identifiers associated with it., and only the relevant part of the video, the back of the airway and vocal cords, will be used. Any capture of the patient’s face will be obscured at the least, and most likely trimmed off the beginning/end of the video. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? 14

• The initialInitial costs: $24,784. Initial funding will be $24,784.00, which will be fundedprovided by a federal grant. This • Ongoing maintenance: The initial purchase includes 120 disposable blades. Once the initial supply of blades is exhausted, replacement blades will be purchased by CFD at a cost of $40-$52 each, depending on the style of blade. Training and Quality Improvement costs are impossible to determine, because they will be embedded within our standard training and quality processes. Ongoing costs will be funded through federal grants if available at the time, or through the CFD budget. 15

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Revising STIR No. 9 Submitted December 9, 2019) Department: Law Division or Unit (if applicable): Submitted by: Nancy Glowa Date: 12/9/192/24/20 Surveillance Technology: WestLaw Public Records Search function 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • WestLaw’s public records search function is used to gather publicly available information concerning litigants such as other lawsuits filed, judgments, convictions, warrants, bankruptcies, property records, and other publicly available filings or documents. 2. What is the purpose of the Surveillance Technology? • Gathering evidence of violations of any law in criminal, civil, and administrative actions. • Preventing waste, fraud, and abuse of City resources. 3. Where will the Surveillance Technology be deployed? When? • On an as-needed basis in litigation. 4. What privacy impact will the Surveillance Technology have? • The technology searches for public records based on documents filed in courts, registry of deeds, and other publicly available sources. • None. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? 16

• The WestLaw subscription total cost is bundled and not broken down by feature, therefore the cost for this specific feature is unknown. 17

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Consolidating STIRs Nos. 10 & 47 Submitted December 9, 2020) Department: Mayor’s Office, Council Office & Police Division or Unit (if applicable): CPD – PIO Submitted by: Mayor’s Office & Council Office – Naomie Stephen; CPD – Jim MulcahyCommissioner Branville Bard Date: 2/24/20 Surveillance Technology: Tweetdeck – Social media monitoring software through Twitter 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • TweetDeck is a social media dashboard application for management of Twitter accounts. Originally an independent app, TweetDeck was subsequently acquired by Twitter Inc. and integrated into Twitter's interface. • Tweetdeck allows users to organize and search Tweets in various ways. From Twitter1: o Collections – With collections, you can organize Tweets according to topics, events, interests, conversations, and more, all in real-time. Add your collections as columns and Tweet the URL to share it with others. o Search Typeahead – When you begin to type characters into the search box, TweetDeck will run a real-time search that attempts to autocomplete your search term, surfacing potentially relevant search topics and accounts. Different search topics will be shown on the top half of the drop-down menu, whereas user accounts will be shown on the bottom half. If you select one of the suggested search terms, you will be given the option to browse users related to that search topic or Tweets related to that search term. o Sentiment – It’s easy to uncover sentiment surrounding a topic; simply search for a topic followed by a happy or sad emoticon. For example, you can create a search column with the keyword "San Francisco :)" to see Tweets regarding San Francisco in a positive manner. 1 See About advanced Tweetdeck features at https://help.twitter.com/en/using-twitter/advanced-tweetdeck-features 18

o Column filters – TweetDeck’s column filters are a powerful way to customize searches by keyword, date and time, and to stay on top of new Tweets as columns quickly update. ▪ Content: Tweets matching keywords, media type, dates and time, language, or including or excluding Retweets ▪ Location: Tweets geotagged in a specified locations ▪ Users: Tweets from a specific account, members of a List, or verified accounts ▪ Engagement: Tweets with a minimum number of Retweets, likes, or replies ▪ Alerts: Tweet alerts through sound or desktop notifications o List management – TweetDeck allows you to manage your Lists easily in one centralized place for all your accounts. You can create Lists in TweetDeck filtered by your interests or by particular accounts. Any List that you have set up or subscribed to previously can also be added as separate columns in TweetDeck. o Tweets from a specific account – You can designate a column to display a specific account’s Tweets. Just add a Tweet column and search for the account you would like featured in the search box. 2. What is the purpose of the Surveillance Technology? • CPD o Providing information to emergency personnel o Analyzing and managing service delivery o Documenting and improving performance of City employees o Surveying and gathering feedback from constituents • Mayor’s Office & Council Office – Surveying and gathering feedback from constituents. More frequently, people are using Twitter to communicate their constituent concerns or issues with City services much in the same way that they would send an email. 3. Where will the Surveillance Technology be deployed? When? • Through City-issued computers and laptops, the technology is available continuously. • CPD – Public Information Office • Mayor’s Office & Council Office – While not in use at this time, the Mayor’s Office and City Council Office anticipate that staff could use this technology in the future, as former Mayors’ staff has done. 19

4. What privacy impact will the Surveillance Technology have? • This technology has a minimal impact as the software merely aggregates publicly available Twitter posts and mentions. • Tweets complied by Tweetdeck potentially collect all Tweets responding to designated search criteria that are Public (see definition below) and Protected Tweets if a City account follows that person. In each case, staff would only be able to see information that a person has chosen to release publicly on their Twitter account, in accordance with Twitter’s Terms and Conditions. Obviously, the search also only applies to people who use Twitter, and only those who include identifiable information on their account (some accounts, for example, are anonymous, use a nom de plume or, perhaps more appropriately, nom de guerre). Impacts to privacy would likely not be felt by any individual, as a simple search of one’s Twitter profile shows all Tweets, likes, retweets, and other activity from a user over the course of that profile’s existence, and Tweetdeck would not provide any additional information than could be found during such a search. • Additional information from Twitter: o What is the difference between public and protected Tweets? ▪ When you sign up for Twitter, your Tweets are public by default; anyone can view and interact with your Tweets. Should you choose to protect your Tweets, you can do so through your account settings. ▪ If you protect your Tweets, you’ll receive a request when new people want to follow you, which you can approve or deny. Accounts that began following you before you protected your Tweets will still be able to view and interact with your protected Tweets unless you block them. o Who can see my Tweets? ▪ Public Tweets (the default setting): Are visible to anyone, whether or not they have a Twitter account. ▪ Protected Tweets: Only visible to your Twitter followers. Please keep in mind, your followers may still capture images of your Tweets and share them. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? 20

• Tweetdeck is free through Twitter. • Personnel costs are minimal as Tweetdeck is only passively monitored. 21

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Revising STIR No. 11 Submitted December 9, 2019) Department: Police Division or Unit (if applicable): Crime Analysis Unit Submitted by: Jim MulcahyCommissioner Branville Bard Date: 12/9/192/24/2020 Surveillance Technology: Accurint Workstation 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • Crime Analysis Software for analysis, mapping, etc • The Accurint Workstation is a software program utilized by CPD to analyze and map incident data from the Department’s Incident Database, including arrest and incident reports; information contained in this database is gathered directly from QED, the Department’s Records Management System (RMS). • The Department uses this software to produce daily, monthly and yearly maps; many that are disseminated publicly in various formats (Public Safety Bulletins, monthly Bridgestat, CPD Annual Crime Report, etc.). 2. What is the purpose of the Surveillance Technology? • Identifying trends and preventing threats to persons and property and preventing injury to persons or significant damage to property • Identifying, apprehending, and prosecuting criminal offenders • Gathering evidence of violations of any law in criminal, civil, and administrative actions • The purpose of the Incident Database is to create a “condensed and corrected” accounting of QED arrest and incident reports for purpose of crime incident reporting. 3. Where will the Surveillance Technology be deployed? When? • Crime Analysis 22

• The Accurint Workstation is a software program used by the Crime Analysis Unit. The software is used on a daily basis. The Accurint Mapping product has been used by CPD for slightly more than 1 year. 4. What privacy impact will the Surveillance Technology have? • This technology has a minimal impact as the software analyzes incident data fromalready stored in the Department’s records management system. The Department is required by state and federal law, as well as court procedural rules to document a variety of police encounters, whether for criminal, civil or administrative matters. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? • $30,000 per year; previously budgeted through E-Gov but CPD anticipates funding will be included in the police budget beginning FY’21. 23

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Revising STIR No. 12 Submitted December 9, 2019; Supplemented January 22, 2020) Department: Police Division or Unit (if applicable): Crime Analysis (and CID) Submitted by: Jim MulcahyCommissioner Branville Bard Date: 12/9/192/24/20 Surveillance Technology: BRIC Omega Dashboard 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • BRIC Omega Dashboard is the Intel portal for Boston Regional Intelligence Center (BRIC). The BRIC works at the forefront of intelligence collection and analysis. The BRIC allows for a regional approach to analyze whether crimes are interconnected by geography, type, or method. The BRIC covers the Metro Boston Homeland Security Region (MBHSR), consisting of: Boston, Brookline, Cambridge, Chelsea, Everett, Quincy, Revere, Somerville, Winthrop, The Greater Boston Police Council (Boston Area Police Emergency Radio Network—BAPERN), Massachusetts Bay Transportation Authority (MBTA), Massachusetts Port Authority (Massport), and Metro Fire Association. • In order to have the most complete accounting of what crimes and trends are impacting the region, it is necessary for all cities and towns, including Cambridge to contribute intelligence information. As such, the Cambridge Police Department contributes the following information: Approved arrest reports and Field Interview and Observation (FIO) reports for certain cases (Confidential items, i.e., specifically marked domestic, juvenile, and sexual assault reports are excluded). • Intel portal for Boston Regional Intel CTR 2. What is the purpose of the Surveillance Technology? • Identifying and preventing threats to persons and property and preventing injury to persons or significant damage to property • Identifying, apprehending, and prosecuting criminal offenders • Gathering evidence of violations of any law in criminal, civil, and administrative actions 24

