Sign in Subscribe

SB 6002 (Driver Privacy Act Flock/ALPR regulation): email and testimony to the Civil Rights & Judiciary Committee

There were over 40 people signed up to testify at this hearing, so I wasn't at all sure I'd get a chance to speak – disappointing since I (and many others) had already been shut out at the previous hearings on SB 6002 and its companion HB 2332, but oh well, it is what it is. So I sent the committee some short email before the hearing, and that night submitted written testimony expanding on the topics I raised in the email. Over the next few days I was in several meetings, and sent followon mail to a couple of the legislators. A striker (aka substitute) amendment was released on Monday, 2/23, and the committee had an exec session and vote on the 24th – another good opportunity to email the committee!

Of course, this is only one fragment of the overall conversation. 50 Indivisible, community, advocacy and non-profit groups sent the committee a letter the morning of the hearing; ACLU of Washington sent a letter as well, organized a couple of panels at the hearing, and had quite a few legislator meetings. Several of the other organizers and activists I'm working with also submitted testimony, asked questions and had discussions at town halls, and emailed the committee as well as specific legislators. And there's also a whole bunch of stuff going on behind the scenes that I have no visibility into!

A few thoughts going into the hearing

Chair Taylor, Ranking Member Walsh, members of the committee,

Thank you for your attention to this important issue. I realize how difficult it is when so many people are signed up to testify, so if I once again don't get to provide my input live, so be it – I'll follow up with written testimony. So I figured I'd share a couple of thoughts with you that nobody covered in the previous hearing, and I'm not sure anybody else is planning on talking about today.

Section 1 starts with

The legislature finds that it plays an important role balancing the need to ensure public safety and an individual's right to privacy under both the federal Fourth Amendment to the United States Constitution and the broader protection of individual rights guaranteed by Article I, section 7 of the Washington state Constitution.

It's more complex than that, though. The public safety aspects of this bill are themselves a balance.

  • How many crimes do ALPRs really help solve? How many of these would be solved by a hot-list only solution (retention time of three minutes or less)?
  • How to weigh that against the horrible impact ALPRs have on the safety of so many people? Remember, we only know about the abuses that have been detected and reported. How many of the risks would be mitigated by a hotlist-only approach, limiting retention to three minutes or less?

Just as importantly, though, the vast majority of the steadily-growing list of authorized uses in the bill have nothing to do with keeping the public safe. ALPRs for parking, for example, harm both privacy and public safety. Paid parking existed before ALPRs. Are they really needed here?

With that, I'll go prepare for the hearing.  The testimony at the January 20 hearing was excellent on all sides, with a few exceptions, and the questioning was excellent -- Rep. Entenman, in my written testimony I'll respond to the hilarious claim from Chamber of Progress in the earlier hearing that the bill as written would lead to "cybersecurity vulnerabilities."  

Thank you again for all the work you do, on this and so many other challenging bills.

Jon Pincus, Bellevue

Written testimony

Chair Taylor, Ranking Member Walsh, members of the committee,

I'm Jon Pincus of Bellevue. I run the Nexus of Privacy Newsletter; I co-chaired the ACM Computers, Freedom and Privacy conference in 2010; and I have worked in bipartisan grassroots coalitions opposing mass surveillance since Get FISA Right in 2008.  My position on SB 6002 is Other.  

Flock and other ALPRs are mass surveillance systems, and regulation is desperately needed. I’m one of those people Sen. Trudeau talked about in today’s hearing who thinks we really should ban them – and more and more cities and counties in Washington and around the country are making good progress on that. That said, my understanding is that the votes for a ban are not yet there in the legislature.  So I greatly appreciate the efforts by the sponsors of SB 6002 (and its companion HB 2332) to put some guardrails in place – and especially appreciate that the legislation is framed as a floor, not a ceiling, allowing cities and counties to put stronger regulations in place if they choose to.  Given the ongoing documented abuses of these systems, if we’re not going to ban them, it’s certainly worth trying to reduce the harms.

