The City of Seattle has a law on the books requiring The City Council to approve any department’s acquisition of surveillance equipment. The law is old and badly in need of updating, as last year’s Geofeedia incident made clear. Yesterday the Council started its formal consideration of a refreshed version more in keeping with today’s technology.
Here’s the Council central staff’s overview of the proposed ordinance.
The biggest problem with the existing ordinance is that it’s focused on regulating equipment, which really means “hardware.”
“Surveillance equipment” means equipment capable of capturing or recording data, including images, videos, photographs or audio operated by or at the direction of a City department that may deliberately or inadvertently capture activities of individuals on public or private property, regardless of whether “masking” or other technology might be used to obscure or prevent the equipment from capturing certain views. “Surveillance equipment” includes drones or unmanned aircraft and any attached equipment used to collect data. “Surveillance equipment” does not include a handheld or body-worn device, a camera installed in or on a police vehicle, a camera installed in or on any vehicle or along a public right-of-way intended to record traffic patterns and/or traffic violations, a camera intended to record activity inside or at the entrances to City buildings for security purposes, or a camera installed to monitor and protect the physical integrity of City infrastructure, such as Seattle Public Utilities reservoirs.
But as the Geofeedia incident showed, in 2017 surveillance can be about software and services as well; or simply acquiring the right data set to analyze, even if the data came from devices not intended for surveillance — such as license plate readers.
The Council’s work, led by Council member Lorena Gonzalez, scraps the old ordinance and rewrites it from scratch. It retains the triggering event: the acquisition of materials for the intent of surveillance. But it broadens the scope from simply “equipment” to more kinds of technology:
“Surveillance technology” means any: electronic device; software program or hosted software solution; or services provided by a third party; that is or are designed or primarily intended by the vendor to be used for the purpose of surveillance.
But along with the broader definition comes a longer list of exceptions:
Surveillance technology does not include: (a) technology used to collect data from individuals who knowingly and voluntarily consent to provide, or who do not avail themselves of an opportunity to opt out of providing, such data for use by a City department; (b) social media sites or news monitoring and news alert services; (c) a body-worn camera; (d) a camera installed in or on a police vehicle; (e) a camera installed in or on any vehicle or along a public right-of-way used to record traffic patterns or traffic violations or to otherwise operate the transportation system safely and efficiently, including in any public right-of-way; (f) a camera installed on City property for security purposes; (g) a camera installed solely to protect the physical integrity of City infrastructure, such as Seattle Public Utilities reservoirs; and (h) routine patches, firmware and software updates, and hardware lifecycle replacements.
That hints at one of the challenges of writing this particular ordinance, as voiced by Amy Tsai of the Council’s central staff: they start with a set of general principles, then start generating scenarios that need to be accounted for and end up bending and twisting the ordinance to make it fit the intent.
The heart of the new ordinance is the requirement thata department acquiring new surveillance technology or surveillance data must submit a “Surveillance Impact Report” (SIR) to the City Council for approval. The SIR includes:
- a description of the technology or data;
- its purpose and proposed use;
- a “use and management” policy;
- a description of how the potential impact of the surveillance on civil rights and disparate impacts on marginalized communities has been taken into account, and a mitigation plan to limit those impacts;
- a description of the fiscal impact of the surveillance technology.
This process codifies an important principle: the technology and its intended uses are approved together as a unified bundle and serve as a limit to what can be done with it. Upgrades to the technology don’t require re-approval, so long as they don’t enable other uses.
An obvious loophole would be to simply contract out the surveillance work to a third party; the ordinance anticipates that and lays down the rules:
- sharing surveillance technology or data with a third party requires that party to comply with the SIR.
- bringing in third party data under an agreement requires going through the SIR process. One-off cases may not, for instance if SPD, in the course of investigating a convenience store robbery, acquires video from the store’s surveillance cameras. As Council member O’Brien pointed out, though, it is a bit of a slippery slope: the city may not place cameras in city parks, but if it can round up enough surveillance camera footage from surrounding businesses and residences, it may have de facto surveillance of that park anyway without need to go through the Council’s approval process.
- there are still some cases that are being worked out, such as sharing data with law enforcement agencies in other jurisdictions. This is particularly worrisome for several Council members who don’t want to empower the Trump administration to use local law enforcement resources to crack down on Seattle residents (including immigrants), but recognizes the reality that under existing federal law it’s very difficult to prevent the feds from getting their hands on data that local law enforcement agencies collect.