• Intelligence information is fundamental to the prevention of crime and violence. The use of regional intelligence enables CPD to make better informed decisions to combat crime and terrorism committed by individuals and organizations. Intelligence also helps with decisions pertaining to the deployment of resources throughout the City and region. • The BRIC frequently produces Officer Safety and Public Safety bulletins. Crime is not an isolated phenomena and Cambridge does not exist in a vaccuum; therefore, it is necessary for Cambridge to understand crime as it occurs throughout the region, as any crime committed in the region has the potential to impact crime and safety in Cambridge. 3. Where will the Surveillance Technology be deployed? When? • Crime Analysis Unit and Criminal Investigation Division: The BRIC Omega Dashboard’s usage and access is limited to members of the Procedural Justice Section (Crime Analysis) and the Criminal Investigation Divisions; as the Department analyzes and investigates criminal activity. • Access to the BRIC Omega Dashboard (by personnel outside of the CPD) is determined by the BRIC. 4. What privacy impact will the Surveillance Technology have? • Anytime that large amounts of intelligence information are gathered, significant privacy implications exist. The BRIC maintains a strict policy designed to “protect individual privacy, civil rights, civil liberties, and other protected interests”.2 o The 43-page policy states [in part]: The BRIC will not seek or retain and originating agencies will agree to not submit information about individuals or organizations solely on the basis of their religious, political, or social views or activities; their participation in a particular noncriminal organization or lawful event; or their races, ethnicities, citizenship, places of origin, ages, disabilities, genders, or sexual orientation. • The Cambridge Police are committed to responsibly accessing regional systems in manners that are consistent with Cambridge values and in compliance with its ordinances and practices. Based on its current usage and the significant safeguards in 2Boston Regional Intelligence Center Privacy, Civil Rights and Civil Liberties Protection Policy https://static1.squarespace.com/static/5086f19ce4b0ad16ff15598d/t/53449a84e4b0425649a10bb3/1397004932 621/BRICPrivacyCivilRightsCivilLibertiesProtectionPolicy.pdf 25

place, this technology has a minimal privacy impact on Cantabrigians and surrounding communities. • This technology has a minimal impact as it analyzes and maps incident data from the surrounding communities. Allows regional approach to analyze whether crimes are interconnected by geography, type, or method. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? • The BRIC Omega Dashboard has no financial costs to the City of Cambridge. It is funded by the Department of Homeland Security. • None 26

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Revising STIR No. 13 Submitted December 9, 2019; Supplemented January 22, 2020) Department: Police Division or Unit (if applicable): Crime Analysis (and CID) Submitted by: Jim MulcahyCommissioner Branville Bard Date: 12/9/192/24/20 Surveillance Technology: Coplink 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • Nespin portal for exchange of criminal justice incident reports. • COPLINK is one of the “solutions and services” provided through NESPIN (New England State Police Information Network®). COPLINK is a data sharing and crime analytics platform. • NESPIN is the local arm of a national project known as the RISS Program (Regional Information Sharing Systems). The goal of RISS is to assist local, state, federal and tribal Criminal Justice partners by providing adaptive solutions and services that facilitate information sharing, support criminal investigations, and promote officer safety.3 NESPIN is one of only six RISS centers operating nationwide. • In order to have the most complete accounting of what crimes and trends are impacting the region (statewide), it is necessary for all cities and towns, including Cambridge to contribute intelligence information. As such, the Cambridge Police Department contributes the following information: Approved arrest reports and Field Interview and Observation (FIO) reports for certain cases (Confidential items, i.e., specifically marked domestic, juvenile, and sexual assault reports are excluded). • Currently there are 280 cities and towns of the Commonwealth that contribute and utilize COPLINK. 2. What is the purpose of the Surveillance Technology? 3 Riss.net/about-us/ 27

• Identifying and preventing threats to persons and property and preventing injury to persons or significant damage to property • Identifying, apprehending, and prosecuting criminal offenders • Gathering evidence of violations of any law in criminal, civil, and administrative actions • As noted on its website, COPLINK is utilized by CPD personnel to improve officer and community safety, identify high concentration of crime in order to reduce crime and prioritize resource reallocation, identify crime trends as they occur in real-time, and develop data-driven tools to improve crime analysis and operational effectiveness. COPLINK has also proven useful in fulfilling requirements related to the issuance of License to Carry Firearms and background checks for Public Safety. 3. Where will the Surveillance Technology be deployed? When? • Crime Analysis and Criminal Investigation Division. • Crime Analysis Unit and Criminal Investigation Division: typically access to COPLINK (via NESPIN) is reserved to those members of the department assigned to Crime Analysis and Criminal Investigations; however, there are times when other members may be granted access. Because COPLINK contains Criminal Offender Record Information (CORI), only authorized persons in the performance of their official duties may access, use or disseminate this information for official and lawful criminal justice purposes. • Access to the COPLINK (by personnel outside of the CPD) is determined by the NESPIN/RISS. 4. What privacy impact will the Surveillance Technology have? • Anytime that large amounts of intelligence information are gathered, significant privacy implications exist. The NESPIN/RISS Centers operate their intelligence system under the Criminal Intelligence Systems Operating Policies (28 Code of Federal Regulations [CFR] Part 23). All RISS member agencies have agreed to comply with the requirements of 28 CFR Part 23 with respect to any criminal information they submit into an applicable RISS Criminal Intelligence Database (RISS/Intel). RISS has adopted a comprehensive privacy policy to protect individual privacy, civil rights, civil liberties, and other protected interests.4 4 See RISS's Commitment to Safeguarding Privacy, Civil Rights, and Civil Liberties at https://www.riss.net/policy/riss-commitment-to-privacy/. 28

• The Cambridge Police Department is committed to responsibly accessing regional systems in manners that are consistent with Cambridge values and in compliance with its ordinances and practices. • FACIAL RECOGNITION TECHNOLOGY: COPLINK’s user license account includes access to FaceMatch® and/or other facial recognition technology. Access to this technology has been banned pursuant to the prohibition created by City Ordinance Chapter 2.128 Surveillance Technology Ordinance (Effective 12/10/2019—amended 01/13/2020). Effective January 2020, Forensic Logic/COPLINK has removed the ability to access facial recognition technology from all CPD user accounts. o Additionally, the Cambridge Police Department is drafting an internal Policy to provide additional guidance. That Policy will state: “…Members of the Cambridge Police Department SHALL NOT access such technology in the performance of official duties. Members of the Cambridge Police Department SHALL NOT access such technology while on duty for any type of use. Members of the department SHALL NOT knowingly use data which originates from facial recognition technology…” 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? • Not available.RISS/NESPIN/COPLINK has no financial costs to the City of Cambridge. It is funded by the federal government. The actual cost is unknown at this time. 29

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Revising STIR No. 14 Submitted December 9, 2019) Department: Police Division or Unit (if applicable): Police Department Submitted by: Jim MulcahyCommissioner Branville Bard Date: 2/24/20 Surveillance Technology: QED Records Management System 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • QED currently functions as CPD’s Record Management System (RMS). A records management system (RMS) is “an agency-wide system that provides for the storage, retrieval, retention, manipulation, archiving, and viewing of information, records, documents, or files pertaining to law enforcement operations. In this context, records are limited to documents or electronic files directly related to law enforcement operations such as incident and accident reports, arrests, citations, warrants, case management, field contacts, etc.”5 • Nearly all information that comes to the Department interacts with its RMS and it has implications for data collection for most all systems and processes, including but not limited to: Calls for service (Computer Aided Dispatch CAD), Incident Reporting, Investigative Case Management, Traffic Accident Reporting, Citations, Field Contacts, Pawns, Civil processes, Protective/Restraint Orders, Permits and Licences, etc. • The Cambridge RMS satisfies the specifications required by the Bureau of Justice Assistance (BJA). According to the, “Standard Functional Specifications for Law Enforcement Records Management Systems (RMS)”6, published by the Bureau of Justice Assistance (BJA), a Law Enforcement RMS must: Allow for Single entry (i.e., no duplicate data entry), should automatically submit data to external sources as defined by the agency, enable the ability to enter and query narrative(s)/text fields, provide capability to access multiple systems from a single RMS workstation, create 5 https://it.ojp.gov/documents/LEITSC_Law_Enforcement_RMS_Systems.pdf 6 https://it.ojp.gov/documents/LEITSC_Law_Enforcement_RMS_Systems.pdf 30

