🏛️ Issues and Advocacy Training
Courses › Surveillance Technology and Privacy

Lesson 9 of 9 · about 18 minutes

Records to Request and How to Judge a Surveillance Program Fairly

You'll be able to

  • List the core records for any surveillance program and what each one proves
  • Use Idaho public records deadlines and exemptions when planning requests
  • Turn an audit log export into usage statistics with simple arithmetic
  • Test both the agency's claims and its critics' claims against the same records

Public arguments about surveillance go wrong in two directions. Some sound like a vendor brochure: cameras installed, crime will drop, chief is pleased. Others sound like a dystopian novel: the town is watching you, with nothing behind it but fear. Records fix both. A contract, a policy, an audit log and a sharing list will tell you more than any interview.

The core records list

Whatever the technology, the same kinds of documents exist. Ask for them by name. A clerk can find "the ALPR sharing agreements" much faster than "everything about the cameras."

RecordWhat it provesWhere it usually lives
Contract, quotes, renewals, invoicesCost, term, features bought, vendor's data rightsPurchasing, city clerk, council packet
Council or commission minutes and staff reportWho approved it, what they were told, any promised limitsClerk, meeting archive
Use policyAllowed purposes, who can access, retention, disciplinePolice policy manual
Audit logsWho searched, when, for what stated reasonVendor platform export
Audit reportsWhether anyone checked the logs and what they foundPolice administration, internal affairs
Sharing agreements and MOUsWhich outside agencies have access and on what termsPolice administration, legal office
Retention scheduleHow long data and logs are kept by ruleRecords manager, state archives
Usage statisticsSearches, alerts, stops, arrests, requests receivedVendor dashboard, crime analyst
Grant applications and reportsWhat the agency promised a funder, and what it reportedGrants office, state or federal grantor
Emails with the vendorSales claims, pilot terms, problemsOfficials' email accounts

For an Idaho plate reader program, add the semiannual audits required by Idaho Code 49-1432 and the training records the statute requires. For drones, add flight logs and the FAA authorization. For phone extraction tools, add licenses and annual extraction counts split by warrant and consent. For a real-time crime center, add the list of connected feeds by owner type.

The Idaho FOIA / Public Records Letter Generator at jeffapierson.com/journal_tools/foia-letter-generator/ builds a request letter you can adapt. For more on how Idaho requests work and how to track them, see the public records lesson in the Basic Journalism module: Public Records Requests in Idaho.

Idaho deadlines and exemptions

Under Idaho Code 74-103, an agency must grant or deny a resident's request within 3 working days. If staff need more time to find records, the agency must say so in writing, and the records are then due within 10 working days. Nonresidents get 21 days, or 35 with an extension. If an agency does not answer in time, the request is deemed denied, which starts your appeal options.

Expect the law enforcement exemption, Idaho Code 74-124. Investigatory records may be withheld only to the extent disclosure would cause a listed harm, such as interfering with enforcement proceedings, an unwarranted invasion of privacy, revealing a confidential source, disclosing investigative techniques and procedures, or endangering officers. Inactive investigatory records must be released unless one of those harms applies. Contracts, policies, invoices and aggregate statistics are generally not investigatory records. If an agency withholds a contract as a "technique," ask it to cite the specific harm.

Ask for aggregate numbers when individual records would be withheld. "How many searches last month" is far harder to deny than "every search last month."

Turning logs into numbers

Worked example: one month of audit log

An invented sheriff's office releases a 30-day audit log export for its plate reader system, with deputy names replaced by ID numbers.

  • Total searches: 1,240, or 1,240 / 30 = about 41 a day.
  • Searches by outside agencies: 496. Share: 496 / 1,240 = 40 percent.
  • Searches with a case number in the purpose field: 930. Share: 930 / 1,240 = 75 percent.
  • Searches with only "investigation" typed in: 310. Share: 310 / 1,240 = 25 percent.
  • Top single user: 188 searches, or 188 / 1,240 = about 15 percent of all searches.

None of these numbers proves misuse. Each is a question. Why do 40 percent of searches come from outside agencies, and which ones? Does policy require a case number? Is the top user a crime analyst whose job is searching, which would explain the volume? Put every question to the agency, and weigh its answers alongside the numbers before drawing a conclusion in public.

Total Outside agencies With case number "Investigation" only 1,240 496 930 310

Reading the contract

Contracts are long, and most of them are boilerplate. Go straight to these clauses:

  • Price and term. Per-unit cost, total cost, auto-renewal, price increases.
  • Data ownership. Who owns the data, and whether the vendor may use it to train products or share it in aggregate.
  • Retention. Default deletion period and who can change it.
  • Sharing. Whether the agency's data joins a network by default or only by opt-in.
  • Termination. What happens to data when the contract ends.
  • Public records. Whether the vendor claims documents or logs are confidential trade secrets.

Weighing claims fairly

Fairness here means testing each side's strongest claim against records and saying what you found. Giving a chief and an activist equal time is a format, and it can hide which claims held up.

Claim you will hearUsually fromHow to test it
"It solved 120 cases last year."Agency, vendorGet the case list; verify a sample; ask what other evidence existed
"Data is deleted after 30 days."AgencyPolicy text, vendor settings screenshot, retention schedule
"Nobody outside our county can search it."AgencySharing list, audit log entries from outside agencies
"It tracks everyone everywhere."CriticsCamera count and locations, retention, what is actually searchable
"Officers abuse it."CriticsDiscipline records, audit reports, complaints
"It's illegal."CriticsName the statute or ruling; check how courts have actually ruled

Give the agency a real chance to answer specific questions. Hold critics to the same standard when their claims do not hold up. If a privacy group says a city keeps data for a year and the policy says 30 days, the policy is the fact. If a chief says the system is audited and no audit exists, that is a fact too. When you describe a program at a meeting, in testimony or online, word any accusation carefully; the fairness lesson in Basic Journalism explains how: Fairness and defamation.

