.55 EXECUTIVE DECISION DOCUMENT GENERAL MANAGER APPROVAL: GENERAL MANAGER ACTION e) ?SC-?it 20? 69 Forward to Board of Directors 5" 41-64. CW DATE: 1/30/2017 BOARD INITIATED ITEM: Yes Originator/Prepared by: Matthew Burrows \Gen ral ounsel Controller/Treasurer District Secretary BARC Dept: Office of the General Counsel ,i ?w 42/61] [1 [1 l/ f\ 1 {Sig ture te: ?aw/7 qibik?? District Surveillance Technology Policy/Ordinance PURPOSE: To bring to the Board for its consideration a comprehensive policy governing the use of surveillance technology at the District. DISCUSSION: In 2016, while considering the implementation of an Automatic License Plate Reader, the Board directed staff to delay such implementation until a surveillance policy had been considered and approved by the Board. The matter was referred to the technology and communications committee for further work over several public meetings, between which staff and representatives from the public met to develop a document. Following review by the committee, District staff and representative(s) from both Oakland Privacyand-the American Civil Liberties Union continued meeting in an attempt to ?nd common ground and have developed the attached Surveillance Technology Policy ("Policy") for the Board's consideration. As detailed more extensively in the attached, the Policy generally requires Board of Directors' review and approval before new surveillance technology is purchased and implemented and before existing surveillance technology is used in a manner or location different than had already been approved. Approval of grants for surveillance technology also will require Board approVal. Staff must also report to the Board at a publicly noticed meeting about surveillance technOlogy currently in Use at the District. Required approvals will occur through various reports brought to the Board at publicly noticed meetings. Those reports to the Board will be publicly released at least 15 days prior to their consideration and may only be approved if the Board determines that the bene?ts to the community outweigh the costs and that the use reasonably safeguards civil liberties and Surveillance Policy rights. Approvals under this Policy are subject to annual review by the Board of Directors to assist the Board in its ongoing oversight. Limited exceptions exist for use of surveillance technology in exigent circumstances or for the testing of equipment being considered by the District. FISCAL IMPACT: Implementation of this Policy will begin 1n FY19 and will be funded with existing operating and capital rescurces in Maintenance and Engineering, the Police Department, and the Of?ce of the Chief Information Of?cer. . Capital funding will be subject to certi?cation of funding availability by the Of?ce of the Controller/Treasurer. Operating funding for subsequent years, if necessary, will be included in the proposed annual budget, which is subject to Board approval. This action is not anticipated to have any Fiscal Impact on unprogrammed District reserves in the current Fiscal Year. ALTERNATIVES: The direction given staff by the Board of Directors was to draft a policy for the Board's consideration. The community groups that participated in the formulation of this draft seek that the policy actually be codi?ed by ordinance, with the ability of a prevailing plaintiff to be awarded attorneys' fees by a court. A difference between a policy and an ordinance is in its enforcement. A policy is enforced by the BART Board of Directors. An ordinance may be enforced by a court of law. The Board could direct these rules to be codi?ed as an ordinance, a copy of which is also attached. This meeting would constitute the ?rst reading and a second reading would be required to occur at a future meeting. The Board could also direct staff to make additional changes or could decline to pass these proposed rules. RECOMMENDATION: This Is a Board directed Policy and has been discussed and considered by the now disbanded communications and technology committee. At the committee level, two cf the three members favored an ordinance, although without the inclusion of attorneys' fees. Staff recommends that the Board adopt these rules as a Policy, at least for an initial 2 year Surveillance Policy period so that staff may report back to the Board on how it has worked and with suggestions for changes, if any, based on experience, before it being codi?ed as an ordinance. SAMPLE MOTIONS: 1) That the Board of Directors approves the attached Surveillance Technology Policy; or 2) That the Board of Directors adopts the attached Surveillance Technology Policy and directs staff to return within 24 months with an update on how the Policy has worked in practice and if any changes should be considered by the Board before adopting these rules as an ordinance; or 3) That the Board of Directors directs, staff to return with the attached Ordinance Codifying the Surveillance Technology Policy for a second reading and consideration of the matter for adoption at that future meeting; 3a) . That the Board directs that the ordinance provide for attorneys' fees for a prevailing party. BART SURVEILLANCE TECHNOLOGY POLICY WHEREAS, the San Francisco Bay Area Rapid Transit District (BART) Board of Directors has invested heavily in maintaining a safe and secure transportation system hardened against terrorist - sabotage, vandalism and theft; and WHEREAS, the Board of Directors has and continues to believe that the safety and security of the BART system requires the maintenance and support of every technology available to maintain