Statement of Indivisible Albany Concerning the City of Troy’s Proposed Local Law #3 on ALPRs

News came late last week that the Troy City Council is proposing a new Local Law #3 “Establishing Standards Governing the City’s Use of Automatic License Plate Reader (ALPR) Systems.” As the name of the proposed legislation suggests, it does not impose an outright ban on Flock cameras or other ALPRs within the Collar City’s limits. Instead, the proposal – which appears to be modeled, almost verbatim, on proposed state consumer protection legislation sponsored by Hudson Valley Sen. Michelle Hinchey (D-41SD) and Syracuse Assembly Member Pamela Hunter (D-128AD) – would permit the use of ALPRs and the data the surveillance machines generate, but only for certain specified purposes by the City and its officials. The Local Law purports to limit the sharing of ALPR data with entities outside the City, would impose 48-hour time limits – with exceptions – on how long ALPR data could be retained, and would require annual reporting requirements aimed at increased transparency over who uses Troy’s ALPR data and for what purpose. To be sure, this legislation is superficially an improvement over what Troy – and pretty much every other local municipality – currently has in place, which is absolutely nothing. But better than nothing is probably not going to cut it when our basic civil liberties are at stake, and this legislation does raise enough questions to make one wonder whether Local Law No. 3 is worth the political capital it will take for the Troy City Council to formally enact it.

First and foremost, whither Flock? Last time we checked, the City had at least 26 Flock cameras watching Trojans’ every move, and Troy Mayor Carmella Mantello has declared an absurd “state of emergency” for the past 4+ weeks in order to make sure that the cameras kept clicking away and that Flock keeps getting taxpayer funding in order to upload and hoard all our data. This proposed Local Law does nothing to undo Mantello’s unlawful and unbridled use of her executive power, it does nothing to restore the City Council’s authority to decide who gets Troy’s tax money and for what purpose and, most importantly, it leaves unanswered the question of whether Troy and Flock are currently subject to a valid and binding existing contractual agreement that may leave the Flock surveillance cameras in place all throughout the City, regardless of what this Local Law has to say on the matter.

In fact, it's not altogether clear that this proposed Local Law would diminish the existence of Flock in Troy even under the best of circumstances. On its face, the proposal declares that the City and its police “shall not sell, share, lease, provide access to, or otherwise transfer captured plate data to any person or entity outside the City,” and “captured plate data” is broadly defined elsewhere in the legislation as “the location (including GPS coordinates), date and time, photograph, license plate number, and any other data captured by, derived from, or inferred from an ALPR system, including a vehicle's make, model, color, and other identifying characteristics or features.” That sounds good, right? It seems to envision a scenario where Troy has a self-contained ALPR system, for Trojans and by Trojans, and that absolutely NOBODY ELSE is getting Troy’s data without a “judicial probable cause warrant” or similarly compelling reason. 

But what if Flock and the City of Troy are one and the same? ALPR networks are costly and difficult to maintain; you’ve got the start-up costs of purchasing the cameras and installing them, and then, once the data starts flowing, where does it go? To some server in the basement of Proctor’s Theatre/City Hall? Also, any ALPR network worth its salt is going to need a robust AI-powered Skynet brain to sort through and organize all that data; where is that software coming from? And what if some civil libertarian takes a ball-peen hammer to one of the cameras? Does Troy have the technician on staff to get that camera running again? Remember, this is the genius of Flock’s turn-key business model; it is nice and easy. Just sign on the dotted line, and Flock takes care of the rest. You don’t need to buy the cameras, Flock will lease them to you, and then choose their optimal locations and install and maintain them for you. Updates and tech support? Flock’s got your back. And don’t worry about all that data frying your antiquated municipal servers, Flock will automatically upload all that stuff to its massive cloud in Georgia where they can sort through it with their Palantir-esque software and give you back whatever you need whenever you need it. You know, because the City “owns” the data.

