Chula Vista City Council
November 1, 2022

WRITTEN COMMENTS SUBMITTED TO THE TASK FORCE
APRIL 25, 2022 - SEPTEMBER 26, 2022
Written comments received by Task Force 4/25/22 - 9/26/22: Page 1 MeetingDate AgendaItem Name Comment
5/ 9/ 2022 18:00
PUBLIC

COMMENTS -

ITEMS NOT ON

THE AGENDA
Seth Hall
Thank you to the City of Chula Vista and to Madaffer Enterprises for convening this important task force. As soon as possible, please consider voting on a resolution that reassures the viewing public that the task force chairperson and members have taken control of the task forces agenda. From an outside perspective, itappears so far that the agenda is controlled by a party who is not the chairperson, vice chairperson, or any seated member of the task force. This may have been necessary for the first meeting, but should no longer be the case going forward. In orderfor the public to have confidence the task force is being properly led by the communitys task force members, the task force must control its own agenda, and accordingly must control the minutes of the task force meeting. Each task force member is attaching their personal name to the work and outcomes of this task force, so each member deserves a fair and formal process for selecting how to spend the time you have. Thank you to each task force member for their volunteer time and attention to the important topic of privacy and surveillance technology.
5/ 9/ 2022 18:00
Presentation
on privacy in
other
California
cities
Seth Hall
Thank you to the City for assembling this summary of how so many cities are tackling the challenges of ensuring surveillance technology is operated according to best practices and designed to protect residents from potential abuse.

As a member of the TRUST SD Coalitions Steering Committee, working on these same topics in San Diego, I personally would like to add that San Diego is on the cusp of adding a community-led oversight process that is very similar to the one in Oakland, which is summarized in the citys document. Our Privacy Advisory Board received final approval in April. The TRUST Surveillance Oversight ordinance is undergoing labor negotiations and is not far from reaching its approval.

The TRUST SD Coalition only reached this goal by uplifting community voices that have been previously left out.

Ihave enormous optimism that this task force will make recommendations that will rebalance the needs of government with the inalienable rights of residents. While Chula Vista and San Diego are separated by borders on a map, our two cities are profoundly intertwined, and our communities share many fates. As such, the TRUST SD Coalition is advocating for Chula Vista to be represented among the members of San Diegos upcoming Privacy Advisory Board.

Ihope our cities can be close collaborators in enabling only safe and effective surveillance technology in our region, while we all work to acknowledge and prioritize the fundamental rights of our community members.
6/ 8/ 2022 18:00
Receive and
File Meeting
Summaries
Margaret Baker
Thank you for providing notes in a timely manner. Here are some changes that would help the general public engage more easily: The agenda item numbers need to be included for each item in the notes. Also, the physical location of each meeting should be included.

A link to the post-meeting agenda would facilitate access to public e-comments, attachments and PPT presentations, and video-recordings of the meetings. The background documents and other archived materials for the Task Force are not easy to find. The meeting summaries fail to list former City Manager Gary Halpert who was participating on the dais. Could his role please be clarified in the meeting notes? 6/ 17/ 2022 7:00 Sandra This is test from eSCRIBE at 8:42AM EST 6/ 17/ 2022 7:00 Sandra Ihad the tab open never closed- leaving comment at 9:11 Am EST Comment was supposed to close at 9:00am EST
Written comments received by Task Force 4/25/22 - 9/26/22: Page 2 8/ 15/ 2022 18:00 PUBLIC
COMMENTS Nancy Relaford
This agenda seems like a last minute demolition of both the process and the timeline for the Task Forces work. Where did the idea come from to send barely discussed draft reports to City department heads and key staff for consideration and response at this point in the process, before recommendations have been finalized and submitted to the City Manager for her report to Council?
All of the reports posted with the agenda are clearly preliminary and need research and discussion in the next weeks. They are not ready to be vetted for implementation by departments even in the most general sense. As just one example, the Privacy Oversight & Transparency Subcommittee Report draft would from editing and discussion:

Disclaimer is used where Policy is meant; both may be needed, but the difference is critical
More research is needed into existing legal requirements that the City is already bound to comply with (and whether it is currently in compliance); for example, ALPR operation, privacy policy, and breach disclosure are governed by CA SB-34: Automated license plate recognition systems: use of data.

There are many more examples in all of the reports; the point is that these reports are not, and last we heard were not expected to be, complete enough after cursory discussion today to be considered and responded to outside of the Task Force process and original timeline. I trust the Task Force members will push back on this bizarre expectation. 8/ 15/ 2022 18:00 Work Session
3 Margaret Baker
Iam writing to thank Task Force members for their time, expertise, and commitment to set in place processes that will protect the civil liberties and proper governance of technology and data that the City is already using and types and uses going forward. I also am writing in strong opposition to the process proposed for tonight's Work Session. The Task Force should NOT submit the preliminary policy recommendations for consideration by City staff at this time. Community members have not had an opportunity to review them and the draft recommendations do not reflect the community's efforts to provide a process and ordinances to protect civili rights and civil liberties. The stated deadline for the work of the Task Force is already too short, and there is not adequate opportunity for deliberation and robust community input on these important policy provisions.
8/ 22/ 2022 18:00 Work Session
4 Nancy Relaford
ADD" Any required notifications, policy postings, disclosures, signage, or other actions mandated under State law (e.g. SB-34) or other laws and ordinances must be researched, included inpolicies, and followed. When in doubt, the City should opt for broader adherence to the spirit of the law or requirement, rather than narrow technical compliance. In addition, Welcoming City criteria must be considered as part of surveillance technology policy and transparency review." Something like this needs to be added to the recommendations. There are very clear requirements for ALPR policy posting and breach notifications spelled out in SB34 and I'm sure other technologies have similar requirements that the city should be in compliance with. The part about the spirit of the law rather than technical compliance would have prevented the City deciding that sharing ALPR with ICE didnt violate state law because it doesn't technically contain PII. That was an extremely narrow and incorrect interpretation.

Written comments received by Task Force 4/25/22 - 9/26/22: Page 3 April 25, 2022
City of Chula Vista
Technology and Privacy Advisory Task Force
276 Fourth Avenue
Chula Vista, California 91910
Email: [email protected]
RE: Surveillance Technology Ordinance
Dear Members of the Chula Vista Technology and Privacy Advisory Task Force:

I write today on behalf of the Electronic Frontier Foundation (EFF), a California-based nonprofit that advocates for civil liberties as society adopts more and more advanced technologies. Our organization has helped to develop, inform, and enforce municipal surveillance oversight programs across the United States. In my personal capacity, I was recently honored with the San Diego Society of Professional Journalists' Sunshine Award for bringing transparency to the types of surveillance in use across San Diego County.1 We congratulate the city of Chula Vista for taking this first step towards reviewing surveillance technologies through the lens of privacy. However, more needs to be done.

We urge the Task Force to cooperate with local civil rights and social justice organizations to negotiate a robust surveillance oversight ordinance that allows for public involvement and transparency, and that designates the power of final approval of technology acquisitions and policies to elected officials.

Too often, public safety agencies acquire powerful technologies after closed-door conversations with vendors, shutting the community out of discussions that will have a significant impact on their rights. Privacy, civil rights, and individual freedoms are often either an afterthought for officials or seen as a hindrance to investigations, when in reality addressing these issues is a crucial element to public safety and maintaining a healthy relationship between the government and its constituents. Without proper deliberation and safeguards, surveillance technology can have a number of deleterious effects, including misuse, racial and socio-economic bias, over-policing, and waste of public 1 Fraley, Malaika. "EFF Director of Investigations Dave Maass Honored With Sunshine Award For Driving Public Disclosure of Government Surveillance Records." Electronic Frontier Foundation. March 23, 2022. https://www.eff.org/deeplinks/2022/03/eff-director-investigations-dave-maass-honored-sunshine-award-dri ving-public

EELECTRONIC FRONTIER

FOUNDATION
FF
815 Eddy Street, San Francisco, CA 94109 USA phone +l.415.436.9333 fax +l.415.436.9993 email [email protected] eff.org Written comments received by Task Force 4/25/22 - 9/26/22: Page 4 RE: Surveillance Technology Ordinance
April 25, 2022

funds.

In recent years, the Chula Vista Police Department (CVPD) has adopted sophisticated surveillance technologies that have proven controversial and damaging to community relations. Of these, one of the most troubling has been the use of automated license plate readers to collect data on drivers, which CVPD was found to have shared with immigration enforcement agencies in apparent violation of multiple state laws.2 CVPD has also deployed the "Drones as First Responders" program, an unorthodox system at odds with commonly accepted use across the United States. While many police agencies use drones sparingly for emergency situations, swat operations, or documenting crime scenes, CVPD has deployed drones more than 10,000 times to respond to routine calls for service, including a variety of low-level incidents such as vandalism and people sleeping in public.for34 In fact, welfare checks and psychological evaluations accounted 19% of drone-involved cases— incidents that social workers and mental health professionals would be better suited to address than remote-controlled police robots. If a member of the community were to read CVPD's formal policy for Unmanned Aerial System (UAS) Operations, they would discover a bare, 2½-page document generated by the company Lexipol.program5 They would not get a clear understanding of how the works or what safeguards are in place. In addition, Voice of San Diego raised legitimate questions about the relationship between CVPD officers and the drone vendor, which has resulted in an employment "revolving door."6
CVPD has been planning to build a real-time crime center (RTCC), a surveillance facility that would allow police to analyze and combine data from a large variety of sources, including drones and license plate readers.vendors7 This model of policing, pushed by with much to gain, should raise red flags for public officials, especially without strong 7 Marx, Jesse. " Chula Vista Is Building a Real-Time Crime Center." Voice of San Diego. Sept. 2, 2021. https://voiceofsandiego.org/2021/09/02/chula-vista-is-building-a-real-time-crime-center/ 6 Mejías Pascoe, Sophia. "Chula Vista PD’s Drone Program Opened a Revolving Door for Officers." Voice of San Diego. April 6, 2021.
https://voiceofsandiego.org/2021/04/05/chula-vista-pds-drone-program-opened-a-revolving-door-for-officer s/
5 Chula Vista Police Department. "Policy 613: Unmanned Aerial System (UAS) Operations." February 20, 2020. https://www.chulavistaca.gov/home/showpublisheddocument/16381/637178753321100000 4 Mejías Pascoe, Sophia. "Police Drone Footage Is Off Limits – Unless This Legal Challenge Takes Flight." Voice of San Diego. May 5, 2021.
https://voiceofsandiego.org/2021/05/05/police-drone-footage-is-off-limits-unless-this-legal-challenge-takes flight/
3 Chula Vista Police Department. "Drone Program." Retrieved April 22, 2022. https://www.chulavistaca.gov/departments/police-department/programs/uas-drone-program 2 Solis, Gustavo. "Chula Vista gives immigration officials, others access to license plate reader data." San Diego Union-Tribune. Dec. 6, 2020.
https://www.sandiegouniontribune.com/communities/south-county/chula-vista/story/2020-12-06/chula-vist a-gives-immigration-officials-others-access-to-license-plate-reader-data 815 Eddy Street, San Francisco, CA 94109 USA phone +l.415.436.9333 fax +l.415.436.9993 email [email protected] eff.org Written comments received by Task Force 4/25/22 - 9/26/22: Page 5 RE: Surveillance Technology Ordinance
April 25, 2022

controls grounded in community input. Such a center would supercharge privacy-invasive surveillance, without commensurate improved oversight.

The Task Force has quite the task ahead of you, but by promoting an ordinance that is inclusive of communities and permanently shifts power to elected officials, the city of Chula Vista will be better suited to balance public safety with privacy and civil liberties.