a single database (i.e., virtual or physical), and have validation on data entry (i.e., logical edits, edit checks for all fields). o Additionally, according to the BJA standards, an RMS should provide the capabilities for users to generate inquiries to internal and external data sources—such as state Department of Motor Vehicles and criminal history files, as well as the National Crime Information Center (NCIC)—from within each module where such inquiries make sense. o It must also provide the user with the ability to reuse and/or import data returned from external sources to eliminate redundant data entry. 2. What is the purpose of the Surveillance Technology? • A records management system (RMS) is an agency-wide system that provides for the storage, retrieval, retention, manipulation, archiving, and viewing of information, records, documents, or files pertaining to law enforcement operations. In this context, records are limited to documents or electronic files directly related to law enforcement operations such as incident and accident reports, arrests, citations, warrants, case management, field contacts, etc. 3. Where will the Surveillance Technology be deployed? When? • QED is utilized by the entire Department. QED gathers information from several areas throughout the department and Public Safety Systems. 4. What privacy impact will the Surveillance Technology have? • Anytime that large amounts of intelligence information are gathered, significant privacy implications exist. QED serves as the central report writing and incident documentation system for the Department. The Department is required by state and federal law, as well as court procedural rules to document a variety of police encounters, whether for criminal, civil or administrative matters. • The Cambridge Police Department is committed to responsibly maintaining systems in manners that are consistent with Cambridge values and in compliance with its ordinances and practices. Only CJIS Compliant Certified Public Safety Employees in the performance of their official duties may access, use or disseminate information contained in QED for official and lawful criminal justice purposes. Based on its current usage and the significant safeguards in place, this technology has a minimal privacy impact on Cantabrigians and surrounding communities. 31

5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? • QED is a longstanding multi-agency product (Police, Fire, ECD). Its initial costs are unknown. According the Director of ECD the combined annual maintenance cost for all three agencies is $60K. 32

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Revising STIR No. 15 Submitted December 9, 2019) Department: Police Division or Unit (if applicable): Crime Analysis Submitted by: Jim MulcahyCommissioner Branville Bard Date: 12/9/192/24/2020 Surveillance Technology: Incident Database 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • The Incident Database is a Microsoft® Access database of corrected Records Management System Data. The database is used to “clean up” or to keep a more accurate record of the data that comes into the Records Management System (RMS) (i.e., initially an entry may be coded as a Larceny Motor Vehicle (L-MV) but through investigation it is determined to be a House Break where a L-MV also occurred—this database accurately reflects the appropriate Uniform Crime Reporting/National Incident-Based Reporting System code). • Access database of corrected RMS Data 2. What is the purpose of the Surveillance Technology? • Identifying and preventing threats to persons and property and preventing injury to persons or significant damage to property • Identifying, apprehending, and prosecuting criminal offenders • Gathering evidence of violations of any law in criminal, civil, and administrative actions • This database is a condensed and corrected accounting of QED incidents for purposes of crime incident statistical reporting. 3. Where will the Surveillance Technology be deployed? When? • Access to this database is limited to members of Crime Analysis Unit. 4. What privacy impact will the Surveillance Technology have? 33

• This technology has a minimal impact. Anytime that large amounts of intelligence information are gathered, significant privacy implications exist. This database is a condensed and corrected accounting of QED incidents for purposes of crime incident statistical reporting. The Department is required by state and federal law, as well as court procedural rules to document a variety of police encounters, whether for criminal, civil or administrative matters. • The Cambridge Police Department is committed to responsibly maintaining systems in manners that are consistent with Cambridge values and in compliance with its ordinances and practices. Only CJIS Compliant Certified Public Safety Employees in the performance of their official duties may access, use or disseminate information contained in this “limited” database for official and lawful criminal justice purposes. Based on its current usage and the significant safeguards in place, this technology has a minimal privacy impact on Cantabrigians and surrounding communities. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? • This database is created using Microsoft® Access, available through the City’s Microsoft Office suite, and is of little to no cost to the Department. • None. 34

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Revising STIR No. 16 Submitted December 9, 2019; Supplemented January 22, 2020) Department: Police Division or Unit (if applicable): Crime Analysis Submitted by: Jim MulcahyCommissioner Branville Bard Date: 2/24/20 Surveillance Technology: CLEAR 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • CLEAR® is a Public Records search engine. For a fee, CLEAR’s database provides access to thousands of data sets including, address, phone numbers, billing (utilities, etc.) and credit-related information through public records and publically available sources. According to its website: o “Thomson Reuters CLEAR® is powered by billions of data points and leverages cutting-edge public records technology to bring all key content together in a customizable dashboard. Locate hard-to-find information and quickly identify potential concerns associated with people and businesses to determine if further analysis is needed. The user-friendly platform was designed with intuitive navigation and simple filtering parameters, so you can quickly search across thousands of data sets and get accurate results in less time.” 2. What is the purpose of the Surveillance Technology? • Identifying and preventing threats to persons and property and preventing injury to persons or significant damage to property • Locating victims and witnesses of crimes • Identifying, apprehending, and prosecuting criminal offenders • Gathering evidence of violations of any law in criminal, civil, and administrative actions • Analyzing criminal activity and assisting with background investigations. 3. Where will the Surveillance Technology be deployed? When? 35

• Typically, this technology is reserved for members assigned to the Criminal Investigations Section. 4. What privacy impact will the Surveillance Technology have? • Anytime large quantities of data and information are accessed, even when those data/information are publicly available, significant privacy implications exist. Thomson Reuters’ CLEAR boast providing access to “billions of data points and thousands of datasets”. Thompson Reuters is a private, for-profit company that provides its service for a fee. The Cambridge Police Department is committed to responsibly accessing this service in a manner that is consistent with Cambridge’s values. The likelihood of disparately impacting a particular population via using this technology is small, as it has broad uses, aimed at providing information to assist the Department in providing services for those who have been harmed and locating those who have caused the harm. • CLEAR is subscription-based and access to certain levels of information is governed by the user’s level of subscription. In addition to accessing these public records to gather information on criminal suspects, the Department utilizes CLEAR to locate victims, witnesses and to verify background information on applicants (Public Safety Employment or License to Carry Firearms (LTC)). Through the Department’s Legal Advisor, it has been confirmed that CPD does not have subscription access to advance features such as CLEAR LPR which contains information obtained via License Plate Recognition Technology. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? • CPD currently has access to 5 licenses furnished to the Department by the Urban Area Security Initiative (UASI) at no cost to the agency. Information as to actual cost was not furnished by UASI. 36

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Revising STIR No. 17 Submitted December 9, 2019; Supplemented January 22, 2020) Department: Police Division or Unit (if applicable): Crime Analysis and Focussed Deterrence Unit Submitted by: Jim MulcahyCommissioner Branville Bard Date: 12/9/192/24/2020 Surveillance Technology: Focused Deterrence Database 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • Algorithm to analyze RMS data • The Focused Deterrence Database uses an algorithm to analyze Records Management System (RMS) data based on past arrest and incident reports. The database algorithm identifies individuals who most recently have caused or been the subject of (i.e., victim/survivor) the greatest social harm and could currently benefit from social services and a case manager (offender or victim/survivor). CPD reaches out to individuals identified through the Database to offer them the option of joining the Focused Deterrence Program. • “Focused Deterrence” in terms of policing is a strategy that aims to deter specific criminal behavior through fear of specific sanctions, as well as anticipation of benefits for not engaging in crime. In its initial iteration here in Cambridge, Focused Deterrence closely resembled this. There have always been “variants” of the Focused Deterrence program in practice; here in Cambridge, Focused Deterrence has morphed into an altogether different program. • Focused Deterrence in Cambridge does not utilize a predictive policing program, through the Focused Deterrence Database or otherwise. The department does not have a “gang database” (or any semblance thereof) and instead pulls information directly from the CPD RMS. 2. What is the purpose of the Surveillance Technology? • Assisting those who have most recently been the subject of the greatest amount of social harm and who could currently benefit from social services. 37

• Identifying and preventing threats to persons and property and preventing injury to persons or significant damage to property • Identifying, apprehending, and prosecuting criminal offenders • Gathering evidence of violations of any law in criminal, civil, and administrative actions 3. Where will the Surveillance Technology be deployed? When? • Crime Analysis Unit and Focussed Deterrence Unit 4. What privacy impact will the Surveillance Technology have? • This technology has a minimal impact as it analyzes existing incident reports from the Department’s Records Management System.RMS. The Department is required by state and federal law, as well as court procedural rules to document a variety of police encounters, whether for criminal, civil or administrative matters. The algorithm utilizes factors such as “role” played and “when” the incident occurred (allowing for a decaying weighted analysis). Additionally, crimes are weighted in strict accordance with Massachusetts Sentencing Guidelines. • The Department is committed to responsibly utilizing data in a way that is protective of privacy, civil rights and civil liberties. The potential for a widespread or disparate impact is limited; currently 6 individuals are in the Focused Deterrence program. As a point of reference, the Focused Deterrence database was not utilized for the 2019/2020 Focused Deterrence firearms violence program. Involved parties were identified through RMS arrest and firearms incident reports from the previous three years. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? • There is no cost associated with this technology; two CPD Detectives are assigned to this program in addition to their other duties/responsibilities. • None. 38