SPD and the city’s Chief Technology Officer will have primary oversight responsibility of the city’s acquisition of surveillance technology. Each department will be required to submit an annual report on its acquisition and use of surveillance technology. SPD and the CTO will also be required to submit an annual report to the City Council on whether the new ordinance is meeting the goals of the city’s Race and Social Justice Initiative, what adjustments should be made to address any disparate impacts, and any new approaches and considerations the City Council should consider.
The ordinance also includes an enforcement clause granting Seattle residents and workers a private right of legal action in which they can ask for injunctive relief, declaratory relief, or evidence suppression (but not monetary damages) for violations of the ordinance.
Finally, since the new ordinance casts a wider net than the old law, any surveillance technology acquisitions that didn’t require Council approval before but would if acquired under the new law must be submitted for approval. There is still debate as to how quickly that must happen; too quickly might overburden the departments and the Council with paperwork, but too long would just drag it out and undermine the point of having the oversight at all.
Today’s briefing was a first discussion of the bill, to guide further drafting and potential amendments. Several issues came up over the course of the conversation:
- How much regulation should be done over the use of public data, for instance Geofeedia-type technology that does analysis over public social media data. On one hand, all the data is public, which means that anyone could, in theory, do the same kind of analysis. On the other hand, the general public probably isn’t aware, and doesn’t expect, that governments are doing that kind of analysis, which gives it an uncomfortable “creepiness factor.” Further, aggregating the data allows for tracking movement and activity in ways that could chill individuals’ exercise of their civil liberties, such as using license plate reader data from a wide variety of locations (like toll bridges) to track people going to mosques or public protests. It’s a difficult balance to strike between enabling law enforcement to enhance public safety and protecting civil liberties. Council member Burgess argued in favor of not over-regulating the use of technology, while Council member O’Brien emphasized the need to be transparent with the public and enable a robust public debate about what it’s acceptable to use the technology for. Council member Gonzalez noted that “regulating” isn’t the same as “prohibiting,” and that in the end the intent of the new ordinance is to set up a review and approval process, not blanket prohibitions.
- How should emergency situations be handled, when there isn’t time to run through a City Council approval process? At the suggestion of the ACLU, the ordinance includes an exemption “in the event of an emergency situation that poses an imminent and serious risk of death or substantial bodily harm.” Gonzalez noted that this is a very high legal bar. O’Brien wanted to attach a reporting mechanism to that, so that if SPD did invoke that power they would be required to notify the City Council within a week (rather than wait until the annual report which might be months away).
- Community outreach. A perennial topic for the Council, especially related to law enforcement, Council members emphasized the importance of building public trust in city government through transparency and community engagement, both in writing the new ordinance and in the process of seeking approval for individual technologies before acquiring them. They still need to work out the requirement for community outreach and feedback to be incorporated into the SIR process, so that the Council can benefit from that feedback as it deliberates on whether to approach a specific request.
- Overhead and bureaucracy. David Mendoza, representing the Mayor, voiced a general concern from the executive branch (not entirely unfounded) that the new ordinance has the potential to generate a large amount of overhead with SIR requests, public outreach, and ongoing reports from every department. The question is whether the cost to productivity and efficiency of city government is worth it when dealing with a subject as touchy as government surveillance.
- This isn’t just an SPD issue; it affects all 13,000 city employees. CTO Michael Mattmiller pointed out that his Seattle IT department is also a law enforcement agency: by city ordinance, SeattleIT enforces the rules on cable providers and it uses monitoring equipment to investigate when it receives customer complaints about how cable companies are billing them. The ordinance needs to interpret whether that monitoring equipment falls under the umbrella of “surveillance technology.” As an aside: Mattmiller noted that they recently rolled out a new privacy training course for city employees, and SPD had the highest rate of compliance: 98% of its officers and staff completed it within the required time.
Today’s was the first briefing on the bill, and Gonzalez voiced her desire to use this “critical time” to make sure they get the ordinance right. While she didn’t give an explicit timeline for moving it forward, it will need to compete with the police accountability legislation for time and attention in her GESCNA committee in the coming weeks so don’t expect it to take the fast lane through to final approval.