Unfortunately, the bill in its current form does not accomplish that.  Others have made the case for specific improvements better than I could, so I won’t go over the list yet again.  Hopefully the committee will be able to make significant progress on these, Transportation will address the fiscal aspects, and that will give enough momentum to make further improvements on the floor. Still, given all the pressure to weaken the bill, it’s hard to be optimistic.  One of the committee members said at his town hall tonight that he thought the likely outcome was that you’d make it a bit stronger … that’s better than further weakening it, but that’s not good enough to protect Washingtonians.

One thing I haven’t heard discussed at any of the hearings is the inconsistency between the framing in the findings and the actual bill.  Section 1 starts with 

"The legislature finds that it plays an important role balancing the need to ensure public safety and an individual's right to privacy under both the federal Fourth  Amendment to the United States Constitution and the broader protection of individual rights guaranteed by Article I, section 7 of the Washington state Constitution."

But the vast majority of the vast majority of the steadily-growing list of authorized uses in the bill have nothing to do with keeping the public safe.  There was an extreme example of this in the hearing where a Mercer Island City Council member asked for an amendment to allow mobile ALPRs to be used at immigration centers, protected health facilities, and schools or “otherwise we’d have to go back to marking tires with chalk.”  Given the obvious public safety risks of ALPRs at these sensitive locations, hopefully it’s clear that using ALPRs there would be worse for both privacy and safety than chalk.  

For that matter, using ALPRs for parking enforcement in general harms both public safety and privacy. Paid parking existed before ALPRs. Why are they needed here?

In the HB 2332 hearing, the lobbyist from Chamber of Progress talked about the potential for a “cybersecurity vulnerability”, and in response to an excellent question from Rep. Entenman clarified that he was talking about the complexity of different retention times for different uses. Obviously “cybersecurity vulnerability” is a wild exaggeration here – and I hope there was a moment of bipartisan unity in laughing at a lobbyist for an organization billing themselves as advocating for “Technology's Progressive Future” signing in CON on a bill to put guardrails around mass surveillance technologies. How progressive!

Still, the underlying point is accurate. The different authorized uses, with different retention times, certainly increases the possibilities for unknowing errors and accidental misconfigurations. And there’s an obvious way of addressing this: reduce the complexity by only authorizing ALPR use in situations where there is a clear public safety benefit.

And even the public safety aspects are a complex balance.  

  • How many crimes do ALPRs really help solve?  I was very pleased to hear Rep. Salahuddin’s request for data on how often ALPRs are used for misdemeanor crimes, and hopefully you will be able to build on that by requesting more data, not only about usage but about impact.  
  • How much of this impact could be achieved with a hotlist-only approach, with a retention time of three minutes or less?  I heard the pushback in the hearing that there isn’t a clear definition of what could go on the hotlist, and it could well be that cleanup is needed there.  Still, a hotlist-only approach significantly improves both privacy and the public safety risk of data abuse.
  • How to weigh that against the horrible impact ALPRs have on the safety of so many people – especially from impacted communities?  Remember, we only know about the abuses that have been detected and reported. How many of the risks would be mitigated by a hotlist-only approach, limiting retention to three minutes or less?

As several people pointed out while talking about different bills in the hearing, CR&J has a well-deserved reputation for excellent staff work.  Please ask them to dig into whatever data you can find here rather than just accepting claims at face value. In Lynnwood, for example, initial law enforcement reports about Flock efficiency had significant errors.  

Hopefully, reframing the thinking in this way can point to opportunities to strengthen the guardrails in ways that benefit both public safety and privacy – and significantly reduce the harms of these systems.   Please let me know how I can help you and your colleagues improve the bill as the session continues.

Jon Pincus, Bellevue

Followup with Rep. Salahuddin (February 22)

Another Indivsible Eastside member and I had met with Rep. Salahuddin's LA (legislative assistant) on Thursday (2/19), sharing some perspectives and making a few asks. On Saturday (2/21), Rep. Salahuddin hosted a "Community Conversation" in Redmond. The focus was on state and local response in light of the federal action that's harming our communities, and there were brief perspectives from several local mayors and city councilmembers as well as community organizations. Unsurprisingly Flock, ALPRs, and SB 6002 came up . Rep. Salahuddin described the goal of SB 6002 as keeping data from ICE and hostile state law enforcement – for repro rights and gender-affirming care as well as immigration. Here's the mail I sent the next day.

