Automated Surveillance Technology Governance Ordinance Draft

A starting point for communities to address the concerns of residents while leaving nearly all valuable functionality in place for Police Departments.

Automated Surveillance Technology Governance Ordinance

Jurisdiction: City of Oshkosh, Wisconsin

Version: 8.1 (July 2026 community draft)

Article I. Purpose and Scope

Section 1.1 Purpose

The City recognizes that surveillance technologies may provide legitimate public safety value and that their deployment without adequate governance creates serious risks to civil liberties, data security, and public trust. This Ordinance establishes minimum standards for evaluation, procurement, deployment, and oversight for any automated or AI-assisted surveillance technology, including but not limited to automated license plate readers, facial recognition systems, audio detection sensors, drone surveillance, and predictive analytics platforms, operated by or on behalf of the City. Where this Ordinance references specific technologies, including automated license plate readers, as examples, such references are illustrative and not exhaustive. All provisions of this Ordinance apply equally to any Surveillance Technology that collects, processes, or produces equivalent data types regardless of the sensor modality or product name.

This Ordinance states required outcomes and minimum standards. Operational procedures for meeting those outcomes are established by the responsible departments under the authority of the Chief of Police or the responsible department head, consistent with this Ordinance. Time periods stated in this Ordinance are outer bounds or minimum standards of promptness, not exact prescriptions, except where a minimum is expressly required by law. Departmental policy, administrative standards, and technical standards may adopt more protective or more restrictive requirements, including shorter deadlines and shorter retention periods, so long as they do not conflict with this Ordinance or applicable law.

Section 1.2 Scope

This Ordinance applies to:

All automated or AI-assisted Surveillance Technology deployed by City departments, including the Police Department, Traffic Engineering, and Public Works.
Automated or AI-assisted Surveillance Technology operated by third parties where

(a) the City or a City department is a named party, subscriber, or data controller, or (b) any City department has been granted recurring or programmatic access credentials, API access, or a dedicated portal to query or receive data in its official capacity, including deployments that the City has funded, subsidized, equipped, granted, donated to, induced, sponsored, or operationally facilitated, in whole or in part.

Section 1.3 Non-Applicability

This Ordinance does not govern body-worn cameras, non-automated in-car dash cameras, or internal building security systems, which are addressed under separate policy.

Article II. Definitions

Section 2.1 Definitions

For purposes of this Ordinance, the following definitions apply:

Surveillance Technology means any electronic device, software, or system that is

(a) operated by or on behalf of the City; (b) operated by a Vendor or other third party under contract with the City; or (c) operated by a third party where any City department, including the Police Department, has been granted recurring or programmatic access credentials, application programming interface access, or a dedicated portal to query or receive data in its official capacity; and that is used to observe, record, analyze, or report on the activities, movements, behaviors, or associations of individuals, groups of people, or vehicles in public or semi-public spaces, including systems that collect biometric data, location data, vehicle identifiers, or communications metadata.

Agency Data means all raw data collected by a Surveillance Technology system on behalf of the City, including images, video, audio, metadata, derived records, and analytic outputs. The City is the sole data controller for all Agency Data collected under this Ordinance.
Vendor means any company, contractor, or service provider that manufactures, operates, licenses, or maintains a Surveillance Technology system under contract with the City. For City-operated systems, provisions of this Ordinance that are expressly directed to vendor contracts, vendor financial penalties, vendor attestations, or other obligations that by their nature apply only to a third-party vendor shall be implemented through internal administrative controls and documentation rather than by deeming the City to contract with itself.
Authorized User means a City employee or agent with a documented, role-specific permission to access a Surveillance Technology system or Agency Data.
Hotlist means a list of specific identifiers, including but not limited to license plates and vehicle identification numbers, associated with active criminal investigations or law enforcement alerts.
Legal Process means a warrant, court order, subpoena, or other judicially authorized compulsory demand issued by a court of competent jurisdiction.
Independent Security Auditor means a qualified security auditing firm or individual retained directly by the City or through contract terms requiring independence, having no current contractual relationship with the Vendor and no contractual relationship with the Vendor within the preceding three years, and having no financial interest in the Vendor or in any entity that provides or is reasonably likely to seek to provide Surveillance Technology to the City.
Role-Based Access Control (RBAC) means the system by which user permissions to access Agency Data are assigned, modified, and revoked based on defined organizational roles.
Cybersecurity Officer means the person designated by the City Manager, Information Technology Director, or other authorized administrative official to perform the information-security responsibilities assigned by this Ordinance. The designee may be a City employee or a qualified contractor or consultant engaged by the City, provided that the designation is documented in writing, the designee acts under the direction of a City official, and accountability for the responsibilities remains with the City. The title need not be a currently existing job title if those responsibilities are formally assigned.
Vulnerabilities means any weakness or defect in hardware, software, firmware, configuration, or operational process that could be exploited to compromise the confidentiality, integrity, or availability of Agency Data or the systems that store, transmit, or process such data. Severity may be assessed using an industry-standard framework such as the Common Vulnerability Scoring System, but shall ultimately be determined by the City's Cybersecurity Officer based on exploitability, potential for chaining with other weaknesses, and the current threat environment.
Cryptographic Deletion means rendering data permanently inaccessible by destroying the cryptographic keys necessary to decrypt it, such that no party retains any means to recover the underlying plaintext data, except to the extent that keys or preserved copies are retained pursuant to a litigation hold, evidence preservation duty, approved records-retention exception, or pending public-records request.
Serious Criminal Offense means any offense under Wisconsin law that is:
Classified as a felony, and
Involves violence or a credible threat of violence against a person, a sexual offense, human trafficking or trafficking of a child in violation of Wis. Stat. § 940.302 or § 948.051, kidnapping, arson, burglary in violation of Wis. Stat. § 943.10 committed under circumstances involving a person lawfully present in the burglarized enclosure, or another offense that presents a comparable risk to public safety as determined by the Chief of Police in a written directive approved by the Common Council
Relevant Board or Commission means the board, commission, committee, or authority designated by the Common Council by resolution to perform the oversight, review, and advisory functions assigned by this Ordinance. The Common Council may designate an existing body or establish a new body for this purpose, and may change the designation by resolution. Unless and until a designation is made, the Common Council itself serves as the Relevant Board or Commission.

