The Responsible Surveillance Standard

Stage 1

Decide

1.1Documented necessity

Before acquisition, the agency writes down the specific problem, what it tried first, and why that failed. The document is public before the vote.

A surgeon does not open a patient because a scalpel is available. The indication comes first. Most surveillance purchases we have read begin with a vendor demo, not a documented problem.

Source: Cambridge, MA Surveillance Technology Ordinance (2018); Oakland Surveillance and Community Safety Ordinance (2018)
Lens: Surveillance Saturation
Done well: Cambridge’s surveillance ordinance

1.2Least invasive option

The agency shows, in writing, that the rungs above on the ladder were considered and rejected for stated reasons.

Radiation safety calls this ALARA: as low as reasonably achievable. The dose is never zero, and it is never more than the job requires.

Source: 10 CFR 20.1101 (ALARA); GDPR Article 5
Lens: Surveillance Saturation

1.3Public notice and a recorded vote

Acquisition, renewal, and any material change in capability go to the elected body in open session, with the use policy attached, before money moves.

Oklahoma City’s council saw its $165,608.82 LexisNexis renewal and, in the same memo, an amendment restricting who could see the city’s data. The amendment exists because someone read the renewal. Most renewals are consent-agenda items nobody reads.

Source: Oklahoma City council memo, April 21, 2026; Seattle Surveillance Ordinance (2017)
Lens: Complexity as a Shield
Done well: Cambridge’s surveillance ordinance; Cambridge’s 2026 annual surveillance report; Oklahoma City’s AVCC amendment; Duluth’s no-contribution addendum

Stage 2

Acquire

2.1Direct contract, no marketplace add-ons

Each surveillance capability has its own contract, its own line item, and its own public record. Enabling a facial recognition or commercial data feature inside an existing platform counts as a new acquisition and goes back to Stage 1.

When an agency turns on Clearview inside AVCC, its LexisNexis bill goes up and no contract with Clearview ever exists in a public file.

Source: Colorado Information Sharing Consortium board minutes, May 2025 (Babel Street and Clearview available as AVCC add-ons); Lens: The Marketplace Veil
Lens: The Marketplace Veil

2.2Published use policy before deployment

A plain-language policy covering purpose, who may use it, what for, what is forbidden, retention, sharing, audit, and complaint process. Posted where residents can find it before the first day of use.

A policy written after deployment describes what the agency already does. A policy written before describes what it is allowed to do.

Source: Minn. Stat. § 13.824, subd. 6 (written ALPR policy required); Cambridge, MA Surveillance Technology Ordinance (2018)
Lens: Complexity as a Shield
Done well: Paul Bunyan Drug Task Force audit; Cambridge’s surveillance ordinance; Cambridge’s 2026 annual surveillance report

2.3Sunset clause

Every contract and every use policy expires on a date. Renewal repeats Stage 1 with the actual results of the prior term attached.

The Oklahoma City AVCC subscription dates to 2014. Twelve years of renewals is twelve chances to ask whether it worked. A sunset makes the question mandatory.

Source: Title III wiretap orders expire at 30 days, 18 U.S.C. § 2518(5); Oakland Surveillance and Community Safety Ordinance (2018)
Lens: The Permanent Record

2.4No irrevocable license to the vendor

The agency owns its data. The vendor holds it under a license that ends when the contract ends, with certified destruction.

Portland’s PSDEX agreement grants LexisNexis a license the city cannot take back. Once the records leave, the city’s policy stops mattering.

Source: Portland Police Bureau PSDEX contributor agreement (2024); LexisNexis PSDEX contribution terms
Lens: The Permanent Record
Done well: Duluth’s no-contribution addendum

Stage 3

Deploy

3.1Purpose limitation in writing

The policy names the purposes the system may serve. Anything else is off-label and requires a new decision.

A drug is approved for an indication. ALPR bought for stolen-car hits and used for immigration lookups is off-label use with no pharmacovigilance.

Source: GDPR Article 5; Fair Information Practice Principles (1973)
Lens: The Loophole
Done well: Minnesota’s ALPR statute; Cambridge’s surveillance ordinance; St. Louis Park ALPR policy

3.2Scope limits

Where the system operates, when, and against whom. Cameras at the three intersections named in the necessity document, not wherever the vendor’s coverage map suggests.

Saturation is built one reasonable placement at a time. The scope document is the only thing that stops the next reasonable placement.

Source: Cambridge, MA Surveillance Technology Ordinance (2018); German Federal Constitutional Court, ALPR rulings of March 11, 2008 and December 18, 2018
Lens: Surveillance Saturation
Done well: Cambridge’s surveillance ordinance

3.3Signage and notice

Fixed surveillance is marked. People can find out what is watching them and under what policy without filing a records request.