Best regards,
Dave Maass
Director of Investigations
Electronic Frontier Foundation
815 Eddy Street, San Francisco, CA 94109 USA phone +l.415.436.9333 fax +l.415.436.9993 email [email protected] eff.org Written comments received by Task Force 4/25/22 - 9/26/22: Page 6 Written comments received by Task Force 4/25/22 - 9/26/22: Page 7 Written comments received by Task Force 4/25/22 - 9/26/22: Page 8 Written comments received by Task Force 4/25/22 - 9/26/22: Page 9 Written comments received by Task Force 4/25/22 - 9/26/22: Page 10 Written comments received by Task Force 4/25/22 - 9/26/22: Page 11 Written comments received by Task Force 4/25/22 - 9/26/22: Page 12 Written comments received by Task Force 4/25/22 - 9/26/22: Page 13 Written comments received by Task Force 4/25/22 - 9/26/22: Page 14 Written comments received by Task Force 4/25/22 - 9/26/22: Page 15 Written comments received by Task Force 4/25/22 - 9/26/22: Page 16 Written comments received by Task Force 4/25/22 - 9/26/22: Page 17 Written comments received by Task Force 4/25/22 - 9/26/22: Page 18 Written comments received by Task Force 4/25/22 - 9/26/22: Page 19 Written comments received by Task Force 4/25/22 - 9/26/22: Page 20 Written comments received by Task Force 4/25/22 - 9/26/22: Page 21 Written comments received by Task Force 4/25/22 - 9/26/22: Page 22 Written comments received by Task Force 4/25/22 - 9/26/22: Page 23 Written comments received by Task Force 4/25/22 - 9/26/22: Page 24 Written comments received by Task Force 4/25/22 - 9/26/22: Page 25 Appendix C: Public Disclosure and Review Process
Written comments received by Task Force 4/25/22 - 9/26/22: Page 26 Written comments received by Task Force 4/25/22 - 9/26/22: Page 27 Appendix D: Sample Ordinances
Written comments received by Task Force 4/25/22 - 9/26/22: Page 28 Appendix D: Sample Ordinances
Written comments received by Task Force 4/25/22 - 9/26/22: Page 29 Appendix D: Sample Ordinances
Written comments received by Task Force 4/25/22 - 9/26/22: Page 30 Appendix D: Sample Ordinances
Written comments received by Task Force 4/25/22 - 9/26/22: Page 31 1 Jeremy Ogul
From: Jeremy Ogul
Sent: Monday, August 1, 2022 1:14 PM
To: Jeremy Ogul
Subject: FW: Privacy meetings
From: Jorge Marroquin <>
Sent: Sunday, July 31, 2022 1:50 PM
To: Adrianna Hernandez <[email protected]>
Subject: Privacy meetings
I was unable to attend the meeting due to other commitments but I feel you can't be safe without any type of surveillance equipment, why are residents buying home protection equipment alarms or cameras. If you have some problems with privacy stay home but if you have nothing to hide.

Enjoy the extra protection,, this is not big brother this is our elected government protecting all of us. I am a retired MTS rail (trolley) accident investigator and at present all public agencies require some type of surveillance equipment to locate and evidence of the 5% of criminals in our communities.

Present, timed out member of the Chula Vista safety commision.from the all new AOL app for Android Warning:

External
Email
Appendix D: Sample Ordinances
Written comments received by Task Force 4/25/22 - 9/26/22: Page 32 1 Jeremy Ogul
From: Margaret Baker <
Sent: Monday, August 1, 2022 1:20 PM
To: Privacy Task Force
Cc: Sophia Rodriguez
Subject: Community's proposed ordinances
Attachments: Revised Privacy Advisory Commission Ordinance_2022-07-15.pdf; Revised Surveillance and Community Safety Ordinance_2022-07-15.pdf
Dear Privacy Task Force members,
I am writing to make sure you each have copies of the ATTACHED community’s proposed ordinances, and to request that these two documents be posted as attachments for tonight’s Task Force meeting so that the general public can access them.

In addition, I am including the link to our group's PPT presentation that provides a clear outline of some of the major provisions of these ordinances, specifically, community-led oversight commission, and elements of the Surveillance Impact Reports and Surveillance Usage Policy. We hope that you will carefully review these provisions during your deliberations.

As you know, our community groups have worked diligently to research best practices, discuss options with local community members as well as leaders in cities that have already implemented such ordinances regarding what is needed and what works to protect our privacy. All agree that a community-led process is essential. We feel the city needs to establish BOTH a community-led Privacy Advisory Commission and a Usage Ordinance that establishes processes to codify clear usage policies for each type of surveillance, and to lay out processes for initial and ongoing review of impact and privacy protections, as well as regular reporting that includes provisions for robust community review and comment. We encourage you to start with some basic agreements on definitions, a set of guiding principles, and an outline of components of policy provisions before jumping to votes on details that require more research and consultation. The definitions and provisions included in the Surveillance and Community Safety Ordinance will help you to establish a common language.

Finally, I would like to thank you for your time and commitment to this challenging work, and to encourage you to continue to ask tough questions and to bring in concerns of often-marginalized members of our community about the need for enforceable, transparent civil rights protections in our city.

Sincerely,
Margaret A. Baker, DrPH
South Bay People Power promotes social justice through nonpartisan civic engagement.

Warning:

External
Email
Appendix D: Sample Ordinances
Written comments received by Task Force 4/25/22 - 9/26/22: Page 33 Privacy Advisory Commission Ordinance
Revised - July 15, 2022)
ORDINANCE NO. _________________

ORDINANCE OF THE CITY OF CHULA VISTA ESTABLISHING

THE CHULA VISTA PRIVACY ADVISORY COMMISSION

PROVIDING FOR THE APPOINTMENT OF MEMBERS

THEREOF, AND DEFINING THE DUTIES AND FUNCTIONS OF

SAID COMMISSION
WHEREAS, the Chula Vista City Council (City Council) finds that the use of surveillance technology is important to protect public health and safety, but such use must be appropriately monitored and regulated to protect the privacy and other rights of Chula Vista residents and visitors, and
WHEREAS the City of Chula Vista (the City) has been building on a detailed Smart City Strategic Action Plan since 2017 with limited opportunity for community input, oversight or control; and
WHEREAS Chula Vista seeks to maintain its designation by Welcoming America as a certified Welcoming City, City Council strives to comply with the criteria in the Welcoming Standard, in particular, relevant criteria relating to “Safe Communities”, “Equitable Access”, and Civic Engagement”; and
WHEREAS, the City Council recognizes the use of open data associated with surveillance technology offers benefits to the City, but those benefits must also be weighed against the costs, both fiscal and civil liberties; and WHEREAS, the City Council recognizes that surveillance technology may be a valuable tool to support community safety, investigations, and prosecution of crimes, but must be balanced with the individual’s right to privacy, it also; and WHEREAS, the City Council recognizes that privacy is not just a personal matter; there are societal consequences to privacy degradation over time as well as societal benefits with increased trust and transparency; and
WHEREAS, the City Council finds that surveillance technology includes not just technology capable of accessing non-public places or information, but also may include technology that aggregates publicly-available information, which, in the aggregate or when 1 Appendix D: Sample Ordinances
Written comments received by Task Force 4/25/22 - 9/26/22: Page 34 pieced together with other information, has the potential to reveal details about a person’s familial, political, professional, religious, or intimate associations; and WHEREAS, the City Council recognizes that government surveillance may chill associational and expressive freedoms; and
WHEREAS, the City Council recognizes that data from surveillance technology can be used to intimidate and oppress certain groups more than others, including those that are defined by a common race, ethnicity, religion, national origin, income level, sexual orientation, or political perspective; and
WHEREAS, the City Council finds that safeguards, including robust transparency, oversight, and accountability measures, must be in place to protect civil rights and civil liberties before City surveillance technology is deployed; and
WHEREAS, the City Council finds that decisions regarding if and how the City’s surveillance technologies should be funded, acquired, or used should include meaningful public input; and
WHEREAS, on January 18, 2022, City Council unanimously approved creation of a Technology and Privacy Advisory Task Force” to draft policy and recommendations to be presented to the City Council for consideration, and further requested that the City Administration prepare a “Citywide Technology Oversight Policy”; and WHEREAS, the said Technology and Privacy Advisory Task Force recommends creation of a new permanent citizen advisory board known as the “Privacy Advisory Commision” to advise the Mayor and City Council on transparency, accountability, and public deliberation in the City’s acquisition and usage of surveillance technology and data; and WHEREAS, Article VI, Section 600 of the City Charter reserves to the City Council the authority to create boards and commissions by ordinance, and to prescribe their function, powers, duties, membership, appointment, terms, qualifications, eligibility, reimbursements for expenses, if any;
NOW THEREFORE the City Council of the City of Chula Vista does hereby ordain as follows:

Section I. Establishment
A. Establishment and Appropriations
Pursuant to Article VI of the Charter of the City of Chula Vista, there is hereby created a Chula Vista Privacy Advisory Commission (hereinafter referred to as the “Privacy Commission” or “Commission”). Appropriations of funds sufficient for the efficient and proper functioning of the Privacy Commission shall be included in the annual budget by the City Council. 2 Appendix D: Sample Ordinances
Written comments received by Task Force 4/25/22 - 9/26/22: Page 35 B. Purpose and Intent
It is the purpose and intent of the City Council to establish a Privacy Commission to serve as an advisory body to the Mayor and City Council on policies and issues related to privacy and surveillance. The Commission will provide advice intended to ensure transparency, accountability, and public deliberation in the City’s acquisition and use of surveillance technology.

C. Definitions
For purposes of this ordinance, all words defined in the CVMC Chapter XXXX, known as the Chula Vista Surveillance and Community Safety Ordinance, have the same meaning herein.

D. Membership
The Privacy Advisory Commission shall consist of nine (9) members, who shall serve without compensation. At least six (6) members shall be Chula Vista residents. Members shall be appointed by the City Council.

E. Qualifications of Members
All members of the Privacy Advisory Commission shall be persons who have a demonstrated interest in privacy rights through work experience, civic participation, and/or political advocacy.

The City Council shall appoint the nine (9) members from the following representative areas of organization interest, expertise, and background:

1. At least one attorney or legal scholar with expertise in privacy or civil rights, or a representative of an organization with expertise in privacy or civil rights;

2. One auditor or certified public accountant;

3. One computer hardware, software, or encryption security professional;

4. One member of an organization that focuses on open government and transparency or an individual, such as a university researcher, with experience working on open government and transparency; and

5. At least four (4) members from equity-focused organizations serving or protecting the rights of communities and groups historically subject to disproportionate surveillance, including communities of color, immigrant communities, religious minorities, and groups concerned with privacy and protest.

Member qualifications and eligibility shall be in accordance with Chula Vista Charter Article VI, Section 602, and CVCM Section 2.25.030. No member shall have a state law-prohibited financial interest, employment, or policy-making position in any commercial or for-profit facility, research center, or other organization that sells data products, surveillance equipment, or otherwise profits from recommendations made by the Privacy Advisory Commission.

F.Terms
3 Appendix D: Sample Ordinances
Written comments received by Task Force 4/25/22 - 9/26/22: Page 36 Pursuant to Article VI, Section 602 of the City Charter, members shall be appointed by motion of the City Council adopted by at least three affirmative votes. The members thereof shall serve for a term of four (4) years and until their respective successors are appointed and confirmed. Members shall be limited to a maximum of two (2) consecutive terms and an interval of two (2) years must pass before a person who has served two (2) consecutive terms may be reappointed to the body upon which the member had served.

Initial members shall be appointed in staggered terms by lot. For the initial appointments, three (3) members shall be appointed to an initial term that will expire on June 30, 2023, and two (2) members shall be appointed to an initial term that will expire on June 30 of each subsequent year. Initial appointments to a term of two years or less shall not have the initial term count for purposes of the eight-year term limit.

G. Rules
The Commission shall hold regular meetings as required by ordinance of the City Council, and such special meetings as such commissions may require. All proceedings shall be open to the public.

At the first regular meeting, and subsequently at the first regular meeting of each year following the first day of July of every year, members of the Privacy Advisory Commission shall select a chairperson and a vice chairperson.

The Commission shall adopt rules for the government of its business and procedures in compliance with the law. The Commission rules shall provide that a quorum of the Privacy Advisory Commission is five people.

Pursuant to Article VI, Section 603 of the City Charter, the Commission shall have the same power as the City Council to compel the attendance of witnesses, to examine them under oath and to compel the production of evidence before it.

Section II. Privacy Advisory Commission: Duties and
Functions
A. Duties and Functions
The Privacy Advisory Commission shall:

1. Provide advice and technical assistance to the City on best practices to protect resident and visitor privacy rights in connection with the City’s acquisition and use of surveillance technology.

2. Conduct meetings and use other public forums to collect and receive public input on the above subject matter.

3. Review Surveillance Impact Reports and Surveillance Use Policies for all existing and new surveillance technology and make recommendations prior to the City seeking solicitation of funds and proposals for surveillance technology.