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Revising STIR No. 18 Submitted December 9, 2019) Department: Police Division or Unit (if applicable): Crime Analysis Submitted by: Jim MulcahyCommissioner Branville Bard Date: 12/9/192/24/2020 Surveillance Technology: LENS (Law Enforcement Notification System) 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • Federal Probation Database (active Cambridge federal probationers) • The Law Enforcement Notification System (LENS) is a web-based system which provides local law enforcement with information on federal offenders currently on supervision with the U.S. Courts. This release of information is required by the Violent Crime Control Act of 1994. Qualifying offenders include those convicted of certain drug trafficking crimes, crimes of violence, sex offenses and those convicted of internet child pornography offenses included as part of the Sex Offender Registration and Notification Act. LENS does not include offender information for those convicted in state or local jurisdictions nor does it include federal offenders convicted of non-qualifying offenses. LENS allows real time updates regarding these offenders, provides the ability to search neighboring jurisdictions and nationwide. 2. What is the purpose of the Surveillance Technology? • Identifying and preventing threats to persons and property and preventing injury to persons or significant damage to property • Identifying, apprehending, and prosecuting criminal offenders • Gathering evidence of violations of any law in criminal, civil, and administrative actions 3. Where will the Surveillance Technology be deployed? When? • Crime Analysis Unit 4. What privacy impact will the Surveillance Technology have? 39

• This technology has a minimal impact as the Department only has access to information about those individuals who are Cambridge residents that are on federal probation. The information is accessed via restricted web site for official use only and provided through federally managed application/portal. Only CJIS Compliant Certified Public Safety Employees in the performance of their official duties may access, use or disseminate information contained in LENS for official and lawful criminal justice purposes. The LENS web site informs users that “…Unauthorized use is subject to prosecution under Title 18 of the U.S. Code”, and that “…all activities and access attempts are logged”. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? • There are no costs to CPD, the program is federally managed and funded. None. 40

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Revising STIR No. 19 Submitted December 9, 2019) Department: Police Division or Unit (if applicable): CID Days; DV/SA; Cyber Submitted by: Jim MulcahyCommissioner Branville Bard Date: 12/9/192/24/2020 Surveillance Technology: GPS Tracking Devices (2) 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • Location tracking through satellite triangulation • Global Positioning System (GPS) is a technology that makes possible exact location tracking through satellite trilateration (sometimes mistakenly refered to as triangulation) using a network of satellites orbiting the Earth. The satellites are able to communicate with specialized receivers on the ground, providing the exact location of the receiver. • The CPD possess and utilizes two of these receivers to assist in certain criminal investigations (thefts of bicycles and pacakages). A GPS device is attached to a bicycle or package that might be stolen and, if a theft occurs, CPD tracks the item. 2. What is the purpose of the Surveillance Technology? • Identifying and preventing threats to persons and property and preventing injury to persons or significant damage to property • Identifying, apprehending, and prosecuting criminal offenders • Gathering evidence of violations of any law in criminal, civil, and administrative actions 3. Where will the Surveillance Technology be deployed? When? • Various locations throughout the City of Cambridge on an as needed basis (e.g., Bicycle Package Theft Sting Operations) 4. What privacy impact will the Surveillance Technology have? 41

• While the privacy implications for tracking individuals and items using GPS are wide-ranging; the technology as currently employed by the Cambridge Police Department should have no privacy impact because it is only utilized to track property (bikes/packages) stolen from the Cambridge Police Department. • This technology should have no privacy impact since it is utilized to track property (bikes/packages) stolen from the Cambridge Police Department. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? • The initial purchase price of this equipment was not available. 42

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Revising STIR No. 20 Submitted December 9, 2019; Supplemented January 22, 2020) Department: Police Division or Unit (if applicable): CID Days; DV/SA; Cyber Submitted by: Jim MulcahyCommissioner Branville Bard Date: 12/9/192/24/2020 Surveillance Technology: Digital Intelligence Workstation 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • Desktop computer hardware • Digital Intelligence Workstation is one of many tools utilized by the Criminal Investigation’s Cybercrime Unit to investigate computer-related crimes. This hardware allows Cybercrime Detectives to “image” a hard-drive for future analysis by computer software tools (Axiom-Magnet Forensics and/or Getdata Forensic Explorer). This technology is used in conjuction with other technologies: o Axiom-Magnet Forensics is software that can analyze the history of a file, recover digital evidence and analyze and report on digital evidence. o Getdata Forensic Explorer is software that can analyze digital evidence by locating, filtering, sorting and keyword searching. o Dell Laptop BCERT is hardware that is utilized to recover evidence from computer equipment (hard-drives, etc.). 2. What is the purpose of the Surveillance Technology? • Identifying and preventing threats to persons and property and preventing injury to persons or significant damage to property • Identifying, apprehending, and prosecuting criminal offenders • Gathering evidence of violations of any law in criminal, civil, and administrative actions • The technology is necessary to perform investigative functions in an increasingly “digital” world. It is utilized for a vast array of criminal investigations as well as non- criminal purposes: (1) where there is no reasonable expectation of privacy, (2) after consent is provided, or (3) where a search warrant is obtained. 43

3. Where will the Surveillance Technology be deployed? When? • Criminal Investigation’s Cybercrime Unit 4. What privacy impact will the Surveillance Technology have? • This technology has a minimal impact as it is utilized on property (phones, computers, etc.) where there is no reasonable expectation of privacy, after consent is provided or a search warrant is obtained. This technology is used in a wide berth of situations and the Cambridge Police Department is committed to using this technology responsibly and obtaining a search warrant in all situations that it be necessary. • The investigative capabilities contained herein are necessary tools for modern law enforcement. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? • We have not been able to determine this cost. None 44

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Revising STIR No. 21 Submitted December 9, 2019; Supplemented January 22, 2020) Department: Police Division or Unit (if applicable): CID Days; DV/SA; Cyber Submitted by: Jim MulcahyCommissioner Branville Bard Date: 12/9/192/24/2020 Surveillance Technology: Dell Laptop BCERT 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • Hardware for computer evidence recovery • Dell Laptop BCERT is hardware that is utilized to recover evidence from computer equipment (hard-drives, etc.). This technology is used in conjuction with other technologies: o Digital Intelligence Workstation is one of many tools utilized by the Criminal Investigation’s Cybercrime Unit to investigate computer-related crimes. This hardware allows Cybercrime Detectives to “image” a hard-drive for future analysis by computer software tools (Axiom-Magnet Forensics and/or Getdata Forensic Explorer). o Axiom-Magnet Forensics is software that can analyze the history of a file, recover digital evidence and analyze and report on digital evidence. o Getdata Forensic Explorer is software that can analyze digital evidence by locating, filtering, sorting and keyword searching. 2. What is the purpose of the Surveillance Technology? • Identifying and preventing threats to persons and property and preventing injury to persons or significant damage to property • Identifying, apprehending, and prosecuting criminal offenders • Gathering evidence of violations of any law in criminal, civil, and administrative actions • The technology is necessary to perform investigative functions in an increasingly “digital” world. It is utilized for a vast array of criminal investigations as well as non- criminal purposes: (1) where there is no reasonable expectation of privacy, (2) after consent is provided, or (3) where a search warrant is obtained. 45

3. Where will the Surveillance Technology be deployed? When? • Criminal Investigation’s Cybercrime Unit 4. What privacy impact will the Surveillance Technology have? • This technology is used in a wide berth of situations and the Cambridge Police Department is committed to using this technology responsibly and obtaining a search warrant in all situations that it be necessary. • The investigative capabilities contained herein are necessary tools for modern law enforcement. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? • We have not been able to determine this cost. None. 46

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Revising STIR No. 22 Submitted December 9, 2019; Supplemented January 22, 2020) Department: Police Division or Unit (if applicable): CID Days; DV/SA; Cyber Submitted by: Jim MulcahyCommissioner Branville Bard Date: 12/9/192/24/2020 Surveillance Technology: Magnet Forensics - Axiom 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • Forensics software for computers & mobile devices • Axiom-Magnet Forensics is software that can analyze the history of a file, recover digital evidence and analyze and report on digital evidence. This technology is used in conjuction with other technologies: o Dell Laptop BCERT is hardware that is utilized to recover evidence from computer equipment (hard-drives, etc.). o Digital Intelligence Workstation is one of many tools utilized by the Criminal Investigation’s Cybercrime Unit to investigate computer-related crimes. This hardware allows Cybercrime Detectives to “image” a hard-drive for future analysis by computer software tools (Axiom-Magnet Forensics and/or Getdata Forensic Explorer). o Getdata Forensic Explorer is software that can analyze digital evidence by locating, filtering, sorting and keyword searching. 2. What is the purpose of the Surveillance Technology? • Identifying and preventing threats to persons and property and preventing injury to persons or significant damage to property • Identifying, apprehending, and prosecuting criminal offenders • Gathering evidence of violations of any law in criminal, civil, and administrative actions • The technology is necessary to perform investigative functions in an increasingly “digital” world. It is utilized for a vast array of criminal investigations as well as non- criminal purposes: (1) where there is no reasonable expectation of privacy, (2) after consent is provided, or (3) where a search warrant is obtained. 47