public safety and system security; and WHEREAS the Board recognizes that there 13 a point at which technological resources may be viewed to restrict or limit the reasonable expectation of privacy of the riding public; and WHEREAS, the Board wishes to harmonize these compelling interests in a manner that permits public discourse and discussion aboutthe decision?making process of adding new technologies for safety and security into the BART transit system; and WHEREAS, the Board of Directors recognizes that surveillance technology in public areas should be judiciously balanced with the need to reasonably protect recognized civil liberties, including privacy, free expression and public assembly; and WHEREAS, the Board of Directors ?nds that proper transparency, oversight and accountability are fundamental to minimizing risks to the afore- mentioned civil liberties posed by surveillance technologies, and WHEREAS, the Board of Directors ?nds it essential to have an informed public discourse about whether to adopt additional surveillance technology to that already utilized within the District; and WHEREAS, the existing infrastructure of surveillance technology already employed within the BART transportation system is extensive, it shall be grandfathered in as a "baseline"; and WHEREAS, the Board of Directors ?nds it desirable that safeguards be in place to protect reasonable expectations of privacy and freedom of speech and assembly, duly balanced against a need to preserve public peace and safety, and to address exigent circumstances before any'new surveillance technology is deployed; and WHEREAS, the Board of Directors ?nds that if either new surveillance technology is approved for use or existing technology is used in a materially different manner or for a materially different purpose in places where the'public enjoys a reasonable expectation of privacy or a right to expressive activities and public a8sembly, there must be clear internal policies and procedures to ensure that reasonable safeguards are being followed and that the surveillance technology?s bene?ts outweigh its costs. NOW, THEREFORE, BE IT RESOLVED that the Board of Directors of the San Francisco Bay Area Rapid Transit District adopts the following Policy: Section 1. Title This Policy shall be known as the Surveillance Technology Policy. Section 2. De?nitions The following de?nitions apply to this policy: 1) ?Surveillance Annual Report? means an annual written report concerning a speci?c surveillance technology in active use by the District that includes all of the following: a) A reasonably speci?c description of how the surveillance technology was used; b) Whether and how often data acquired through the use of the surveillance technology was shared with outside entities, the name of any recipient entity, the type(s) of data BART SURVEILLANCE TECHNOLOGY POLICY disclosed, under what legal standard(s) the information was disclosed, and the justi?cation for the disclosure(s); c) A summary of community complaints or concerns received by the BART District related to the surveillance technology; . d) The results of any internal audits, any information about violations of the Surveillance Use Policy, and any actions taken in response e) Information, including crime statistics, if the equipment is used to deter or detect criminal activity, that help the community assess whether the surveillance technolOgy has been effective at achieving its identi?ed purposes;- f) Statistics and information about public records act requests related to surveillance technology; and g) Total annual costs for the new surveillance technology, including personnel and other ongoing cost 2) District entity? means any department, bureau, division, or unit of the San Francisco Bay Area Rapid Transit District. The BART Police Department is considered to be a BART District entity, but may also be referenced directly when the BART Police Department is subject to additional requirements of this policy that are speci?c to the BART Police Department and do not apply to other BART District entities. 3) ?Surveillance technology? means any electronic device or system with the capacity to monitor and collect audio, visual, locational, thermal, or similar information on any individual or group. This includes, but is not limited to, drones with cameras or monitoring capabilities, automated license plate recognition systems, closed?circuit cameras/televisions, International Mobile Subscriber Identity (IMSI) trackers, global positioning system (GPS) technology, software designed to monitor social media services or forecast criminal activity or criminality, radio frequency identi?cation (RF ID) technology, body- -worn cameras, biometric identi?cation hardware or software, and facial recognition hardware or software. a) "Surveillance technology" does not include the following devices or hardware, unless they have been equipped with, or are modi?ed to become or include, a surveillance technology as de?ned in Section 1. routine of?ce hardware, such as televisions, computers, and printers, that is in widespread public use and will not be used for any surveillance or law enforcement functions; 2. Parking Ticket Devices 5 manually -operated, non-wearable, handheld digital cameras, audio recorders, and video recorders that are not designated to be used surreptitiously and Whose functionality is limited to manually capturing and manually downloading video and/or audio recordings; 4. surveillance devices that cannot record or transmit audio or video or be remotely accessed, such as image stabilizing binoculars or night vision goggles; 5. manually-operated technological devices used primarily for internal municipal entity communications and are not designated to surreptitiously collect surveillance data, such as radios and email systems; U) 6. 