Article III. Technology Evaluation and Procurement Standards

Section 3.1 Pre-Deployment Review Required

No Surveillance Technology may be deployed unless a structured evaluation process has been completed and the deployment has been approved by the Common Council after review by either the Common Council itself or the Relevant Board or Commission. This requirement applies to any deployment regardless of cost, contract structure, or funding source, including but not limited to no-cost pilots, grant-funded trials, and cooperative purchasing or piggyback agreements. No cooperative purchasing agreement shall be used to procure Surveillance Technology without completing the full evaluation process under this Article.

Emergency deployments require written justification from the Chief of Police and are subject to retroactive review within thirty days. Any such emergency deployment automatically expires no later than thirty days from initial activation and must cease operation unless formally approved through the standard authorization process. Deactivation shall be confirmed and certified in writing, and the certification shall be provided to the Relevant Board or Commission.

Re-designating the same deployment as a new emergency absent materially new emergency circumstances is prohibited.

Section 3.2 Privacy Impact Assessment

Prior to procurement, the City shall complete a Privacy Impact Assessment that addresses at minimum:

What data will be collected, by whom, and under what circumstances.
Where data will be stored, in what legal jurisdiction, and under which cloud or physical infrastructure.
What third parties, including Vendors, platform providers, and subprocessors, will have access to data.
What legal authorities govern data access, including any foreign law applicable to the Vendor's headquarters or infrastructure.
What the realistic potential for misuse is, including insider threats and lateral sharing.
Whether the proposed deployment is proportionate to the stated public-safety objective.
Whether the proposed deployment is reasonably likely to create or exacerbate disparate impacts on communities or groups defined by race, ethnicity, religion, national origin, income level, disability status, or other protected characteristics, and what specific safeguards will be implemented to mitigate those risks.
The proposed deployment geography and criteria for siting, routing, or connecting Surveillance Technology, including how placement decisions will avoid targeting locations or communities in a manner that is discriminatory or not justified by the stated public safety objective.

Section 3.3 Mandatory Contractual Standards

No contract with a Surveillance Technology Vendor shall be executed unless it contains, at minimum:

A clause confirming that all Agency Data is exclusively owned and accessible by the City. The Vendor obtains no license, right, or ability to use, disclose, sublicense, or monetize Agency Data without the City's explicit, written, revocable authorization, including for the Vendor's own product improvement, training, or research purposes.
A prohibition on the Vendor sharing, disclosing, or transmitting Agency Data to any third party, including other law enforcement agencies, federal agencies, and analytics partners, without specific, written authorization from the City for each named recipient or specifically identified multi-agency task force.
The Vendor shall not comply with any third-party Legal Process directed at Agency Data unless and until the Vendor has notified the City and provided the City a reasonable opportunity to intervene, except to the extent applicable law or a valid court order prohibits such notice. If notice is prohibited, the Vendor shall disclose only the minimum information legally required and shall notify the City as soon as notice becomes legally permitted.
A requirement that the Vendor maintain a comprehensive, tamper-evident audit log of all Vendor access to any systems, services, encryption keys, or storage locations that store, transmit, or process Agency Data or related metadata, with such logs retained consistent with applicable records-retention law, and provide this log to the City upon request.
A clause specifying that the contract will include a defined schedule of financial penalties for unauthorized disclosure, access, or sharing of Agency Data, calibrated by the City Attorney's Office and City's Purchasing function to provide a meaningful deterrent to non-compliance, in addition to other contractual remedies.
An explicit prohibition on honoring voluntary data requests from federal agencies, including the Department of Homeland Security, United States Immigration and Customs Enforcement, United States Customs and Border Protection, the Drug Enforcement Administration, the Federal Bureau of Investigation, and other federal bodies, without City-issued written authorization or a judicially issued warrant directed at and served on the City.
A written acknowledgment by the Vendor that, by design of the security and data-control outcomes required by Section 3.5 of this Ordinance, the Vendor is technically incapable of producing plaintext Agency Data in response to any Legal Process, administrative demand, or national security letter directed solely at the Vendor, and that any such request must be directed to the City as the exclusive data controller and key holder.

Section 3.4 Security Standards

Vendors shall demonstrate, at time of procurement and annually thereafter:

Current SOC 2 Type II or equivalent independent security attestation.
A documented vulnerability disclosure and remediation process that supports risk-based prioritization and timely correction of weaknesses that could affect Agency Data or systems that store, transmit, or process it.
A patch management program with documented timelines for addressing Vulnerabilities, and a commitment to promptly remediate any Vulnerability that the City designates as posing material risk, regardless of any public severity rating.
Documented network segmentation between City data and other customers' data.
For edge devices deployed in the field, physical tamper protections, disabling of unnecessary debug interfaces, hardware-backed secure boot, and a mechanism to detect unauthorized firmware modification.
A contractual obligation to notify the City of any security incident that may have affected Agency Data within a time period measured in hours, as defined in the contract and consistent with applicable law.
Cooperation with reasonable, City-initiated security testing or vulnerability scanning of components that store, transmit, or process Agency Data, under terms to be defined in the contract.

Section 3.5 Security and Data-Control Outcomes; Mandatory Technical Requirement

This Section establishes non-negotiable security and data-control outcomes. Any Vendor unable to comply is ineligible for contract award unless the Common Council approves a specific variance after public review under Article III.