3. Where will the Surveillance Technology be deployed? When? • Criminal Investigation’s Cybercrime Unit 4. What privacy impact will the Surveillance Technology have? • This technology has a minimal impact as it is utilized on property (phones, computers, etc.) where there is no reasonable expectation of privacy, after consent is provided or a search warrant is obtained. The investigative capabilities contained herein are necessary tools for modern law enforcement. • This technology is used in a wide berth of situations and the Cambridge Police Department is committed to using this technology responsibly and obtaining a search warrant in all situations that it be necessary. • The investigative capabilities contained herein are necessary tools for modern law enforcement. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? • We have not been able to determine this cost. 48

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Revising STIR No. 23 Submitted December 9, 2019; Supplemented January 22, 2020) Department: Police Division or Unit (if applicable): CID Days; DV/SA; Cyber Submitted by: Jim MulcahyCommissioner Branville Bard Date: 12/9/192/24/2020 Surveillance Technology: Getdata Forensic Explorer 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • Software for analysis of digital evidence • Getdata Forensic Explorer is software that can analyze digital evidence by locating, filtering, sorting and keyword searching. This technology is used in conjuction with other technologies: o Axiom-Magnet Forensics is software that can analyze the history of a file, recover digital evidence and analyze and report on digital evidence. o Dell Laptop BCERT is hardware that is utilized to recover evidence from computer equipment (hard-drives, etc.). o Digital Intelligence Workstation is one of many tools utilized by the Criminal Investigation’s Cybercrime Unit to investigate computer-related crimes. This hardware allows Cybercrime Detectives to “image” a hard-drive for future analysis by computer software tools (Axiom-Magnet Forensics and/or Getdata Forensic Explorer). 2. What is the purpose of the Surveillance Technology? • Identifying and preventing threats to persons and property and preventing injury to persons or significant damage to property • Identifying, apprehending, and prosecuting criminal offenders • Gathering evidence of violations of any law in criminal, civil, and administrative actions • The technology is necessary to perform investigative functions in an increasingly “digital” world. It is utilized for a vast array of criminal investigations as well as non- criminal purposes: (1) where there is no reasonable expectation of privacy, (2) after consent is provided, or (3) where a search warrant is obtained. 49

3. Where will the Surveillance Technology be deployed? When? • Criminal Investigation’s Cybercrime Unit 4. What privacy impact will the Surveillance Technology have? • This technology has a minimal impact as it is utilized on property (phones, computers, etc.) where there is no reasonable expectation of privacy, after consent is provided or a search warrant is obtained. This technology is used in a wide berth of situations and the Cambridge Police Department is committed to using this technology responsibly and obtaining a search warrant in all situations that it be necessary. • The investigative capabilities contained herein are necessary tools for modern law enforcement. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? • unavailable.We have not been able to determine this cost. 50

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Consolidating STIRs Nos. 25, 26 & 28 Submitted December 9, 2020; Supplemented January 22, 2020) Department: Police Division or Unit (if applicable): SIU Submitted by: Jim MulcahyCommissioner Branville Bard Date: 2/24/20 Surveillance Technology: Covert Cameras (Keltech Covert Streetlight Camera, CSA Pole Camera, IVC Covert Camera) 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • Covert cameras are deployed only in serious cases that pose a significant security or public safety risk. Cameras are placed in specified locations to capture images of suspected illegal activity. • These devices are not capable of recording audio, cannot capture license plate information, and do not possess a search function. The IVC Covert Camera does have pan, tilt, and zoom capabilities. • These cameras are not permanently deployed. • Per policy, these cameras cannot be deployed without the approval of a Police Superintendent or the Police Commissioner. 2. What is the purpose of the Surveillance Technology? • Identifying and preventing threats to persons and property and preventing injury to persons or significant damage to property • Identifying, apprehending, and prosecuting criminal offenders • Gathering evidence of violations of any law in criminal, civil, and administrative actions 3. Where will the Surveillance Technology be deployed? When? • Across the City, on an as-needed basis. 4. What privacy impact will the Surveillance Technology have? 54

• This technology has minimal impact as it is typically used for brief periods in public spaces that do not implicate constitutional protections. • This technology is only used in constitutionally protected spaces with consent, a search warrant or exigent circumstances. o Note: This technology has been/is used in protected spaces during investigations with third-party consent: (e.g., complainant thought that the presence of dead animals on multiple occasions may have been some type of threat; permission was given for CPD to place covert camera in protected space to capture image of culprit; it was determined that the dead animals were being placed by another animal). • Equipment/software does not possess a “search” function and cannot record license plates or other personally identifying information other than images of the individuals themselves. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? • unavailable.We have not been able to determine the cost of this technology. 55

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Revising STIR No. 27 Submitted December 9, 2019) Department: Police Division or Unit (if applicable): SIU Submitted by: Jim MulcahyCommissioner Branville Bard Date: 12/9/192/24/2020 Surveillance Technology: DTC body wire 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • Audio surveillance • Body wire is an audio surveillance device and is only used for officer safety purposes during undercover operations (controlled drug buys, prosititution stings, human trafficking, etc.). An officer wears the body wire to record audio of their surroundings. 2. What is the purpose of the Surveillance Technology? • Promoting officer safety during undercover operations • Identifying and preventing threats to persons and property and preventing injury to persons or significant damage to property • Maintaining the safety and security of City employees, students, customers, and City- owned or controlled buildings 3. Where will the Surveillance Technology be deployed? When? • Across the City, on an as-needed basis. 4. What privacy impact will the Surveillance Technology have? • This technology has minimal impact as it is used for officer safety purposes during controlled drug buys, prostitution stings and human trafficking operations. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? 56

• We have not been able to determine the initial cost of this technology.Not available 57

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Revising STIR No. 29 Submitted December 9, 2019) Department: Police Division or Unit (if applicable): Crime Scene Services Submitted by: Jim MulcahyCommissioner Branville Bard Date: 12/9/192/24/2020 Surveillance Technology: Morpho Automated Fingerprint Identification System (AFIS) with camera (Massachusetts State Police (MSP) System) 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • FingerprintMorpho is a fingerprint database withthrough the MSP. 2. What is the purpose of the Surveillance Technology? • Identifying, apprehending, and prosecuting criminal offenders • Gathering evidence of violations of any law in criminal, civil, and administrative actions 3. Where will the Surveillance Technology be deployed? When? • Crime Scene Services 4. What privacy impact will the Surveillance Technology have? • This technology has a minimal impactimpacts the privacy of individuals with fingerprints stored in the MSP database. It allows the Department’s Crime Scene Serves Section to compare unknown latent fingerprints to a state database of known fingerprints when investigating criminal activity. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? • $4,571 in The initial purchase price of this equipment is unavailable; annual maintenance costs are $4,571. 58

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Consolidating STIRs Nos. 30-32 Submitted December 9, 2020) Department: Police Division or Unit (if applicable): Crime Scene Services Submitted by: Jim MulcahyCommissioner Branville Bard Date: 2/24/20 Surveillance Technology: Live scan fingerprint system (3) 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • Digital fingerprint system with live feed to the Massachusetts State Police and Federal Bureau of Information for criminal history 2. What is the purpose of the Surveillance Technology? • Identifying and preventing threats to persons and property and preventing injury to persons or significant damage to property • Identifying, apprehending, and prosecuting criminal offenders • Gathering evidence of violations of any law in criminal, civil, and administrative actions 3. Where will the Surveillance Technology be deployed? When? • Two systems in Booking and one system in Records. 4. What privacy impact will the Surveillance Technology have? • This technology has a minimal impact as it is used to document and identify persons in lawful police custody or those persons who voluntarily wish to be fingerprinted. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? • Approximately $29,000 per system; plus $9,660 per system in maintenance costs. 59

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Consolidating STIRs Nos. 33-38 Submitted December 9, 2020) Department: Police Division or Unit (if applicable): EOD Submitted by: Jim MulcahyCommissioner Branville Bard Date: 2/24/20 Surveillance Technology: Wireless Explosive Ordinance Disposal (EOD) robots with cameras: Robotex Avatar II 2 (3); Foster Miller Tallon 4; Foster Miller Dragon Runner 4; Remotetec F6A 4 with fiberoptic 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • These devices provide robot gripper and camera assistance that can be remotely depoloyed to provide a live image of a suspected explosive device. The devices are various sizes: Robotex Avatar II 2 is a small platform, Foster Miller Tallon 4 & Foster Miller Dragon Runner 4 are medium platform, and the Remotetec F6A 4 with fiberoptic is a large platform. • These devices provide fast and reliable threat assessment for explosive ordinance disposal (EOD) and bomb technicians. Grippers allow for device manipulation. Cameras allow for visual inspection via distance. 2. What is the purpose of the Surveillance Technology? • Identifying and preventing threats to persons and property and preventing injury to persons or significant damage to property • Identifying, apprehending, and prosecuting criminal offenders • Gathering evidence of violations of any law in criminal, civil, and administrative actions • Maintaining the safety and security of City employees, students, customers, and City- owned or controlled buildings 3. Where will the Surveillance Technology be deployed? When? • Various explosive units 60

