Lesson 9 of 9 · about 18 minutes
Records to Request and How to Judge a Surveillance Program Fairly
You'll be able to
- List the core records for any surveillance program and what each one proves
- Use Idaho public records deadlines and exemptions when planning requests
- Turn an audit log export into usage statistics with simple arithmetic
- Test both the agency's claims and its critics' claims against the same records
Public arguments about surveillance go wrong in two directions. Some sound like a vendor brochure: cameras installed, crime will drop, chief is pleased. Others sound like a dystopian novel: the town is watching you, with nothing behind it but fear. Records fix both. A contract, a policy, an audit log and a sharing list will tell you more than any interview.
The core records list
Whatever the technology, the same kinds of documents exist. Ask for them by name. A clerk can find "the ALPR sharing agreements" much faster than "everything about the cameras."
| Record | What it proves | Where it usually lives |
|---|---|---|
| Contract, quotes, renewals, invoices | Cost, term, features bought, vendor's data rights | Purchasing, city clerk, council packet |
| Council or commission minutes and staff report | Who approved it, what they were told, any promised limits | Clerk, meeting archive |
| Use policy | Allowed purposes, who can access, retention, discipline | Police policy manual |
| Audit logs | Who searched, when, for what stated reason | Vendor platform export |
| Audit reports | Whether anyone checked the logs and what they found | Police administration, internal affairs |
| Sharing agreements and MOUs | Which outside agencies have access and on what terms | Police administration, legal office |
| Retention schedule | How long data and logs are kept by rule | Records manager, state archives |
| Usage statistics | Searches, alerts, stops, arrests, requests received | Vendor dashboard, crime analyst |
| Grant applications and reports | What the agency promised a funder, and what it reported | Grants office, state or federal grantor |
| Emails with the vendor | Sales claims, pilot terms, problems | Officials' email accounts |
For an Idaho plate reader program, add the semiannual audits required by Idaho Code 49-1432 and the training records the statute requires. For drones, add flight logs and the FAA authorization. For phone extraction tools, add licenses and annual extraction counts split by warrant and consent. For a real-time crime center, add the list of connected feeds by owner type.
The Idaho FOIA / Public Records Letter Generator at jeffapierson.com/journal_tools/foia-letter-generator/ builds a request letter you can adapt. For more on how Idaho requests work and how to track them, see the public records lesson in the Basic Journalism module: Public Records Requests in Idaho.
Idaho deadlines and exemptions
Under Idaho Code 74-103, an agency must grant or deny a resident's request within 3 working days. If staff need more time to find records, the agency must say so in writing, and the records are then due within 10 working days. Nonresidents get 21 days, or 35 with an extension. If an agency does not answer in time, the request is deemed denied, which starts your appeal options.
Expect the law enforcement exemption, Idaho Code 74-124. Investigatory records may be withheld only to the extent disclosure would cause a listed harm, such as interfering with enforcement proceedings, an unwarranted invasion of privacy, revealing a confidential source, disclosing investigative techniques and procedures, or endangering officers. Inactive investigatory records must be released unless one of those harms applies. Contracts, policies, invoices and aggregate statistics are generally not investigatory records. If an agency withholds a contract as a "technique," ask it to cite the specific harm.
Turning logs into numbers
Worked example: one month of audit log
An invented sheriff's office releases a 30-day audit log export for its plate reader system, with deputy names replaced by ID numbers.
- Total searches: 1,240, or 1,240 / 30 = about 41 a day.
- Searches by outside agencies: 496. Share: 496 / 1,240 = 40 percent.
- Searches with a case number in the purpose field: 930. Share: 930 / 1,240 = 75 percent.
- Searches with only "investigation" typed in: 310. Share: 310 / 1,240 = 25 percent.
- Top single user: 188 searches, or 188 / 1,240 = about 15 percent of all searches.
None of these numbers proves misuse. Each is a question. Why do 40 percent of searches come from outside agencies, and which ones? Does policy require a case number? Is the top user a crime analyst whose job is searching, which would explain the volume? Put every question to the agency, and weigh its answers alongside the numbers before drawing a conclusion in public.
Reading the contract
Contracts are long, and most of them are boilerplate. Go straight to these clauses:
- Price and term. Per-unit cost, total cost, auto-renewal, price increases.
- Data ownership. Who owns the data, and whether the vendor may use it to train products or share it in aggregate.
- Retention. Default deletion period and who can change it.
- Sharing. Whether the agency's data joins a network by default or only by opt-in.
- Termination. What happens to data when the contract ends.
- Public records. Whether the vendor claims documents or logs are confidential trade secrets.
Weighing claims fairly
Fairness here means testing each side's strongest claim against records and saying what you found. Giving a chief and an activist equal time is a format, and it can hide which claims held up.
| Claim you will hear | Usually from | How to test it |
|---|---|---|
| "It solved 120 cases last year." | Agency, vendor | Get the case list; verify a sample; ask what other evidence existed |
| "Data is deleted after 30 days." | Agency | Policy text, vendor settings screenshot, retention schedule |
| "Nobody outside our county can search it." | Agency | Sharing list, audit log entries from outside agencies |
| "It tracks everyone everywhere." | Critics | Camera count and locations, retention, what is actually searchable |
| "Officers abuse it." | Critics | Discipline records, audit reports, complaints |
| "It's illegal." | Critics | Name the statute or ruling; check how courts have actually ruled |
Give the agency a real chance to answer specific questions. Hold critics to the same standard when their claims do not hold up. If a privacy group says a city keeps data for a year and the policy says 30 days, the policy is the fact. If a chief says the system is audited and no audit exists, that is a fact too. When you describe a program at a meeting, in testimony or online, word any accusation carefully; the fairness lesson in Basic Journalism explains how: Fairness and defamation.