City Control of Plaintext Data. The City shall remain the sole holder of the cryptographic means necessary to access plaintext Agency Data. Vendors shall not possess or control any decryption key, escrow, derivative key material, or administrative pathway sufficient to access plaintext Agency Data under ordinary operation or in response to legal process directed solely at the Vendor.
Protected Processing Requirement. Agency Data shall be processed only within an architecture that, to the maximum extent technically feasible, prevents the Vendor and any cloud or service provider from accessing plaintext Agency Data. The specific technical method used to achieve this outcome, including but not limited to edge inference, secure enclaves, or future equivalent methods, shall be established through procurement documents and any technical standards adopted under Appendix A.
Vendor Compliance Attestation. Prior to contract execution and annually thereafter, the Vendor shall provide a written attestation, signed by its Chief Information Security Officer or a superior officer with equivalent authority, confirming that the deployed architecture conforms to this Section and that no pathway exists by which Vendor personnel or infrastructure can access plaintext Agency Data.
Architecture Verification. Conformance with this Section shall be independently verified at initial deployment and at least once every two years thereafter by an Independent Security Auditor, who may be retained through the contract with the cost borne as a contract term. The City shall coordinate the verification. Verification shall include review of system architecture, network traffic and data-flow controls, key-management controls, and any other evidence necessary to confirm compliance with this Section. Results shall be reported to the Relevant Board or Commission. Any material deviation from the approved architecture shall constitute a material breach of contract.
Vendor Support and Diagnostics. All Vendor support activities requiring access to device software or configuration shall occur through a dedicated, City-monitored diagnostic channel that operates only on non-sensitive system telemetry, including device health metrics, firmware version, and error codes, and shall be contractually defined and technically scoped to exclude any channel carrying Agency Data.
Cryptographic Agility. Cryptographic mechanisms used for key establishment, key agreement, authentication, and data protection in systems that store, transmit, or process Agency Data shall follow contemporary best practices and support replacement or augmentation without major architectural change. The City's Cybersecurity Officer may issue technical standards or updated requirements consistent with this Ordinance.
Compliance Support. The system shall support immutable, machine-readable logging of all policy-relevant transactions and shall provide the interfaces and export capabilities necessary for the City to implement automated and manual compliance monitoring as required by Article VII. Detailed technical requirements may be specified in a separate technical standard or administrative policy adopted under Appendix A.
Variances for City-Operated Systems. For systems operated directly by the City without a third-party Vendor, the City shall implement administrative, technical, and audit controls that achieve outcomes substantially equivalent to those required by this Section. Contract-specific provisions that by their nature apply only to a third-party Vendor shall be satisfied through documented internal controls, designation of responsible officials, and independent verification by an Independent Security Auditor.

Section 3.6 Vendor Background and Risk

The evaluation shall include, at minimum:

Review of the Vendor's litigation history related to data privacy and unauthorized sharing.
Review of known Vulnerabilities and security incidents involving the Vendor's products.
Review of the Vendor's data-center jurisdiction and any applicable foreign government access laws.
Assessment of whether the Vendor's business model relies on aggregated data from multiple customers, which creates a structural incentive toward broad data-sharing that may be difficult to contractually constrain.
Review of credible press reports and public complaints regarding the Vendor's handling of surveillance data or privacy practices.

Section 3.7 Capability Expansion Review

Any expansion of a deployed Surveillance Technology system's capabilities beyond those reviewed and approved at time of procurement shall be subject to the same pre-deployment review and Council approval required under Section 3.1 before activation. Capability expansions subject to this requirement include but are not limited to:

Addition of new data collection types or sensor modalities.
Addition of new AI inference categories, including but not limited to audio event detection, behavioral analysis, or biometric identification.
Expansion of data retention periods beyond those approved at procurement.
Addition of new third-party integrations, data-sharing features, or external network connections.

Routine software updates, security patches, and bug fixes that do not alter the system's data collection scope, inference capabilities, retention behavior, or sharing integrations are exempt from this requirement. The responsible department shall document in writing its determination that an update qualifies as routine, and such determinations shall be made available to the Relevant Board or Commission upon request. The City shall document administrative standards identifying what categories of updates require escalation as capability expansions and what categories may proceed as routine maintenance. Detailed review procedures may be established through administrative policy or technical standards consistent with this Ordinance.

Article IV. Data Governance

Section 4.1 Data Minimization

The City shall collect only the data minimally necessary for a specific, documented public-safety or law-enforcement purpose associated with the deployment. Operational necessity shall be interpreted narrowly and tied to specific law-enforcement or public-safety purposes, not generalized or speculative benefits. Systems shall be configured to:

Avoid collecting data beyond the designated geographic and temporal scope of a specific deployment.
Suppress or immediately delete data associated with protected sensitive locations, including but not limited to places of worship, healthcare facilities, political offices, legal-aid offices, and schools, to the maximum extent technically feasible. Where the City determines that such suppression is not technically feasible, it shall document in writing the specific reasons and provide that documentation to the Relevant Board or Commission for review.

Section 4.2 Retention Schedule

Agency Data shall be retained for the shortest period consistent with operational necessity and applicable law.

Non-hit data. Data that does not match any active hotlist, alert, or open investigation shall be subject to a default retention period of seven days in ordinary operation and a target maximum retention period of thirty days, provided that any shorter-than-statutory retention schedule required by this Ordinance shall take effect only upon approval by the applicable state records-retention authority or other legally required approval. Until such approval is obtained, the City shall implement administrative and technical controls to restrict access to non-hit data beyond the period otherwise intended by this Ordinance, except as required by law. Any retention of non-hit data beyond the seven-day default, up to the thirty-day maximum, shall require a documented written justification approved as provided by departmental procedure, and the use of any extended retention period shall be reviewed at least annually by the Relevant Board or Commission.
Hit data. Data matching an active hotlist or associated with an open investigation shall be retained for the duration of the investigation plus any applicable evidence retention period required by law, not to exceed seven years absent a court order.
Audit logs. Records of who accessed what data, when, and under what authorization shall be retained for the period required by applicable records-retention law, and in no event less than seven years unless a shorter period is expressly required by controlling law.
Preservation Duties. No deletion, including Cryptographic Deletion, shall occur for any record subject to a pending public-records request, litigation hold, evidence preservation duty, court order, or other legal obligation requiring preservation. The City shall maintain an administrative process for placing and releasing such holds and, where lawful and technically feasible, may preserve retained records in an alternative controlled storage location for the duration of the hold.