10. ll. 12. 13. 14. 15. 16. 17. BART SURVEILLANCE TECHNOLOGY POLICY municipal agency databases that do not contain any data or other information collected, captured, recorded, retained, processed, intercepted, or analyzed by surveillance technology; equipment designed to detect the presence of and/or identify the source of chemical, biological, radiological, nuclear or explosive materials; portable or ?xed observations towers designed to provide an elevated viewing platform for facility security; the BART Watch app or similar successor apps for making reports to the District. the BART. gov web site and platform; BART databases and enterprise systems that contain information kept in the ordinary course of BART business, including, but not limited to, human resource, permit, license and business records; BART Police Department computer aided dispatch (CAD), records case management, Live Scan, booking, Department of Motor Vehicles, California Law Enforcement Telecommunications System (CLETS), 9-1-1 and related dispatch and operation or emergency services systems; BART Police Department early warning systems; Infrastructure and mechanical control systems (SCADA), including those that control or manage lights, utilities, train control, or fare collection; Physical access control systems, employee identi?cation management systems, and other physical control systems; Information technology security systems, including ?rewalls and other internal- facing cyber security, systems; Computers, software, hardware or devices used in monitoring the work and work- related activities involving District buildings, employees, contractors and volunteers or used in conducting internal investigations involving District employees, contractors or volunteers. 4) ?Surveillance Impact Report? means a publicly-released written report including at a minimum the followinginformation describing the proposed surveillance technology and how it generally works, information on the proposed purpose(s) for the surveillance technology; if applicable, the general location(s) it may be deployed, crime statistics for any location(s), if the equipment is used to deter or detect crime; an assessment identifying any potential impact on privacy rights and discussing any plans to safeguard the rights of the .public; the ?scal costs for the surveillance technology, including initial purchase, personnel and other ongoing costs, and any current or potential sources of funding; whether use or maintenance of the technOlogy will require data gathered by the technology to be handled or stored by a third-party vendor on an ongoing basis; a summary of alternative methods (whether involving the use of a new technology or not) considered before deciding to use the proposed surveillance technology, including the_costs and bene?ts associated with each alternative and an explanation of the reasons why each alternative is inadequate or undesirable; and U) 5) BART SURVEILLANCE TECHNOLOGY POLICY i) a summary of the experience, if any is known, other law enforcement entities have had with the proposed technology, including information about the effectiveness, any known adverse information about the technology such as unanticipated costs, failures, civil rights or civil liberties issues. "Surveillance Use Policy" means a publicly-released policy for use of the surveillance technology that at a minimum speci?es the followingPurpose: The purpose(s) that the surveillance technology is intended to advance. Authorized Use:-The uses that are authorized, the rules and processes required prior to such use, and the uses that are prohibited. Data Collection: The information that can be collected by the surveillance technology. Data Access: The individuals (as a category) who can access or use the collected information, and the rules and processes required prior to access or use of the information. Data Protection: The safeguards that protect information from unauthorized access, including and access control mechanisms. Data Retention: The time period, if any, for which information collected by the surveillance technology will be routinely retained, the reason such retention period 18 appropriate to further the purpose(s), the process by which the information IS regularly deleted after that period lapses, and the speci?c conditions that must be met to retain information beyond that period. Public Access: How collected information can be requested by members of the public, including criminal defendants. Third Party Data Sharing. If and how other BART District or non? District entities can access or use the information, including any required justi?cation or legal standard necessary to do so and any obligations imposed on the recipient of the information. Training: A summary of the training required for any individual authorized to use the surveillance technology or to access information collected by the surveillance technology. Auditing and Oversight: The mechanisms to ensure that the Surveillance Use Policy IS followed, including internal personnel assigned to ensure compliance with the policy, internal recordkeeping of the use of the technology or access to information collected by the technology, technical measures to monitor for misuse, any independent person or entity with oversight authority. The District must seek approval from the Board before implementing any changes to any Surveillance Use Policy. 