Sign in Subscribe

Renton City Council Flock discussion: Email and public comments

There was a lot of concern before the Renton City Council meeting that they'd vote to turn their Flock cameras back on – a motion had been tabled a couple of weeks ago, and quite possibly had enough votes to pass even though Deflock Renton and other local organizers have been pushing back hard. I was planning to testify on the issues in general, and after talking with other organizers we realized that pre-meeting mail focusing on a specific issue with the terms of Flock's contract might be a useful tactic. In practice I'm not sure how much of a difference it make; almost 30 people testified against Flock, with really powerful testimony, so I like to think they wouldn't have voted to turn them on anyhow.

In any case, they explicitly voted to extend the pause on Flock ALPRs and review the contract. That's good!. The motion also included a resolution to unpause their other ALPRs (Axon in vehicles, and Genetech for parking), although as several councilmembers pointed out the police chief has said that they'll have to remain paused in any case because the technology doesn't yet comply with SB 6002. Not sure what that's about, and it's not necessarily good. Overall, though, a victory!

Pre-meeting email

My live testimony was a shortened version of this, to fit into the three-minute limit, with some minor changes.

Dear Renton City Councilmembers,

I'm Jon Pincus of Bellevue, and run the Nexus of Privacy newsletter. I'm planing on providing public comment on Flock's AI-enabled ALPR cameras at tonight's meeting, and have included a draft below. In addition, I want to call your attention to a set of issues described in the recent report from the Los Angeles Police Department's Office of the Inspector General reviewing LAPD's ALPR usage (including Flock as well as Axon). Before any decision to turn the cameras back on in Renton, it is vital to ensure that these issues are addressed in an amended Master Agreement with Flock.

LAPD announced last week that they are not renewing their current Flock contract, citing "serious concerns around civil liberties and civil rights issues, particularly around privacy and the data that is being collected from these cameras.” They're currently trying to renegotiate their MOU with Flock to adjust the terms to better protect the data. The OIG report (available here) includes a draft of LAPD's proposed terms, although Flock hasn't yet agreed to it.

Renton's Master Agreement with Flock appears to have some of the same data ownership and privacy problems that LAPD has highlighted need to be fixed. For example, Section 4.3 (Anonymized Data) of Renton's Master Agreement "grants Flock a non-exclusive, worldwide, perpetual, royalty-free right to use and distribute such Anonymized Data to improve and enhance the Services and for other development, diagnostic and corrective purposes, and other Flock offerings." In other words, Flock can use this data for a wide variety of commercial purposes -- including training their AI models, both for their ALPR system and for their other offerings -- and even distribute it, as long as it "improves" or "enhances" their services. ACLU and Have I Been Flocked have more details on Flock's terms of service that also appear to apply to Renton's Master Agreement.

At a minimum, Redmond's Master Agreement with Flock needs to be amended to include language to address these issues. Sections 10.2-10.4 of LAPD's new proposed MOU (starting on p. 45 of the OIG report) includes language that attempts to address the AI training and some of the other issues the report discusses, and may well be a useful starting point.

Note that even once these changes are made, there are still significant risks of ALPR data abuse. While SB 6002 and technical solutions like encryption provide some protection, there are still paths for federal agencies like ICE and CBP -- and hostile out-of-state law enforcement agencies like Texas Sheriffs, who search Washington state ALPR data to target people seeking reproductive health care -- to get at the data. So even if the agreement is amended, there's still a very strong argument for continuing to keep the cameras off, canceling the contract with Flock as more and more cities around the state are doing, and considering a moratorium on ALPR usage. I realize, though, that not everybody on the council necessarily agrees with this position yet.

Still, whatever you think of the longer-term discussions, it is critical to make sure that these known problems are addressed before deciding to turn the cameras back on.

Jon Pincus, Bellevue

https://thenexusofprivacy.net

Written testimony

Draft testimony for public comment tonight.

Mayor Pavone and Renton City Councilmembers,

I'm Jon Pincus of Bellevue, and I run the Nexus of Privacy newsletter. My background is as a software architect and security researcher. I've served on the National Academy of Sciences/CSTB committee on Resilient software; co-chaired the ACM Computers, Freedom, and Privacy conference; and testified on privacy and surveillance-related issues in the state legislature and the King County Council.

My comments today are about Flock's AI-enabled ALPR cameras. There are four key points I want to make:

  • SB 6002 provides only limited protection.
  • Technical safeguards like encryption also provide only limited protection, so there are still a lot of ways federal and hostile out-of-state law enforcement agencies can get at the ALPR data -- despite Renton PD's best efforts to protect it. .
  • More and more cities are turning their Flock cameras off,
  • So, please keep the cameras off in Renton.

A bit more detail on each of these:

  • SB 6002 provides only limited protection. As Representative Brianna Thomas said in the House floor debate, "What concerns me today is that the safeguards in this bill do not go far enough to match the power of the technology." Similarly, Senator Yasmin Trudeau -- the bill's sponsor -- highlights that SB 6002 is a floor not a ceiling, and emphasizes that it's not an endorsement of the technology. SB 6002 does provide some very valuable guardrails, but it only goes so far, and there are a lot of abuses it doesn't prevent.

  • Technical safeguards like encryption also provide only limited protection, so there are still a lot of ways federal and hostile out-of-state law enforcement agencies can get at the ALPR data -- despite Renton PD's best efforts to protect it. In his comments at the July 6 meeting, Councilmember Alberson talked about RPD's integrity, and I am taking that as a given. But it's important to realize that there's a lot that's out of RPD's control. A few examples:
    • getting a warrant from a Trump-appointed federal judge -- or a friendly out-of-state judge looking to target people seeking or providing reproductive health care or gender-affirming health care
    • getting somebody at one of the eight agencies Renton PD allows direct access to the system to do a search on their behalf
    • sending Flock a national security letter requiring them to put in a back door to get around encryption, along with a gag order prohibiting them from disclosing the back door to Renton or any of their other customers

These concerns aren't just theoretical. Earlier this year, the Mountain View, California PD discovered that Flock had changed the settings to allow ALPR data to be searchable by hundreds of law enforcement agencies across the country highlights that these concerns aren't just theoretical. Even though Mountain View has a very tech-savvy police department (they're in the heart of Silicon Valley), it took them over a year to discover that Flock had let unauthorized agencies access the city's ALPR data.

  • More and more cities are turning their Flock cameras off. Here in Washington, Edmonds recently canceled their Flock contract, joining Lynnwood and Mountlake Terrace. Mount Vernon recently voted to turn the cameras off, joining Skamania County, Olympia, and Redmond. Just last week, the Los Angeles Police Department announced that they're not renewing their Flock contract, citing "serious concerns around civil liberties and civil rights issues, particularly around privacy and the data that is being collected from these cameras” – including Flock's use of customer data to train their AI models.
  • So, please keep the cameras off in Renton. There is no way to keep the data from AI-enabled surveillance systems like Flock and other ALPRs from getting to the federal government or hostile out-of-state law enforcement. Turning the cameras back on would put your constituents and anybody who visits Renton at risk -- especially immigrants, LGBTQIA2S+ people, people seeking reproductive health care, protestors, and anybody the administration decides are enemies.

Thank you for the opportunity to provide public comment, and please feel free to follow up if you have any questions.