Covert use is rung five and gets rung-five controls. Everything else is in the open by definition.

Source: Minn. Stat. § 13.824, subd. 5 (public disclosure of ALPR use); UK Surveillance Camera Code of Practice
Lens: Chilling Effects
Done well: Paul Bunyan Drug Task Force audit; St. Louis Park ALPR policy

Stage 4

Use

4.1Logged justification for every query

Each search records who, when, which case, and why. Free-text reasons like “investigation” do not satisfy this.

Financial audit calls it a paper trail. A reason field that accepts anything is decoration. The Minnesota audits that actually looked found queries with no documented authorization at all.

Source: Minn. Stat. § 13.824, subd. 5 (ALPR access log required); CJIS Security Policy, audit logging; FinePrint ALPR Audit Watch
Lens: Complexity as a Shield
Done well: Minnesota’s ALPR statute; St. Louis Park ALPR policy

4.2Access control and separation of duties

The person who queries is not the person who approves the query is not the person who audits the log. Access is role-based, individually assigned, and revoked on departure.

The rule that keeps a city’s finance office honest keeps its surveillance honest for the same reason.

Source: CJIS Security Policy, access control; NIST Privacy Framework
Lens: Complexity as a Shield
Done well: Minnesota’s ALPR statute

4.3No off-label use

A capability added by the vendor in a software update is not authorized because it appeared. It goes back to Stage 1.

Vendors ship features. Agencies inherit them. A “reverse search” or a national lookup toggle that arrives in a release note is a new surveillance system with no vote behind it.

Source: Cambridge ordinance: a material change triggers a new impact report
Lens: The Loophole
Done well: Cambridge’s surveillance ordinance; Cambridge’s 2026 annual surveillance report

4.4Misuse is reported like a near miss

Every improper query is logged, investigated, disclosed in the annual report, and studied for the control that failed, along with the person who failed.

Aviation got safe by studying near misses without burying them. A department that reports zero misuse in a year has a reporting problem, not a clean record.

Source: Aviation Safety Reporting System (NASA/FAA); FinePrint ALPR Audit Watch
Lens: Chilling Effects
Done well: Paul Bunyan Drug Task Force audit

Stage 5

Share

5.1No sharing without a published policy

Who can receive data, for what, under what agreement, is written in the use policy. Federal access is named specifically, not implied by “law enforcement partners.”

Local police in a sanctuary city may be barred from helping ICE. The database they feed is not. The sharing clause is where the sanctuary policy either holds or does not.

Source: ICE used LexisNexis to reach Belleville, IL records; Illinois TRUST Act
Lens: The Loophole
Done well: Paul Bunyan Drug Task Force audit; Oklahoma City’s AVCC amendment; Duluth’s no-contribution addendum

5.2Chain of custody

Every hand the data passes through is named: vendor, sub-processor, consortium, platform, downstream subscriber. The agency can produce the list on request.

Downers Grove, IL confirmed in writing it has no way to monitor what happens to records it contributes. That is a chain of custody with one link.

Source: Downers Grove AVCC audit admission; GDPR Article 28
Lens: Complexity as a Shield
Done well: Cambridge’s 2026 annual surveillance report

5.3Downstream deletion

When the agency deletes, everyone it shared with deletes, and the contract says so.

Under PSDEX terms, an agency can request deletion and any subscriber that already downloaded the records may keep them indefinitely. Deletion that stops at the first hop is not deletion.

Source: LexisNexis PSDEX contribution terms; Oklahoma City Amendment No. 1, the contrast case
Lens: The Permanent Record

5.4Consortium and platform terms are public

If the agency joins through a consortium, joinder, or master agreement, the master terms are attached to the local contract and published with it.

The Colorado consortium sits between more than a hundred agencies and LexisNexis. Nobody at the local level holds the technical specifications. The intermediary is where the accountability goes to die.

Source: CISC master agreement joinder structure; Lens: The Marketplace Veil
Lens: The Marketplace Veil
Done well: Oklahoma City’s AVCC amendment

Stage 6

Retain

6.1Shortest retention that serves the stated purpose

Non-hit data is deleted on a clock measured in days, not years. The clock is in the policy and in the contract.

Minnesota gives ALPR data not tied to an active investigation 60 days. Flock’s default is 30. Most departments never change the default, and most states have no clock at all. Leave No Trace in seven words: take only what you need, pack out what you brought.