4. What privacy impact will the Surveillance Technology have? • This technology has a minimal impact as it is utilized minimally during exigent circumstances when an explosive device is believed to be present. The images captured are only of the suspected explosive device and its immediate surroundings. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? • Robotex Avatar II 2: Original cost was approximately $40,000 per Robotex. Ongoing cost is maintenance when needed. • Foster Miller Tallon 4: Original cost was $105,000. Ongoing maintenance costs when needed. • Foster Miller Dragon Runner 4: Original cost was $102,000. Ongoing maintenance costs when needed. • Remotetec F6A 4 with fiberoptic: Original cost was $150,000. Ongoing maintenance costs when needed. 61

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Revising STIR No. 39 Submitted December 9, 2019) Department: Police Division or Unit (if applicable): EOD Submitted by: Jim MulcahyCommissioner Branville Bard Date: 12/9/192/24/2020 Surveillance Technology: Tactical electronics VF52 Fiber scope 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • Optical scope technology used to view enclosed or secure areas for explosive mitigation. • Provides fast and reliable threat assessment for explosive ordinance disposal (EOD) and bomb technicians. 2. What is the purpose of the Surveillance Technology? • Identifying and preventing threats to persons and property and preventing injury to persons or significant damage to property • Identifying, apprehending, and prosecuting criminal offenders • Gathering evidence of violations of any law in criminal, civil, and administrative actions • Maintaining the safety and security of City employees, students, customers, and City- owned or controlled buildings 3. Where will the Surveillance Technology be deployed? When? • Explosive unit Response vehicle 4. What privacy impact will the Surveillance Technology have? • This technology has a minimal impact as it is utilized minimally during exigent circumstances when an explosive device is believed to be present. The images captured are only of the suspected explosive device and its immediate surroundings. 62

5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? • Original cost was $56,000 plus ongoing maintenance. 63

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Revising STIR No. 40 Submitted December 9, 2019) Department: Police Division or Unit (if applicable): EOD Submitted by: Jim MulcahyCommissioner Branville Bard Date: 12/9/192/24/20 Surveillance Technology: ATF Bomb arson trackingArson Tracking System (BATS) 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • ATF reporting online system • The Bomb Arson Tracking System (BATS) is a web-based case management system that allows state and local arson and explosive investigators access to up-to-date arson and explosve data from across the nation. 2. What is the purpose of the Surveillance Technology? • Identifying and preventing threats to persons and property and preventing injury to persons or significant damage to property • Identifying, apprehending, and prosecuting criminal offenders • Gathering evidence of violations of any law in criminal, civil, and administrative actions 3. Where will the Surveillance Technology be deployed? When? • ATF • The BATS system is owned by the federal Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF). CPD has access through a web-based portal. 4. What privacy impact will the Surveillance Technology have? • This technology has a minimal impact as it only used to track arson and bomb incidents. Only authorized explosive investigators are granted access using username and password. Only CJIS Compliant Certified Public Safety Employees in the 64

performance of their official duties may access, use or disseminate information contained in BATS for official and lawful criminal justice purposes. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? • Access provided by ATF at no charge. • none 65

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Consolidating STIRs Nos. 41 & 42 Submitted December 9, 2020) Department: Police Division or Unit (if applicable): Fleet Submitted by: Jim MulcahyCommissioner Branville Bard Date: 12/9/192/24/2020 Surveillance Technology: Prisoner Transport Security Cameras (Wagon 236 & 240) 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • Prisoner Transport Security Cameras provideenhanced safety for transporting officers and prisoners by recording the circumstances of individuals’ transportation by CPD. 2. What is the purpose of the Surveillance Technology? • Identifying and preventing threats to persons and property and preventing injury to persons or significant damage to property • Maintaining the safety and security of City employees, students, customers, and City- owned or controlled buildings 3. Where will the Surveillance Technology be deployed? When? • Transport vehicles 4. What privacy impact will the Surveillance Technology have? • This technology has a minimal impact as it is used to view persons lawfully in police custody who are being transported by the Department and is implemented strictly for their safety and the safety of the transporting officers. The information is saved for 14 days and is automatically written over unless affirmative action is taken to save a particular piece of footage. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? 66

• $2,280 for Wagon 236 cameras; approximately $2,500 for Wagon 240 cameras. 67

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Revising STIR No. 43 Submitted December 9, 2019) Department: Police Division or Unit (if applicable): SRT Submitted by: Jim MulcahyCommissioner Branville Bard Date: 12/9/192/24/2020 Surveillance Technology: Throwbot XT 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • Robotic camera for remote viewing; no recording but real-time viewing with audio. • This technology is a throwable micro-robot platform that enables operators to obtain instanteous video and audio. It can be placed, or made to travel (crawl) into hazardous situations (without risking human exposure to harm) in order to allow operators to quickly make informed decisions when seconds count. 2. What is the purpose of the Surveillance Technology? • Identifying and preventing threats to persons and property and preventing injury to persons or significant damage to property • Identifying, apprehending, and prosecuting criminal offenders • Gathering evidence of violations of any law in criminal, civil, and administrative actions • Maintaining the safety and security of City employees, students, customers, and City- owned or controlled buildings 3. Where will the Surveillance Technology be deployed? When? • Across the City, on an as-needed basis. 4. What privacy impact will the Surveillance Technology have? • This technology has a minimal impact since the technology is used in minimal situations where an exigency exists and the Special Response Team needs to assess 68

whether a threat exists before making lawful entry or taking further action. The audio and video captured in real time are not recorded or stored. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? • $14,000 purchase cost plus most recent maintenance of $1,750. 69

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Revising STIR No. 44 Submitted December 9, 2019; Supplemented January 22, 2020) Department: Police Division or Unit (if applicable): CID Submitted by: Jim MulcahyCommissioner Branville Bard Date: 12/9/192/24/2020 Surveillance Technology: Case Cracker 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • Video Recording - Interview Rooms • Case Cracker is a video recording technology used in interview rooms at the police stations to document police interviews. 2. What is the purpose of the Surveillance Technology? • Identifying, apprehending, and prosecuting criminal offenders • Gathering evidence of violations of any law in criminal, civil, and administrative actions 3. Where will the Surveillance Technology be deployed? When? • Police station interview rooms. 4. What privacy impact will the Surveillance Technology have? • This technology has a minimal impact since the recordings are all done voluntarily. In addition, theAudiovisual recordings are posited to alleviate public concerns connected with suspect treatment in custodial settings. There is a compelling societal interest in requiring video recording of police interviews and interrogations. The benefits of recording custodial interrogations go above and beyond transparency. The benefits extend not only to the accused, but also to the police, defense attorneys, prosecutors, fact finders, and the public8. 8 Bang, B. et al. (2018) Police Recording of Custodial Interrogations: A State-by-State Legal Inquiry 70

o Note: The Supreme Judicial Court has expressed a preference that criminal interrogations and identification procedures be recorded whenever practicable. See Commonwealth v. DiGiambattista, 442 Mass. 423 (2004);)9; Commonwealth v. Silva-Santiago, 453 Mass. 782 (2004).)10. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? • Approximately $40,000 9 Commonwealth vs. DiGiambattista, 442 Mass. 423 10 Commonwealth vs. Silva-Santiago 71

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Revising STIR No. 45 Submitted December 9, 2019) Department: Police Division or Unit (if applicable): Professional Standards Unit Submitted by: Jim MulcahyCommissioner Branville Bard Date: 12/9/192/24/2020 Surveillance Technology: Infraware 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • Dictation Software • Infraware is dictation software that records a person’s voice for transcription purposes. 2. What is the purpose of the Surveillance Technology? • Gathering evidence of violations of any law in criminal, civil, and administrative actions 3. Where will the Surveillance Technology be deployed? When? • Police station 4. What privacy impact will the Surveillance Technology have? • This technology has a minimal impact since the technology records voluntary interviews. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? • Not available. 72

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Revising STIR No. 48 Submitted December 9, 2019) Department: Public Health Department Division or Unit (if applicable): Public Health Nursing Epidemiology and Data Services Submitted by: Anna Wielgosz Manager, Epidemiology and Data Services Cambridge Public Health DepartmentClaude Jacob Date: 12/9/192/24/20 Surveillance Technology: MAVEN (Massachusetts Virtual Epidemiologic Network) 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • "MAVEN" is the Massachusetts Virtual Epidemiologic Network - a PHIN (Public Health Information Network) compliant, secure web-based surveillance and case management system for infectious diseases that enables rapid, efficient communication among local and state health departments and laboratories. MAVEN is an easy way to conduct case investigations and management while also decreasing paperwork. The system was purchased and developed in 2005 by MDPH and local health partners. The data in MAVEN goes back until approximately 1989 for the general epidemiology and vaccine preventable disease events. For tuberculosis, the data goes back to approximately 1993. • Infectious disease surveillance is the routine collection, analysis, interpretation, and distribution of data in order to reduce morbidity and mortality through the control and/or prevention of disease. • M.G.L. c.111, §§ 1, 3, 5, 6, 7, 94C, 109, 110, 110B, 111 and 112 define the responsibilities of the local boards of health and the Department of Public Health with respect to the reporting and control of diseases dangerous to the public health. M.G.L. c.111D, § 6, references the obligation of clinical laboratories to report infectious diseases to the Department. • By state law, when a MA resident is diagnosed or has a suspected diagnosis of a reportable condition, their medical providers are required to report information about 73

