Learning about the dangers of surveillance technology can be empowering, the Santa Cruz County Civil Grand Jury writes in the introduction to the new report they published June 20.
Its latest 20-page look at spy tech and data collection at the Santa Cruz County Sheriff’s Office is chock-full of educational nuggets.
“In a world where people are subjected to ongoing and widespread use of surveillance by public and private actors, there is a need for increased transparency in law enforcement surveillance,” the Summary reads. “The Grand Jury recommends increasing the Sheriff’s Office public accountability for any acquisition and use of surveillance technologies.”
Investigators spoke with privacy officials and attended their meetings across California, interviewed Santa Cruz County staff and politicians, reviewed contracts, audits and surveillance tech plans, and combed through emerging local ordinances and State legislation.
They dug into the details about the Amazon Ring: Neighbors Public Safety Service, automated license plate readers (ALPR), body-worn cameras, mobile device forensic tools (MDFT), drones, robots and dash cam recorders, security alarm services and partnerships with neighborhoods, and tablets and phones used by inmates.
Last July, Amazon Ring responded to a request for information from Democratic Senator Edward J. Markey, who represents Massachusetts. They said their Neighbors App doesn’t share the address where the device is based unless a subscriber posts it or shares a video in response to a Sheriff’s Office request. However, they failed to clarify the distance from which Ring products can capture audio, refused to commit to turning off the automatic recording of sound by default, and provided videos to law enforcement during emergencies without requiring the consent of the device owner.
Santa Cruz County Sheriff’s Office signed up with Amazon Ring in 2020.
The Ring Neighbors Portal has been used “less than 10 times since 2020” to help solve “significant crimes,” the Sheriff’s Office told the Civil Grand Jury in January 2023.
“The Sheriff’s Office indicates evidentiary videos recovered through the Neighbors Ring Portal are booked to the Digital Evidence server and retained pursuant to Digital Evidence Policy 801,” the Civil Grand Jury reported. “No information was provided on the disposal of non-evidentiary recordings.”
From the Sheriff’s Office’s standpoint, the Neighbors Portal is a social platform, and so it relies on its “Policy 343 Department Use of Social Media,” to guide its embrace of the audio/visual spy network.
The Sheriff’s Office says it hasn’t been using automated tech to scan people’s license plates.
In January 2017, the Sheriff’s Office completed a roll-out of body cams.
Now, the Civil Grand Jury speaks highly of this tool. However, they point out a serious contradiction in how the local law enforcement agency says it handles data.
“Within the Body Worn Camera policy, two different dates are listed for minimum retention of non-evidentiary data,” the report reads, noting in one place it says 90 days, and another says 180 days, adding, “Neither policy 422 nor 423 offers a definitive date for the disposal of non-evidentiary data.”
Just a few months back, on Dec. 13, the Board of Supervisors approved the purchase of a Universal Forensics Extraction Device (UFED) made by Cellebrite (CLBT), an Israeli digital intelligence company owned by Japanese video game developer Sun Corporation; the CLBT share price rose from $4.36 on Jan. 9 to $6.22 on June 20.
The Sheriff’s Office got the money for the product from Homeland Security’s Urban Area Security Initiative to purchase this smartphone data extractor.
A Supreme Court decision called Riley v. California ruled that warrantless search and seizure of digital files during an arrest is unconstitutional, although there are exceptions, such as in exceptional circumstances or when the owner gives consent.
“According to the Cellebrite website, the tools can access locked devices bypassing pattern, password, or PIN locks,” the Civil Grand Jury noted. “They can overcome encryption, as well as retrieve cloud tokens and select app data. In other words, there are few limitations to access.”
Unfortunately, the Sheriff’s Office wasn’t exactly responsive to the Civil Grand Jury’s queries about Mobile Device Forensic Tools.
“The Sheriff’s Office provided no MDFT specific documentation or equipment delivery date in response to the Jury’s request,” the report states. It simply forwarded over its Property and Evidence and Computers and Digital Evidence policies.
In Sept. 15, 2021, the Board of Supervisors approved a contract with Florida-based company CentralSquare’s CryWolf Services, a software company which can assist with false-alarm situations.
“The Grand Jury examined the CryWolf Santa Cruz County portal and noticed a video surveillance registry,” the report reads. “While the Video Surveillance category is available to those who wish to register on the CryWolf False Alarm and Administration online registration, the Santa Cruz County Sheriff’s Office reports no use of this video registry for surveillance.”
The Sheriff’s Office has partnered with Smart Communications, another Florida-based company, since 2021 to provide tablets to inmates.
All physical mail addressed to the jail, except documents from lawyers, gets sent to Florida for digitization and inmates can read this on their device (the hard copies are destroyed).
A lawsuit filed in San Mateo County, in March, raises questions about the tablet dragnet, pointing out this results in surveillance not just of offenders, but of “those presumed innocent, and of the many individuals who send mail to those incarcerated people,” noting data is stored in Florida for seven years.
The Grand Jury said it asked for more information about Inmate Tablet Monitoring, including how data is disposed of.
Instead of responding, the Sheriff’s Office just provided its Inmate Telephone Access policy.
The Civil Grand Jury recommends the Sheriff’s Office put out more information about how it uses the Amazon Ring Neighbors Portal, fix confusing body-worn camera policies, clarify what the false alarm system is for, provide details about when data not useful as evidence will be destroyed and consider a documented process of handling inmate data, such as their tablet use, by the end of September.
