2021-Surveillance Technology amendments — File 211312

1 CITY OF SOMERVILLE ORDINANCE NO. 2021-_____ In City Council: - AN ORDINANCE AMENDING SECTIONS OF CHAPTER 10, ARTICLE III – PUBLIC OVERSIGHT OF SURVEILLANCE TECHNOLOGY OF THE CODE OF ORDINANCES OF THE CITY OF SOMERVILLE Be it ordained by the City Council, in session assembled, that Chapter 10, Article III, Public Oversight of Surveillance Technology is hereby amended to read as follows: ARTICLE III. - PUBLIC OVERSIGHT OF SURVEILLANCE TECHNOLOGY Sec. 10-61. - Purpose. The purpose of this article is to provide for the regulation of surveillance technology acquisition or use by the City of Somerville or the use of the surveillance data it provides; to safeguard the right of individuals to privacy; to balance the public's right to privacy with the need to promote and ensure safety and security; to provide protocols for use of surveillance technology or surveillance data that include specific steps to mitigate potential impacts on the civil rights and liberties of any individuals, communities or groups including communities of color or other marginalized communities in the city; to balance any decision to use surveillance technology with an assessment of the costs and protection of privacy, civil liberties and civil rights; to allow for informed public discussion before deploying surveillance technology; to provide for transparency, oversight, and accountability; and to minimize the risks posed by use of surveillance technology in the city. Once in effect, this article shall override Somerville's Executive Order of October 4, 2017 entitled "Executive Policy on Surveillance Technology." Sec. 10-62. - Definitions. The following definitions apply to this article: Annual surveillance report means a written report submitted by the mayor's office on an annual basis concerning specific surveillance technology used by any city department during the previous year and containing the information set forth in 10-66(b) of this article. Exigent circumstances means the fire chief’s or fire chief’s designee, or police chief's or the police chief's designee's good faith and reasonable belief that an emergency involving danger of death, physical injury, or significant property damage or loss, similar to those that would render impracticable to obtain a warrant, requires use of the surveillance technology or the surveillance data it provides. The use of surveillance technology in exigent circumstances shall not infringe upon an individual's right to peacefully protest and exercise other lawful and protected constitutional rights. Identifiable individuals means an individual whose identity can be revealed by data, including surveillance data, or revealed by data when it is analyzed and/or combined with any other type of record.

2 Surveillance means the act of observing or analyzing the movements, behavior, or actions of identifiable individuals. Surveillance data means any electronic data collected, captured, recorded, retained, processed, intercepted, or analyzed by surveillance technology acquired by the city or operated at the direction of the city. Surveillance technology means any device, hardware, or software that is capable of collecting, capturing, recording, retaining, processing, intercepting, analyzing, monitoring, or sharing audio, visual, digital, location, thermal, biometric, or similar information specifically associated with, or capable of being associated with, any identifiable individual or group; or any system, device, or vehicle that is equipped with an electronic surveillance device, hardware, or software. Examples of surveillance technology include, but are not limited to: (a) International mobile subscriber identity (IMSI) catchers and other cell site simulators; (b) Automatic license plate readers; (c) Electronic toll readers; (d) Closed-circuit television cameras except as otherwise provided herein; (e) Biometric surveillance technology, including facial, voice, iris, and gait-recognition software and databases; (f) Mobile DNA capture technology; (g) Gunshot detection and location hardware and services; (h) X-ray vans; (i) Video and audio monitoring and/or recording technology, such as surveillance cameras; (j) Surveillance enabled or capable lightbulbs or light fixtures; (k) Tools, including software and hardware, used to gain unauthorized access to a computer, computer service, or computer network; (l) Social media monitoring software; (m) Through-the-wall radar or similar imaging technology; (n) Passive scanners of radio networks; (o) Long-range Bluetooth and other wireless-scanning devices; (p) Thermal imaging or "forward looking infrared" devices or cameras; (q) Radio-frequency identification (RFID) scanners; and (r) Software designed to integrate or analyze data from surveillance technology, including surveillance target tracking and predictive policing software. Surveillance technology impact report means a written report submitted by the mayor's office with a request for approval of acquisition or use of surveillance technology, and which includes, at a minimum, the requirements set forth in subsection 10-65(b). Surveillance use policy means a policy for the city's use of surveillance technology, approved by the city solicitor and the mayor's office, and submitted by the mayor's office to and

