Responsible Surveillance
The conditions under which surveillance is tolerable at all. Most systems do not meet them.
We grade the ones we can get our hands on.
We are not anti-surveillance. We are pro-accountability. Those two sentences have been on this site since it launched, and this page is the second one cashed out.
Every other project here documents a gap: the contract nobody read, the audit nobody did, the data that left the building without anyone deciding it should. This page describes what closing the gap looks like. It is written for three readers at once. A resident who wants to know what to ask for at a council meeting. A reporter who needs a yardstick. A police chief who would rather build something defensible than inherit something embarrassing.
The standard below borrows from fields that solved this problem a long time ago. Medicine does not operate when a pill will do, and it gets consent first. Radiation safety sets exposure as low as reasonably achievable, never zero, never more than the job needs. Wiretap law has required a judge, a 30-day clock, and a public annual report since 1968. None of these fields banned the dangerous thing. All of them made the person holding it prove the need, log the use, and answer for the outcome.
That is the posture here. The burden sits on the watcher. The default is off.
The ladder
Before anything is switched on
Before an agency turns anything on, it should be able to show it climbed down every rung above and each one failed.
Do nothing.
Most problems that get pitched a camera do not need one. The pitch is usually the vendor’s, not the community’s.
Descend only if this rung failed, in writing
Solve it without collecting data.
Lighting, staffing, design, a phone number people trust enough to call.
Descend only if this rung failed, in writing
Use data you already hold.
Before buying a new feed, exhaust the ones already in the records system.
Descend only if this rung failed, in writing
Collect narrowly, briefly, in the open.
Specific place, specific purpose, short clock, posted policy, public vote.
Descend only if this rung failed, in writing
Covert or bulk collection.
The bottom rung. Warrant, judge, notice afterward, and an annual public count. The wiretap standard, because that is what a wiretap is.
A system that starts at rung five and works backward to a justification has the ladder upside down. That is most of what we document.
How we grade
Cities are graded practice by practice against the Standard, with a document behind every mark. Four marks:
- Meets
- The practice is written down, specific, and enforceable.
- Partial
- Written down but vague, discretionary, or missing a piece.
- Fails
- The document says the opposite, or permits what the practice forbids.
- Missing
- Not addressed at all. We mark this separately from Fails because the missing clause is usually where the story is. A contract that never mentions retention has decided retention in the vendor’s favor.
Each city also gets a composite letter grade. The formula is published with the Standard and nobody’s grade is a secret. The documents themselves are read and annotated, never scored: a contract is one piece of a city’s governance.
On this page
The Standard
26 practices across the life of a surveillance system, each with its source and the Lens it serves.
Open →
Examples
9 real ordinances, statutes, contracts, policies, audits and reports. What each does well, and what it leaves out.
Open →
Clauses
In progressModel language an agency can paste into a vendor contract, keyed to the practice it satisfies.
Checklist
In progressOne page to bring to a council meeting.
Europe has the words
What happens when the standard is law and nothing enforces it.
Open →
The eight stages