A Flock Safety license plate reader. Credit: David Goldman/AP Photo
A confidential memo, laying bare city lawyers’ reservations about a proposed $2 million expansion of Berkeley’s police surveillance network, has leaked on the eve of what was supposed to be the City Council’s final vote on the matter.
The Berkeley Police Department has asked to renew its contract with Georgia-based Flock Safety for automated license plate readers, and to procure new video cameras, drones and software from the company. The department also wants permission from the City Council to plug into private cameras around the city, which could involve Flock as well. At the same time, the city’s civilian police oversight board has warned that the proposed expansion runs afoul of Berkeley’s own competitive contracting rules.
The April 24 memo, which was first obtained by The Daily Californian and verified by Berkeleyside, lays out a litany of concerns about moving ahead with the $2 million expansion. Attorneys for the city warned about threats of lawsuits against Berkeley, unreliable data protections and what could have been either simple negligence or shady maneuvering by Flock while negotiating with Berkeley, to name a few. The document was sent to members of the City Council and Police Accountability Board, as well as City Manager Paul Buddenhagen, Police Chief Jen Louis and Interim Director of Police Accountability Kathy Lee.
“Contracting with Flock and purchasing all the products [the police department] is requesting carries some legal risks,” the memo concludes. “Although the city can mitigate some of those risks through contractual protections and improving use policies and acquisition reports, this technology carries inherent legal risks that cannot be entirely mitigated.”
The attorneys suggested that Flock is likely going to agree to any safety measures the city demands, but added, “we cannot ensure Flock will abide by its contractual obligations,” and the company may not even have the technical ability to implement some of the safeguards to which it might agree.
A coalition of two council members and Mayor Adena Ishii have already proposed dropping contracts with Flock altogether while nevertheless pursuing some sort of surveillance network. Ishii declined to comment on the memo Wednesday.
A majority of the council, however, has remained bullish on Flock, writing in statements published since they received the memo that the technology is an essential force multiplier for BPD, now in a years-long staffing crisis, even though other members have proposed additional safeguards of their own.
A coalition of community organizations has planned a rally for Thursday at 4 p.m. outside where the council will meet an hour later, at the Berkeley Unified School District boardroom at 1231 Addison St.
The memo was written by City Attorney Farimah Brown, Interim Assistant City Attorney Katrina Eiland and Deputy City Attorney Stephen Hylas. Attorneys for the city have not responded to inquiries from Berkeleyside about the content of memo, or whether its admonitions are relatively egregious or commonplace when the council contemplates new contracts.
Berkeley lawyers warn of improper data sharing, hackers
Part of what makes Flock’s hardware so attractive to law enforcement agencies is the ease with which different networks of equipment — such as plate readers, video cameras and drones — can talk to each other, whether it’s different networks under one agency or different agencies accessing one other’s networks. But the city’s lawyers said that one-stop-shopping aspect is equally attractive to hackers.
“If an unauthorized user were to gain access to Berkeley’s Flock OS login, they could view not only the footage from one camera but the footage from all the city’s devices and all those cameras shared with the city,” according to the memo.
Flock has faced scrutiny nationwide because law enforcement officers have used data from its networks to investigate people who have had abortions, monitor protesters and locate undocumented people for deportation.
Of particular concern to Berkeleyans, federal immigration officials have accessed data from Flock networks elsewhere in the country even after police agencies said that would not happen, Berkeley’s lawyers wrote. They were hesitant to say whether the fault lay with Flock or with the agencies using its hardware, and even if it did lay with Flock, whether the corporation had been “intentional or merely negligent.” That said, the attorneys wrote, it did appear that Flock had unilaterally reactivated a “national lookup” feature in several West Coast jurisdictions after those jurisdictions had shut the feature off, opening up those networks to other agencies.
Although Berkeley has proposed a $150,000 penalty for each incident of unauthorized data sharing, the attorneys warned that if Flock challenges a claim from Berkeley, the cost of that potential court battle could be prohibitive given that Flock is a multi-billion-dollar corporation and can drag legal cases on far longer than a city the size of Berkeley.
The attorneys also flagged strange draft language Flock had proposed for its contract with Berkeley, which Flock described as “boilerplate” but nevertheless reversed tweaks Berkeley had made to tighten restrictions on sharing data with third parties.
“We cannot be sure if Flock’s amendments reflect an intentional attempt to discreetly revise the city’s previous edits without notifying us, or rather just involve a failure to recognize inconsistencies between its standard boilerplate and the city’s requests. But either possibility is troubling,” the attorneys wrote.
Berkeley could make itself a target for litigation
Beyond the daunting prospect of taking Flock to court, Berkeley could become the target of litigation itself.
Secure Justice, a nonprofit that has already sued Oakland over allegations of improperly sharing data from Flock hardware, wrote to Berkeley in November demanding the city abandon all contracts with Flock, threatening that Berkeley could risk facing multi-million dollar lawsuits like other California cities have. Berkeley, the nonprofit warned, would be running afoul of a state law that bars local police agencies from sharing plate reader data with federal or out-of-state agencies, as well as several of Berkeley’s own city ordinances, if it didn’t bail on Flock. (In February, an Oakland law firm filed a class action suit against Flock based on similar allegations, which Flock has denied.)
Brian Hofer’s nonprofit Secure Justice has asked Berkeley to cut off its relationship with Flock Safety. Credit: Estefany Gonzalez for The Oaklandside
Berkeley denied Secure Justice’s allegations at the time. The city’s attorneys wrote in the confidential April memo that they could mount a robust defense if necessary, but warned that the state law in question would punish Berkeley even if it were Flock that shared data improperly.
And BPD failed entirely to meet city ordinance requirements before asking to plug “community video streams,” or video captured by private residents or businesses, into the department’s surveillance network, the lawyers wrote. The Police Accountability Board had already warned about that practice, according to the memo, though it is unclear when.
Flock contract belies Berkeley bidding rules, PAB warns
Beyond the possible legal consequences, the Police Accountability Board has alleged that the proposed surveillance expansion flies in the face of Berkeley’s own contracting rules.
BPD and other city officials “did not engage in a competitive bidding process” when they should have, according to a memo from the PAB Monday.
The board has raised a number of other concerns before, some of which were mirrored in the attorneys’ confidential memo, such as agencies not always knowing who has the ability to look at their data. Putting all the city’s surveillance eggs in Flock’s basket meant if one part of the network goes down or faces a security threat, it could precipitate a catastrophic surveillance crash citywide, the PAB warned in March. On top of the practical risks, committing to a single vendor gives that vendor undue leverage, board members said at the time.
The PAB recommended the city set aside its proposed surveillance expansion unless and until the city heard competing bids, and asked that finance officials review the contracts Berkeley already has with Flock to make sure the city was following its own purchasing rules.
The board also wanted clearer information from BPD on what the department needed versus what it preferred from surveillance hardware, as well as a more comprehensive analysis of the geographical coverage, data retention implications, civil liberties ramifications and financial burden of the proposed network for the City Council to review.
“*” indicates required fields