Section 4.3 Judicial Order Requirement for Historical Data Access

No role under this Ordinance shall carry standing access to conduct retroactive searches of Agency Data older than twenty-four hours. Such access may be temporarily granted only upon presentation and logging of a judicial order, specifically a court-issued warrant based on probable cause unless a higher legal standard is required by applicable law, and shall expire upon completion of the authorized search session. This requirement applies regardless of officer rank or stated urgency and is subject to the access requirements of Article V. The sole exception is the exigent-circumstances authorization described in Section 4.4.

Section 4.4 Exigent Circumstances Exception

A supervisory officer may authorize access for a time-limited retroactive search of Agency Data older than twenty-four hours without prior judicial order where specific, articulable facts establish an objectively reasonable belief that delay would result in imminent loss of life, serious bodily harm, destruction of evidence, or the failure to locate a vulnerable person, including a minor, elderly individual, or person with a cognitive or physical disability, reported missing under circumstances suggesting they are in danger.

The Chief of Police shall establish written procedures governing the operational use of this authority. Those procedures shall address, at minimum: the supervisory rank or position authorized to approve exigent access, including coverage when the designated rank is unavailable; the documentation to be created for each authorization; and the internal review that will apply. Any use of this exception shall be:

Documented in writing promptly, in accordance with the timeline established by departmental procedure, including the identity of the authorizing supervisor and the specific facts supporting the authorization.
Reported to the Relevant Board or Commission within the period established by departmental procedure, and in no event later than seven days, subject to lawful redaction or closed-session handling where necessary.
Followed by retroactive judicial review of the access, initiated no later than seventy-two hours through the appropriate legal channels and consistent with applicable law, if the search produced evidence relevant to a criminal proceeding or if the search, conducted pursuant to a welfare or community-caretaking purpose, did not result in the safe recovery of the subject of that search. The objective of this requirement is to preserve the integrity and admissibility of any evidence obtained. If retroactive authorization is denied, the data accessed shall be sequestered and preserved in a manner that maintains its integrity pending review by the Relevant Board or Commission, and the access shall be treated as an Ordinance violation subject to Article VIII.
Logged permanently in the system audit trail with the supervisor's identity, stated justification, and outcome.

Use of the exigent exception without subsequent reporting to the Relevant Board or Commission, or without timely initiation of retroactive judicial review where applicable, shall be treated as an Ordinance violation subject to Article VIII.

Section 4.5 Sensitive-Use Restrictions

Agency Data shall not be used, and Authorized Users shall not conduct searches, for any of the following purposes:

Immigration enforcement, absent a judicial warrant specifically authorizing use of City surveillance data.
Investigating reproductive healthcare-related activity, absent a judicial warrant.
Tracking individuals based on their exercise of First Amendment or other constitutional rights, including attendance at protests, religious services, or political events.
Investigating activity that is legal in the City or State, regardless of its status elsewhere.
Any personal, non-official purpose.

These restrictions apply equally to searches of Agency Data and to access of third-party data under Section 4.7.

Section 4.6 Hotlist Composition and Use

Definition and scope. For purposes of this Ordinance, "Hotlist" has the meaning provided in Section 2.1(5) and includes any list of specific identifiers, including but not limited to license plates and vehicle identification numbers, created by or for the benefit of a government entity and used to generate alerts or match results in connection with this Ordinance.
Permitted entries. Hotlists shall be limited to identifiers that meet at least one of the following criteria:

a. The identifier is associated with a Serious Criminal Offense as defined in Article II and is tied to an active investigation or arrest warrant. b. The identifier is associated with a vehicle that has been reported stolen or is the subject of an active attempt to locate for public safety reasons. c. The identifier is associated with a time sensitive public safety alert, including but not limited to AMBER, Silver, or Blue Alerts, or is otherwise expressly authorized by a court order.

Prohibited entries. Hotlists shall not be used for civil or revenue enforcement, immigration or other civil regulatory purposes, to track lawful exercise of constitutional rights, or to track individuals based on their seeking, providing, or facilitating healthcare services that are lawful in this jurisdiction.
Documentation. Each Hotlist entry shall be associated with a documented case number, warrant, or alert identifier, shall specify the source system or agency that created the entry, shall include an expiration or review date, and shall be subject to the same audit and retention requirements as other Agency Data under this Ordinance.
Accuracy and completeness. The City shall maintain Hotlists with reasonable accuracy and completeness, consistent with the data quality principles of the federal Privacy Act of 1974. At a minimum:

a. Entries that are known or reasonably believed to be inaccurate, expired, or no longer relevant to an active investigation or alert shall be corrected or removed as soon as practicable. b. The department that maintains a Hotlist shall conduct periodic reviews at intervals defined by administrative policy to confirm that entries remain current and justified. c. Procedures shall exist to correct or remove entries where a court, prosecuting authority, or originating agency has withdrawn or resolved the underlying matter.

Section 4.7 Third-Party Vehicle Surveillance and Location Data

Access by any Authorized User to automated surveillance or vehicle location data from any commercial, subscription-based, or third-party network whose data is not collected or retained as Agency Data under this Ordinance, including but not limited to data aggregators, repossession network databases, and privately operated camera networks, is subject to the following requirements:

For queries limited to data no older than twenty-four hours as measured from the time of original capture by the third-party source to the time the query is executed, a documented active investigation with written supervisor authorization specifying the investigative purpose, the data source, and the scope of the query.
For queries seeking data older than twenty-four hours as measured from the time of original capture by the third-party source to the time the query is executed, a judicial order meeting the standard of Section 4.3, in addition to the supervisor authorization required under Section 4.7(1).
Logging of the access event under Section 5.2 as if the search were conducted on Agency Data, including case number, stated justification, data source, query parameters, and results acted upon.
Reporting of all third-party data access events to the Relevant Board or Commission in the annual report required under Section 7.2.

No Authorized User shall access third-party data for any purpose prohibited under Section 4.5. Nothing in this Section authorizes the City to establish a standing subscription or persistent access credential to any third-party data network; such arrangements are governed by Section 5.5.