3 approved by the city council. The surveillance use policy shall at a minimum satisfy the requirements set forth in section 10-64. Technology-specific surveillance use policy means a policy governing the city's use of a specific surveillance technology not already covered under the city's surveillance use policy, approved by the city solicitor and the mayor, and submitted by the mayor to the city council with a surveillance technology impact report under section 10-65 of this article. Sec. 10-63. - Exceptions and exemptions. (a) For the purposes of this article, the following do not constitute surveillance data or surveillance technology, and the requirements of this article do not apply to them: (1) Surveillance data acquired where the individual knowingly and voluntarily consented to provide the information, such as submitting personal information for the receipt of city services; and (2) Surveillance data acquired where the individual was presented with a clear and conspicuous opportunity to opt out of providing the information. (b) For the purposes of this article, surveillance technology and surveillance data do not include the following devices, software, or hardware and are exempt from the requirements of this article, unless the devices, hardware, or software are modified to include additional surveillance capabilities as defined in section 10-62: (1) Routine office hardware, such as televisions, computers, and printers, that are in widespread public use and will not be used for any surveillance or surveillance-related functions; (2) Parking ticket devices (PTDs) and related databases. (3) Manually-operated, non-wearable, handheld digital cameras, audio recorders, and video recorders that are not designed to be used surreptitiously and whose functionality is used for manually capturing and manually downloading video and/or audio recordings; (4) Body-worn cameras; (5) Cameras installed in or on a police vehicle; (6) Cameras installed pursuant to state law authorization in or on any vehicle or along a public right-of-way solely to record traffic violations or traffic patterns, provided that the surveillance data gathered is used only for that purpose; (7) Surveillance devices that cannot record or transmit audio or video or be remotely accessed, such as image stabilizing binoculars or night vision goggles; (8) City databases that do not and will not contain any surveillance data or other information collected, captured, recorded, retained, processed, intercepted, or analyzed by surveillance technology; (9) Manually-operated technological devices that are used primarily for internal city communications and are not designed to surreptitiously collect surveillance data, such as radios and email systems;

4 (10) Parking access and revenue control systems, including proximity card readers and transponder readers at city-owned or controlled parking garages; (11) Card readers and key fobs used by city employees and other authorized persons for access to city-owned or controlled buildings and property; (12) Cameras installed on city property solely for security purposes, including closed circuit television cameras installed by the city to monitor entryways and outdoor areas of city- owned or controlled buildings and property for the purpose of controlling access, maintaining the safety of city employees and visitors to city buildings, and protecting city property; (13) Security cameras including closed circuit television cameras installed by the city to monitor cashiers' windows and other cash-handling operations and to maintain the safety of city employees and visitors to such areas; (14) Cameras installed solely to protect the physical integrity of city infrastructure; or (15) Technology that monitors only city employees in response to complaints of wrongdoing or in order to prevent waste, fraud, or abuse of city resources. (c) The following situations are exceptions to the requirements of this article: (1) Notwithstanding the provisions of this article, the police department or fire department, to the extent applicable, may temporarily acquire or temporarily use surveillance technology in exigent circumstances for a period not to exceed 90 days without following the provisions of this chapter before that acquisition or use. However, if the police department or fire department, to the extent applicable, acquires or uses surveillance technology in exigent circumstances under this section, the chief of police or fire chief, to the extent applicable, must: i. Report that acquisition or use to the city council in writing within 90 days following the end of those exigent circumstances; ii. Submit a surveillance technology impact report, and, if necessary, a technology- specific surveillance use policy to the city council regarding that surveillance technology within 90 days following the end of those exigent circumstances; and iii. Include that surveillance technology in the police department's or fire department’s, to the extent applicable, next annual surveillance report to the city council following the end of those exigent circumstances. If the chief of police or fire chief, to the extent applicable is unable to meet the 90- day timeline to submit a surveillance technology impact report and, if necessary, a technology-specific surveillance use policy to the city council, the chief of police or fire chief, to the extent applicable, may notify the city council in writing requesting to extend this period. The city council may grant extensions beyond the original 90- day timeline to submit a surveillance technology impact report, and, if necessary, a technology-specific surveillance use policy. (2) Any surveillance technology impact report, and, if necessary, technology-specific surveillance use policy submitted to the city council under this section shall be made publicly available upon submission to the city council.

