Minnesota State Patrol

What the audit said

No findings. MNSec was given administrative access to the PIPS Technology BOSS system; all 6 mobile devices carried 2-day retention settings and no plate reads were detectable after 2 days. Audit trail sampled; log of use reports maintained in BOSS; no inter-agency sharing requests during the period.

What the audit said

Agreed-upon procedures engagement under AICPA attestation standards; no exceptions noted on any of the 8 procedures. OSA inspected PIPS hit data, the audit trail and data request log for 2020-2021 (four staff searches, all with documented purposes; no data shared with outside agencies; no exports observed), the log of use, user access roles, and the 2-day retention practice. GHOST FINDING: the report's own narrative notes the State Patrol's policies do not designate who may grant written access authorization as Minn. Stat. 13.824, subd. 7(b) requires (practice relies on the Director of Operations and Asset Management), yet the procedure was closed with no exception recorded. A policy-documentation gap, superficial in tier, but described and left off the record.

What the audit said

No discrepancies recorded, and the testing was genuinely substantive: LEADS examined a random sample of 160 of 3,726 reads from the prior 48 hours, ran electronic searches of the live BOSS database confirming no data older than 48 hours, examined the audit trail directly (16 trooper users, 4 administrators), and reviewed public logs of use. Observations noted without findings: 2 of 16 ALPR units had malfunctioning GPS recording (3M delaying repair amid its sale of the ALPR business to Neology), two false reads, and duplicate reads among hits. Notable: the State Patrol deletes ALPR data within 48 hours, far stricter than the 60-day statutory maximum — the shortest retention in this table.