Some cities have passed surveillance ordinances that require council approval and annual reports before police buy or use surveillance technology. If your town has one, the annual report is your first document. If it does not, asking council members whether they want one is a fair question, and the Idaho Open-Meetings Compliance Tracker at jeffapierson.com/journal_tools/idaho-open-meetings-tracker/ can help you keep track of the meetings where contracts get approved. Before you repeat a claim from either side, you can run its sourcing through the Source Checker.

Common mix-ups

  • Claim: Police surveillance records are all secret. What the evidence shows: Contracts, policies, invoices, audit reports and aggregate statistics are usually public. Exemptions target specific investigative harms.
  • Claim: A big number of searches means abuse. What the evidence shows: Volume alone shows activity. Patterns, missing case numbers, and searches unrelated to any case are what point to problems, and they still need the agency's explanation.
  • Claim: Balance means equal time for each side. What the evidence shows: Balance means testing each side's claims with the same rigor and saying where the evidence points.

Reporting angle

Start a surveillance file for your area. Use the Atlas of Surveillance to list reported technologies, then confirm each with a contract or invoice. Calendar contract renewal dates; renewals bring the program back to a public meeting. Request audit reports on the schedule the law sets (twice a year under Idaho Code 49-1432), so your story can say whether the required audits actually happened.

Pictures, Numbers and Infographics

Surveillance programs come down to records, and records can be counted: location points per day, plate images per hit, matches per million faces. The figures here come from the Supreme Court, a state audit, a federal test lab and a national survey.

A young woman in a dark dress pulls a card of fingerprint and photo records from a drawer of a wooden card file cabinet
A clerk pulls a fingerprint record from a card file, photographed by the Washington, D.C., studio Harris & Ewing and dated 1923 in the Library of Congress catalog. Every search of a file like this took a person, a drawer and time. A plate reader or location database holds the same kind of record about far more people and answers a query in seconds, which is why lesson 2 says the database is where privacy lives. Credit: Harris & Ewing, Library of Congress Prints and Photographs Division. Public domain, via Wikimedia Commons.

By the numbers

  • 12,898 location points over 127 days: the cell-site records the government got about Timothy Carpenter from his wireless carriers, an average of 101 points a day. Supreme Court, Carpenter v. United States, 2018
  • 320 million: plate images the Los Angeles Police Department had stored. Only 400,000 of them produced an immediate hot list match, so 99.9 percent were of vehicles not on a hot list when photographed. California State Auditor, Report 2019-118, 2020
  • 70 percent: share of California police and sheriff departments, in the auditor's survey of 391, that operate or plan to operate a plate reader system. Roughly 84 percent of those running one share their images with other agencies. California State Auditor, 2020
  • 189 algorithms from 99 developers: tested by NIST on 18.27 million images of 8.49 million people from State Department, Homeland Security and FBI databases. National Institute of Standards and Technology, 2019
  • 10 to 100 times: how much higher the one-to-one false positive rates often ran for Asian and African American faces than for Caucasian faces, depending on the algorithm. The most equitable algorithms were also among the most accurate. NIST, 2019
  • 71 percent: U.S. adults who say they are worried about how the government uses people's data, up from 64 percent in 2019. And 79 percent say they have little or no control over what the government does with their data. Pew Research Center, 2023
Americans and their data Percent of U.S. adults (Pew survey, 2023) Worried about gov't use, 2019 64% Worried about gov't use, 2023 71% Little or no control: companies 73% Little or no control: gov't 79%
Worry about government use of data rose between Pew's 2019 and 2023 surveys, and most adults say they have little control over it. Source: Pew Research Center, How Americans View Data Privacy, 2023.
Is it a search? Six decades of answers Supreme Court cases from lesson 1. Blue: a search. Orange: no search. 1967 Katz v. United States Bug on a phone booth. A search; the privacy expectation test. 1976 United States v. Miller Bank records by subpoena. No search. 1979 Smith v. Maryland Pen register on dialed numbers. No search. 2012 United States v. Jones GPS tracker on a car for 28 days. A search. 2014 Riley v. California Phone searched after arrest. Warrant generally needed. 2018 Carpenter v. United States 127 days of cell-site records. A search. 2026 Chatrie v. United States Google Location History from a geofence. A search.
The third-party cases of the 1970s said no search; the digital cases since 2012 have mostly said yes. Holdings as summarized in lesson 1. Sources: Carpenter opinion, 2018; Chatrie opinion, 2026.

Check yourself

1. Under Idaho Code 74-103, how long does an agency have to respond to a public records request from an Idaho resident?

2. Which record best shows who outside your local agency can search its plate reader data?

3. An audit log export shows 1,240 searches in 30 days; 310 have the purpose field 'investigation' with no case number. What share lack a case number?

4. Idaho Code 74-124 lets agencies withhold investigatory records only to the extent disclosure would cause certain harms. Which item is NOT listed as protected under that exemption?

5. What is the fairest way to handle an agency's claim that its cameras 'solved 120 cases last year'?

6. Which document usually sets the vendor's rights to use agency data?

Terms in this lesson

Memorandum of understanding (MOU)
A written agreement between agencies, often covering data sharing, task forces or equipment loans.
Retention schedule
An official list setting how long each type of record must be kept before it can be destroyed.
Usage statistics
Counts that show how a tool is used: searches, alerts, stops, arrests, requests from other agencies.
Deemed denial
Under Idaho law, a records request not answered within the deadline is treated as denied, which opens the appeal route.
Surveillance ordinance
A local law requiring public approval and reporting before agencies buy or use surveillance technology.

Full glossary

Sources