4. Submit annual reports and recommendations to the City Council regarding:
4 Appendix D: Sample Ordinances
Written comments received by Task Force 4/25/22 - 9/26/22: Page 37 a. The City’s use of surveillance technology; and
b. Whether new City surveillance technology privacy and data retention policies should be developed, or existing policies should be amended. c. Provide analysis to the City Council of pending federal, state, and local legislation relevant to the City’s purchase and/or use of surveillance technology. d. The Privacy Advisory Commission shall make reports, findings, and recommendations either to the City Manager or the City Council, as appropriate.

The Commission shall present an annual written report to the City Council. The Commission may submit recommendations to the City Council following submission to the City Manager.

B. Meetings and Voting
The Commission shall meet at an established regular interval, day of the week, time, and location suitable for its purpose. Such meetings shall be designated regular meetings. Other meetings scheduled for a time or place other than the regular day, time and location shall be designated special meetings. Written notice of special meetings shall be provided to the Commission members, and all meetings of the Commission shall comport with any City or State open meetings laws, policies, or obligations.

The Commission shall, in consultation with the City Manager, establish bylaws, rules and procedures for the conduct of its business by a majority vote of the members present. Voting shall be required for the adoption of any motion or resolution. Any action by the Commission shall be approved by a majority of members present, provided a quorum exists.

C. Staff
Staff assistance may be provided to the Board as determined by the City Manager, pursuant to his or her authority under the Charter to administer all affairs of the City under his or her jurisdiction.

Section III. Severability
If any portion of this Ordinance, or its application to any person or circumstance, is for any reason held to be invalid, unenforceable or unconstitutional, by a court of competent jurisdiction, that portion shall be deemed severable, and such invalidity, unenforceability or unconstitutionality shall not affect the validity or enforceability of the remaining portions of the Ordinance, or its application to any other person or circumstance. The City Council of the City of Chula Vista hereby declares that it would have adopted each section, sentence, clause or phrase of this Ordinance, irrespective of the fact that any one or more other sections, sentences, clauses or phrases of the Ordinance be declared invalid, unenforceable or unconstitutional.
5 Appendix D: Sample Ordinances
Written comments received by Task Force 4/25/22 - 9/26/22: Page 38 Section IV. Construction
The City Council of the City of Chula Vista intends this Ordinance to supplement, not to duplicate or contradict, applicable state and federal law and this Ordinance shall be construed in light of that intent.

Section V. Effective Date
This Ordinance shall take effect and be in force on the thirtieth day after its final passage.

Section VI. Publication
The City Clerk shall certify to the passage and adoption of this Ordinance and shall cause the same to be published or posted according to law.

Presented by: Approved as to form by
Maria Kachadoorian Glen R. Googins
City Manager City Attorney
6 Appendix D: Sample Ordinances
Written comments received by Task Force 4/25/22 - 9/26/22: Page 39 Surveillance & Community Safety Ordinance
Revised - July 15, 2022)

ORDINANCE ADDING CHAPTER XXXX TO THE CHULA VISTA
MUNICIPAL CODE ESTABLISHING RULES FOR THE CITY’S

ACQUISITION AND USE OF SURVEILLANCE TECHNOLOGY
WHEREAS, the City of Chula Vista (“City”) takes great public pride in its status as a Welcoming City and as a Smart City; and
WHEREAS, smart public safety decisions and the protection of all community members require that municipalities ensure public debate and community involvement in decisions about whether to acquire or use surveillance technology; moreover, that real public safety requires that residents have a voice in these decisions; and
WHEREAS, across the U.S. cities that have adhered to a “privacy bill of rights” approach are able to win public support in implementing the technology with proper safeguards in place to build trust. Alternatively, cities that implement new technology in secrecy, without oversight, without policy, and without broad and inclusive public input have found themselves facing scrutiny, lawsuits, and voter referendums to ban certain technologies.

WHEREAS, the City Council finds it is essential to have an informed public debate as early as possible about decisions related to the City’s acquisition and use of surveillance technology; and
WHEREAS, the City Council finds that, while the use of surveillance technology may threaten the privacy of all citizens, throughout history, surveillance efforts have been used to intimidate and oppress certain communities and groups more than others, including those that are defined by a common race, ethnicity, religion, national origin, income level, sexual orientation or political perspective; and
WHEREAS, while acknowledging the significance of protecting the privacy of citizens, the City Council finds that surveillance technology may also be a valuable tool to bolster community safety and aid in the investigation and prosecution of crimes; and WHEREAS, the City Council finds that surveillance technology includes not just technology capable of accessing non-public places or information (such as wiretaps) but also may include technology which aggregates publicly available information, because such information, in the aggregate or when pieced together with other information, has the potential to reveal a wealth of detail about a person’s familial, political, professional, religious, or sexual associations; and
1 Appendix D: Sample Ordinances
Written comments received by Task Force 4/25/22 - 9/26/22: Page 40 WHEREAS, the City Council finds that no decisions relating to the City’s use of surveillance technology should occur without strong consideration being given to the impact such technologies may have on civil rights and civil liberties, including those rights guaranteed by the California and United States Constitutions; and
WHEREAS, the City Council finds that any and all decisions regarding if and how the City’s surveillance technologies should be funded, acquired, or used should include meaningful public input and that public opinion should be given significant weight in policy decisions; and WHEREAS, the City Council finds that legally enforceable safeguards, including robust transparency, oversight, and accountability measures, must be in place to protect civil rights and civil liberties before any City surveillance technology is deployed; and WHEREAS, the City Council finds that if a surveillance technology is approved, data reporting measures must be adopted that empower the City Council and public to verify that mandated civil rights and civil liberties safeguards have been strictly adhered to.

NOW, THEREFORE, the City Council of the City of Chula Vista does ordain as follows:

Section I. Establishment
A. This Ordinance shall be known as the Surveillance and Community Safety Ordinance.

B. Chula Vista Municipal Code Chapter XXXX, is hereby added as set forth below:

Chapter XXXX. REGULATIONS ON CITY’S ACQUISITION AND USE OF SURVEILLANCE

TECHNOLOGY
C. Definitions

1.“ Annual Surveillance Report” means a written report concerning a specific surveillance technology that includes all the following:
a. A description of how the surveillance technology was used, including the type and quantity of data gathered or analyzed by the technology; b. Whether and how often data acquired through the use of the surveillance technology was shared with internal or external entities, the name of any recipient entity, the type(s) of data disclosed, under what legal standard(s) the information was disclosed, and the justification for the disclosure(s) except that no confidential or sensitive information should be disclosed that would violate any applicable law or would undermine the legitimate security interests of the City;
c. Where applicable, a description of the physical objects to which the surveillance technology hardware was installed without revealing the specific location of such 2 Appendix D: Sample Ordinances
Written comments received by Task Force 4/25/22 - 9/26/22: Page 41 hardware; for surveillance technology software, a breakdown of what data sources the surveillance technology was applied to;
d. Where applicable, a description of where the surveillance technology was deployed geographically, by each Police Area in the relevant year; e. A summary of community complaints or concerns about the surveillance technology, and an analysis of its Surveillance Use Policy and whether it is adequate in protecting civil rights and civil liberties. The analysis shall consider whether, and to what extent, the use of the surveillance technology disproportionately impacts certain groups or individuals; f. The results of any internal audits or investigations relating to surveillance technology, any information about violations or potential violations of the Surveillance Use Policy, and any actions taken in response. To the extent that the public release of such information is prohibited by law, City staff shall provide a confidential report to the City Council regarding this information to the extent allowed by law;
g. Information about any data breaches or other unauthorized access to the data collected by the surveillance technology, including information about the scope of the breach and the actions taken in response, except that no confidential or sensitive information should be disclosed that would violate any applicable law or would undermine the legitimate security interests of the City; h. A general description of all methodologies used to detect incidents of data breaches or unauthorized access, except that no confidential or sensitive information should be disclosed that would violate any applicable law or would undermine the legitimate security interests of the City; I. Information, including crime statistics, that helps the community assess whether the surveillance technology has been effective at achieving its identified purposes;
i. Statistics and information about Public Records Act requests regarding the relevant subject surveillance technology, including response rates, such as the number of Public Records Act requests on such surveillance technology and the open and close date for each of these Public Records Act requests; j. Total annual costs for the surveillance technology, including personnel and other ongoing costs, and what source of funding will fund the surveillance technology in the coming year; and
k. Any requested modifications to the Surveillance Use Policy and a detailed basis for the request.
3 Appendix D: Sample Ordinances
Written comments received by Task Force 4/25/22 - 9/26/22: Page 42

2.“ City” means any department, unit, program, and/or subordinate division of the City of Chula Vista as provided by Chapter XXXX of the Chula Vista Municipal Code.

3.“ City staff” means City personnel authorized by the City Manager or appropriate City department head to seek City Council Approval of Surveillance Technology in conformance with this Chapter.

4.“ Community meeting” means a publicly held meeting that is accessible, noticed at least seventy-two hours in advance in at least two languages, for the purpose of educating communities, answering questions, and learning about potential impacts of surveillance technology on disadvantaged groups.

5.“ Continuing agreement” means a written agreement that automatically renews unless terminated by one or more parties.

6.“ Exigent circumstances” means a City department’s good faith belief that an emergency involving imminent danger of death or serious physical injury to any individual requires the use of surveillance technology that has not received prior approval by City Council.

7.“ Facial recognition technology” means an automated or semi-automated process that assists in identifying or verifying an individual based on an individual’s face.

8.“ Individual” means a natural person.

9.“ Personal communication device” means a mobile telephone, a personal digital assistant, a wireless capable tablet and a similar wireless two-way communications and/or portable internet-accessing device, whether procured or subsidized by a City entity or personally owned, that is used in the regular course of City business.

10.“ Police area” refers to each of the geographic districts assigned to a Chula Vista Police Department captain or commander and as such districts are amended from time to time.

11.“ Surveillance” (or “spying”) means to observe or analyze the movements, behavior, data, or actions of individuals. Individuals include those whose identity can be revealed by data or combinations of data, such as license plate data, images, IP addresses, user identifications, unique digital identifiers, or data traces left by the individual.

12.“ Surveillance technology” means any software (e.g., scripts, code, Application Programming Interfaces), electronic device, or system utilizing an electronic device used, designed, or primarily intended to observe, collect, retain, analyze, process, or share audio, electronic, visual, location, thermal, olfactory, biometric, or similar information specifically associated with, or capable of being associated with, any individual or group. It also includes the product (e.g., audiovisual recording, data, analysis, report) of such surveillance technology. Examples of surveillance technology include, but are not limited to the following: cell site simulators (Stingrays); automated license plate readers; gunshot detectors (ShotSpotter); drone-mounted data collection; 4 Appendix D: Sample Ordinances
Written comments received by Task Force 4/25/22 - 9/26/22: Page 43 facial recognition software; thermal imaging systems; body-worn cameras; social media analytics software; gait analysis software; video cameras that can record audio or video and transmit or be remotely accessed. It also includes software designed to monitor social media services or forecast and/or predict criminal activity or criminality, and biometric identification hardware or software.

Surveillance technology” does not include devices, software, or hardware, unless they have been equipped with, or are modified to become or include, a surveillance technology beyond what is set forth below or used beyond a purpose as set forth below:
a. Routine office hardware, such as televisions, computers, credit card machines, badge readers, copy machines, and printers, that is in widespread use and will not be used for any public surveillance or law enforcement functions related to the public;
b. Parking Ticket Devices (PTDs) used solely for parking enforcement-related purposes, including any sensors embedded in parking sensors to detect the presence of a car in the space;
c. Manually-operated, non-wearable, handheld digital cameras, audio recorders, and video recorders that are not designed to be used surreptitiously and whose functionality is limited to manually-capturing and manually-downloading video and/or audio recordings;
d. Surveillance devices that cannot record or transmit audio or video or be remotely accessed, such as image stabilizing binoculars or night vision goggles; e. Manually-operated technological devices used primarily for internal municipal entity communications and are not designed to surreptitiously collect surveillance data, such as radios and email systems;
f. City databases that do not contain any data or other information collected, captured, recorded, retained, processed, intercepted, or analyzed by surveillance technology, including payroll, accounting, or other fiscal databases; g. Medical equipment used to diagnose, treat, or prevent disease or injury, provided that any information obtained from this equipment is used solely for medical purposes;
h. Police department interview room cameras;
i. City department case management systems;
j. Personal Communication Devices that have not been modified beyond stock manufacturer capabilities in a manner described above;
5 Appendix D: Sample Ordinances
Written comments received by Task Force 4/25/22 - 9/26/22: Page 44 k. Surveillance technology used by the City solely to monitor and conduct internal investigations involving City employees, contractors, and volunteers; and, l. Systems, software, databases, and data sources used for revenue collection on behalf of the City by the City Treasurer, provided that no information from these sources is shared by the City Treasurer with any other City department or third-party except as part of efforts to collect revenue that is owed to the City.