Rep. Salahuddin,

What an outstanding event yesterday!  Hearing the consistent message from so many local elected officials and community organizations was really powerful, and I very much appreciated the candor (echoed in so many of the remarks) that it's really going to be the community taking the lead here, with electeds and lawyers doing everything they can to help.  

Afterwards, I had an excellent short discussion about the Flock cameras in Redmond with Councilmember Nuevacamina, who is extremely knowledgeable about this issue. She pointed out that during the process of considering whether to adopt Flock, the council had several presentations from security experts on the risks, and so as a result adopted policies that restricted sharing -- avoiding unpleasant surprises of the kind that have happened in cities like Mountain View CA (where they discovered after a few months that their settings had allowed sharing with everybody, and literally hundreds of agencies had searched it -- including BATF, as Senator Trudeau mentioned during the hearing). I'm not sure that state legislators have had similar working sessions, so even though a handful of legislators like you are very deeply involved, it drove home to me that many of your colleagues may not yet have a deep understanding of the issue.

In the discussion Hanna and I had with Gavin a couple of days ago, we suggested that it would be useful for committee staffers to dig into the data about the tradeoffs related to public safety. I discussed this some in my written testimony (attached), which I'll be emailing to the committee later this evening, but wanted to go into a little more detial here.

For example:

  • How many of the successes could be achieved with a "hotlist-only" approach, with 3-minute-or-less retention? I'm CCing Maya Morales of WA People's Privacy, who has looked at the examples in WASPC's "Recent ALPR Success Stories in Washington."
  • How many of the successes attributed to use of ALPRs are real? How many could have been achieved by other means?
  • Balanced against that, what are the harms – to specific people, and to communities as a whole – and costs of ALPR usage? Very frankly, to me this is the most important aspect, and I certainly hope we don't wind up situation where anybody is trying to excuse the harms because there are also some successes and/or cost savings to law enforcement. Still, if in fact the vast majority of successes can be achieved with a hotlist-only approach, and/or the presumed cost savings to law enforcement don't hold up to deeper analysis, that's important information as well.

Interestingly, Councilmember Nuevacamina mentioned to me that the recent presentation by Redmond PD on their own successes with ALPRs primarily focused on 6 cases where they were used to identify stolen vehicles – so probably could have been achieved in a hotlist-only approach of three-minute-or-less retention. And if I understood her correctly, this is still just a tiny fraction of the overall number of auto thefts in this period, so despite a handful of successes, ALPR usage does not appear to be a significant factor in overall law enforcement efficiency. Again, I don't want to take the attention away from the harms these systems of mass surveillance cause! But since there's so much focus on ensuring that law enforcement has the tools they need, it's really worth digging into this.

Jon Pincus

Followup with Rep. Goodman (February 22)

Saturday (2/21) wes a busy day for me; I had dropped by Sen. Vandana Slatter's "Lattes with Slatter" in the morning, and then Indivisible Eastside had set up a meeting with Rep. Roger Goodman after the LD-45 town hall. I got to the town hall about two thirds of the way through, and my timing was great: just a few minutes after I arrived, Rep. Goodman and Sen. Manka Dhingra both said a bit about Flock during their overviews of important legislation, and there was also a very good question from an audience member. Our discussion was good too, albeit brief. Here's the followon mail I sent the next day. Since

Rep. Goodman,

We greatly appreciated you taking the time to meet with us after Saturday's Town Hall – and thanks Angela as well for setting it up!  The clarification that (if I understood correctly) the changes at the committee level would be limited to technical changes, with any more significant modifications coming in the floor striker, was extremely helpful – as was the information that Rep. Salahuddin will be driving the strikers with you and others helping to work out the challenging areas.  Another LD-48 Indivisible Eastside member and I had met with Rep. Salahuddin's LA Gavin on this topic last week, so I'm including them on the response, as well as Southend Indivisible (who took the lead in putting the letter together).