the patient (when available, full demographic, clinical and epidemiologic information, as defined by the Massachusetts Department of Public Health) to the health department. At this point in time, most of these reports are automatically sent by laboratories and providers electronically to the state health department through MAVEN; they can also report information via fax or phone to either the state health department or their local health department, where staff then enter this information into MAVEN by hand. Reporting is mandated by the state for certain conditions. 2. What is the purpose of the Surveillance Technology? • "MAVEN" is the Massachusetts Virtual Epidemiologic Network - a PHIN (Public Health Information Network) compliant, secure web-based surveillance and case management system for infectious diseases that enables rapid, efficient communication among local and state health departments and laboratories. MAVEN is an easy way to conduct case investigations and management while also decreasing paperwork. The system was purchased and developed in 2005 by MDPH and local health partners. The data in MAVEN goes back until approximately 1989 for the general epidemiology and vaccine preventable disease events. For tuberculosis, the data goes back to approximately 1993. Infectious disease surveillance is the routine collection, analysis, interpretation, and distribution of data in order to reduce morbidity and mortality through the control and/or prevention of disease. • Surveillance data is used to: o Monitor disease trends over time o Rapidly detect increases in disease occurrence o Implement control measures o Identify high-risk groups o Allocate resources & guide public health policy and action • There are approximately 90 notifiable infectious diseases that have a required response. 3. Where will the Surveillance Technology be deployed? When? • The Cambridge Public Health Department has been using MAVEN since its inception in 2005. Access is limited by a user's roles and groups, so, by default, CPHD users can see only Cambridge residents’ information. Within CPHD, only those staff who 74

are required to use MAVEN to conduct infectious disease surveillance work have access to the system. 4. What privacy impact will the Surveillance Technology have? • The information collected in MAVEN is considered protected health information (PHI) under HIPAA. HIPAA specifically allows public health reporting and access to PHI for public health activities without requiring an individual's authorization. • Access to MAVEN is limited by a user's roles and groups, so, by default, CPHD users can see only Cambridge residents’ information. Within CPHD, only those staff who are required to use MAVEN to conduct infectious disease surveillance work have access to the system. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? • MAVEN is managed and maintained by the Office of Integrated Surveillance and Informatics Services at the Massachusetts Department of Public Health, which funds MAVEN. CPHD staff use MAVEN to do state-mandated infectious disease investigations, but are not involved in the initial or ongoing maintenance of the system. 75

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Revising STIR Submitted January 22, 2020) Department: School Department Division or Unit (if applicable): Transportation Submitted by: James Maloney Date: 1/22/20 2/24/20 Surveillance Technology: GPS devices installed on student transportation vehicles 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • GPS Units units are attached to the student transportation vehicles to monitor and report back the physical location of the vehicles to the CPS Transportation Department. The GPS unitss monitor the physical location of each vehicle in real time. This is the only data collected by the GPS Unitsunits. 2. What is the purpose of the Surveillance Technology? • Maintaining the safety and security of City employees, students, customers, and City- owned or controlled buildings • Operating vehicles for City • Communicating among City employees, with citizens, or with third parties 3. Where will the Surveillance Technology be deployed? When? • On each vehicle trannsporting students. 4. What privacy impact will the Surveillance Technology have? • For the students riding the a particular vehicle the GPS location, when combined with the transportation routing data, could indicate the physical location of a student if/when they were riding the vehicle. Whether or not a student is actually riding in a vehicle is not part of the data collected. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? 80

a. Ongoing Maintenance = $1579/year b. Personnel = N/A – Once installed there is no ongoing maintenance. c. Source of Funds = School General Fund 81

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Revising STIR Submitted January 22, 2020) Department: School Department Division or Unit (if applicable): Transportation Department Submitted by: James Maloney Date: 1/22/20 2/24/20 Surveillance Technology: Edulog Transportation System 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • The Edulog Transportation system is a database used by the CPS Transportation Department to manage the bus routes and student assignments. All information about what buses students ride as well as the buses locations are stored and managed within this system. 2. What is the purpose of the Surveillance Technology? • Providing information to emergency personnel • Maintaining the safety and security of City employees, students, customers, and City- owned or controlled buildings • Operating vehicles for City business • Analyzing and managing service delivery • Communicating among City employees, with citizens, or with third parties 3. Where will the Surveillance Technology be deployed? When? • Hosted in the cloud and available at discrete workstations within CPS and the contracted transportation provider. 4. What privacy impact will the Surveillance Technology have? • Student assignments to bus routes as well as actual bus GPS locations are recorded in the database. This data is used to monitor bus performance as well as to provide a parent portal for parents to know when to expect busses at the bus stops. CPS Transportation staff have access to the Edulog system with all student bus 82

assignments. Parents only have access to the bus routes that their child is assigned to on a particular day through a secure portal. • Actual ridership – meaning whether a student is actually on a bus is not obtained or recorded. All that is maintained is student to bus assignment, routes, and actual geo- location of the buses. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? • Ongoing Maintenance = $19,660/Yearyear • Personnel = A portion of the CPS transportation office staff’s time is devoted to maintaining the Edulog system. • Source of Funds = School General Fund 83

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Revising STIR No. 51 Submitted December 9, 2019) Department: Traffic, Parking, and Transportation Division or Unit (if applicable): Street Management Submitted by: Joe Barr, Brooke McKenna, Stephanie McAuliffe Date: 12/9/192/24/20 Surveillance Technology: Traffic Signal Detection Cameras 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • The traffic detection units each consist of a video camera device which is mounted approximately 10 feet above one of the traffic signal mast arms at an intersection. There are two types of cameras: o MioVision SmartLink 360 cameras o Iteris directional detection cameras • The MioVision units are mounted in a location that allows visibility towards all approaches to the intersection and provide detection of users in all directions from a single device. The Iteris units are mounted for each approach where intersection detection is required and provide for detection of users from one roadway approach. • The camera communicatesBoth types of cameras communicate a video feed via the hardwire signal conduit to the signal control cabinet at the intersection, where a video processing unit is installed. The video processing unit analyzes the video feed on-site in order to count and classify roadway users approaching the intersection by their transportation mode type and direction of travel. • The MioVision Cameras and supporting software and hardware originally included the ability to collect video by plugging a laptop into the processing unit located in the traffic control cabinet at the intersection or to stream video upon demand to the cloud for access through an online portal. Use of captured video is needed from time to time to ensure proper functionality of the system to recognize and count vehicles, cyclists and pedestrians. 84

• At our request, MioVision has changed the default settings so that the City cannot collect video at the control cabinet or stream video to the cloud. Only the Vendor will be able to collect video in the field or stream data to the cloud. The vendor has agreed in writing that they will do so only under specific circumstances and will notify the City in advance of streaming or collecting any data. They have also agreed to delete all captured video within 30 days. The circumstances agreed upon include: capture video for training purposes, capture video for intersection detection accuracy validation, capture video specifically to validate a solution to a problem at the intersection, and capture video to analyze and detect/root-cause a problem at the intersection. • The Iteris cameras do not have the ability to stream or record video as configured. 2. What is the purpose of the Surveillance Technology? • The purpose of this technology is to analyze and manage service delivery, in this case operation of traffic signals and counting vehicles, bicycles, and pedestrians. The technology provides detection of roadway users, to classify their mode of transportation, and to quantify their movements at signalized intersections in the City of Cambridge. The aggregated data collected will beis analyzed and used to improve the efficiency and safety of operations for all roadway users. The technology will also provideprovides City staff with continuous roadway user counts to allow for evaluation of seasonal and annual traffic volume variations to assist in future design and planning projects. • The processed data collected will beis used for two purposes: o Traffic detection – this process provides a notification to the traffic signal controller requesting to call or extend a signal phase to allow for dynamic signal phasing that adapts to changes in the number of roadway users present. o Traffic counts – providing continuous counts of roadway users traveling through the intersection. Counts are broken out by movement (i.e., direction of approach and turn or straight movement through the intersection) and by transportation mode type (i.e., truck, bus, vehicle, bicycle, pedestrian)). 3. Where will the Surveillance Technology be deployed? When? • MioVison Intersection Cameras were deployed in the field in the Fall of 2019 at multiple signalized intersections across the City. 85

• MioVision Cameras will be installed at additional locations as funding becomes available. • Iteris cameras have been installed at isolated locations over the past three years. 4. What privacy impact will the Surveillance Technology have? • We expectTPT expects that the impact on privacy will be minimal, for the following reasons: o The cameras do not have sufficient resolution to provide personally identifiable details in the video such as faces or license plates. o While video streaming and collection is used in an extremely limited and controlled manner as indicated abovebelow, the core functionality of the technology operates through real-time processing of lower resolution video data, resulting in non-identifiable discrete data on number of users and deletion of video in real time on-site. The impacts of recording the location of individuals, even at lower resolutions, will be primarily mitigated by tight controls over when video is recorded or streamed. • The MioVision Cameras and supporting software and hardware originally included the ability for the City to collect video by plugging a laptop into the processing unit located in the traffic control cabinet at the intersection or to stream video upon demand to the cloud for access through an online portal. Use of captured video is needed from time to time to ensure proper functionality of the system to recognize and count vehicles, cyclists and pedestrians. • At our request, MioVision has changed the default settings so that the City cannot collect video at the control cabinet or stream video to the cloud. Only the vendor, MioVision, will be able to collect video in the field or stream data to the cloud. The City will have no access to the video. The vendor has agreed in writing that they will do so only under specific circumstances and will request permission from the City in advance of streaming or collecting any data. They have also agreed to delete all captured video within 30 days. The circumstances agreed upon include: capture video for training purposes, capture video for intersection detection accuracy validation, capture video specifically to validate a solution to a problem at the intersection, and capture video to analyze and detect/root-cause a problem at the intersection. • The Iteris cameras do not have the ability to stream or record video as configured. 86