14. “Surveillance Impact Report” means a publicly-posted written report including, at a minimum, the following:
a. Description: Information describing the surveillance technology and how it works, including product descriptions from manufacturers; b. Purpose: Information on the proposed purposes(s) for the surveillance technology;
c. Location: The physical or virtual location(s) it may be deployed, using general descriptive terms, and crime statistics for any location(s); d. Impact: An assessment of the Surveillance Use Policy for the particular technology and whether it is adequate in protecting civil rights and liberties and whether the surveillance technology was used or deployed, intentionally or inadvertently, in a manner that may disproportionately affect marginalized communities;
e. Mitigations: Identify specific, affirmative technical and procedural measures that will be implemented to safeguard the public from each identified impact; f. Data Types and Sources: A list of all types and sources of data to be collected, analyzed, or processed by the surveillance technology, including open source data, scores, reports, logic or algorithm used, and any additional information derived therefrom;
g. Data Security: Information about the controls that will be designed and implemented to ensure that adequate security objectives are achieved to safeguard the data collected or generated by the surveillance technology from unauthorized access or disclosure;
h. Fiscal Costs and Sources: The forecasted, prior, and ongoing fiscal costs for the surveillance technology, including initial purchase, personnel, and other ongoing costs, and any past, current or potential sources of funding; 6 Appendix D: Sample Ordinances
Written comments received by Task Force 4/25/22 - 9/26/22: Page 45 i. Third-Party Dependence: Whether use or maintenance of the surveillance technology will require data gathered by the surveillance technology to be handled or stored by a third-party vendor at any time;
j. Alternatives: A summary of all alternative methods (whether involving the use of a new technology or not) considered before deciding to use the proposed surveillance technology, including the costs and benefits associated with each alternative and an explanation of the reasons why each alternative is inadequate;
k. Track Record: A summary of the experience (if any) other entities, especially government entities, have had with the proposed technology, including, if available, quantitative information about the effectiveness of the proposed surveillance technology in achieving its stated purpose in other jurisdictions, and any known adverse information about the surveillance technology such as unanticipated costs, failures, or civil rights and civil liberties abuses, existing publicly reported controversies, and any court rulings in favor or in opposition to the surveillance; and
l. Public engagement and comments: A description of any community engagement held and any future community engagement plans, number of attendees, a compilation of all comments received and City departmental responses given, and City departmental conclusions about potential neighborhood impacts and how such impacts may differ as it pertains to different segments of the community that may result from the acquisition of surveillance technology.

15. "Surveillance Use Policy" means a publicly-released and legally-enforceable policy for use of the surveillance technology that at a minimum specifies the following:
a. Purpose: The specific purpose(s) that the surveillance technology is intended to advance;
b. Use: The specific uses that are authorized, and the rules and processes required prior to such use;
c. Data Collection: The information that can be collected, captured, recorded, intercepted, or retained by the surveillance technology, as well as data that might be inadvertently collected during the authorized uses of the surveillance technology and what measures will be taken to minimize and delete such data. Where applicable, any data sources the surveillance technology will rely upon, including open source data, should be listed; 7 Appendix D: Sample Ordinances
Written comments received by Task Force 4/25/22 - 9/26/22: Page 46 d. Data Access: The job classification of individuals who can access or use the collected information, and the rules and processes required prior to access or use of the information;
e. Data Protection: The safeguards that protect information from unauthorized access, including logging, encryption, and access control mechanisms; f. Data Retention: The time period, if any, for which information collected by the surveillance technology will be routinely retained, the reason such retention period is appropriate to further the purpose(s), the process by which the information is regularly deleted after that period lapses, and the specific conditions that must be met to retain information beyond that period; g. Public Access: A description of how collected information can be accessed or used by members of the public, including criminal defendants; h. Third Party Data Sharing: If and how information obtained from the surveillance technology can be used or accessed, including any required justification or legal standard necessary to do so and any obligations imposed on the recipient of the information;
i. Training: The training required for any individual authorized to use the surveillance technology or to access information collected by the surveillance technology;
j. Auditing and Oversight: The procedures used to ensure that the Surveillance Use Policy is followed, including internal personnel assigned to ensure compliance with the policy, internal recordkeeping of the use of the surveillance technology or access to information collected by the surveillance technology, technical measures to monitor for misuse, any independent person or entity with oversight authority, and the legally enforceable sanctions for violations of the policy; and
k. Maintenance: The procedures used to ensure that the security and integrity of the surveillance technology and collected information will be maintained.

Section II. Privacy Advisory Commission
Commission”) Notification and Review Requirements
A. Commission Notification Required Prior to City Solicitation of Funds and Proposals for Surveillance Technology.

1. City staff shall notify the Chair of the Commission by written memorandum along with providing a Surveillance Use Policy and a Surveillance Impact Report prior to:
8 Appendix D: Sample Ordinances
Written comments received by Task Force 4/25/22 - 9/26/22: Page 47 a. Seeking or soliciting funds for surveillance technology, including but not limited to applying for a grant;
b. Soliciting proposals with any entity to acquire, share or otherwise use surveillance technology including the information it provides; or c. Formally or informally facilitating in a meaningful way or implementing surveillance technology in collaboration with other entities, including City ones.

2. Upon notification by City staff, the Chair of the Commission shall place the item on the agenda at the next Commission meeting for discussion and possible action. At this meeting, City staff shall present the Commission with evidence of the need for the funds or equipment, or shall otherwise justify the action City staff will seek Council approval for pursuant to Section III.

3. The Commission may make a recommendation to the City Council by voting for approval to proceed, by objecting to the proposal, by recommending that the City staff modify the proposal, or by taking no action.

4. If the Commission votes to approve, object, or modify the proposal, City staff may proceed and seek City Council approval of the proposed surveillance technology initiative pursuant to the requirements of Section III. City staff shall present to City Council the result of the Commission’s review, including any objections to the proposal.

5. If the Commission does not make its recommendation on the item within 90 calendar days of notification to the Commission Chair, City staff may proceed and seek City Council approval of the proposed Surveillance Technology initiative pursuant to the requirements of Section II.

B. Commission Review and Approval Required for New Surveillance Technology Before City Council Approval

1. Prior to seeking City Council approval under Section III, City staff shall submit a Surveillance Impact Report and a Surveillance Use Policy for the proposed new surveillance technology initiative to the Commission for its review at a publicly noticed meeting. The Surveillance Impact Report and Surveillance Use Policy must address the specific subject matter specified for each document as set forth in Section I.

2. The Commission shall approve, modify, or reject the proposed Surveillance Use Policy. If the Commission proposes that the Surveillance Use Policy be modified, the Commission shall propose such modifications to City staff. City staff shall present such modifications to the Commission for approval before seeking City Council approval under Section III.

3. Prior to submitting the Surveillance Impact Report, City staff shall complete one or more community meetings in each City Council district where the proposed surveillance 9 Appendix D: Sample Ordinances
Written comments received by Task Force 4/25/22 - 9/26/22: Page 48 technology is deployed, with opportunity for public comment and written response. The City Council may condition its approval of the proposed surveillance technology on City staff conducting additional community engagement before approval, or after approval as a condition of approval.

4. The Commission shall recommend that the City Council adopt, modify, or reject the proposed Surveillance Use Policy. If the Commission proposes that the Surveillance Use Policy be modified, the Commission shall propose such modifications to City staff. City staff shall present such modifications to City Council when seeking City Council approval under Section III.

5. If the Commission does not make its recommendation on a presented item within 90 days of notification to the Commission Chair pursuant to Section II, City staff may seek City Council approval of the item.

6. City staff seeking City Council approval shall schedule for City Council consideration and approval of the proposed Surveillance Use Policy, and include Commission recommendations, at least fifteen (15) days prior to a mandatory, properly noticed, germane public hearing. Approval may only occur at a public hearing.

C. Commission Review Requirements for Existing Surveillance Technology Before Seeking City Council Approval

1. Prior to seeking City Council approval for existing City surveillance technology used by the City under Section III, City staff shall submit a Surveillance Impact Report and Surveillance Use Policy for each existing surveillance technology to the Commission for its review, and for the public’s review, at least fifteen (15) days prior to a publicly noticed meeting, so the public can prepare for and participate in the Commission meetings. The Surveillance Impact Report and Surveillance Use Policy shall address the specific subject matters set forth for each document in Section I.

2. Prior to submitting the Surveillance Impact Report, City staff shall complete one or more community meetings in each City Council district where the proposed surveillance technology is deployed with opportunity for public comment and written response. The City Council may condition its approval on City staff conducting additional outreach before approval, or after approval as a condition of approval.

3. Prior to submitting the Surveillance Impact Report and proposed Surveillance Use Policy as described above, City staff shall present to the Commission, and for public review, a list of all surveillance technology possessed and/or used by the City.

4. The Commission shall rank the surveillance technology items in order of potential impact to civil liberties to provide a recommended sequence for items to be heard at Commission meetings. The Commission shall take into consideration input from City 10 Appendix D: Sample Ordinances
Written comments received by Task Force 4/25/22 - 9/26/22: Page 49 staff on the operational importance of the surveillance technology in determining the ranking to allow such matters to be heard in a timely manner.

5. Within sixty (60) days of the Commission’s action in Section II(C)(4), and continuing every month thereafter until a Surveillance Impact Report and a Surveillance Use Policy have been submitted for each item of the list, City staff shall submit at least one (1) Surveillance Impact Report and one (1) proposed Surveillance Use Policy per month to the Commission for review, generally beginning with the highest ranking surveillance technology items as determined by the Commission.

6. If the Commission does not make its recommendation on any item within 90 days of submission to the Commission Chair, City staff may proceed to the City Council for approval of the item pursuant to Section III.

Section III. City Council Approval Requirements for New and Existing Surveillance Technology
A. City staff shall obtain City Council approval prior to any of the following:

1. Accepting local, state, or federal funds, or in-kind or other donations for surveillance technology;
x2. Acquiring new surveillance technology, including but not limited to procuring such technology without the exchange of monies or consideration;

3. Using existing surveillance technology, or using new surveillance technology, including the information the surveillance technology provides, for a purpose, in a manner, or in a location not previously approved by the City Council pursuant to the requirements of this ordinance; or

4. Entering into a continuing agreement or written agreement with to acquire, share or otherwise use surveillance technology or the information it provides, including data-sharing agreements.

5. Notwithstanding any other provision of this section, nothing herein shall be construed to prevent, restrict or interfere with any person providing evidence or information derived from surveillance technology to a law enforcement agency for the purposes of conducting a criminal investigation or the law enforcement agency from receiving such evidence or information.

B. City Council Approval Process

1. After the Commission notification and review requirements in Section II have been met, City staff seeking City Council approval shall schedule a date for City Council consideration of the proposed Surveillance Impact Report and proposed Surveillance 11 Appendix D: Sample Ordinances
Written comments received by Task Force 4/25/22 - 9/26/22: Page 50 Use Policy, and include Commission recommendations, at least fifteen (15) days prior to a mandatory, properly-noticed, germane public hearing. Approval may only occur at a public hearing.

2. The City Council shall only approve any action as provided in this Chapter after first considering the recommendation of the Commission, and subsequently making a determination that the benefits to the community of the surveillance technology outweigh the costs; that the proposal will safeguard civil liberties and civil rights; and that, in the City Council’s judgment, no alternative with a lesser economic cost or impact on civil rights or civil liberties would be as effective.

3. For Approval of existing surveillance technology for which the Commission does not make its recommendation within ninety (90) days of review as provided for in Section II:
if the City Council has not reviewed and approved such item within four (4) City Council meetings from when the item was initially scheduled for City Council consideration, the City shall cease its use of the surveillance technology until such review and approval occurs.

C. Surveillance Impact Reports and Surveillance Use Policies as Public Records

1. Unless otherwise provided in this Ordinance, Surveillance Impact Reports and Surveillance Use Policies are public records.

2. City staff shall make all Surveillance Impact Reports and Surveillance Use Policies, as updated from time to time, available to the public as long as the City uses the surveillance technology in accordance with its request pursuant to Section II.

3. City staff shall post all Surveillance Impact Reports and Surveillance Use Policies to the City’s website with an indication of its current approval status and the planned City Council date for action.

