Plain-Language Guide for the Community Proposed Surveillance Technology Ordinance

Plain-Language Guide for the Community Proposed Surveillance Technology Ordinance

What this is: A community draft ordinance that lays out guardrails for how Oshkosh would evaluate, acquire, deploy, and oversee automated surveillance technology, including automated license plate readers (ALPRs), facial recognition, gunshot and audio sensors, drones, AI-assisted camera networks, and similar tools.

Who this is for: Any Oshkosh resident who wants to understand what this draft ordinance could provide.

Status: This draft is being shared with the Common Council and the public at the same time. It is not currently under active consideration by the Council. It is offered to start an informed conversation. This guide is aligned to the July 2026 draft (version 8.1) of the ordinance.

\\About this draft.\\ This is a community-driven draft developed by a group of contributors with diverse expertise, in areas such as cybersecurity, civil liberties, law, and public policy. It is an early working draft, not finished legislation. It will need additional legal vetting and adjustment before it could be adopted. Some of the subjects it touches may fall under authority reserved to the State of Wisconsin, the Police and Fire Commission, or other bodies, and any such provisions would need to be reconciled with those authorities. The goal is to help everyone reach their objectives in a reasonable way, supporting effective public safety work while protecting residents' privacy.

\---

The short version

This draft does not ban surveillance technology. It is built to enable effective use of these tools by police while putting sensible guardrails around them: a public evaluation process, limits on how long data is kept and how it can be used, strong protection against outside access, a record of every search, and independent oversight with public reporting. The aim is to help police, residents, and the City reach their goals together, keeping key decisions in public, accountable hands.

A quick definition: An automated license plate reader (ALPR) is a camera that automatically photographs license plates, reads the numbers, and records the time and location. Over days or weeks, a network of these can build a detailed picture of where a vehicle, and its owner, has been.

\---

What's covered, and what isn't

Covered: Automated or AI-assisted surveillance operated by the City or on its behalf, such as ALPRs, facial recognition, audio and gunshot detection, drones, predictive analytics, and AI-enabled camera networks. The guardrails also reach situations where the City gets ongoing access to a third party's surveillance network, so the guardrails can't be bypassed by using someone else's system.

Not covered: Body-worn cameras, ordinary in-car dash cameras, and internal building security systems. Those are handled under separate policies.

\---

The Six Core Protections

1\. A warrant is needed to look into the past (older than 24 hours)

What it provides: Officers can see live alerts and very recent data (the last 24 hours) for active situations. To search older data and reconstruct where someone has been over time, the draft calls for a judge's warrant based on probable cause. A narrow emergency exception allows immediate access in life-or-death situations, such as a kidnapping, a missing vulnerable person, or an active threat, with the action documented and reviewed by a judge afterward.

Why it matters: The U.S. Supreme Court held in Carpenter v. United States that tracking a person's location over time is a search under the Fourth Amendment that generally requires a warrant, and in 2026 the Court reaffirmed in Chatrie v. United States that this applies even to location data held by a private company. Historical license-plate data can paint that same picture. A warrant standard keeps the City on solid legal ground (so evidence holds up in court) and reassures residents the system isn't used for open-ended tracking. Police keep fast access to what matters most in an emergency.

2\. The City, not the vendor, controls the data

What it provides: Data is encrypted, and the City alone holds the keys needed to read it. A vendor may store the data but is designed so it cannot read it. If a company that sells the technology receives a federal demand for the data, it can't comply, and it has to direct the request to the City. (In plain terms, this is similar to "end-to-end encryption.") The draft sets this as a required outcome. The specific technology used to achieve it would be decided during purchasing and public review, and any exception would require the Council's approval in public.

Why it matters: It prevents quiet outside access to residents' data through the vendor, and it limits the damage if a vendor is ever breached. Accountability stays with the City, which answers to the public, rather than with a private company.

3\. Data is kept only briefly

What it provides:

• Everyday (non-hit) data, meaning plates not tied to an alert or case: a 7-day default, with a 30-day outer limit that requires written justification and annual review by the oversight body.
• Case-related data: kept as long as the investigation and the law require, then deleted, with a ceiling of seven years absent a court order.
• Access records (audit logs): kept at least seven years.
• Data under a legal hold or a public-records request is preserved and not deleted.

Note: Wisconsin law sets default record-keeping requirements, so the City would formalize these shorter timelines with the state records authority. Until that approval is in place, the City would strictly limit access to older data.

Why it matters: A long-term archive of everyone's movements becomes a tracking database, with all the risks that implies. Most of the investigative value is in the first days of a case. Short retention limits the harm if data is ever breached or misused, while still allowing longer keeping when a case truly needs it.

4\. No automatic data sharing, and strict guardrails for federal requests

What it provides: By default, the City shares nothing, and vendor "network" sharing features are turned off. Data sharing happens only through:

• A Council-approved agreement (spelling out who, what, why, and for how long),
• A specific, supervisor-approved request tied to an active investigation, or
• Legal process served directly on the City.

Federal agencies (FBI, DHS, ICE, CBP, DEA, and others) can receive data only with a warrant served on the City and reviewed by the City Attorney. A subpoena, administrative demand, or national security letter (a federal request that does not come from a judge) is not enough. Another agency also can't be used as a go-between: every request must certify it isn't being made on behalf of someone who would need their own warrant.