Lo and behold, the proposed Local Law in Troy acknowledges these functional and technological realities. In section 2 (c) of the proposal, the City of Troy is defined as not just the agencies, departments and people that do the City’s day-to-day work, but also any “person, agent, or contractor acting for, on behalf of, or pursuant to a contract with the City.” So, when the proposed legislation says that “the City may operate an ALPR system and use captured plate data only for” certain purposes, what it means is that the City of Troy and its ALPR vendor/contractor of choice – whether that be Flock, Genetec, Axon, Motorola, or whoever – can together operate an ALPR system and use captured plate data. And it’s not just the way that “City” is defined in this proposed Local Law that opens the door to participation by a vendor like Flock, by the way. As one of the “permitted uses” of Troy’s captured plate data, the proposal permits City officials to compare that data against an existing “hot list,” which is defined as a database “maintained by a federal, New York State, or local law enforcement agency, concerning vehicles that law enforcement reasonably believes are related to an ongoing criminal or missing persons investigation.” As written, this provision suggests an interagency law enforcement dialogue, a one-on-one, show-me-yours-and-I’ll-show-you-mine exchange of information between neighborly officers acting in good-faith. Trouble is, it doesn’t really work like that. Even 15 years ago, the State Division of Criminal Justice Services was acknowledging that the sheer volume of data being gathered by ALPRs necessitated the computerized storage of “hot lists” and, wouldn’t you know it, Flock has since coopted the concept for its own use, trumpeting the fact that its cameras and software come “integrated” with hot list data from the FBI’s National Crime Information Center and the National Center for Missing and Exploited Children. That all comes with the caveat, of course, that such hot list data is only available to paying customers. Flock also offers its customers the opportunity to create their own hot lists which Flock will then kindly maintain. Flock makes it easy at every single turn.

But, the issue of hot lists and permitted uses aside, there are still rules in this proposal on how the City of Troy and its vendors could share, retain and be transparent about captured plate data, right? Yes, there are, but, once you accept the premise that the City of Troy is going to need private contractors to install and maintain any ALPR system on its streets, those rigorous restrictions start to look pretty flimsy. Take the “transfer” restrictions of section 4, which, as noted above, prohibit the City (and, by definition, its contractors) from sharing data with “any person or entity” in the absence of a judicial warrant. If the City keeps working with a vendor like Flock, who possesses an “irrevocable, perpetual, worldwide license to use and disclose” all its customer data in order to provide its services to other customers, do we really think that a multibillion-dollar corporation is going to abide by that transfer restriction in Troy’s little ole’ Local Law and deprive its other customers of all the data they have bargained for? And, lest you think that Local Law has some serious enforcement teeth, section 7 purports to give anyone who is “injured” by a violation of Troy’s proposed Local Law a private right of action (we’re not sure a City like Troy has the authority to do that, but whatever). So, if a contractor like Flock discloses your data in violation of the Local Law, you can sue them and, assuming you can prove you are “injured” despite Flock’s inevitable team of high-priced lawyers, you can be compensated for your damages, including pain and suffering, or get liquidated damages in the amount of $1,000. That’ll show ‘em.

Ok, well at least the Local Law has transparency, right? With a whole list of reporting requirements imposed by section 6 of the proposed Local Law? Yes, that’s true, and, truth be told, those reporting requirements are quite comprehensive and would require the Troy PD to do all sorts of unprecedented disclosure about their use of ALPR technology. It’s a worthy endeavor that we would encourage the City Council to pursue even if they were to abandon the rest of the proposal. But, be forewarned, because section 6 applies to “Any City department or agency that operates or uses an ALPR system,” instead of “the City” itself as defined in section 2 (c), the transparency and reporting requirements would not apply to contractors like Flock.

Lastly, a final few words about what proposed Local Law #3 would not do. ALPR vendors like Flock are increasingly pitching their surveillance technology to private entities like homeowners’ associations, hospitality businesses and property management companies. Local Law #3 says nothing about what these entities can or cannot do in terms of installing surveillance cameras on their properties, although the Local Law would, admittedly, require a judicial warrant for Troy PD to access those entities’ “privately captured plate data.” But, the Local Law says nothing about Dinosaur Bar-B-Que – for example – setting up a bunch of Flocks in their parking lot to watch the cars go back and forth over the Troy-Green Island Bridge and then turn that data to whatever entities outside of Troy that they so choose. It’s a Fourth Amendment nightmare.

The Troy City Council will be debating a Resolution on Thursday, May 7 which would authorize a public hearing in another two weeks concerning proposed Local Law #3. While we’re sure such a hearing involving Mayor Mantello might make good TV, we’re not convinced that it’s worth it. Read in a vacuum, the most optimistic reading of Local Law #3 is that its onerous data sharing and data retention obligations might limit which ALPR contractors are willing to do business with the City. Maybe the Local Law scares off so many ALPR vendors that the City never gets an ALPR network off the ground. We suppose that would be a good result, if only the City of Troy were operating from square one. But Troy isn’t at square one; it already has an ALPR network in place and (apparently) has contractual obligations with Flock surveillance that go well beyond what Local Law #3 purports to impose. In our view, the vast amount of political capital that would be expended in trying to pass this Local Law would be better used in fighting back against Mayor Mantello’s illegal exercise of her “emergency” powers and pushing out Flock altogether. And, if the City Council wants to legislate in the meantime, we suggest they focus on the transparency and reporting requirements in section 6 of their proposed Local Law.