Section IV. Use of Unapproved Surveillance Technology
during Exigent Circumstances
A. City staff may temporarily acquire or use surveillance technology and the data derived from that use in a manner not expressly allowed by a Surveillance Use Policy only in a situation involving exigent circumstances.

B. If City staff acquires or uses a surveillance technology in a situation involving exigent circumstances, City staff shall:

1. Immediately report in writing the use of the surveillance technology and its justifications to the City Council and the Commission;

2. Use the surveillance technology solely to respond to the exigent circumstances;

3. Cease using the surveillance technology when the exigent circumstances end; 12Written comments received by Task Force 4/25/22 - 9/26/22: Page 51

4. Only keep and maintain data related to the exigent circumstances and dispose of any data that is not relevant to an ongoing investigation or the exigent circumstances; and

5. Following the end of the exigent circumstances, report the temporary acquisition or use of the surveillance technology for exigent circumstances to the Commission in accordance with Section II of this ordinance at its next meeting for discussion and possible recommendation to the City Council.

C. Any surveillance technology acquired in accordance with exigent circumstances shall be returned within thirty (30) calendar days following when the exigent circumstances end, unless City staff initiates the process set forth for the use of the surveillance technology by submitting a Surveillance Use Policy and Surveillance Impact Report for Commission review within this 30-day time period. If City staff is unable to meet the 30-day deadline, City staff shall notify the City Council, who may grant an extension. In the event that City staff complies with the 30-day deadline or the deadline as may be extended by the City Council, City staff may retain possession of the surveillance technology, but may only use such surveillance technology consistent with the requirements of this Ordinance.

Section V. Oversight Following City Council Approval
A. Annual Surveillance Report

1. For each approved surveillance technology item, City staff shall present a written Annual Surveillance Report for the Commission to review within one year after the date of City Council final passage of such surveillance technology and annually thereafter as long as the surveillance technology is used.

2. If City staff is unable to meet the annual deadline, City staff shall notify the Commission in writing of staff’s request to extend this period, and the reasons for that request. The Commission may grant a single extension of up to sixty (60) calendar days to comply with this provision.

3. After review of the Annual Surveillance Report by the Commission, City staff shall submit the Report to the City Council.

4. The Commission shall recommend to the City Council: (a) that the benefits to the community of the surveillance technology in question outweigh the costs and that civil liberties and civil rights are safeguarded; (b) that use of the surveillance technology cease; or (c) propose modifications to the corresponding Surveillance Use Policy that will resolve any identified concerns.

5. If the Commission does not make its recommendation on the item within 90 calendar days of submission of the Annual Surveillance Report to the Commission Chair, City staff may proceed to the City Council for approval of the Annual Surveillance Report.

B. Summary Of All Requests And Recommendations And City Council Determination 13Written comments received by Task Force 4/25/22 - 9/26/22: Page 52

1. In addition to the above submission of any Annual Surveillance Report, City staff shall provide in its report to the City Council a summary of all requests for City Council approval pursuant to Section III for that particular surveillance technology and the pertinent Commission recommendation, including whether the City Council approved or rejected the proposal and/or required changes to a proposed Surveillance Use Policy before approval.

2. Based upon information provided in the Annual Surveillance Report and after considering the recommendation of the Commission, the City Council shall revisit its cost benefit” analysis as provided in Section III(B)(2) and either uphold or set aside the previous determination. Should the City Council set aside its previous determination, the City’s use of the surveillance technology must cease. Alternatively, City Council may require modifications to a particular Surveillance Use Policy that will resolve any concerns with the use of a particular surveillance technology.

Section VI. Enforcement
A. Violations of this article are subject to the following remedies:

1. Any material violation of this Ordinance, or of a Surveillance Use Policy promulgated pursuant to this Ordinance, constitutes an injury and any person may institute proceedings for injunctive relief, declaratory relief, or writ of mandate in the Superior Court of the State of California to enforce this Ordinance. An action instituted under this paragraph shall be brought against the City of Chula Vista and, if necessary, to effectuate compliance with this Ordinance or a Surveillance Use Policy (including to expunge information unlawfully collected, retained, or shared thereunder), any other governmental agency with possession, custody, or control of data subject to this Ordinance, to the extent permitted by law.

2. Any person who has been subjected to the use of surveillance technology in material violation of this Ordinance, or of a material violation of a Surveillance Use Policy, or about whom information has been obtained, retained, accessed, shared, or used in violation of this Ordinance or of a Surveillance Use Policy promulgated under this Ordinance, may institute proceedings in the Superior Court of the State of California against the City of Chula Vista and shall be entitled to recover actual damages (but not less than liquidated damages of $1,000 or $100 per day for each day of violation, whichever is greater).

3. A court may award costs and reasonable attorneys' fees to the plaintiff who is the prevailing party in an action brought under paragraphs A(1) and A(2) under Section VI above.
14Written comments received by Task Force 4/25/22 - 9/26/22: Page 53 Section VII. Contract for Surveillance Technology
A. Contracts and agreements for surveillance technology

1. It shall be unlawful for the City to enter into any contract or other agreement for surveillance technology that conflicts with the provisions of this Ordinance. Any conflicting provisions in any such contract or agreements, including but not limited to non-disclosure agreements, shall be deemed void and legally unenforceable. Any amendment or exercise of any option to any contract to obtain or use surveillance technology shall require City staff to comply with the provisions of this Ordinance.

2. To the extent permitted by law, the City shall publicly disclose all of its surveillance contracts, including any and all related non-disclosure agreements, if any, regardless of any contract terms to the contrary.

Section VIII. Whistleblower Protections
A. Neither the City nor anyone acting on behalf of the City may take or fail to take, or threaten to take or fail to take, a personnel action with respect to any employee or applicant for employment, including but not limited to discriminating with respect to compensation, terms and conditions of employment, access to information, restrictions on due process rights, or civil or criminal liability, because:

1. The employee or applicant was perceived to, about to, or assisted in any lawful disclosure of information concerning the funding, acquisition, or use of a surveillance technology or surveillance data based upon a good faith belief that the disclosure evidenced a violation of this Ordinance; or

2. The employee or applicant was perceived to, about to, had assisted in or had participated in any proceeding or action to carry out the purposes of this Ordinance.

B. It shall be grounds for disciplinary action for a City employee or anyone else acting on behalf of the City to retaliate against another City employee or applicant who makes a good-faith complaint that there has been a failure to comply with any Surveillance Use Policy or administrative instruction promulgated under this Ordinance.

C. Any employee or applicant who is injured by a violation of this Section may institute a proceeding for monetary damages and injunctive relief against the City in any court of competent jurisdiction.
15Written comments received by Task Force 4/25/22 - 9/26/22: Page 54 Section IX. Review of Existing Surveillance Use Policies and Adoption as Ordinances
A. Surveillance technology is considered existing if the City possessed, used, or has a contract in force and effect for the use of surveillance technology, or any resulting data, on the effective date of this Ordinance.

B. The requirement for City staff to present a list of all existing surveillance technology and, once ranked, to seek monthly Commission review and approval for the use of existing surveillance technology shall begin within sixty (60) days after the effective date of this Ordinance.

C. As per Section II, City staff shall return to City Council with an ordinance or ordinances for adoption and codification under the Chula Vista Municipal Code of all Surveillance Use Policies, but only after proper Commission and City Council review of any Surveillance Use Policies for existing surveillance technology, and with a 15-day public notice period in each instance to allow the public to prepare and participate in the meetings.

Section X. Severability
If any portion of this Ordinance, or its application to any person or circumstance, is for any reason held to be invalid, unenforceable or unconstitutional, by a court of competent jurisdiction, that portion shall be deemed severable, and such invalidity, unenforceability or unconstitutionality shall not affect the validity or enforceability of the remaining portions of the Ordinance, or its application to any other person or circumstance. The City Council of the City of Chula Vista hereby declares that it would have adopted each section, sentence, clause or phrase of this Ordinance, irrespective of the fact that any one or more other sections, sentences, clauses or phrases of the Ordinance be declared invalid, unenforceable or unconstitutional.

Section XI. Construction
The City Council of the City of Chula Vista intends this Ordinance to supplement, not to duplicate or contradict, applicable state and federal law and this Ordinance shall be construed in light of that intent.

Section XII. Effective Date
This Ordinance shall take effect and be in force on the thirtieth day after its final passage.
16Written comments received by Task Force 4/25/22 - 9/26/22: Page 55 Section XIII. Publication
The City Clerk shall certify to the passage and adoption of this Ordinance and shall cause the same to be published or posted according to law.

Presented by Approved as to form by
Maria Kachadoorian Glen R Googins
City Manager City Attorney
17Written comments received by Task Force 4/25/22 - 9/26/22: Page 56 1 Jeremy Ogul
From: Michael McDonald < >
Sent: Monday, August 1, 2022 1:21 PM
To: [email protected]
Subject: 7/27 Community Meeting - Technology & Privacy Advisory Task Force Dear Task Force members,
I attended the community forum on July 27, 2022 and would like to provide my feedback about the meeting for your attention and the record.

I was in Raf's (Rafael?) group and takeaways were as follows:

1. Most of the conversation was dominated by one person in particular who claimed he had prior experience with Chula Vista government and politics. He traded a lot of questions and remarks with the moderator and it appeared that Raf was in a defensive position the whole time instead of taking notes and facilitating a discussion. I'm not sure if there was an overall plan for the discussion groups prior to this meeting, but I did not feel the conversation was productive for all of us and I felt some members did not have a chance to voice their opinions, ideas and experiences. Please be mindful of individuals dominating the conversation and guide the conversation and take notes rather than taking any position that could be perceived as bias towards the City or the police department and allow others to share as well.

2. Based on the results of the survey in the beginning of the meeting, the majority of the attendants were over 40 years of age and were either white or white presenting. This was not representative of the population of Chula Vista or the demographics of the communities where these technologies are used the most. This was apparent in our discussion as all members of my group were concerned with issues surrounding personal property, which limited the scope and reach of these technologies and the broader issues relating to the communities that are most impacted, the unhoused in Chula Vista, young people in underserved communities and so forth. Without adequate representation of residents of Chula Vista at these meetings, including those that were formerly incarcerated, young people of color and those that are most impacted by the use of surveillance technologies is a disservice to this Task Force and will produce inaccurate data that is collected for the purpose of policy making.

3. This leads to my next not which is the discussion question about how to get more people to attend the meetings. As I'm aware, the City may already employ a marketing/PR team that could contract with a consultant or hire more people to figure out ways to attract and incentivize more people, especially from the communities where this technology is most deployed, to attend the meetings. This could mean being more transparent about how this technology is used, how many drones the PD currently deploys to neighborhoods and what is done with the data collected. There could be an outreach team visiting local junior and high schools to talk with students or attend after school programs in the area. These ideas were not discussed because the conversation was only regarding what has already been done and doing more of that ex. sending mailers to homes. I was disappointed that the moderator only shared this idea to the rest of the attendants at the end and not the majority of the conversation about confusion and concerns the group members had.

4. Finally, our group although limited in focus on personal privacy concerns did offer valid questions about past events about how this contract was approved, current data collection and management processes and future use of these technologies. The moderator appeared to take the position of representing the City by trying to answer questions about the contract, police protocols and data collection practices and the policy proposals they came up with. I expected the moderator to ask the questions and take notes about what questions and concerns that were raised. As soon as he tried to answer the initial questions about the contract, the group Warning:

External
Email
Written comments received by Task Force 4/25/22 - 9/26/22: Page 57 2 assumed that he represented the City and continued to ask questions and this was not a productive conversation.

Thank you for your time and attention to my feedback. I hope to participate in future meetings and events surrounding this topic.

Best,
Michael McDonald
Written comments received by Task Force 4/25/22 - 9/26/22: Page 58 1 Jeremy Ogul
From: Stacey Uy
Sent: Monday, August 1, 2022 9:46 AM
To: [email protected]
Subject: Takeaways from 7/27 Public Comment Forum
Dear Privacy Task Force Members,
Thank you for carving out a space for the community to contribute to the conversation on surveillance in Chula Vista. As a member of Adriana's group, I wanted to make sure highlights from our group were put into the record. We had a great discussion. We probably disagreed on many things, but we were in consensus over the following points, and especially for surveillance policies being community-led.

1. Seeking public approval after programs are already underway is TOO LATE. The fact that the drone program and automated LPRs are already being used without the public's consent and knowledge is a sign that the city of Chula Vista is failing to protect its citizens' privacy. There needs to be processes in place before technology is acquired and used.