6) "Exigent circumstances" means the BART Police Department's good faith belief that an emergencyinvolving danger, death, or serious physical injury to any person requires the immediate use of a surveillance technology, or the information it provides, without pre-approval. Section 3. Board of Directors Review 1) A BART District entity will obtain Board of Directors approval at a properly-noticed public meeting prior to any of the following: BART SURVEILLANCE TECHNOLOGY POLICY a) Accepting funds for new surveillance technology, applying for a grant, or soliciting or accepting state or federal funds or in-kind or other donations; (1) If it is determined that the timetable for applying for surveillance technology funding is not compatible with the notice requirements of Section the General Manager is authorized to apply for grants after providing a written justi?cation to the Board of Directors at least ?ve calendar days prior to the deadline for applying for or accepting the relevant funding. Any such notices shall be agendized for public discussion at the next regular meeting of the Board of Directors if that meeting is at least 10 days from the date the notice is sent. If the notice is sent less than 10 days from the next regular meeting, it shall be agendized for public discussion at the following regular meeting. Any funding awarded to a BART District entity following such an application remains subject to the regular review, approval, and oversight requirements of Sections 3, 4, and 5. . b) Acquiring surveillance technology, with or without consideration, except for those occasions when a BART District entity conducts a limited scope trial of technology to assess its viability. Such trial shall be limited to a single station or facility, last no longer than 90 days, and shall be agendized for public discussion at the ?rst regular meeting of the Board of Directors following the completion of the trial. (1) The BART District will not disclose to any third party information acquired during use of this exception unless disclosure is, similar to the Section 11 exigent circumstances provision (A) for purposes of responding to an emergency and the third party agrees to be bound by the restrictions in this Section or is (B) otherwise required by law enforcement or response agencies that identify the information as pertaining to an active investigation, or is (C) otherwise required by law. A (2) Following conclusion of the testing, the BART District will only keep and maintain data related to the results of the testing and will immediately dispose of any data not relevant'to the evaluation of the ?tness of the technology unless retention is authorized by a court order or (ii) Otherwise required by law. 0) Using new surveillance technology, or using existing surveillance technology for a purpose, in a manner or in a materially different type of location not previously approved by the Board of Directors; or d) Entering into a written agreement. or memorandum of understanding with a non- BART District entity to acquire, share or otherwise use surveillance technology or the information it provides unless such information is provided by way of BART Watch or any successor smart phone application associated with that speci?c software. . 2) Any BART District entity will obtain Board of Directors approval of a Surveillance Use Policy applicable for newly acquired'technologies in any of the activities described in subsection BART SURVEILLANCE TECHNOLOGY POLICY Section 4. Information Required 1) The BART District entity seeking approval under Section 3 shall submit to the Board of Directors a Surveillance Impact Report and a draft Surveillance Use Policy at least twenty-one (21) days prior to the public meeting where approval will be requested. 2) The Board of Directors shall publicly release, in print and online, the Surveillance Equipment Request and draft Surveillance Use Policy at least ?fteen (15) days prior to the public meeting. - Section 5. Determination by Board of Directors that Bene?ts Outweigh Costs and Concerns The Board of Directors shall approve any action described in section 3, subsection (1) .or Section 6 of this policy only after making a determination that the bene?ts to the community of the surveillance technology outweigh the costs, and the proposed use policy will reasonably safeguard civil liberties and civil rights. Section 6. Compliance for Existing Surveillance Technology 1) Each BART District entity possessing or using surveillance technology prior to the effective date of this policy shall submit a draft Surveillance Use Policy and Surveillance Impact Report no later than one hundred eighty (180) days following the effective date of this policy for review and approval by Board of Directors. The Board of Directors may grant extensions to this requirement. If such an extension is granted, a status report must be prepared and submitted to the Board of Directors at a public meeting no later than ninety (90) days from the date of said extension. The draft Surveillance Use Policy shall be made in a manner that is informative, but that will not undermine the District's legitimate security interests. I Section 7. Continuing Oversight of Surveillance Technology 1) Each BART District entity must submit for approval at a public hearing a Surveillance Annual Report for. each surveillance technology to the Board of. Directors on or before August 1. 