After Flock controversy, Eugene considers data privacy policy

Presenter: Without public discussion, Eugene police requested—and the former city manager approved—Flock surveillance cameras. Activists quickly organized to say ‘Flock no!’ and to get the cameras removed. The controversy led to the City Council discussion June 17, about how a growing number of cities are now crafting policies relating to data and privacy. Assistant City Manager Matt Rodrigues: 

Matt Rodrigues (Eugene, assistant city manager): Today we’ll be discussing surveillance technologies currently used by the city. We’re not seeking a decision today, but rather feedback on principles and potentially policy considerations that may guide future work.

We’ll start with security cameras, of which there are three varieties.

Fixed security cameras represent the largest category, and we have approximately 700 cameras in 26 locations citywide. Their primary purpose is facility and infrastructure monitoring. Most are used for operational or security purposes. Examples include securing city buildings and facilities, monitoring traffic operations, supporting traffic signal functionality, and monitoring wastewater treatment processes.

Portable cameras are the second type and serve a similar purpose, but provide greater flexibility. They can be relocated, although they are typically mounted in a way that requires significant effort to relocate them.

Public Works primarily uses these systems to monitor certain Parks facilities, while Eugene Police Department uses them as a crime prevention and public safety tool in accordance with established departmental policies. We have approximately six camera units in five locations citywide. 

Mobile security cameras are the third category. They’re typically trailer-mounted systems that can be rapidly deployed to locations experiencing specific security concerns or operational needs. Currently these systems are used by Public Works and EPD, and we have approximately 10 camera units deployed based on need. 

Presenter: Some cameras can check for weapons. Matt Rodrigues:

Matt Rodrigues (Eugene, assistant city manager): Camera security screening technology systems differ somewhat from traditional cameras. They combine video technology, metal detection, and machine learning algorithms to identify potential concealed weapons.

City-owned systems are currently used at two locations, the Hult Center and City Hall Council Chambers. These systems are especially effective at providing security screening while maintaining a steady flow of people in the large events.

We have six city-owned units at two locations citywide. This technology is also used at the Cuthbert by the venue operator.

Presenter: The city also has cameras on its 27 drones. Matt Rodrigues:

Matt Rodrigues (Eugene, assistant city manager): Public Works uses drones for infrastructure inspections, construction monitoring and assessments of natural systems. EPD uses are for public safety and to assist Eugene Springfield Fire when needed, and the city currently owns approximately 27 drones, which are deployed based on need. 

In-car video systems are installed in police patrol vehicles and are intended to document interactions between officers and members of the public. Body-worn cameras provide a closer perspective on officer interactions. Currently the department has approximately 250 body-worn camera units worn by sworn personnel, which record video and audio with cloud-based data storage. 

The city currently uses automated license plate recognition technology, also known as ALPR for parking management purposes. 

Fixed ALPR systems are typically installed on poles, on buildings, or at other fixed locations. Currently these systems are used by the planning and development department parking services team at two downtown parking garages and at the Eugene Airport parking facilities. 

These systems support parking operations and facility management, and these technologies are not connected to law enforcement systems. And to be clear, EPD does not currently use ALPR. 

However, at the airport, the ALPR system is included in the TSA approved airport security program.

The Planning and Development Department Parking Services team also uses vehicle-mounted ALPR technology to improve parking management and enforcement efficiency. These systems are installed in approximately 14 parking service vehicles.

Presenter: He said surveillance technology policies are not yet common in the U.S. Assistant City Manager Matt Rodrigues: 

Matt Rodrigues (Eugene, assistant city manager): Most of the existing policies stem from the American Civil Liberty Union’s Community Control Over Police Surveillance (COPS) framework, which began in 2016.

According to the ACLU, just over two dozen cities have adopted policies based on those principles, and they span a wide range of sizes and regions from Seattle, San Francisco, and Berkeley to Grand Rapids, Madison, Nashville, Detroit, New York. 

Here in Oregon, Portland is the only city that appears to have implemented a surveillance technology policy. After a significant community engagement process, Portland adopted its policy in February of 2023 as a council resolution establishing a citywide surveillance technology inventory, and setting procedures for privacy use and acquisition.

Portland spent several years engaging community organizations, privacy advocates, city bureaus, and other stakeholders to develop a governance framework focused on transparency, privacy, and accountability. Their approach has been phased, beginning with the creation of a citywide inventory, rather than immediately creating approval requirements.  

Portland first focused on understanding what technologies existed and establishing a governance structure around them. 

Portland defined surveillance technology as any electronic or analog device, equipment, software, information, and or associated metadata, automated decision systems, data processing systems, or software solution that is designed or primarily intended to be used for the purpose of surveillance.

And it goes on to further defined surveillance, the policy applies citywide and Portland is now implementing privacy impact assessments while also creating public reporting and transparency requirements.

The process is managed by Smart City PDX in the Office of Equity and Human Rights, with oversight transitioning to a new city Data and Privacy Office once it’s established.

Council’s role is primarily establishing the overall framework through resolution and receiving information, while much of the implementation work and technology approvals are carried out through administrative and privacy governance processes. 

Presenter: Councilor Alan Zelenka:

Councilor Alan Zelenka: The main question for me in all of this is: What’s the role of the City Council in the mass surveillance policy, and is the use of mass surveillance a policy question or a management issue?

And I hearken back to what I consider the oracle on it, Ken Tollenaar, who used to be a city councilor here. He also wrote the model code for Eugene.

And I once asked him what’s the difference between, there’s kind of a gray line between policy and management. And you know, policy is the purview of the City Council and management or contracts are the purview of the city manager.

And he said, ‘It’s pretty simple. It’s, if it’s controversial, it becomes policy.’

