Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Police Data Privacy topic
No spam. Unsubscribe anytime.
Syracuse police say license-plate reader data policy being tightened after unintended external access
Summary
Syracuse Police Department officials told a joint Public Safety–Public Works committee they found an unintended external opt-in that allowed some outside agencies to view live LPR camera streams; the exposure has been closed and department policy and contracts are being revised.
Syracuse — Syracuse Police Department officials told a joint meeting of the City Council’s Public Safety Committee and the Department of Public Works on Oct. 26 that license-plate reader (LPR) data that had been inadvertently visible to outside parties has been shut off and new policies are being drafted to tighten controls.
The change followed reporting and requests for information from the press, Chief and First Deputy Chief Robert Shaw said during a discussion led by council members. "When we found out that that was open, it was immediately shut down," Shaw said, describing an initial opt-in setting that allowed outside Flock users to see cameras if a department representative agreed to share. "It does no longer exist."
The matter matters because the LPR program stores images and plate reads that investigators can use for missing-person or homicide inquiries and other criminal investigations. Sergeant Einbeck of the department’s technology division said LPR data captured by the vendor Flock are stored in the vendor’s cloud, where he believes some records may be retained for up to a year. In contrast, on‑pole police cameras the department holds on its own servers are retained on prem for up to 30 days before being overwritten, he said.
Officials said the department has a memorandum of understanding with the Central New York Crime Analysis Center (CAC), overseen by the New York State Division of Criminal Justice Services, that allows the CAC to make formal written requests for vehicle-specific searches. The department said such requests must cite a crime or other authorized reason and specify a full plate; casual or broad queries are not permitted under the stated procedures.
Chief Shaw and Sergeant Einbeck described three immediate changes to restrict access: (1) the open opt‑in that allowed outside agencies to view Syracuse cameras has been closed; (2) only three senior department staff will be authorized to opt agencies in or out of sharing for the near term (Shaw, Chief Cecil and Sergeant Einbeck); and (3) the department is rewriting its rules and regulations and drafting an LPR policy using New York State Police guidance and recommendations from the city’s surveillance technology committee.
Shaw acknowledged operational tradeoffs in hosting data. "We wouldn't have the capabilities of keeping that much data on‑prem. It's abundance of data. It's more cost efficient to keep it in the cloud through Flock," he said when asked whether the city could host the vendor data itself. He added, however, that the written contract with Flock specifies the department owns the data and that Flock is not authorized to release data without police command approval.
Committee members asked how long the inadvertent sharing had been open. Shaw said it was “probably the whole time we've had it, probably push a year,” and that the department has been reviewing logs and working with staff to audit access. Sergeant Einbeck said the department follows Criminal Justice Information Services (CJIS) requirements for any criminal-justice data and that data the county holds follows similar controls.
Officials said the department will publish an annual report of LPR use that will describe how often the system was queried and for what purposes. Shaw said the department is also exploring vendor features — including the ability for requesters later this year to include a police report number with requests — that would make it easier to audit the stated purpose of outside searches.
The committee discussion did not include any formal vote. Council members asked the department to provide the Flock contract language and a copy of the draft LPR policy to the council before the policy is finalized.
What remains unresolved: officials said they will review the Flock contract in detail and share the contract clause identifying ownership and sharing restrictions, finalize the new LPR policy (expected in the coming weeks), and produce the annual reporting template the committee can review.