Nothing in this Section authorizes the City to use third-party data access as a substitute for direct deployment of Surveillance Technology that would otherwise require Council approval under Section 3.1. A pattern of routine, programmatic, or substitutional access to a third-party network shall be treated as a deployment subject to the full requirements of Article III.

Section 4.8 Individual Data Rights

Right to Inquiry. Any person who reasonably believes their vehicle or person may have been recorded by a Surveillance Technology covered by this Ordinance may submit a written request to the City to determine whether Agency Data relating to them is currently retained. The City shall respond in writing within a reasonable time, subject to applicable law and any restriction necessary to avoid compromising an active investigation.
Accuracy Challenge. Where Agency Data that is still retained is demonstrably inaccurate as to a person's identity, the City shall correct the record where feasible or annotate the record to reflect the challenge and outcome, consistent with records management law.
Non-Hit Data. Nothing in this Section requires the City to retrieve or disclose non-hit data that has already been lawfully deleted under Section 4.2.
Saving Clause. Nothing in this Section shall be construed to limit or expand rights or obligations under the Wisconsin Public Records Law or any other applicable law governing access to records.
Procedures. The City may adopt administrative procedures to implement this Section, including reasonable identity verification steps and appeal mechanisms through the Relevant Board or Commission.

Article V. Access Controls and Authorized Use

Section 5.1 Role-Based Access Control

Access to Agency Data shall be governed by role-based access control implementing the following outcomes:

Least privilege. Each Authorized User's access shall be limited to the minimum data, functions, and time period necessary for that user's documented role.
No standing historical access. No role shall carry standing access to retroactive searches of Agency Data older than twenty-four hours, consistent with Section 4.3.
Documented authorization for retroactive search. Retroactive searches within the twenty-four hour window shall require a documented case number or specific legal basis and supervisor authorization for each search session. Retroactive searches of older data additionally require temporary access granted pursuant to Section 4.3 or a properly documented exigent-circumstances authorization under Section 4.4.
Heightened authorization for cross-jurisdiction access. Access to inter-agency shared data shall require written supervisor approval and a documented legal predicate, in addition to the requirements otherwise applicable to the search.
Administrative separation. Personnel performing system administration, including configuration, audit-log management, and RBAC management, shall have no access to Agency Data content.

The responsible department shall define the specific access roles implementing these outcomes in written administrative policy, which shall be provided to the Relevant Board or Commission and reflected in the technical standards adopted under Appendix A.

Section 5.2 Search Logging and Justification

Every search of Agency Data, regardless of role, shall automatically log:

User identity and badge or employee number.
Date, time, and duration of the search session.
Search parameters, including plate or partial plate, date range, and geography.
The associated case number or, where no case number exists, a specific legal basis that identifies the investigation or proceeding entered by the user. Generic terms such as 'investigation' are insufficient.
For searches of data older than twenty-four hours, the judicial order number, issuing court, and date of issuance, or the exigent authorization information required by Section 4.4.
The results returned and whether any were acted upon.

Such logs shall be stored in a system that no Authorized User, including system administrators, can modify or selectively delete during the applicable retention period, and shall be accessible to the Relevant Board or Commission at all times during that period, subject to lawful restrictions on disclosure.

Section 5.3 RBAC Change Logging and Notification

All changes to user access roles, permissions, or credentials within the Surveillance Technology system, including provisioning of new accounts, role escalations, role de-escalations, account suspensions, and account deletions, shall be:

Automatically and immediately logged in the system audit trail at the moment the change is executed, including the identity of the administrator who made the change, the affected user account, the prior role, the new role, and the stated operational reason.
Compiled into periodic RBAC change reports transmitted to the Relevant Board or Commission on a regular cadence established by administrative standard, no less frequently than monthly. Each report shall include every RBAC change occurring within the reporting period and shall flag access escalations and new account provisioning for priority review.
Escalated promptly, outside the regular reporting cycle, to the Relevant Board or Commission when the change involves creating a new system administrator account, granting elevated or cross-jurisdiction access, or any change executed outside an authorized process, under escalation criteria and timelines established by administrative standard.

No RBAC change shall take effect unless it is logged. Any attempt to modify access permissions through a pathway that circumvents the logging mechanism shall constitute a critical security incident triggering immediate notification under Section 7.3.

Section 5.4 Prohibition on Bulk or Fishing Searches

Searches that lack a specific investigative basis, such as querying all vehicles present at a geographic location over an extended period without an active case, are prohibited without prior supervisory approval. Any such search covering more than twenty-four hours of retroactive data additionally requires temporary access granted pursuant to Section 4.3 or authorization under Section 4.4.

Section 5.5 Third-Party Data Access Provisioning

Access to any third-party surveillance or vehicle location data network shall be provisioned on a just-in-time basis only. No standing subscription, persistent login credential, or continuous data feed from any third-party network shall be established or maintained without affirmative Council approval under Section 3.1.

Each access event shall be provisioned specifically for the authorized investigation or query described in Section 4.7, and shall be technically scoped to the data source, time window, and query parameters specified in the authorization. Access shall be revoked immediately upon completion of that query.
Provisioning and revocation of each access event shall be logged in the system audit trail under the same requirements as RBAC changes in Section 5.3, including the identity of the administrator who provisioned access, the Authorized User granted access, the stated investigative basis, the data source, and the time of provisioning and revocation.
Any Vendor or data provider granted recurring or standing access to City systems or City networks as part of a third-party data arrangement shall be subject to the full contractual standards of Section 3.3 and the security standards of Section 3.4.

Section 5.6 Duty to Report

An Authorized User, who observes or becomes aware of a suspected search violation or possible misuse of Agency Data by another party shall promptly report the suspected activity through established misconduct reporting guidelines and in accordance with Section 7.3. The City shall not retaliate, and shall not permit retaliation, against any person for making a good-faith report under this Section. The reporting obligation under this Section is enforced through Sections 8.1 and 8.2.

