Rampart Audit LLC

GHOST FINDING — Rampart's biennial audit of Duluth PD's dual ALPR program (49 Axon Fleet in-car OCR units at 60-day retention, plus 10 Flock Safety stationary cameras at 9 intersections at Flock's 30-day default) records one exception but describes two further statutory gaps it never records, and still issues an unqualified compliance opinion. RECORDED FINDING (1, Material): Duluth's written ALPR policy omitted the employee discipline standards for unauthorized access to ALPR data required by Minn. Stat. 626.8472. Rampart wrote that the policy 'addresses all of the mandatory elements identified in the statute' 'except for the employee discipline standards for unauthorized access to ALPR data.' DPD submitted a revised policy before the report was completed, attached as Appendix B with a new 'Unauthorized Use' section; the report does not state the revision cured the exception. GHOST FINDING 1 — public log of use. Rampart's own narrative states that 'the transparency portal data does not satisfy all of the requirements specified for the public log of use,' then sets the shortfall aside on the ground that the remaining elements 'are captured by the systems.' That is the Grand Rapids pattern: holding the underlying data is not the same as maintaining the public log Minn. Stat. 13.824 subd. 5 requires. No finding or exception was recorded, and the audit opinion is unqualified. GHOST FINDING 2 — no independent audit-log review. DPD personnel told Rampart that the Flock system forces internal audit reviews only when triggered (repeated searches of the same plate) 'but that internal audits are not otherwise conducted.' Absence of independent audit-log review is a substantive access-accountability gap; it appears only under INTERNAL CONTROL RECOMMENDATIONS, where Rampart recommends two administrators or supervisors begin periodic reviews. Never recorded as a finding. Also described but not scored: the Axon audit trail is 'currently unrefined and difficult to read' (handled as a recommendation that DPD ask Axon for a better report — a vendor usability problem, not a DPD compliance failure), and the report contains an unreconciled contradiction about whether the Flock cameras were running: under ALPR PROGRAM, 'DPD personnel advised us during the audit that all of these cameras had been turned off as of the date of our audit,' while under PUBLIC LOG OF USE, 'All of the stationary ALPRs are operational at all times.' Notably for a Rampart report, no live-system access: 'No direct system access was granted to the auditors, nor was any data downloaded by the auditors.' DPD staff ran every report and retrieved sample data at the auditor's direction. Rampart's recommendations are otherwise unusually concrete — retain written data requests and document verbal ones, archive each transparency portal periodically before purge destroys the summary data, keep BCA notification and relocation emails two years, retain audit log data at least 30 months, reconcile random searches to case numbers, and seek legislative clarification on whether the time-of-day log element means every scan or a first-and-last-scan summary. The report also observes that AI-derived vehicle attributes (Axon VAR, Flock VF) are generated from collected photos rather than 'collected' under the statute, and that Flock markets at least limited vehicle identification without a plate.

The only 2025-26 audit to surface a systemic, platform-level problem. Rampart found that Flock data exports generate no audit-trail entry, undercutting the 60-day deletion rule, and flagged that Flock cross-agency search may amount to a prohibited central state repository. Drove corrective action including a Flock support ticket and internal controls.