University of Minnesota Police Department

What the audit said

GHOST FINDING — MNSec records zero findings, but its own narrative states that UMN PD "now compiles" the monthly public log of use required by Minn. Stat. § 13.824 subd. 5, and that only one month of sample reports was reviewed. No exception was recorded for the rest of the period. Same language and same pattern as the companion Flock report and as the Olmsted County Sheriff's Office audit. First audit of UMN PD's new AXON system, roughly 29 mobile units operational 3/11/25 to 8/31/25 alongside the agency's existing Flock deployment. Every other section was marked compliant: ALPR Policy 654, 60-day read and hit retention confirmed in the AXON retention settings, access control with a full user and role review, data classification, interagency sharing, BCA notification validated on the BCA website, and the University's data security breach policy. Checklist-depth executive summary of five pages.

What the audit said

GHOST FINDING — MNSec records zero findings, but its own narrative states that UMN PD "now compiles" the monthly public log of use required by Minn. Stat. § 13.824 subd. 5, and that only one month of sample reports was reviewed against a two-year audit period running 9/1/23 to 8/31/25. A log-of-use practice that began at or near the audit leaves the earlier months of the period unaccounted for, and the auditor recorded no exception for them. Same pattern as the Olmsted County Sheriff's Office audit. Every other section was marked compliant: ALPR Policy 654, the 30-day Flock default retention confirmed in the administrative control panel, access control with a full user and role review, data classification, interagency sharing documented by agency and case number, BCA notification validated on the BCA website, and the University's data security breach policy. Checklist-depth executive summary of five pages, first audit of the new Flock system.