Why it matters: It prevents Oshkosh from being quietly enrolled in national, vendor-run data-sharing networks. The City decides who gets access and for what purpose. Police can still cooperate with other agencies, on clear, documented, locally controlled terms.

5\. Clear limits on how the data can be used

What it provides: Regardless of who is searching, the data may not be used to:

• Enforce immigration law (absent a specific judicial warrant),
• Investigate reproductive-healthcare activity (absent a warrant),
• Track people for attending protests, religious services, or political events,
• Investigate conduct that is legal in Wisconsin, or
• Serve any personal, non-official purpose.

The system would also be configured to avoid and suppress data around sensitive places, such as places of worship, healthcare facilities, schools, and legal-aid and political offices, to the extent technically possible.

Why it matters: These are the uses most likely to make people afraid to do things they have every legal right to do, such as attend a protest, go to a place of worship, or keep a medical appointment. That fear, and the loss of trust that comes with it, harms the whole community. Placing these uses off-limits in writing protects residents' rights and makes clear the system is meant for genuine public-safety work.

6\. Every use is recorded, and independent oversight watches the system

What it provides:

• Access is limited by role (patrol, investigators, supervisors, IT), each with narrowly defined permissions.
• Every search and every export is automatically logged, capturing who, when, what they searched, and the case number or legal basis. A vague entry like "investigation" would not be acceptable. These logs are tamper-resistant.
• A Relevant Board or Commission, designated by the Common Council (which may use an existing body or create a new one), reviews how the system is used. By rule, no member may have ties to a surveillance vendor, and the body is advisory, so final authority stays with the Council and the bodies the law assigns it to. The community draft's companion notes recommend designating a dedicated privacy and data-ethics body whose community members hold at least three seats and on which City staff do not form a majority.
• The City would publish an annual public report (searches, warrants, violations and outcomes, sharing events, security incidents, costs and benefits) and commission an independent security audit at least every two years.

Why it matters: A clear record deters misuse and protects officers who follow the guardrails from false accusations. Independent review and public reporting keep the system from quietly expanding into new uses without public debate.

\---

Your rights as a resident

• Ask whether your data is held. You could submit a written request asking whether the City currently retains data about your vehicle or you, and the City would respond, subject to active-investigation and legal limits.
• Challenge inaccurate data. If retained data is wrong about who you are, you could ask to have it corrected or flagged with a note.
• File a complaint. There would be a formal way to raise concerns about how the system is used, with a written response within 60 days.
• Show up and be heard. Each year, after the public report comes out, the City would hold a well-publicized community meeting to present the report and take questions and comments, in person and in writing.

\---

How a new surveillance tool would be brought online

• No secret rollouts. Any new surveillance technology would go through a public evaluation and Common Council approval before use, regardless of cost, and including free trials, grant-funded pilots, and "piggyback" purchasing through another agency.
• Privacy Impact Assessment first. Before acquiring a tool, the City would study what data is collected, where it's stored, who could access it, the potential for misuse, whether it is a sensible fit for the problem it is meant to solve, and whether it could create unfair impacts on particular communities.
• New capabilities get a fresh look. Adding a new sensor, a new type of AI analysis, longer retention, or a new data-sharing feature would trigger the same public review again.
• Built-in expiration. Contracts would run no more than three years, would not auto-renew, and would require a fresh review to continue.
• Core protections are hard to weaken. Several key guardrails (the warrant standard, the data-control requirement, retention limits, use restrictions, and federal-access rules) could be weakened only through a heightened public process: review by the designated board or commission, public notice and comment, two readings, a public hearing, and a recorded vote.

\---

Common Questions

Does this ban license plate readers or other tools? No. It sets guardrails for using them and is built to enable continued use, not to prohibit it. Police keep real-time alerts and recent data, and can reach older data with a warrant.

Will this stop police from solving crimes? The intent is the opposite. Officers keep fast access to live and recent information, and the emergency exception covers urgent situations. The main difference is that reaching back in time beyond 24 hours would involve a judge agreeing there's probable cause, which also makes the resulting evidence more defensible in court.

Why involve a warrant for older data? Because looking back beyond a day stops being a single check and becomes a reconstruction of someone's movements. The Supreme Court has already said that kind of long-term tracking generally needs a warrant.

How would this apply to facial recognition, drones, or AI camera networks? The same guardrails apply. The draft is written to cover surveillance technology generally, not just license plate readers, and new capabilities would call for a fresh public review.

Could the City get around this with a "free pilot"? No. Even no-cost pilots and trials would go through the full evaluation and Council approval.

Why not just trust the vendor's security? The draft does call for strong vendor security, and it also keeps the vendor from ever holding the keys to read the data. Even if a vendor is breached or pressured by another government, residents' data would stay unreadable without going through the City.

Is this anti-police? It is designed as a workable framework, not a ban. It supports effective use of these tools with clear, constitutional guardrails, creates records that can clear officers who follow proper procedure, and reduces the risk that misuse leads to these tools being banned completely.

\---

Want to weigh in?

Community input is welcome. If you have thoughts on this draft, reach out to your Council representative or the City Clerk's office, and watch for opportunities to comment as the conversation develops.

This guide is a plain-language summary and is not the ordinance text itself. Where this summary and any adopted ordinance differ, the ordinance text controls.