There is another middle option that I would have liked to see the author discuss: requiring either a case number or a CAD ID, instead of a "search reason".
In my conversations with law enforcement (mostly at management level, chiefs of police), all of them have had reasonable-sounding objections to a warrant requirement for a search, but zero of them have been able to come up with a reason why a case-or-CAD ID requirement isn't workable. Generally, they argue that in practice obtaining a warrant can be too onerous in time sensitive situations, and can be harder to obtain than the public realizes. Two popular examples are in kidnappings (time sensitive) and missing persons (difficult to obtain).
A case number or CAD ID however simply requires that the details of either a public call for service or an active investigation are associated with the historical search. It closes the door on officers' hobby searching.
Andrew's blog post does note the problems with oversight, which also match my experience, so this isn't a perfect fix. But it will go further in conversations with law enforcement for people that are trying to thread the needle on making "safe" mass surveillance.
(I am personally opposed to mass surveillance in all its forms, but arguing only from that position pretty much immediately excludes me from policy discussions.)
This is already the current status quo on paper. I bet the majority of the cases IJ identified of mis-use the PDs already had this policy. (That is the same standard when you do a background criminal history check in New York, need to put in a case number, FYI.)
I did not want to go into too many technical details on the post -- I think you could do an AI audit at the point in time of the search query to prevent people putting in junk cases. That said I believe there will always need to be third party audits at a minimum.
Part of the issue is policies on paper are not effectively enforced. So people saying "just have policy X to prevent abuse" is a non-answer.
I wrote the post mainly because people arguing for limited data retention I think is bad for both sides -- it neither protects civil liberties and simultaneously makes it harder for long term criminal investigations.
It isn't at all the current status quo. There may be some kind of departmental guideline in some cases, but it's neither required by the software, nor mentioned in the Lexipol Media Group policy template that commonly gets purchased by police departments once the public starts asking them what their ALPR policy is. A quick spot-check of eyesonflock.com finds that, of those audit logs that are still available to the public, case or CAD IDs are still not commonly required.
The thing about CAD/case IDs is that it makes the use of junk cases in audit trails more detectable vs. the current situation.
Third-party audits would be great, but I haven't been able to find an ideal third party to do the auditing. Locally, police commission groups quickly got co-opted through political processes into being both toothless and extremely deferential towards the police department. I wouldn't trust state auditors any more than local auditors. That's why we pushed to force audit logs to be made publicly accessible in SB1516 6(3)(a): https://olis.oregonlegislature.gov/liz/2026R1/Downloads/Meas...
> Part of the issue is policies on paper are not effectively enforced. So people saying "just have policy X to prevent abuse" is a non-answer.
Policies on paper are where you start. I wholeheartedly agree that they are not by themselves sufficient, but they have to exist, and to that end, you want the strictest possible policies that are politically achievable. I don't believe that a warrant requirement is politically achievable.
We had several deep conversations with ACLU on data retention limits. Data retention limits were one of the things they fought hardest for in this state. We supported that, but focused more of our energy on a different aspect (which we didn't succeed at, unfortunately). ACLU's point of view is that longer data retention makes it easier to profile the movements and activities of politically sensitive groups. It's true that it does, but ALPR vendors' ability to directly access and control the data means that there are numerous trivial workarounds for targeting any demographic or political group, regardless of data retention limits.
I remain of the opinion that these systems simply don't need to exist at all, which makes the answers to a lot of these questions a lot easier. Violent crime has overall been trending downward for a long time, we live in one of the most peaceful societies in human history, we already know how to reduce property crime and crime directly related to poverty, and roving armed gangs are not a sensible immigration policy. We're twisting ourselves in knots trying to figure out how to make an inherently unsafe technology safe to meet a need that we don't have.
Flock exists because YCombinator and subsequent investors saw an opportunity to use public grant money to pay to bootstrap the collection of an enormous amount of really valuable data on Americans.
Yeah but that is the exact purpose of the warrant. It's suppose to add friction so you can't do this exact thing, even if it's useful and faster not to.
In my conversations with law enforcement (mostly at management level, chiefs of police), all of them have had reasonable-sounding objections to a warrant requirement for a search, but zero of them have been able to come up with a reason why a case-or-CAD ID requirement isn't workable. Generally, they argue that in practice obtaining a warrant can be too onerous in time sensitive situations, and can be harder to obtain than the public realizes. Two popular examples are in kidnappings (time sensitive) and missing persons (difficult to obtain).
A case number or CAD ID however simply requires that the details of either a public call for service or an active investigation are associated with the historical search. It closes the door on officers' hobby searching.
Andrew's blog post does note the problems with oversight, which also match my experience, so this isn't a perfect fix. But it will go further in conversations with law enforcement for people that are trying to thread the needle on making "safe" mass surveillance.
(I am personally opposed to mass surveillance in all its forms, but arguing only from that position pretty much immediately excludes me from policy discussions.)