5 (3) Any surveillance technology impact report and, if necessary, technology-specific surveillance use policy submitted to the city council under this section may be redacted to the extent required to comply with an order by a court of competent jurisdiction, or to exclude information that, in the reasonable discretion of the chief of police, if disclosed, would materially jeopardize an ongoing investigation or otherwise represent a significant risk to public safety and security provided, however, that any information redacted pursuant to this paragraph will be released in the next annual surveillance report following the point at which the reason for such redaction no longer exists. (4) A city department head may apply a technical patch or upgrade that is necessary to mitigate threats to the city's environment. The department shall not use the new surveillance capabilities of the technology until the requirements of section 10-65 are met, unless the mayor, or his/her designee, determines that the use is unavoidable; in that case, the mayor shall request city council approval as soon as possible. The request shall include a report to the city council of how the altered surveillance capabilities were used since the time of the upgrade. Sec. 10-64. - Surveillance use policy. (a) The mayor shall submit to the city council for its review and approval a proposed surveillance use policy applicable to each city department that possesses or uses surveillance technology before the effective date of this article. Any surveillance use policy submitted under this section shall be made publicly available upon submission to the city council. (b) A surveillance use policy shall at a minimum specify the following: (1) Purpose. the specific purpose(s) for the surveillance technology; (2) Authorized use. the uses that are authorized, the rules and processes required before that use, and the uses that are prohibited; (3) Data collection. the surveillance data that can be collected by the surveillance technology; (4) Data access. the individuals who can access or use the collected surveillance data, and the rules and processes required before access or use of the information; (5) Data protection. the safeguards that protect information from unauthorized access, including, but not limited to, encryption, access-control, and access-oversight mechanisms; (6) Data retention. the time period, if any, for which information collected by the surveillance technology will be routinely retained, the reason that retention period is appropriate to further the purpose(s), the process by which the information is regularly deleted after that period has elapsed, and the conditions that must be met to retain information beyond that period; (7) Public access: if and how collected surveillance data can be accessed by members of the public, including criminal defendants; (8) Third-party data-sharing: if and how other city or non-city entities can access or use the surveillance data, including any required justification and legal standard necessary to do so, and any obligation(s) imposed on the recipient of the surveillance data;