And I thought, ‘Oh, that’s kind of a little bit too simple. But then as I used that over the years, that’s become kind of the way that I look at this.’

If something becomes controversial, becomes in the public realm, it then becomes a policy issue if that issue reaches a threshold of significant public concern and input, it then becomes a policy and then it becomes under the City Council purview. 

Presenter: Councilor Zelenka said cameras can save money and improve safety for city employees.

Councilor Alan Zelenka: Some people say that we just ban all of it, and it’s really not that simple.

There’s some current technology that’s very useful. For example, Public Works uses drones to do rooftop inspections instead of risking someone going up there and coming back down and walking around a roof.

And police use drones to track suspects at night when they can’t find them. That might put the officers at risk or other people at risk. There’s legitimate uses for this stuff that make our work more efficient, lower cost, and make it even more effective.

So for me, the answer to the question of whether the City Council should establish a mass surveillance technology policy, the answer is clearly yes.

It’s ceased being a management or contractual issue under the purview of the city manager when the Flock issue blew up and into the public sphere and continues when the perceived threat of the likely misuse of data and images by the Trump admission became very real, it shifted into the policy realm.

So should the council approve the use of all mass surveillance technology. I think yes. 

Should the council establish rules on how, when and under what rules the city uses mass surveillance technology? I think the answer is yes, but can we grandfather in some existing mass surveillance technologies that we already use? I think the answer to that is yes. And we can, by that, approve them. 

And should we have policies for both new and existing or grandfathered-in ones? Yes. 

Should there be a public input process as we develop this policy? The answer is yes. 

And so we have some really good examples of the type of policies from Berkeley and Portland that we could use to help craft this policy. I like San Jose’s risk level thing to determine what level you do that at. I think that’s a good one. 

So I’m eager to get working on this and have this set up and have this put in place by the end of the year. So I agree with the phase-in approach. 

Presenter: Councilor Mike Clark:

Councilor Mike Clark: Matt, during the presentation you mentioned with red light cameras and speeding cameras, that technology is currently being reviewed. My question: by whom?

Presenter: Assistant City Manager Matt Rodrigues:

Matt Rodrigues (Eugene, assistant city manager): Councilor Clark, thanks for the question. It’s not being reviewed, it’s being explored. 

A number of cities around Oregon have implemented the technology. It is part of two different actions in the Vision Zero action plan, and the team is trying to understand logistically how we would implement it, if we chose to, how much it would cost, how that would work through municipal court, and how that would work through EPD.

So before that moved forward, we would be coming back to Council to talk about that as a proposal. 

Councilor Mike Clark: Okay, that will be reviewed by Council before implemented no matter what. Correct? 

Matt Rodrigues (Eugene, assistant city manager): Yes. And, yes, the simple answer is yes, both for the implementation and also likely budget needs for a program like that.

Councilor Mike Clark: If the chief is there, I’d like to ask a more specific question about a different kind of technology. And my question is whether or not EPD makes use of geofencing warrants.

Do we ask courts to help us—through the means of a private company like Google—to say, ‘In this area (defined) at this particular time, please give us a list of all devices that were there.’ Ask the court to insist that Google give that to us. 

Presenter: Eugene Police Chief Chris Skinner:

Chris Skinner (Eugene, police chief): Yeah. So there are a variety of investigative techniques that we will use to geofence certain pieces of information in the hopes of being able to either locate somebody or to assist us in that investigation, those are as a result of writing a warrant for that information.

So I guess the quick answer would be: Case by case, depending on the investigation. We would write a judicial warrant, have that signed by the judge, and then the judge would grant our ability to look at that specific information. A good example of that would be, although maybe not geofenced, is our cell phone pinging.

We write warrants for oftentimes, unless there’s significant exigent circumstances, we’ll write warrants to be able to ping an individual’s cell phone to be able to get their last known location, for a variety of different reasons. 

Councilor Mike Clark: But that’s with a known individual. My question focuses more towards the gathering of any device in a particular area at a particular time without a known person as part of the warrant.

I know that 4th (U.S.) Circuit and 5th Circuit have divergent opinions, and it’s before the Supreme Court, so I’m just wondering what the regular use for EPD is of what’s sometimes referred to as a reverse warrant. 

Chris Skinner (Eugene, police chief): My experience has been that we have a very specific investigative need for these warrants usually anchored to an individual or a group of individuals that we’re looking for.

It’s not just to cast a wide net and just gather whatever data we think we can gather. It’s very, very focused. 

Councilor Mike Clark: My second question in regard to those type of warrants is: What we do to store the data after the fact and how long we keep it?

Chris Skinner (Eugene, police chief): Well, that’s on a case-by-case basis, depending on what data we’re keeping.

Now understand anything we’re doing is, if it’s a warrant, it’s been signed by a judge and it’s lawful police action. As we collect that data, likely if it’s of evidentiary value, it goes into our digital evidence management system, which holds all of our digital evidence.

Presenter: Eugene Mayor Kaarin Knudson: 

Kaarin Knudson (Eugene, mayor): I think there could be an opportunity for us to think about a phased approach that is very strategic and uses this body’s time well, but also helps us to focus that surveillance conversation on emergent technologies and issues that are already aligned with the work that is in the next six-month work schedule for this body, just with the items that already before council.

So I wanted to just offer that I think there is a lot of wisdom in that phased approach. 

Presenter: Controversy around the former city manager’s approval for Flock cameras means surveillance tech is no longer a management issue, but a policy issue for the public and the city council.

In 2018, Eugene staff paid for, but ignored, an internal proposal for citywide data governance. Nearly a decade later—and only after ICE agents used data to seize neighbors—the city moves toward a policy on data and privacy.