2. One of our group members, Sergio, spoke of his personal experience of being overly surveilled, to the point where even his daughter is noticing the drones following them and he's had to file complaints to the DOJ with no response. Safeguards like the Oversight Board and policy safeguards need to be community-led. That means, placing the people affected by surveillance the most on the Oversight Board. People like Sergio, Black, Latinx, undocumented, young people, trans and queer folks should be sought after as experts on how surveillance affects our everyday lives and how we can protect privacy while keeping each other safe. Requirements for membership that include bachelor's degrees, clean records, and technology "expertise" are back door attempts to exclude the people who have first hand experience of being overly surveilled in the city.

3. We all identified issues in Chula Vista that needed attention such as homelessness, drug rehabilitation programs, and affordable housing. We ALL agreed the return on investment from surveillance technology to supposedly prevent crime was unacceptable, compared to how that money could have been spent actually helping the people that need it the most. Providing basic services is where crime prevention happens.

4. According to our poll, no one under the age of 24 was present. The city of Chula Vista needs to be actively engaging young people in the conversation, as these policies will affect them for the rest of their lives. That can look like holding youth-specific forums at schools and publicizing meetings on Tik Tok and IG. If you don't know how to do these things, you should hire (and pay) young people to help you.

As an Asian American, I was also very concerned that the forum audience did not reflect the racial makeup of the city.

With the spotlight on anti-Asian violence, people claim we need surveillance to keep us safe, and I disagree. We are just as much at risk of being overly-surveilled and over-policed, and we will not be used as a racial wedge to build more surveillance in the city. Please do a better job of engaging with Black, Latinx, and Asian American communities for these meetings.

Thank you for your attention on this matter. And I hope to engage more in future meetings.

Sincerely,
Stacey Uy (she/hers)
Warning:

External
Email
Written comments received by Task Force 4/25/22 - 9/26/22: Page 59 1 Jeremy Ogul
From: Norah Shultz <
Sent: Friday, August 12, 2022 7:12 AM
To: [email protected]
Subject: Concerns about survey conducted for policy consideration Dear Members of the Chula Vista Privacy Advisory Task Force, I am a Professor of Sociology at San Diego State University. I have been a professor and a senior administrator in higher education for over thirty years. Since my undergraduate days, one of my core specializations has been in the area of survey research.

I’ve reviewed the report and the survey and I have a lot of questions. I’m going to write about them in groups and put representative examples for the types of concerns, rather than go through each question and/or finding.

My overall concern is that while this is a well-known firm that has conducted a classic phone/email survey with traditional methodology (and for that there are strengths to what they have presented), it is not getting to the answers that are needed for the questions that a city council should be seeking.

What is needed is a study to determine the needs and concerns of all community members, which is different from a study to determine the likelihood of something occurring – a market research study or a political poll, for example. In other words, a more nuanced study and analysis is required for a study of community needs and concerns.

I’m sure the firm can answer a few questions I have about their work, however, as I explained I will list the overall issues with their approach:
1) It is very reassuring to read the words random sample and statistically significant. This sounds scientific and unbiased. However, a truly random sample is one in which every person has the same chance as any other person to participate in the survey. That means every person in your population – the group you are interested in learning about. I’m assuming that you are all interested in learning about all the residents of Chula Vista. So if this were truly a random sample of the residents of Chula Vista, then that means that each person in Chula Vista had the same chance of ending up in the final group as any other. But this is not true because of the following:
a. The sample was originally constructed from a list. Unless that list was all of the residents (over 18) of Chula Vista, then not everyone has the opportunity to be selected. Where is the list from? Phone directories and car registrations? There is bias there. Voter registration? We know the bias there. I didn’t see reported in the materials how the list was generated.
b. When you generate your random sample from your list, you decide to select every Xth person depending upon how many you need in your sample as you allude to in your notes on effect size. But again, unless every Xth person agrees to participate and complete the survey, bias has crept in again. Do you know how different the participants are from those who do not participate? One way is to try to get nonparticipants and those who do not complete the survey to provide some demographic information, particularly on relevant variables such as income, or some indicator of Warning:

External
Email
Written comments received by Task Force 4/25/22 - 9/26/22: Page 60 2 socio-economic status, and ethnic group identity and, in this case, also on perceived knowledge of the technology, so that some comparisons can be made to determine if your final sample is representative of the population and if these changes along the way have not introduced a bias that impacts your study questions. Again, while this check on the representativeness of the sample may be included in the final report, it was hard to find.
c. The easiest way to reassure those reviewing the report would be to take the demographic information from p. 2 and on p. 6 and compare it to the data from the Census Bureau for the city. You explain that you applied weights (and only on four variables from what I can discern) but do not provide detail about the demographic characteristics that were impacted. The weighting statistical technique will not account for missing information from groups. The weighting technique also would not impact the open-ended questions. This is an extremely long questionnaire. We have no idea what percentage of the original group actually completed the questionnaire. Even with the weighting, it makes it very difficult to assess many of the findings - particularly when critical policy issues are being considered.
2) The questionnaire is extremely long. This in itself is of concern. People who complete a survey of this length are different from those who don’t. While there are some very good aspects to the questionnaire, there are some that I find concerning, besides the length. For example, let’s look at Q7a. Part of the intro reads, “…where engineers use it to manage traffic signal timing in an effort to improve traffic flow and safety.” It is not surprising that 77% of the respondents approved of this. Who is going to say they don’t approve of improving safety? If a question has an 80/20 split, it is not differentiating. Now it may be that everyone is okay with this, but the question wording makes me wonder. Were there skip sequences? For example, if I don’t know anything about the use of drones, did I answer Q9? After that, Q11 and A12 really start out with sentences that make it pretty hard to answer anything other than beneficial.

I actually think it is problematic that those with little or no knowledge seem to be included in the analyses along with those who claim some awareness of the technology or Chula Vista’s programs, as well as others who may have actual experience or understanding of the technology use and privacy issues and implications, beyond what is written in this survey as the lead-ins to the questions. That may be one of the most problematic aspects. It is very good that you include the opposite questions, however the language is subtly different, “Some people worry the drones might,…..” [emphasis mine]. Again, not to throw this out entirely but I think problems with wording and sequencing of questions should be brought to the attention of those who might want to use the reported findings to make policy decisions that impact people’s lives.
3) My last points are about the analysis. The vast number of crosstabs, many with small cell sizes, makes it hard to go back and make any independent judgments. I also did not see any statistical analysis, such as a chi-square, associated with these data. Since chi-square is sensitive to overall sample size and the cell sizes are so variable, a discussion of statistical significance related to this information would, admittedly, be problematic. But there are other ways to address this. You mention sampling error several times in the report, but I haven’t been able to find any discussion of effect size. In a study such as this, one that is impacting policy and citizens lives, I’d be curious about meaningful differences rather than statistically significant differences. I did appreciate the explanation of how to properly read a cross tab! I also reviewed the section discussing the multivariate analysis, but would like to have seen the actual analysis in the appendix and not just the cloud replication. What was the overall R2? Was this explaining the outcome in any significant way? It is, as I stated above, important to discuss the meaning and not just the statistical significance but the findings are presented in a way that makes it hard to understand overall how much is being explained here. Were all responses put into your model?
Written comments received by Task Force 4/25/22 - 9/26/22: Page 61 3 Another key concern is that we don’t know who is really being represented in this analysis. The very people who may be most impacted by such a policy may be silenced. As I wrote at the beginning, this does not call for a piece of market research. What is needed is a study that looks at the differential impacts on the highly diverse population of Chula Vista. In a situation such as this, I would not have used a random sample. With a simple random sample, you cannot create a stratified random sample, to make sure you are reaching enough of the people who may have particular concerns so that you can adequately analyze their position vis-à-vis the other groups. This requires a more complex sampling design. I realize that important steps were taken to have a Spanish language and a Tagalog version, and to conduct several focus groups drawn again from some lists, but this falls far short of capturing the voices of many others in the community whose opinions and concerns should be a part of the crafting of such a policy.

Finally, I also would add that the survey report is incredibly long, just like the survey, and very difficult for any lay person to digest. I spend a lot of time teaching students not only how to work on surveys but how to prepare their reports for their audience. Ultimately, as decision makers, the city council has the moral obligation to be sure they understand the information that they are given and to be able to interpret it properly.

I pose these questions with respect for the work done; but also with great respect for all of the residents of Chula Vista.

Sincerely,
Norah P. Shultz, Ph.D.

Norah P. Shultz, Ph.D.

Pronouns: She / Her
Professor of Sociology
College of Arts & Letters
Doctoral Faculty
EdD Educational Leadership Community College
Post-Secondary Education Program
College of Education
Director of Inclusive Curriculum
Division of Student Affairs & Campus Diversity
Nasatir Hall 210
San Diego State University
SafeZones@SDSU Ally. Military Ally. Ability Ally.

Indigenous hostlands: Birthplace: Lenapehoking; Residence: Kumeyaay Written comments received by Task Force 4/25/22 - 9/26/22: Page 62 Written 4 comments received by Task Force 4/25/22 - 9/26/22: Page 63 1 Jeremy Ogul
From:

Sent: Monday, August 15, 2022 7:21 PM
To: [email protected]
Subject: Recommendations
Dear Members of the Chula Vista Privacy Advisory Task Force, As a Chula Vista resident, I would like to make some recommendations that can be part of this discussion.

1. Accountability for Breached Data
I would recommend that the task force come up with a fair punishment when a breach occurs. Usually, the punishment for allowing a breach is a light slap on the wrist. More often than not, there is none.

We will never have true data security until we start holding companies/ governments and their executives/leaders legally and financially accountable for the security of any kind of consumer data they possess.” Basically, we need to hold the vendors and city leaders financially accountable.

2. Children Data
I would like to recommend that ALL data be removed after captured.

3. Right of Citizen’s to OPT-OUT
Recommend that each Chula Vista resident have the option to request to review their data and request to have the city erase/ delete all data.

Roman Covarrubias
Warning:

External
Email
Written comments received by Task Force 4/25/22 - 9/26/22: Page 64 1 Jeremy Ogul
From: Seth Hall
Sent: Sunday, August 14, 2022 8:32 PM
To: [email protected]
Subject: Items to consider regarding August 15 Subcommittee reports Attachments: 2208 Tech Lead SD - Consideration Items RE Subcommittee Reports.pdf Distinguished task force members,
Please see the attached document regarding items for your consideration as you continue to discuss your recommendations. I would appreciate a confirmation that this email has been received and distributed appropriately.

Thank you all for your continued work on this important topic.

Seth Hall, techleadsd.org
Warning:

External
Email
Written comments received by Task Force 4/25/22 - 9/26/22: Page 65 1 Technologists Tending the Grass Roots”
August 14, 2022
Dear distinguished task force members,
Please consider the attached suggestions as you deliberate regarding your final recommendations.

Chula Vista residents deserve to determine for themselves how they will leverage new technology while protecting themselves from its many potential harms. The attached suggestions are sent in the spirit of collaboration among neighbors who are both actively working to answer similar questions, while also striving for the safest and healthiest city we can create.

Sincerely and with respect,
Seth Hall
Tech Lead San Diego (member of the TRUST SD Coalition)
Written comments received by Task Force 4/25/22 - 9/26/22: Page 66 2 Items for Consideration Regarding August 15 Subcommittee Reports

1. The task force should consider making clear its intentions behind any exception to its recommendation prohibiting nondisclosure agreements, so that subsequent city attorneys reviewing the recommendation can provide proper guidance on how such an ordinance would be drafted.

Many NDAs can be argued to contain “ proprietary information,” and I don’t believe it is the desire of the task force to incentivize vendors to include proprietary information in the contract for the specific purpose of making contracts undisclosable under the task force’s recommended exception. In my experience, such tactics, while reprehensible from a public perspective, are entirely common in the for-profit vendor context.

2. The task force recommends that a convenience termination clause be added into vendor contracts for cases when a vendor requires their contract be placed under a NDA. If the task force chooses to recommend this, they may wish to further clarify what the task force believes the correct conditions are that would satisfy your intentions for convenience termination.

For example, without additional guidance, convenience termination could be offered by a vendor, but only under the condition the City pays penalty fees that could equal the buyout cost of the contract. I don’t believe that the intention of the task force is to allow vendors to force the City to buy out the entire contract term in exchange for convenience termination in the case of an undisclosable NDA, because that does not protect Chula Vista taxpayers from predatory practices by vendors, and wouldn’t achieve any meaningful options or protection for the City.