Article VI. Inter-Agency Sharing

Section 6.1 Default: No Sharing or Standing External Access

Agency Data shall not be shared with any external agency by default. No automatic or opt-in-by-default network sharing feature of any Vendor platform shall be enabled. No external agency shall be granted standing or continuous access to Agency Data, including any ability to directly query, browse, or otherwise access historical records through the Vendor platform, an application programming interface, or any other integration.

Section 6.2 Authorized Sharing Pathways

Agency Data may be shared with another agency only under the following conditions, and only through specific queries performed by the City on behalf of the requesting agency. External agencies shall not be provided with direct credentials or technical means to perform their own lookback searches.

A specific, written inter-agency Memorandum of Understanding, approved by the Common Council, that defines the requesting agency, the permitted data elements, the permitted purpose, the maximum retention period for the recipient, and audit and accountability obligations on the receiving agency.
A specific, documented request tied to an active investigation, with supervisor authorization for each disclosure event.
A judicially issued Legal Process served directly on the City.

For any disclosure under this Section, the City shall provide only data that is narrowly tailored to the specific vehicle, license plate, time window, and geographic area identified in the request, and only if the requested use is consistent with this Ordinance. Any agency receiving Agency Data must agree in writing to apply security, access control, and retention protections that are at least as protective as this Ordinance, or to apply its own protections where those exceed the City's requirements. Recipients act solely as custodians of the shared data and are prohibited from re-sharing Agency Data with any third party, including other law enforcement or federal agencies, for any purpose. Any subsequent agency seeking access to the same information must submit its own request directly to the City under this Article.

Any re-sharing of Agency Data by a recipient agency in violation of this Section shall result in immediate suspension of the applicable Memorandum of Understanding pending review by the Relevant Board or Commission. The Relevant Board or Commission shall recommend whether the Memorandum of Understanding is terminated for cause, and the Common Council shall act on that recommendation promptly. An agency that has had a Memorandum of Understanding terminated for cause under this Section shall not be eligible for a new Memorandum of Understanding with the City for a period of no fewer than three years from the date of termination. The Common Council's approval authority over Memoranda of Understanding required by this Section may not be delegated.

No requesting agency shall be used as a conduit to obtain Agency Data for any entity that could not itself obtain that data under this Article. Each request under this Section shall include a written certification that the request is made on the requesting agency's own behalf and not, in whole or in part, on behalf of, at the direction of, or for the purpose of furnishing Agency Data to a federal agency or any other entity, and that the data will not be used for any purpose prohibited under Section 4.5. A request that originates with, is directed by, or is intended to furnish data to a federal agency shall be handled exclusively under Section 6.3, regardless of which agency submits it. A materially false certification shall be grounds for immediate suspension of the applicable Memorandum of Understanding pending review by the Relevant Board or Commission, under the same procedure as re-sharing violations under this Section.

Section 6.3 Federal Agency Access

No Agency Data shall be shared with federal law enforcement agencies, including but not limited to the Department of Homeland Security, United States Immigration and Customs Enforcement, United States Customs and Border Protection, the Drug Enforcement Administration, and the Federal Bureau of Investigation, without a judicially issued warrant served on the City and reviewed by the City Attorney's Office prior to any disclosure. The issuing court may be a federal court of competent jurisdiction or a state court of competent jurisdiction issuing a warrant in support of a prosecution under state law in which a federal agency is participating in an authorized investigative capacity. A subpoena, administrative demand, national security letter, Foreign Intelligence Surveillance Court order directed solely at the Vendor, or other non-warrant compulsory process is insufficient to authorize disclosure under this Section; the handling and legal-sufficiency review of any such process, including any compliance legally required of the City, is governed by Section 6.6.

The security architecture required by Section 3.5 shall serve as a technical backstop to this provision, because the Vendor shall not possess the means to produce plaintext Agency Data in response to process directed solely at the Vendor. Nothing in this Section limits the City's obligation to comply with lawful process directed to the City.

Section 6.4 Vendor-Mediated Network Features

The City shall contractually and technically disable any Vendor-operated network sharing feature that would allow other agencies, whether named or unnamed, to query or receive Agency Data, except as explicitly authorized under Section 6.2. The only form of persistent, automated access that may be granted to external agencies is the transmission of hit notifications when a license plate on a mutually agreed hotlist is detected by City-controlled devices.

Such automated alerts shall contain only the minimum information necessary for the receiving agency to act on the hit, such as the license plate, date and time, location of detection, and the hotlist reason code, and shall not confer any right to access or query historical Agency Data beyond the content of the alert itself.

Section 6.5 Disclosure Accounting

The City shall maintain a permanent record of every disclosure of Agency Data to any external party, including the recipient, the data disclosed, the legal basis, and the date. This record shall be included in the annual public report required under Article VII.

Section 6.6 Federal Process Handling

Any national security letter, Foreign Intelligence Surveillance Court order, subpoena, or other federal Legal Process purporting to compel disclosure of Agency Data shall be immediately forwarded to the City Attorney's Office. The City Attorney, or a designee authorized to act on the City Attorney's behalf, shall assess the legal sufficiency and scope of the request, seek narrowing or modification where appropriate, and determine whether and to what extent compliance is legally required. No Agency Data shall be disclosed in response to such process without sign-off from the City Attorney or authorized designee, except where a court of competent jurisdiction orders immediate compliance over the City's objection. The City Attorney's Office shall provide an aggregate count of such federal Legal Process, and the number of times the City contested or narrowed such requests, in the annual public report required under Section 7.2, to the extent permitted by law.

Article VII. Oversight, Transparency, and Accountability

Section 7.1 Oversight by the Relevant Board or Commission

The Common Council shall, by resolution, designate a Relevant Board or Commission to perform the oversight, review, and advisory functions assigned by this Ordinance. The Council may designate an existing board, commission, committee, or authority, or may establish a new body for this purpose, and may change the designation by resolution. Unless and until a designation is made, the Common Council itself performs these functions.