It's certainly a complex situation, but it was refreshing to hear your optimism that the troubled areas in the bill can be addressed. It was especially interesting to learn that Axon's combination dashboard cams / ALPRs don't currently provide a way to turn off ALPR functionality. You mentioned that Washington's legislation may well become a model for nationwide adoption, so there's a great opportunity here. As well as better protecting people here in Washington by prohibiting ALPR use near immigration centers, places of worship, daycares, schools, protected healthcare facilities, and other sensitive locations, well-crafted legislation on this front could also provide the incentive for Axon and other vendors to implement this very basic functionality.

Section 6A of the letter that Indivisible Eastside signed on to (along with 49 other Indivisible, community, advocacy, and non-profit organizations) highlights one area that  it seems to me would be useful to clean up as part of the committee striker making technical fixes.  Section 6A in the letter talks about the importance of complementing the valuable improvement Sen. Holy introduced in his floor striker with a requirement for agencies to validate the settings of currently-installed systems.  (Rather embarrassingly, there was a typo in the header of this section in the original letter, so I'm attaching a cleaned-up version which has that and a couple of other typo fixes, but is otherwise the same as the February 18 version.)  

Here's the text:

Senator Holy’s floor striker added the new Section 5(8), which both prohibits vendors from making any changes to an ALPR system, including changing sharing permissions, without knowledge and explicit consent of the agency, and requires that ALPR vendors default any settings related to sharing to prevent any sharing of data with any nonauthorized agency, person, or entity. These are extremely valuable requirements, especially in the wake of recent revelations that Flock configured the Mountain View (CA) Police Department’s system to allow the data to be searched by agencies across the country. Who knows how many other systems have been misconfigured that way by Flock and other ALPR vendors?

While Section 5(8)’s requirements prevent future misconfigurations of this kind, the bill as written does not yet address the problem of already-installed, potentially misconfigured systems. The operations requirements in Section 3 should be extended with a requirement that agencies validate the configuration of existing systems within a short time after the bill’s passage, and the reporting requirements in Section 8 should require publishing this information.

At an event later on Saturday I had the chance to talk to a councilmember from one of the cities that has paused usage of their Flock cameras, and she mentioned that they had put a lot of work into their policies to ensure that sharing was minimized. That's great, and I'm sure many agencies have also done so. But other agencies may not have had the technical expertise to realize they needed to do this -- and since Mountain View is in the heart of Silicon Valley, apparently this is something that even agencies which do have a lot of technical expertise can easily get wrong!  Senator Holy's amendment was an important first step here, and CR&J has a great opportunity to build on it with a very targeted fix.

Of course this is only one small change, and as we discussed there are also plenty of other challenging issues.  Still, it's a good opportunity for incremental progress, and I hope that the committee will consider it.

Thank you once again for the discussion.  As the letter says, at this point we are reserving our position on the bill while waiting to see the final version. We look forward to working with you and your colleagues over the last few weeks of the session with a goal of producing legislation that keeps Washingtonians safe -- and ideally can be a good model for the rest of the country.

Jon Pincus, Bellevue

Thoughts on the striker (February 24)

Chair Taylor, Ranking Member Walsh, members of the committee,

Not sure if you've seen the news, but Lynnwood City Council voted unanimously to cancel their contract with Flock. You might recognize the t-shirt in the picture; Quinn van Order of Deflock Lynnwood wore as similar shirt to the hearing, although unfortunately he did not get the opportunity to testify. Neither did I, oh well. I did however submit written testimony, which I'm also attaching to the email, expanding on the topics I had touched on in my pre-hearing email (and also discussing the Chamber of Progress lobbyist's warning of "cybersecurity risks" at the earlier hearing on HB 2332).

In terms of the striker, it is what it is; in a quick discussion after his Town Hall, Rep. Goodman helpfully shared the reasoning for deferring major changes at this point.  Hopefully you all realize that the guardrails in the current bill are insufficient to protect Washingtonians' data from BATF, ICE, CBP, the FBI,  and other federal law enforcement.  