If the task force’s intention is that the city can terminate a vendor contract for convenience without any penalty whatsoever imposed by the vendor, the task force should make that intention clear in its recommendation.

3. The task force should reconsider its recommendation that allows for NDAs on vendor contracts in cases of proprietary information. Other subcommittee recommendations (PO& T) require vendor contracts to be posted publicly, and those recommendations do not provide for any exceptions. Upon Items regarding the Procurement Subcommittee Report
Written comments received by Task Force 4/25/22 - 9/26/22: Page 67 3 further deliberation, the task force may find that hiding vendor contracts from the public is always harmful to public interests and only serves the interests of private parties.

1. Each restriction placed on board membership carries a risk the board will not be able to be fully populated, which raises the risk of not achieving quorums, or that a minority of members could control the board’ s decisions. The current recommendation potentially restricts 6 of the 9 seats, and does so in 3 different ways (residency, district residency, professional background). A minimum of 3 board members would have no restrictions whatsoever, beyond applicable law, which gives significant power to an individual who can appoint to those seats.

Consider issues such as redistricting, as well as the ability of council members to interfere with the board’ s functions by withholding nominations in their district. The task force should deliberate regarding the risks of board membership they are trying to mitigate, and ensure their final recommendation addresses the risks the task force believes are the highest and most likely risks.

2. Prior to making final recommendations, the task force should receive advice from city attorneys regarding the creation of boards and commissions, if the task force has not already received such advice. Existing limitations within the charter or municipal code could have the effect of substantially changing the task force’s recommendations if, for example, the task force’s preferred appointment process does not comply with current municipal code.

3. The task force is undecided on whether a seat on the board should be reserved for a past member of law enforcement. The task force should consider the option of neither reserving a seat for police, nor prohibiting police from the board. This model leaves the decision up to those responsible for appointments, who may have contemporary insights on the appropriateness of police membership on the board, at the time vacancies occur. If a seat is reserved for police, future appointees supported by the community may be ineligible for appointment, due to the strict requirement recommended by this task force.

Items regarding the Privacy Advisory Board Subcommittee Report Written comments received by Task Force 4/25/22 - 9/26/22: Page 68 4 4. The task force should consider whether it wants to recommend that a future privacy board be allowed to assemble via virtual meeting in addition to in-person meetings. Virtual meetings can be helpful to ensure quorums are achieved, and virtual meetings can also be helpful with increasing public participation. If the task force does not recommend the accommodation of virtual meetings, the city may not consider supporting that capability.

1. The task force recommends allowing the city to prioritize the surveillance technologies that should be reviewed by the board. Consider that the task force is recommending a board of community members, and that the community members are being carefully selected for residency and professional qualifications to ensure they provide trustworthy recommendations.

Considering the careful requirements placed on board membership, the task force should consider capturing those board members’ input on the prioritization of technology to be reviewed. Appointed board members’ qualifications hopefully indicate a deeper knowledge of what technology is sensitive than what city staff may be aware of. Current task force recommendations cut board members entirely out of the prioritization process and put city staff in the driver’s seat.

1. Regarding data minimization, the task force should consider adding a recommendation that sensitive personal information in particular be specially handled and retained for only the minimum amount of time necessary to accomplish the most immediate and pressing goal of data collection. See later recommendation that “ sensitive personal information” be defined as a term.

2. When the task force makes recommendations that items (such as sale of the public’ s information) should not occur without “sign off,” the task force should consider being more specific with regard to its intention on the process of those approvals. For example, does the task force advise that the sale of public information should require a majority vote of city council, or merely the approval of a particular individual within City staff?
Items regarding the Use Policies Subcommittee Report
Items regarding the Data Subcommittee Report
Written comments received by Task Force 4/25/22 - 9/26/22: Page 69 5 3. Because the City’ s Data Governance Committee is made up of only City staff, which variates with turnover, and is not structured by municipal code governing the City’s boards and commissions, the task force may want to consider removing references to the Data Governance Committee from the recommendations. The current recommendation attempts to incorporate the Data Governance Committee into the new privacy process, which may create conflicts of authority and process.

4. The task force should consider incorporating the term “Sensitive Personal Information” into the terms in need of definition, and the task force should consider recommending that the definition of the term permanently track the definition of Sensitive Personal Information as it is defined in the California Privacy Rights Act. See above #1 for recommendation on using this term to apply stronger protections for the public’s most sensitive data.

1. Nowhere in the subcommittee report are public meetings, community forums, or other live community education offered by City staff recommended. The task force should deliberate on whether posting signs, or posting links on the city website, is sufficient to ensure Chula Vista residents receive an acceptable level of awareness regarding the technology being deployed in their neighborhoods.

1. The task force includes activity covered by a NDA to be “ Confidential Data” and undisclosable to the public. This is very broad because the task force does not know what data could be considered to be covered” by any given future NDA, since NDAs are negotiable and generally favorable to the noncity party. The task force should deliberate on whether this definition of Confidential Data is too favorable to vendors and poses unquantifiable risks to the public.

2. The task force includes in its definition of confidential data “information related to an allegation or investigation of misconduct.” This recommendation pulls the task force and privacy board into the controversy around public records controversies and California laws governing misconduct, such as SB 1421. The task force should deliberate on whether they believe a privacy ordinance is the proper Items regarding the Privacy Oversight & Transparency Subcommittee Report Items regarding the Information Security Subcommittee Report Written comments received by Task Force 4/25/22 - 9/26/22: Page 70 6 venue to engage those controversies or whether the task force’s recommendation should instead lean on existing laws and public records processes and policies that already exist within the city.

Written comments received by Task Force 4/25/22 - 9/26/22: Page 71 Written comments received by Task Force 4/25/22 - 9/26/22: Page 72 Written comments received by Task Force 4/25/22 - 9/26/22: Page 73 1 Jeremy Ogul
From: Margaret Baker <
Sent: Thursday, September 22, 2022 2:52 PM
To: Privacy Task Force
Subject: Please post attached Privacy Advisory Commission Ordinance with Privacy Task Force meeting agenda
Attachments: Revised Privacy Advisory Commission Ordinance_2022-07-15.pdf Margaret A. Baker, DrPH
South Bay People Power promotes social justice through nonpartisan civic engagement.

Warning:

External
Email
Written comments received by Task Force 4/25/22 - 9/26/22: Page 74 1 Jeremy Ogul
From: Jason Essex
Sent: Friday, September 2, 2022 10:08 AM
To: [email protected]
Subject: New Chula Vista Privacy Policy Reply
Greetings,
I have had any number of issues for over ten years as it pertains to privacy.

The root cause also always lead back to lawyers, attorneys, law firms, groups, organizations and company who do honor their oath, do do not state discovery, disclose why they are doing so as well as ignoring Caliofnria Consumer Protection Act.

Each needs to be held accountable for not having a business listing it with the city and or state but a listing with the California State Bar. ANY * website* that ends in : .com is a business. In many cases they do not have a Privacy or Terms of Use page(s).

I have to wonder how many data mining tools they use to capture your IP Address, Email information and the like. A Credential check needs to be run whenever a case is brought to the court as it pertains to these listings. If you can sight said legal entities ongoing failure to state Disclosure and Discovery they need to be penalized and this should count towards the opposing party.

I also have to wonder why said entities that have my Social Security number have shared it with such legal sources and not been accountable. Monies have changed hands for the purpose of earning monies from said information. Does this not fall squarely under the California Consumer Protection Act as well as Disclosures and Discovery laws in addition to Business and Professional Ethics laws?
To review these ongoing concerns please review my cases in the San Diego County Court House / Hall of Justice.

I have not been paid fro any of my Intellectual Properties dating back to 2014 as of today. The courts have repeatedly frozen my assets without ever stating who the asset manager(s) are. With of twenty (20) such items for sale under the author names of By Jason Douglas Essex, By Jason Essex as well as the bulk being under By Jason D. Essex the sales platforms have never provided me with earnings information.

As such this is identity, time and wage theft that has caused endless forced labor and costs in addition to endless stress.

Here is a direct link to some of my content:
https:// www.facebook.com/ByJasonDEssexLocalAuthor
https:// books.apple.com/us/ book/red-tape/id1529009437 https:// books.apple.com/us/ book/a-valentines-day-event-for-you-to-enjoy-too/id1571539079 Warning:

External
Email
Written comments received by Task Force 4/25/22 - 9/26/22: Page 75 2 This appears to be the data mining and redirectional robot that is preventing me from having anisuch information or earnings on this sales platform:
https:// books.apple.com/us/ book/living-the-dream/ id437205980 Thank you for your time today.

By Jason D. Essex
Chula Vista, CA 91914
Written comments received by Task Force 4/25/22 - 9/26/22: Page 76 1 Jeremy Ogul
From: Steve Goldkrantz <
Sent: Tuesday, September 6, 2022 12:50 PM
To: Adrianna Hernandez
Cc: Privacy Task Force
Subject: Re: Share your thoughts on privacy guidelines for the City of Chula Vista Ms. Hernandez,
Thank you for the opportunity to provide comment and feedback. The draft is very well organized and written. As for the formation of a new Board including non-Chula Vista residents, I defer to the current regulations on the books concerning such a matter.

It seems that there are four overarching issues at hand:
1) Cybersecurity - how the City of CV information is secured once collected - be it City Hall offices, the library, the Police Department, etc. This involves technical systems security matters, user procedures, and insider threat detection/mitigation.
2) Information Sharing Externally - this always presents a cybersecurity challenge, and again covers information technology transmissions from the technical level to the user level. Essentially, how information can technically be shared externally - legally and appropriately - while remaining secure. 3) Privacy - what information is deemed Private and [Sensitive] Personally Identifying Information under various laws and rules such a as the Privacy Act, 28 CFR 23, etc. and what are the regulations/rules guiding both the technology and end user applications.
4) Enforcement Technologies - with the rapid expansion of the City of Chula Vista, the Public Security Sector is challenged in meeting the demand for increased patrols, call responses, crime prevention, victim handling, etc. Technology is a force multiplier for deterring crime, responding to crimes, enabling community assistance, investigations, prosecution. Technology is critical to the entire law enforcement cycle needed to protect the residents of the City and those who are non-residents but work, attend school, shop, or have businesses here. Enforcement technologies are a force multiplier for public protection and the officers and first responders working it.

All the above needs to wrapped up with incident detection, response, mitigation, resolution. It might not be bad for a Red Team” to challenge some of the existing processes as well as the gaps/ concerns identified by the Privacy Task Force.

Again, thank you for the opportunity to comment. The Mayor’s Office and the Privacy Task Force are more than welcome to reach back to me for any further questions, comments via this email or my phone: 619-823-3383.

Thank you and have a great afternoon.

Steve Goldkrantz
Sent from Yahoo Mail for iPad
Warning:

External
Email
Written comments received by Task Force 4/25/22 - 9/26/22: Page 77 1 Jeremy Ogul
From: Seth Hall
Sent: Tuesday, September 6, 2022 4:23 PM
To: [email protected]
Subject: Suggestions for Draft Recommendations
Attachments: 2209 Tech Lead SD - Suggestions RE Draft Recommendations.pdf Task Force members,
Please find attached a review of the draft recommendations and additional items for your consideration. Please confirm your receipt and distribution. Thank you!
Seth Hall, Tech Lead San Diego
Warning:

External
Email
Written comments received by Task Force 4/25/22 - 9/26/22: Page 78 September 6, 2022
Dear distinguished task force members,
Congratulations on reaching an important milestone in your work. The Task Force’ s proposed draft of recommendations contains many important improvements, which will benefit the residents and visitors of Chula Vista.

My below review expresses suggestions for 11 potential improvements to your draft recommendations. Among those 11 suggestions, I believe suggestions that are related to 4 items in particular would have the most significant impact on your recommendations.

1. The Task Force’ s draft recommendations do not include a requirement that any specific approvals be required, prior to acquiring or using surveillance technology. My below Recommendation 2 strongly suggests adding that as a Task Force recommendation.

2. The Task Force is not currently recommending the use of impact reports as a tool to discover and mitigate potential harms caused by surveillance technology. My below Recommendation 3 suggests adding that as a Task Force recommendation.

3. The Task Force is not currently recommending any educational meetings with the public be held prior to acquisition or use of surveillance technology. My below Recommendation 6 suggests adding that as a Task Force recommendation.

4. The Task Force is not currently recommending the use of annual surveillance reports as a primary tool to achieve meaningful, ongoing oversight. My below Recommendation 11 suggests adding that as a Task Force recommendation. I suggest adding that as a Task Force recommendation.