5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? • The initial eight (8) MioVision units were purchased for just under $21,000 each and funded by the Casino Mitigation Fund. 4Five (5) additional units were installed as part of a new private developmentdevelopments and turned over to the City for no cost. • Previous installation of Iteris cameras were installed as part of new private developments and State roadway improvement projects and turned over to the City for no cost. • Ongoing operations and maintenance costs for the units will be covered by the Department’s signal operations budget. 87

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Revising STIR No. 52 Submitted December 9, 2019) Department: Traffic, Parking, and Transportation Division or Unit (if applicable): Street Management Submitted by: Joe Barr, Brooke McKenna, Stephanie McAuliffe Date: 12/9/192/24/20 Surveillance Technology: MioVision Traffic Count Mobile Camera Units 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • MioVision Scout is a portable, battery operated, traffic video collection unit. It is a standalone unit that is deployed in the field for unattended traffic video collection,. Video is collected over a series of days and stored in the Scout unit on a digital storage card. At the end of the data collection period, the unit is removed and data is taken from the storage card and processed for traffic data. Additionally, Scout units have the capability of detecting and recording MAC addresses from devices searching for wireless networks within their range. MAC addresses and timestamps are then transmitted to a central system. The central system then looks to see if the same MAC address has been recorded previously by other units and uses any matches to establish travel times. During deployment, the units also communicate wirelessly for monitoring purposes, but do not stream data. • Additionally, there is an optional “Connect” component that can be added to Scout units that allows the unit to communicate wirelessly for monitoring purposes (but not to stream data) and has the capability of detecting MAC addresses from devices searching for wireless networks within their range. With the added ‘Connect” functionality, the Scout Unit can detect devices within an 80-100 foot radius of the unit. The Scout Unit uses MD5 hash function to produce a 128 bit hash value for each MAC address, pseudonymizing the MAC addresses. This process is unidirectional and cannot be reversed, but the MAC addresses remain unique and matchable. These hashed addresses and timestamps are stored in the unit during the data collection period then transmitted to a central system operated by the vendor, MioVision. The central system then looks to see if the same hashed MAC address has been recorded previously by other scout units in the vicinity and in the same time frame and uses any matches to establish travel times. 88

• The City of Cambridge does not own or plan to purchase Scout Units. However, the units are used regularly by traffic engineering and transportation planning consultants in order to collect traffic data in Cambridge to complete Traffic Impact Studies and other transportation related studies. In the future, the City of Cambridge may contract with consulting or data collection firms to collect data, and in turn those firms may use Scout units to collect data on behalf of the City. 2. What is the purpose of the Surveillance Technology? • The purpose of this technology is to analyze and manage service delivery, in this case collecting traffic video and data that is later processed to provide a variety of traffic related data such as turning movement counts, intersection counts and classifications, road volume counts, and travel times. 3. Where will the Surveillance Technology be deployed? When? • These units are deployed in the field, at various locations on a temporary basis. The units are typically attached to a signal, utility, or streetlight pole within the right of way. TheyThe boxes are locked and inaccessible during deployment. • Deployment is based on the need for transportation data for use in a transportation study, traffic impact study, or other transportation related data analysis. 4. What privacy impact will the Surveillance Technology have? • MioVision Scout units records Videorecord video at 720 x 480 resolution. This standard resolution video offers limited personal information and does not include license plate reading ability, limiting privacy impacts. In addition, all video recordings will be done within the public right of way. • While data collection is used across the City, it is possible that data collection, and thus video recording, will occur most frequently in areas with significant new development, thus possibly impacting these areas more than parts of the City with less development. • The impacts of the collection of MAC addresses are mitigated to a great extent by the use of the MD5 pseudonymization process. There is no personally identifiable data remaining in the hashed MAC address, and the process is not reversible. However, because the hashing process will always return the same hashed value for any given MAC address- as required to ensure the data remains unique and matchable- some 89

risk remains. If someone knew the exact time a wireless device was at a specific location and accessed the hashed data, they could identify the hash value and then find other instances where the Scout unit has recorded that same hashed MAC address. We can further mitigate this risk by requiring that all hashed MAC addresses collected within in Cambridge be destroyed once the data has been used to establish travel times. We can do this through the proposed permitting process mentioned below. • In the past, consultants have deployed Scout units in Cambridge without approval from the City. Moving forward, the Traffic, Parking, and Transportation Department will implement a permitting system that will require pre-approval for all deployments. The permit will require that all deployments meet certain data security and data retention requirements. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? • All costs associated with the use of MioVision Scout Units are paid by private consultants and/or developers. 90

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Revising STIR No. 53 Submitted December 9, 2019) Department: Water Division or Unit (if applicable): Submitted by: Fred CentanniSam Corda Date: 12/9/192/24/20 Surveillance Technology: Automated Meter Reading System (AMR) 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • The Water Department’s AMR system is a radio-based system which transmits on a Federal Communication Commission (FCC) licensed/reserved frequency. Meter Transmitter Units (MTUs) are attached to every water meter throughout the city. The MTU transmits water meter reads in a propriety format. These reads are transmitted every 4 hours on a floating schedule. For example, an MTU will transmit a read today at 6:00AM, and then transmit a read tomorrow at 6:03AM. The reads are received by the Data Collection Units (DCUs) located within the city. The DCUs transmit the meter readings, using a cell phone network, to a communications computer located at the Water Department. The communications computer then transfers the data to a database computer which translates the data in order for the city to view the water meter reads. This allows the Water Department to provide actual reads for billing and allows us to alert customers for potential leaks at their property. Below is an example of our STAR AMR software and the data collected: 2. What is the purpose of the Surveillance Technology? 91

• The AMR System allows the Water department to provide actual reads for billing and allows us to alert customers of potential leaks in their property. 3. Where will the Surveillance Technology be deployed? When? • Meter Transmitter Units (MTUs) are attached to every water meter/building throughout the city and the deployment started in 2004. Several Data Collection Units (DCUs) located within the city were installed in 2004. 4. What privacy impact will the Surveillance Technology have? • None, there has been no impact. • Every property that has a water service has a water meter regardless of any other criteria, and the AMR system only gathers information regarding water usage. This allows CWD to provide actual reads for billing and to alert all customers of any potential leaks in their property. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? • Initial costs – The original implementation cost onin 2004 was approximately $4,000,000. o We are nearing completion of an upgrade of the AMR system to replace all the MTUs because the batteries reached their life expectancy. The MTU replacement cost was $1,545,600 and the full value of the installation contract is $1,102,500. o We also have a contract to upgrade the DCUs and software for $48,380. • Ongoing maintenance – The Water Department has an annual maintenance agreement for approximately $15,000. • Personnel costs – personnel costs related to reading water meters have gone down related towith the implementation of the AMR. • Source of funds – Capital Water Funds for upgrade, Operating Water FunsFunds for the annual maintenance agreement. 92

SURVEILLANCE TECHNOLOGY IMPACT REPORT (Revising STIR No. 54 Submitted December 9, 2019) Department: Water Division or Unit (if applicable): Submitted by: Fred CentanniSam Corda Date: 12/9/192/24/20 Surveillance Technology: Consumer Engagement, (AMR) 1. Describe how the proposed Surveillance Technology will work, including how it will collect Surveillance Data. • Using water meter data from the Department’s AMR system, water customers will be able to view their own daily water usage on-line to promote conservation and detect water leaks. The data will be stored on a remote server, hosted by our vendor. The individual data will be accessible through the City’s web page and access will be protected by individual account log-in security which will be approved by our IT Department. 2. What is the purpose of the Surveillance Technology? • Water customers will be able to view their daily water usage on-line to promote conservation and detect increased usage and/or water leaks. 3. Where will the Surveillance Technology be deployed? When? • Through the City’s web page. • The go live date is contingent on the city and vendor signing a contract. The implementation is projected to take 4 months from the kick off meeting. 4. What privacy impact will the Surveillance Technology have? • None. • Every property that has a water service has a water meter regardless of any other criteria, and the AMR system only gathers information regarding water usage. Customers will have the ability to opt into the system and monitor their own usage. 93

Customers that decide not to opt into the system will have no impact on CWDs ability to provide actual reads for billing and will still be alerted of potential leaks. 5. What are the fiscal costs of the Surveillance Technology, including initial costs, ongoing maintenance and personnel costs, and source of funds? • Initial costs – The current low bidder cost information is: • Ongoing maintenance – see above • Personnel costs – no additional personnel costs related to AMR. • Source of funds – capital Water Funds 94