6 (9) Training: the training, if any, required for any individual authorized to use the surveillance technology or to access information collected by the surveillance technology, including whether there are training materials; and (10) Oversight: the mechanisms to ensure that the surveillance use policy is followed, including, but not limited to, identifying personnel assigned to ensure compliance with the policy, internal record keeping of the use of the technology or access to information collected by the surveillance technology, technical measures to monitor for misuse, any independent person or entity with oversight authority, and the sanctions for violations of the policy. (c) In considering the surveillance use policy, the city council shall balance the safeguarding of individuals' right to privacy as well as the investigative and prosecutorial function of the police department and promoting and ensuring the safety and security of the general public. Sec. 10-65. - Surveillance technology impact report and technology-specific surveillance use policy. The mayor's office must seek and obtain approval from the city council as set forth in this section prior to the city acquiring, using, or entering into an agreement to acquire, share or otherwise use, unapproved surveillance technology or surveillance data as defined in this article. The city may seek, but not accept, funds for surveillance technology without approval from the city council, provided that the city shall notify the city council of the funding application at the time it is submitted, and include in this notification the deadline of the funding opportunity and details regarding the nature of the surveillance technology for which funding is sought. (a) Acquisition of surveillance technology by city departments. Unless exempted or excepted from the requirements of this article pursuant to section 10-63, any city department intending to acquire new surveillance technology or surveillance data, including but not limited to procuring that surveillance technology without the exchange of monies or other consideration, or use approved surveillance technology or surveillance data for a purpose, in a manner not previously approved, shall, prior to acquisition or use, obtain council approval of the acquisition or use. The process for obtaining approval shall be as follows: (1) The city department shall submit a surveillance technology impact report, and, if necessary, a technology-specific surveillance use policy, as described in subsections 10-65(b) and 10-65(c) below, to the mayor's office for review and approval. (2) If the request is approved by the mayor's office, the mayor's office shall submit the request, including copies of the city department's surveillance technology impact report and, if applicable, technology-specific surveillance use policy, to the city council for review. (3) The city council shall have 60 days, which shall not include June, July, nor August, from the date of submission to approve or deny a request for the acquisition of surveillance technology. If the city council fails to approve or deny the request within that time frame, the request shall be approved by default.

7 (4) Any surveillance technology approved by default under the provisions in 10-65(a)(3) must be subsequently approved or rejected by the city council during the following annual report. (b) Contents of surveillance technology impact report. A surveillance technology impact report submitted pursuant to subsection (a) above shall include all of the following: (1) Information describing the surveillance technology and how it works; (2) Information on the proposed purpose(s) for the surveillance technology; (3) Information describing the kind of surveillance the surveillance technology is going to conduct and what surveillance data is going to be gathered; (4) The location(s) it may be deployed and when; (5) A description of the privacy and anonymity rights affected and a mitigation plan describing how the department's use of the equipment will be regulated to protect privacy, anonymity, and limit the risk of potential abuse; (6) The potential impact(s) on privacy in the city; the potential impact on the civil rights and liberties of any individuals, communities or groups, including, but not limited to, communities of color or other marginalized communities in the city, and a description of whether there is a plan to address the impact(s); (7) An estimate of the fiscal costs for the surveillance technology, including initial purchase, personnel and other ongoing costs, and any current or potential sources of funding; and (8) An explanation of how the surveillance use policy will apply to this surveillance technology and, if it is not applicable, a technology-specific surveillance use policy. (c) A technology specific surveillance use policy shall be required if the purpose, authorized use, data collection, data access, data protection, data retention, public access, third party data sharing, training, or oversight of the requested surveillance technology submitted under subsection (a) above differ from the standards in the surveillance use policy submitted under section 10-64. A technology specific surveillance use policy shall not conflict with any provision of the city's surveillance use policy. To the extent a conflict arises between the provisions of the city's surveillance use policy and a technology- specific surveillance use policy, the city's surveillance use policy shall govern. A technology-specific surveillance use policy shall include all of the elements of the surveillance use policy as outlined in section 10-64(b)(1)—(10). (d) `In approving or disapproving any acquisition or use of surveillance technology, the city council shall consider the safeguarding of individuals' right to privacy as well as the investigative and prosecutorial functions of the police department and promoting and ensuring the safety and security of the general public. (e) Any surveillance technology impact report, and, if necessary, technology-specific surveillance use policy submitted to the city council under section 10-65(b) or 10-65(c) shall be made publicly available upon submission to the council.