  • Any vendor access to ALPR data provides multiple paths for federal law enforcement to get access to it
  • Any retention of ALPR data by state agencies provides the ability federal law enforcement to get access to it by subpoena or court order
  • Inter-agency sharing of ALPR data magnifies both risks. 

Expanding authorized uses of ALPRs and and longer retention times also magnify both risks, and it's disappointing to see examples of both of those in the striker. The striker's expansions of ALPR usage for parking is a great example of my earlier point about how misleading it is to phrase SB 6002 as balancing privacy and safety. Using ALPRs for parking may well offer cost savings and revenue maximization; as the Mercer Island City Council member said during the hearing, “otherwise we’d have to go back to marking tires with chalk.”  Then again, marking tires with chalk is much better from both a privacy and public safety perspective – for one thing, there isn't any risk of the information going to BATF or ICE or CBP.  Fortunately, the fiscal hearing will provide an opportunity to explore this tradeoff in more detail.

And as we move on to the next stage of the legislative process,  I hope that you have at least started to explore the "hotlist-only" approach (3 minutes or less retention), which offers substantial fiscal savings as well as significantly decreasing the risks of data abuse.Thank you for your ongoing efforts on this bill, and I look forward to continuing to work with you and your colleagues with the goal of passing a bill with guardrails that are strong enough to protect Washingtonians. 

Jon Pincus, Bellevue

Thoughts on the exec session (February 25)

Chair Taylor, Ranking Member Walsh, members of the committee,

First of all, thank you for advancing the bill. I also appreciated the discussion. As Rep. Salahuddin said, this really is a complex issue, and there are a lot of different stakeholders here. It seems to me that there's general agreement on key overall goals like preventing out-of-state access to this data without a subpoenas and limiting the potential for abuse by bad actors in state agencies (speaking of which there was just another example in Wisconsin of a police officer using ALPRs to monitor his dating partner and the guy who used to date her).  Even on the thorny issue of retention time, there's broad agreement on "as short as possible" – although a wide range of opinions on how short that should be.  But, the devil is in the details, and that's just one of many details here that still need to be ironed out.

Many thanks to Rep. Jacobsen for the question about the definition of "immediate surroundings" – I've been wondering that too.  My Health My Data's definition of "precise location data" in RCW 19.373.010(19) could be a good standard to use here. 

Ranking Member Walsh mentioned ALPR usage for offstreet parking in his comments, and that's a good example of why this definition matters.  Consider the hypothetical situation where Gavin Newsom's consultants tell him he can get votes by using all the resources at his disposal to aggressively target gun owners, not just in California but across the nation.* 

It's not just people who park in the spaces right next to the gun shop whose ALPR data identifies them as potential targets for Newsom's minions.  The people who park on the other side of the lot are potential targets too, especially if ALPR data shows they've also parked in a lot near a shooting range that same day. It's the same for street parking, whether they park right in front of the door, across the street, or a few spaces down.  And if somebody gets a parking ticket, Section 4(2) allows the ALPR data to be retained until the exhaustion of the appeals process, which can be 30 days or longer.**  

That hypothetical scenario also relates to Rep. Walen's suggestion that traffic studies should be exempted.  ALPR data from traffic studies on streets with gun shops would be just as useful to Gavin Newsom's minions as any other ALPR data – and can be acquired via a court order or subpoena just as easily.  If the subpoenas go to the companies providing those ALPRs, or to service providers or third-parties they use, it's possible that Washington state agencies wouldn't even know about it. 

The problem is already bad enough with the existing bill's 30-day retention period for traffic studies. Do we even need ALPRs – with all the harms to privacy and public safety they bring – for traffic studies?  We did traffic studies before ALPRs!  If you decide we do need them, though, exempting them from the regulations takes away any guardrails the bill provides.

Jon Pincus, Bellevue

* As somebody who lived in California for years and has seen plenty of Newsom's opportunism, he would totally do this if his consultants told him it might work. And I'm not saying that just to establish common ground with the Republicans on the committee!

** Actually Section 4(2) is worded somewhat ambiguously, and it's not clear to me whether the current language authorizes the longer retention even if there wasn't an infraction, but hopefully this is just a drafting issue that will be cleaned up in the floor striker.