Source: Minn. Stat. § 13.824, subd. 3 (60-day destruction); GDPR Article 5(1)(e), storage limitation
Lens: The Permanent Record
Done well: Minnesota’s ALPR statute; Paul Bunyan Drug Task Force audit; Cambridge’s 2026 annual surveillance report

6.2Hard deletion, verified

Deleted means unrecoverable, including backups and vendor copies, with a certificate the agency can produce.

“Deleted from the dashboard” and “deleted” are different words.

Source: NIST SP 800-88, media sanitization; CJIS Security Policy, media protection
Lens: The Permanent Record

6.3Sealed and expunged records are removed

When a court seals or expunges a record, the agency propagates the order to every recipient in the chain of custody.

LexisNexis’s own disclaimer says its databases may include records that have been expunged, sealed, or otherwise made inaccessible to the public. The court closed the record. The database did not get the memo.

Source: LexisNexis Accurint terms and disclaimers; Lens: The Permanent Record
Lens: The Permanent Record

Stage 7

Audit

7.1Independent audit on a schedule

Someone outside the department, with access to the logs, on a fixed cycle, with a written report.

Minnesota requires one every two years. A handful of firms produce most of the reports, and several found nothing because they looked at nothing. An audit requirement without a standard for the audit produces a receipt, not an audit.

Source: Minn. Stat. § 13.824, subd. 6 (biennial audit); ALPR Audit Watch findings and recommendations
Lens: Complexity as a Shield
Done well: Paul Bunyan Drug Task Force audit

7.2Logs available to the oversight body

The council, a privacy commission, or an inspector general can pull the query log without asking the department’s permission.

Separation of duties again. A log only the department can read is a diary.

Source: Oakland Privacy Advisory Commission authority; Seattle ordinance, Office of Inspector General review
Lens: Complexity as a Shield
Done well: Minnesota’s ALPR statute

7.3Annual public report with counts

Queries, hits, arrests attributable, sharing requests received and granted, misuse incidents, cost. Published on a fixed date.

Federal courts have published a wiretap report every year since 1968: how many orders, how many intercepts, how many arrests. If the strictest surveillance tool in American law can survive that disclosure, a camera network can.

Source: 18 U.S.C. § 2519 (annual wiretap report); Cambridge ordinance, annual surveillance report requirement
Lens: Chilling Effects
Done well: Cambridge’s surveillance ordinance; Cambridge’s 2026 annual surveillance report

Stage 8

Retire

8.1An off switch

The oversight body can suspend the system on a finding of misuse or a failed audit, without waiting for the contract to end.

Every case in Europe where the “necessary and proportionate” test worked had one thing in common: someone had the power to turn the system off.

Source: German Federal Constitutional Court, ALPR rulings of March 11, 2008 and December 18, 2018; Cambridge ordinance, council authority to revoke approval
Lens: Surveillance Saturation
Done well: Minnesota’s ALPR statute; Cambridge’s surveillance ordinance; Cambridge’s 2026 annual surveillance report

8.2Exit terms and certified destruction

When the contract ends, the vendor and every downstream recipient destroy the agency’s data and certify it. The exit clause is negotiated at signing, not at termination.

An agency that cannot leave is not a customer.

Source: GDPR Article 28(3)(g); NIST SP 800-88, media sanitization
Lens: The Permanent Record

Method

Grading

Per practice: Meets earns two points, Partial one, Fails and Missing none. Unknown, for a jurisdiction where we could not find out, also earns none. The score is points earned over points available, as a percentage.

Meets2 pts: The practice is written down, specific, and enforceable.
Partial1 pt: Written down but vague, discretionary, or missing a piece.
Fails0 pts: The document says the opposite, or permits what the practice forbids.
Missing0 pts: Not addressed at all. We mark this separately from Fails because the missing clause is usually where the story is. A contract that never mentions retention has decided retention in the vendor’s favor.
Unknown0 pts: For a jurisdiction: we asked, or looked, and could not find out. Counts against the grade, because a jurisdiction that cannot answer has failed the transparency practice.
n/a: The document has no business addressing this practice. Excluded from the denominator.

Composite letter grade for jurisdictions:

A	85 to 100
B	70 to 84
C	55 to 69
D	40 to 54
F	below 40

One cap. A jurisdiction with no published use policy for a deployed system (practice 2.2 marked Fails, Missing, or Unknown) cannot score above D for that system. You cannot govern what you have not written down.

Documents in the Examples library are read practice by practice but never scored. A contract is one piece of a jurisdiction’s governance, and a number on a single document would imply more than we know. Their marks are the evidence behind a jurisdiction’s grade. Practices a document has no business addressing are marked n/a.

Inventory is reported separately from governance and never averaged into the grade. How much a city surveils and how well it governs what it surveils are different questions.

The Standard