At all times:

No member of the Relevant Board or Commission acting under this Ordinance shall be a current or former employee, officer, contractor, or agent of, or hold any financial interest in, any Vendor or any entity that provides or is reasonably likely to seek to provide Surveillance Technology to the City.
The Relevant Board or Commission acts in an advisory and oversight capacity only with respect to this Ordinance. Nothing in this Ordinance grants it authority reserved by law to the Police and Fire Commission, the Chief of Police, the City Manager, or any court.
The Relevant Board or Commission operates subject to applicable open-meetings and public-records law and may adopt rules of procedure consistent with this Ordinance and City ordinances.

Recommendations regarding the composition, expertise, and independence of the designated body, including the option of establishing a dedicated privacy and technology oversight body, are provided in the companion implementation notes.

Section 7.2 Annual Public Report

The City shall publish an annual report, posted on the City's website, covering at minimum:

Total number of searches conducted, by access role or category.
Total number of searches of data older than twenty-four hours, with counts of searches supported by judicial order and searches conducted under the exigent exception, and the outcome of any retroactive judicial review of exigent accesses.
Number and nature of audited Ordinance violations, and outcomes, including discipline, referral, or exoneration, to the extent lawfully reportable.
A summary of all RBAC changes during the reporting year, including counts of escalations and new account provisioning.
Total number of external disclosures and to which agencies, with respective disclosure counts.
Total number of third-party data access events under Section 4.7, by authorization type.
Aggregate counts of individual data rights requests under Section 4.8 and their outcomes.
Any security incidents involving the Surveillance Technology system.
A cost-benefit assessment, including crime-clearance outcomes attributable to the system where measurable.
Community feedback and complaint summary.
Aggregate counts of federal Legal Process received under Section 6.6 and the number of times the City contested or narrowed such requests, to the extent permitted by law.
An analysis of any observed or reasonably identifiable discriminatory, disparate, or other adverse impacts that the deployment or use of Surveillance Technology may have had on the civil rights or civil liberties of communities or groups, and any corrective actions taken or recommended in response.
A list of capability expansions submitted for approval and of updates determined to be routine under Section 3.7 during the reporting period.

Section 7.3 Incident Reporting

Any security breach, unauthorized access, suspected Ordinance violation, or RBAC change executed through a logging-circumvention pathway involving Agency Data shall be reported to the Relevant Board or Commission within seventy-two hours of discovery and to affected individuals, to the extent legally required, within thirty days.

Section 7.4 Independent Security Audit

The City shall commission an Independent Security Auditor to conduct a security audit of its Surveillance Technology infrastructure no less than once every two years, which may be performed in conjunction with the architecture verification required by Section 3.5. The audit scope shall explicitly include, at minimum:

Verification that the security architecture required by Section 3.5 is functioning as approved.
Verification that the City-controlled key-management architecture supporting Section 3.5 is properly isolated and that no Vendor access pathway exists.
Review of the RBAC change log for completeness, accuracy, and timeliness of notifications.
Review of compliance with the judicial-order requirement for access to data older than twenty-four hours, including examination of exigent-exception usage.
Review of third-party data access logs under Section 4.7 for compliance with authorization and lookback requirements and verification that no standing subscriptions exist in violation of Section 5.5.
Review of compliance with individual data rights procedures under Section 4.8.

Audit results shall be reported to the Relevant Board or Commission and a public summary shall be published, with lawful redactions as necessary for security-sensitive or investigative material.

Section 7.5 Community Complaint Mechanism

A formal, accessible mechanism shall exist for members of the public to submit complaints about Surveillance Technology system use. Complaints shall be reviewed by the Relevant Board or Commission, and the complainant shall receive a written response within sixty days.

Section 7.6 Compliance Monitoring

The City shall maintain an ongoing compliance monitoring program to assess adherence to this Ordinance. At minimum, this program shall:

Rely on the immutable, machine-readable logs required by Sections 3.5, 5.2, and 5.3.
Include periodic sampling and review of searches, RBAC changes, exigent-circumstances invocations, and data sharing events.
Include documented follow-up on potential violations and corrective actions.

More detailed compliance monitoring procedures and technical standards consistent with this Ordinance may be recommended by the Relevant Board or Commission and may be adopted and updated from time to time by the City's Cybersecurity Officer or the Chief of Police (or designee), within their respective areas of responsibility.

Section 7.7 Annual Community Meeting

Within sixty days after publishing the annual report required by Section 7.2, the City shall hold at least one well publicized community meeting at which members of the public are invited to receive a presentation on the report, ask questions, and provide feedback regarding the City's use of Surveillance Technology. The meeting may be held by the Relevant Board or Commission, by the Common Council, or jointly, and shall allow for both in person and written or electronic public comment to the extent reasonably practicable.

Article VIII. Enforcement and Penalties

Section 8.1 Authorized User Violations

Violations of this Ordinance by Authorized Users shall be addressed under the City's existing disciplinary framework, including progressive discipline up to and including termination and referral for criminal prosecution where applicable law supports it, including but not limited to computer fraud and stalking statutes.

Misuse of Surveillance Technology systems covered by this Ordinance shall be treated as a serious offense within that framework. Specific aggravating violations include, but are not limited to:

Conducting a retroactive search of data older than twenty-four hours without temporary access lawfully granted under Section 4.3 or a properly documented exigent circumstance under Section 4.4.
Repeated invocation of the exigent-circumstances exception without subsequent judicial validation where applicable.
Any search conducted for personal, non-official purposes.
Knowingly entering false or misleading justifications into required logging fields.
Knowingly failing to report a search violation or misuse of Agency Data by another party that the Authorized User observed or became aware of.

Section 8.2 Administrator Violations

Violations of this Ordinance by system administrators or other personnel with elevated or privileged access shall be addressed under the City's existing disciplinary framework, up to and including termination, and referred for criminal prosecution where applicable law supports it, including under applicable computer fraud statutes. Because privileged access carries heightened risk to the integrity of the System and Agency Data, administrator misuse shall be treated as a serious offense. Specific aggravating violations include, but are not limited to:

Executing an RBAC change, or any other access or permission change, through a pathway that circumvents automated logging.
Disabling, altering, deleting, or tampering with audit logs, RBAC change logs, or other immutable records required by this Ordinance.
Granting, escalating, or provisioning access in violation of Article V, or outside an authorized, logged process.
Accessing, exporting, or altering Agency Data outside the administrator's defined role.
Knowingly failing to report a violation or misuse that the administrator observed or became aware of.