8 Sec. 10-66. - Annual surveillance report. (a) Within 12 months of the effective date, and annually thereafter, all city departments shall submit to the mayor an annual surveillance report pertaining to each city department for which approval for the use of surveillance technology or surveillance data has been obtained under section 10-65 of this article. Upon receipt of such reports, the mayor shall promptly submit them to the city council. Any annual surveillance report submitted under this section shall be made publicly available upon submission to the council. (b) The annual surveillance report submitted pursuant to this section shall include all of the following: (1) A description of how surveillance technology has been used, including whether it captured images, sound, or information regarding members of the public who are not suspected of engaging in unlawful conduct; (2) Whether and how often data acquired through the use of the surveillance technology was shared with local, state, and federal, the name of any recipient entity, the type(s) of data disclosed, any legal standard(s) under which the information was disclosed, and the justification for the disclosure; (3) A summary of community complaints or concerns about the surveillance technology, if any; (4) The results of any internal audits, any information about violations of the surveillance use policy, and any actions taken in response other than to the extent that such inclusion would violate the privacy rights of an employee of the city; (5) Whether the surveillance technology has been effective at achieving its identified purpose; (6) The number of public records requests received by the city seeking documents concerning surveillance technology approved during the previous year; (7) An estimate of the total annual costs for the surveillance technology, including personnel and other ongoing costs, and what source(s) of funding will fund the technology in the coming year, if known; (8) Whether the civil rights and liberties of any communities or groups, including communities of color or other marginalized communities in the city are disproportionately impacted by the deployment of the surveillance technology; and (9) A disclosure of any new agreements made in the past 12 months with non-city entities that may include acquiring, sharing, or otherwise using surveillance technology or the surveillance data it provides. (c) Based upon information provided in the annual surveillance report, the city council shall determine whether the benefits to the impacted city department(s) and the community of the surveillance technology outweigh the financial and operational costs and whether reasonable safeguards exist to address reasonable concerns regarding privacy, civil liberties, and civil rights impacted by deployment of the surveillance technology. If the benefits or reasonably anticipated benefits do not outweigh the financial and/or operational costs or civil liberties or civil rights are not reasonably safeguarded, the city council may recommend modifications to

9 the surveillance use policy that are designed to address the city council's concerns to the mayor for his consideration; and/or request a report back from the mayor regarding steps taken to address the city council's concerns. (d) Nothing in this article shall prohibit the city council from enacting a separate ordinance to ban or otherwise regulate any surveillance technology, whether previously approved or not. (e) No later than May 31 of each year, the city council shall hold a meeting to discuss the city departments' annual surveillance reports, and shall publicly release a report that includes a summary of all requests for approval of surveillance technology received by the city council during the prior year, including whether the city council approved or disapproved of the surveillance technology. Sec. 10-67. - Enforcement. (a) Enforcement officials. This article shall be enforced by the mayor's office or the mayor's designee. (b) Suppression. No data collected or derived from any use of surveillance technology in violation of this article and no evidence derived therefrom may be received in evidence in any proceeding in or before any department, officer, agency, regulatory body, legislative committee, or other authority subject to the jurisdiction of the City of Somerville. (c) Cause of action. Any violation of this article constitutes an injury and any person may institute proceedings for injunctive relief, declaratory relief, or writ of mandate in any court of competent jurisdiction to enforce this article. An action instituted under this paragraph shall be brought against the city and, if necessary to effectuate compliance with this article, any other governmental agency with possession, custody, or control of data subject to this article. (d) The city will address alleged violations of this article in accordance with its usual practices, applicable law and contractual obligations. (e) Whistleblower protections. Subject to the limitations and requirements set forth in G. L. c. 149, § 185 (the "Massachusetts whistleblower statute" or "Section 185") as it may be amended from time to time, any city employee as defined in Section 185 who reports an alleged violation of this article, shall be afforded protections against retaliation if applicable pursuant to Section 185, as set forth in and subject to the limitations and requirements of Section 185. (f) Nothing in this article shall be construed to limit or affect any individual's rights under state or federal laws. Sec. 10-68. - Severability. The provisions in this article are severable. If any part or provision of this article, or the application of this article to any person or circumstance, is held invalid by a court of competent jurisdiction, the remainder of this article shall not be affected by such holding and shall continue to have full force and effect.

10 Sec. 10-69. - Effective date. This article shall become effective on October 15, 2020. APPROVED: President City Council