2) The Board of Directors may grant extensions to this requirement. Commencing on the date 2 years from the effective date of this policy, no further extensions by the Board of Directors to this reporting/obligation for the BART Police Department can be made. While a Surveillance Annual Report shall reference and be inclusive of technologies in public places, such references may be made in a manner that will not undermine the District?s legitimate security interests. 3) Based upon information provided in the Surveillance Annual Report, the Board of Directors shall determine whether the bene?ts to the community of the surveillance technology implemented after the effective date of this policy outweigh the costs, and that civil liberties and civil rights are safeguarded. If the bene?ts do not outweigh the costs, or civil rights and civil liberties are not safeguarded, the Board of Directors shall direct that use of the surveillance technology cease and/or require modi?cations to the Surveillance Use Policy that Will resolve the above concerns." Section 8. Enforcement . 1) The provisions set forth in this policy of the Board of Directors are all intended to be enforceable exclusively by the Board of Directors. BART SURVEILLANCE TECHNOLOGY POLICY 2) Any perceived failure todischarge the ministerial duties imposed upon District of?cers or staff herein may be addressed by way of submitting the controversy to the Board of Directors for their intervention in a manner that accomplishes the public policies set forth herein. 3.) This policy does not create any right of action in favor of any aggrieved party or plaintiff. Section 9. CategoriCal Exemptions from this Policy 1) Any surveillance technologies in place before this policy was established may be replaced with technology with materially the same capacities and capabilities and shall be exempt from this policy except as to the annual reporting requirement, and (ii) surveillance technologies used exclusively by the BART Police Department. a) Any replacement of surveillance technologies that enhances or otherWise reasonably appears to upgrade enhance, improve, or expand) the capabilities of existing technologies shall NOT be exempt from this policy. Storage capacity increases to CCTV and independent lighting improvements (6. g. LED street lighting or improved stairway lighting) at a facility shall not be regarded to be an improvement or enhancement in surveillance technologies. 2) Any surveillance technologies owned and/or operated by third parties on BART facilities and not used by a BART District entity shall be exempt from this policy unless Section applies. 3) Any surveillance technologies within the secure perimeter of BART's administrative/maintenance/law enforcement facilities and of?ces shall be exempt from this policy. 4) Any surveillance technologies used to protect or monitor areas outside of publicly accessible locations including areas within fenced areas (such as, but not limited to, areas where train cars are parked during non-revenue hours or where the District maintains high voltage equipment) or areas prohibited to the public by signage (such as tunnels, or stairwells leading to the trackway) shall be exempt from this policy. Section 10. Severabilitv The provisions in this Policy are severable. If any part of provision of this Policy, or the application of this Policy to any person or circumstance, is held invalid, the remainder of this Policy, including the application of such part or provisions to other persons or circumstances, shall not be affected by such holding and shall continue to have force and effect. Section 11. Use of Unapproved Technology During Exigent Circumstances The BART Police Department may temporarily acquire or temporarily use surveillance technology in exigent circumstances Without following the provisions of the policy before that acquisition or use. If the BART Police Department acquires or uses a surveillance technology pursuant to this Section, it shall do all of the following: a) Use the surveillance technology to solely respond to the exigent circumstances; b) Cease using the surveillance technology within seven days or When the exigent circumstances end, whichever is sooner; 0) Only keep and maintain data related to the exigent circumstances and dispose of any data that is not relevant to an ongoing investigation unless retention is authorized by a court or (ii) otherwise required by law; BART SURVEILLANCE TECHNOLOGY POLICY d) Not disclose to any third party any information acquired during exigent circumstances, unless disclosure is for purposes of responding to the emergency and the third party agrees to be bound by the restrictions in this Section or is (ii) otherwise required by law enforcement or response agencies that identify the material is needed to prevent, deter, respond to and or document signi?cant criminal action such as a terrorist attack, homegrown violent extremist attack or other activity or threats that endanger public safety or transportation infrastructures, or is otherwise required by law; e) Within 30 days following the end of the exigent circumstances report the acquisition or use to the Board of Directors at a regular meeting of the Board of Directors for discussion and/or possible recommendation for approval to acquire or use the surveillance technology; and f) Any technology temporarily acquired in exigent circumstances shall be returned when the exigent circumstances end unless the technology is submitted to the Board of Directors for approval pursuant to this policy and is approved. Section 12. Effective Date This Policy shall take effect on the date it is adopted by the Board of Directors.