Some cities have passed surveillance ordinances that require council approval and annual reports before police buy or use surveillance technology. If your town has one, the annual report is your first document. If it does not, asking council members whether they want one is a fair question, and the Idaho Open-Meetings Compliance Tracker at jeffapierson.com/journal_tools/idaho-open-meetings-tracker/ can help you keep track of the meetings where contracts get approved. Before you repeat a claim from either side, you can run its sourcing through the Source Checker.
Common mix-ups
- Claim: Police surveillance records are all secret. What the evidence shows: Contracts, policies, invoices, audit reports and aggregate statistics are usually public. Exemptions target specific investigative harms.
- Claim: A big number of searches means abuse. What the evidence shows: Volume alone shows activity. Patterns, missing case numbers, and searches unrelated to any case are what point to problems, and they still need the agency's explanation.
- Claim: Balance means equal time for each side. What the evidence shows: Balance means testing each side's claims with the same rigor and saying where the evidence points.
Reporting angle
Start a surveillance file for your area. Use the Atlas of Surveillance to list reported technologies, then confirm each with a contract or invoice. Calendar contract renewal dates; renewals bring the program back to a public meeting. Request audit reports on the schedule the law sets (twice a year under Idaho Code 49-1432), so your story can say whether the required audits actually happened.
Research angle
- Idaho Code 74-103, where to file a records request and the response deadlines.
- Idaho Code 74-124, the law enforcement records exemption.
- Idaho Code 49-1432, the ALPR statute with its logging and audit rules.
- Upturn, Mass Extraction: a worked example of a records request campaign.
- EFF Atlas of Surveillance, to see what technology an agency is already known to use.
- California State Auditor report 2019-118, a model audit of an ALPR program.
Pictures, Numbers and Infographics
Surveillance programs come down to records, and records can be counted: location points per day, plate images per hit, matches per million faces. The figures here come from the Supreme Court, a state audit, a federal test lab and a national survey.
By the numbers
- 12,898 location points over 127 days: the cell-site records the government got about Timothy Carpenter from his wireless carriers, an average of 101 points a day. Supreme Court, Carpenter v. United States, 2018
- 320 million: plate images the Los Angeles Police Department had stored. Only 400,000 of them produced an immediate hot list match, so 99.9 percent were of vehicles not on a hot list when photographed. California State Auditor, Report 2019-118, 2020
- 70 percent: share of California police and sheriff departments, in the auditor's survey of 391, that operate or plan to operate a plate reader system. Roughly 84 percent of those running one share their images with other agencies. California State Auditor, 2020
- 189 algorithms from 99 developers: tested by NIST on 18.27 million images of 8.49 million people from State Department, Homeland Security and FBI databases. National Institute of Standards and Technology, 2019
- 10 to 100 times: how much higher the one-to-one false positive rates often ran for Asian and African American faces than for Caucasian faces, depending on the algorithm. The most equitable algorithms were also among the most accurate. NIST, 2019
- 71 percent: U.S. adults who say they are worried about how the government uses people's data, up from 64 percent in 2019. And 79 percent say they have little or no control over what the government does with their data. Pew Research Center, 2023
Check yourself
1. Under Idaho Code 74-103, how long does an agency have to respond to a public records request from an Idaho resident?
The agency must grant or deny within 3 working days, or give written notice it needs more time, with records due within 10 working days. Silence past the deadline counts as a denial.
2. Which record best shows who outside your local agency can search its plate reader data?
Sharing lists and memoranda of understanding show which outside agencies have access. Press releases rarely do.
3. An audit log export shows 1,240 searches in 30 days; 310 have the purpose field 'investigation' with no case number. What share lack a case number?
310 / 1,240 = 0.25, or 25 percent. That is a fair question to put to the agency, not proof of misuse.
4. Idaho Code 74-124 lets agencies withhold investigatory records only to the extent disclosure would cause certain harms. Which item is NOT listed as protected under that exemption?
The statute says basic incident facts like time, date, location and nature of a reported crime are not investigatory records protected by the exemption.
5. What is the fairest way to handle an agency's claim that its cameras 'solved 120 cases last year'?
Test claims from every side against records. Say what checked out and what did not.
6. Which document usually sets the vendor's rights to use agency data?
Contract terms decide whether the vendor can use, keep or aggregate data, and what happens to it when the contract ends.
Terms in this lesson
- Memorandum of understanding (MOU)
- A written agreement between agencies, often covering data sharing, task forces or equipment loans.
- Retention schedule
- An official list setting how long each type of record must be kept before it can be destroyed.
- Usage statistics
- Counts that show how a tool is used: searches, alerts, stops, arrests, requests from other agencies.
- Deemed denial
- Under Idaho law, a records request not answered within the deadline is treated as denied, which opens the appeal route.
- Surveillance ordinance
- A local law requiring public approval and reporting before agencies buy or use surveillance technology.
Sources
- Idaho Code 74-103, Location of public records, response deadlines checked 2026-10
- Idaho Code 74-124, Law enforcement records exemption checked 2026-10
- Idaho Code 49-1432, ALPR data access, logging and semiannual audits checked 2026-10
- California State Auditor Report 2019-118 (Feb. 13, 2020) checked 2026-10
- Upturn: Mass Extraction (Oct. 20, 2020), records request method checked 2026-10
- EFF and University of Nevada, Reno: Atlas of Surveillance checked 2026-10