Any administrator who executes a change through a logging-circumvention pathway shall additionally be immediately suspended from system access pending investigation, consistent with Section 5.3.

Section 8.3 Vendor Violations

Vendor violations, including any discovered deviation from the approved security architecture, any unauthorized access to Agency Data, or any failure to report a compulsory demand directed at Agency Data, shall trigger the financial penalties specified in the contract and may result in contract termination for cause.

Section 8.4 No Evidentiary Exclusion Waiver

Nothing in this Ordinance shall be construed to waive any defendant's right to challenge the admissibility of evidence obtained in violation of this Ordinance or applicable law.

Section 8.5 Relationship to Police and Fire Commission Authority

Nothing in this Article or this Ordinance limits or displaces the authority of the Police and Fire Commission under Wis. Stat. § 62.13, the disciplinary discretion of the Chief of Police, or any procedural or substantive right of an employee under applicable law or a collective bargaining agreement. The violations enumerated in this Article state the City's policy assessment of severity for purposes of referral and reporting only; disciplinary determinations remain with the authorities in which the law vests them.

Article IX. Ordinance Review and Sunset

Section 9.1 Review Cycle

This Ordinance shall be reviewed by the Relevant Board or Commission no less than every two years, and that body may recommend updates to reflect changes in technology, legal precedent, community values, and changes in state or federal law.

If state or federal law is enacted or amended in a manner that may affect the validity, implementation, or retention requirements of this Ordinance, the Relevant Board or Commission shall review the affected provisions within ninety days and recommend conforming amendments if necessary. Nothing in this Section shall be construed to require the City to weaken any protection in this Ordinance unless such weakening is required by controlling law.

Any such recommendations may be adopted or amended by ordinance of the Common Council, under the Council's standard voting rules. Unless expressly repealed or superseded by such an ordinance, this Ordinance remains in full force and effect, and failure to adopt a proposed amendment does not suspend or terminate this Ordinance.

Section 9.2 Core Safeguards; Procedural Requirements for Amendment

The following provisions are designated core safeguards of this Ordinance:

The judicial-order requirement for historical data access in Section 4.3.
The security and data-control outcomes required by Section 3.5.
The default and maximum retention approach in Section 4.2, subject to controlling law.
The sensitive-use restrictions in Section 4.5.
The federal agency access restrictions in Section 6.3.

Any ordinance that would weaken or remove a core safeguard is subject to the following procedural requirements before the Common Council may vote on final adoption:

Referral. The proposed ordinance shall be referred to the Relevant Board or Commission at least sixty days before the Council vote. That body shall issue a written recommendation, including a plain-language impact statement describing the protection that would be reduced and the asserted justification, no later than thirty days before the Council vote. Failure to issue a timely recommendation does not prevent the Council from proceeding.
Public Notice and Comment. The City Clerk shall publish notice of the proposed ordinance and the impact statement, together with a minimum thirty-day public comment period, before the Council vote.
Two Readings. The proposed ordinance shall be read at two separate Council meetings, with no fewer than fourteen days between readings.
Public Hearing. The Council shall hold a public hearing at or before the meeting at which the second reading occurs, at which members of the public may address the Council regarding the proposed change.
Roll-Call Vote. Final adoption shall be by roll-call vote, with each member's vote recorded in the minutes.

These procedural requirements express the City's policy judgment that core safeguards should not be weakened without heightened transparency and deliberation. They do not limit the authority of a future Common Council except as provided by applicable law. An ordinance that strengthens a core safeguard is not subject to these requirements.

Section 9.3 Sunset Provision

Any Surveillance Technology contract approved under this Ordinance shall include a defined term not to exceed three years. Renewal requires a fresh evaluation under the then-current version of this Ordinance. No contract shall auto-renew without affirmative Council action.

Section 9.4 Severability

If any provision of this Ordinance or its application to any person or circumstance is held invalid, the invalidity shall not affect other provisions or applications of the Ordinance that can be given effect without the invalid provision or application, and to this end the provisions of this Ordinance are severable.

Appendix A. Technical Standards

The City's Cybersecurity Officer, with the recommendation and review of the Relevant Board or Commission, may adopt and update from time to time technical standards and administrative guidance to implement this Ordinance. The Common Council may by resolution require that any such standard be submitted for Council approval before taking effect. These standards may address, without limitation:

Recommended cryptographic algorithms, key lengths, and key-management methods.
Approved methods for protected processing, including edge inference, secure enclaves, or future equivalent approaches capable of satisfying Section 3.5.
Logging formats, export mechanisms, and compliance monitoring tools.
Device hardening baselines, update-management standards, and service life expectations.
Procedures for secure decommissioning, legal holds, and cryptographic deletion.
Administrative review categories for software updates, capability expansions, and emergency patching.
Access role definitions and RBAC reporting and escalation cadences under Article V.

These technical standards and administrative guidance shall be published and made available to the public to the extent consistent with applicable law and security needs, and shall be consistent with the requirements of this Ordinance.

Appendix B. Glossary of Key Legal Instruments Referenced

National Security Letter. An administrative subpoena issued by the Federal Bureau of Investigation under Title 18 United States Code section 2709 or related statutes, often accompanied by a gag order preventing the recipient from disclosing its existence.
Foreign Intelligence Surveillance Court Order. A surveillance order issued by the Foreign Intelligence Surveillance Court.
Carpenter v. United States. United States Supreme Court decision holding that the government's acquisition of historical cell-site location information constitutes a Fourth Amendment search requiring a warrant.
Chatrie v. United States. United States Supreme Court decision holding that law enforcement's acquisition of location data identifying devices near a crime scene, obtained from a third-party technology company, constitutes a Fourth Amendment search.