In addition, I suggest the Task Force create a Guiding Principles document to make clear the principles that the Task Force suggests be followed after the Task Force has finished its work, and the City attempts to translate Task Force recommendations into actions or law.

Thank you for your continued work on this important topic.

Seth Hall
Tech Lead San Diego (member of the TRUST SD Coalition)
[email protected]
Written comments received by Task Force 4/25/22 - 9/26/22: Page 79 2 Suggestions for the Chula Vista Privacy Task Force
Recommendation 1: Statement of Guiding Principles
The Task force should consider adding a statement of principles that can guide City staff on the Task Force’ s intentions once the Task Force has completed its work.

Currently, the Task Force’ s recommendations are highly detailed. Any City staff that attempts to translate Task Force items into municipal code may be forced to make assumptions about the values and principles that guided the Task Force’ s recommendations.

For example, the Task Force could state that all its recommendations are based in principles of public awareness, public benefit and public consent, and urge that any subsequent City efforts should strictly align to such principles.

Any such statement would help ensure that the Task Force’ s detailed recommendations are not misconstrued to justify outcomes that the Task Force did not intend.

Recommendation 2: Approval for Acquisition and Use of Surveillance Technology The Task Force should consider recommending that the City’s proposed use policies be required to undergo advisory board review, and subsequent City Council approval, prior to acquiring or using surveillance technology. This requirement should be encountered at the earliest stages of surveillance technology acquisition or use.

Currently, the Task Force recommendations do not require City Council approval prior to acquiring or using surveillance technology. The suggested requirements are only that contracts be presented and use policies be created and reviewed. No time frame or sequence for these presentations, creations and reviews is currently specified. No mechanism for rejection of a problematic technology is proposed by the Task Force.

Without further requiring the City to achieve explicit City Council approval, City departments may continue to acquire and use technology without the knowledge of the public and City Council. All acquisitions and uses could be documented after-the-fact, after an undefined period of time, under the Task Force’ s current recommendations.

Written comments received by Task Force 4/25/22 - 9/26/22: Page 80 3 Additionally, unrecognized or obfuscated surveillance features of non-surveillance products could operate indefinitely without review, without consequences.

This requirement for approval would ideally be encountered by the City prior to the phase of City staff seeking any funding for the acquisition or use.

Recommendation 3: Requirement of Impact Reports
The Task Force should consider recommending that the city be required to provide an impact report alongside any proposed use policy.

Currently, the Task Force recommendations only require a Use Policy to be created for each surveillance technology. No impact reports are recommended.

An impact report is a document that indicates the City has diligently investigated the impact its acquisition and use of technology will have on the public. The results discovered through the process of creating the impact report should heavily inform the City department’ s proposed use policy.

Without requiring an impact report, City departments could draft a use policy without considering whether that use policy successfully reduces the threat of harm to the community, or whether the use policy successfully mitigates other risks created by the introduction of the surveillance technology.

Impact reports are included as a definition in the Task Force’ s document, but they are not recommended.

Recommendation 4: Advisory Board’s Conclusive Recommendation The Task Force should consider recommending that the advisory board conclude its advisory work in each case by advising council members to approve, reject, or modify the proposed use policy.

Currently, the Task Force recommendations only cover the advisory board reviewing and suggesting changes to use policies brought by the City. Rejection of use policies is not mentioned.

For the advisory board to have maximum usefulness to council members, the advisory board should be required to make clear a recommendation that the proposal be accepted, modified, or rejected.

Written comments received by Task Force 4/25/22 - 9/26/22: Page 81 4 In the case of the advisory board evaluating contracts with privacy implications, the Recommendation 5: Advisory Board Evaluations
The Task Force should consider changing its draft recommendation to instead reflect that the advisory board drafts its own evaluation, independent of City staff.

Currently, the Task Force recommendations state that any evaluations of contracts be written by a combination of City staff and the advisory board. Procurement: 24.

Under the Task Force’ s current recommendation, council members would be unable to determine if evaluations were the product of employed City staff, or if they were the product of independent community experts.

The advisory board should author its own evaluations so that council members can benefit from knowing the evaluations originate from a board of independent community experts. Since City staff will be presenting final proposals to City Council, City staff already have ample opportunity to document and voice their own evaluations.

Recommendation 6: Educational Community Meetings Prior to Surveillance The Task Force should consider recommending that the city hold public educational meetings prior to submitting the documents for review or approval.

Currently, the Task Force is not recommending the City hold any public meetings prior to drafting the technology’ s use policy, or prior to acquiring or using surveillance technology. “ Transparency and Oversight: 18(d)”
The City may benefit greatly from increased public trust, if it makes the effort to hold public meetings to present surveillance proposals prior to writing documents and acquiring or using technology.

Recommendation 7: Inventory of Existing Surveillance
The Task Force should consider recommending that all currently used surveillance technology be inventoried, and that list be provided to the advisory board as a public document as the first order of business for the advisor board.

Written comments received by Task Force 4/25/22 - 9/26/22: Page 82 5 Recommendation 8: City Council Approval Guidelines
The Task Force should consider recommending the conditions under which council members can determine a surveillance technology is eligible for City Council approval.

Currently, the Task Force does not recommend the City obtain City Council approval prior to acquisition or use of surveillance technology. If such a recommendation was added, the Task Force should provide guidance to council members on the minimum circumstances that should be present before City Council gives approval for a surveillance technology.

The Task Force should consider suggesting minimum, non-controversial preconditions for City Council’s approval, such as requiring that the City Council judge that the technology’s benefits outweigh its costs, or requiring City Council to judge that no better alternative exists.

Recommendation 9: Public Records
The Task force should consider recommending that any use policies (and impact reports, if the Task Force chooses to add a recommendation for them) created in this process be explicitly defined as public documents, regularly maintained and well-presented to the public.

Recommendation 10: Annual Surveillance Reports
The Task Force should recommend that annual reports be required for all surveillance technologies. The reports should review the ongoing cost, usefulness, and integrity of any approved surveillance technology.

Currently, the Task Force does not recommend annual reports.

Annual reports form the basis of ongoing oversight. They provide the advisory board and the City Council with opportunities to safeguard the rights of the public and to maximize budget efficiency, by identifying technologies that are not producing expected results. Annual reports also help the public understand how surveillance technology is benefiting public goals.

Written comments received by Task Force 4/25/22 - 9/26/22: Page 83 6 The definition for Annual Reports is already included in the Task Force’ s recommendation, but the Task Force does not currently have a recommendation that aligns with the definition.

Recommendation 11: Whistleblower Protections
The Task Force should consider that any non-compliant use of surveillance technology will be observed first by City staff. Encouraging those staff to report the non-compliant use to their supervisors is the most efficient and most desirable way to handle any such issues. If the Task Force agrees, then it should consider recommending the City adopt specific whistleblower protections, to ensure City staff feels they can safely report non-compliant activity, without risk of retaliation.

Written comments received by Task Force 4/25/22 - 9/26/22: Page 84 September 3, 2022
Adrianna Hernandez
Special Projects Manager | Office of the City Manager
City of Chula Vista | 276 Fourth Avenue, Chula Vista, CA 91910 619-691-5254 | [email protected]
Let me preface my remarks by thanking you for the opportunity to comment on the proposed Summary of Policy Recommendations.

My comments are limited to the application of these recommendations as they impact law enforcement and more specifically the CVPD, Sheriff and National City.

I speak from a background in law and law enforcement having been a sworn member of the CVPD and SDSO and a licensed attorney representing clients in the area of civil litigation. I served on the 2021-22 County Grand Jury where my Law and Justice committee examined and extensively studied the issue of privacy rights and the impact of surveillance and modern technology on the public. The 2021-2022 Grand Jury published our findings and recommendations which can be found at:
http://www.sdcounty.ca.gov/grandjury.

That being said, the recommendations being proposed are, I believe, incomplete and present potential serious issues concerning public welfare and safety.

2. “The Privacy Advisory Board should have nine members, at least two-thirds of whom are Chula Vista residents.”
It is no surprise that the authors specifically left out inclusion of representatives from law enforcement and victim’s rights advocates The special interest groups, working under the guise of the San Diego TRUST coalition, drafted and presented the exact same recommendations for the City of San Diego. One only need look at the composition of that group to understand the real purpose behind their agenda. Best practices studies show that “city council decisions are more likely to be seen as fair and considerate if all people having a stake in the outcome” are involved. Asking nine people, none of whom have any experience in law enforcement, to make recommendations on what is acceptable use of a piece of modern technology is like asking a jury of nine to determine guilt or innocents after hearing testimony and seeing evidence from only one party to a case. At the August meeting of the Advisory group, a member of TRUST stated they were only interested in being sure that all members of the community were represented. It appears TRUST does not view law enforcement or victims of crime to be part of the Chula Vista community.

Written comments received by Task Force 4/25/22 - 9/26/22: Page 85 Using that as background, the recommendations fail to address serious concerns unique to law enforcement.

The CVPD works closely with the SDSO, which serves the unincorporated area of Bonita, and with the NCPD. The departments are often called upon to assist each other.

This close symbiotic working relationship often requires sharing of information by each organization. That need for sharing must be recognized and incorporated in the guidelines the advisory board works and collaboration with outside agencies must be considered when recommending any rules on surveillance or use of equipment such as drones.

Along the same lines, the use of surveillance technology as it specifically applies to law enforcement cannot be adequately explained by a non-law enforcement lay person.

Hence, any recommendations concerning use of technology must include specific and articulable rationale from the CVPD (or other L.E. sources) as to the appropriateness of the board’s recommendation. If necessary, provisions should be included allowing such presentation to be made in a closed door session.

In addition, the CVPD has officers assigned to various state and federal task forces. In their roles, secret and sensitive information must be shared. Any attempt to quash that sharing might jeopardize further participation by CVPD personnel and affect public safety. Clarification with regard to sharing of such data should be included. Once again, this will require input from high level members of the CVPD.

Finally, I see no provision for discussion of sensitive material among the advisory board members. Secrecy should be addressed and violations should be subject to criminal and/or administrative sanctions.

Once again, I thank you for providing the opportunity to address these issues.

Written comments received by Task Force 4/25/22 - 9/26/22: Page 86 1 Jeremy Ogul
From: Robert Johnson < >
Sent: Thursday, August 25, 2022 6:19 PM
To: [email protected]
Subject: Fwd: Some of my concerns.

Sent from my T-Mobile 5G Device
Get Outlook for Android
From: Robert Johnson < >
Sent: Thursday, August 25, 2022 6:18:50 PM
To: [email protected] <[email protected]> Subject: Some of my concerns.

Some of the paper I've been looking at is call for service. In the data case numbers and many thing are identifiers and can be cross referenced with identifying data in call for service fire department. If they are public records that's the thing it's more detailed on the fire department. I think a standardized version should be ready available to both like the police already have. It's in power bi updates automatically and is very easy to get to. If privacy is a concern sending out city votes for another city to count let alone in machines not made in America. The dod has many hundreds of documents assessments of how nation security risks and what systems are a threat to have a secure election yet mail in ballots remain high risk and you embrace it. If privacy is a concern why are you all talking about noncitzen privacy. And not our privacy. I see a lack of knowledge and leadership thinking they know what makes America safe. Bet you can even fix ur own cell phone.. If u want threat assessment maybe go to the foia web search and read on past elections. We could hold 1000person in person ballots one day and everyone could feel safer about voting. He let's have voter ID so non citizens can't vote.

Sent from my T-Mobile 5G Device
Get Outlook for Android
Warning:

External
Email
Written comments received by Task Force 4/25/22 - 9/26/22: Page 87 1 Jeremy Ogul
From: John Richeson < >
Sent: Saturday, August 27, 2022 12:13 PM
To: Adrianna Hernandez
Cc: Privacy Task Force
Subject: Re: Share your thoughts on privacy guidelines for the City of Chula Vista The foundational recommendation that "The City should create written Use Policies that govern the use of each privacy-impacting technology and the data generated by those technologies" is so general and vague with should meaning compliance is voluntary) as to be meaningless.

The duties of the Chief Privacy Officer should be:

1. Prepare and maintain an inventory of data systems within the City that collect, retain, and/or exchange citizen information with outside entities including, but not limited to: the DMV, County Assessor, State and Federal Government agencies, SDG&E, Republic Services, Community Power, telecommunication providers, credit agencies, law enforcement, and the courts.

2. Periodically assess, or have to be assessed, the justification for collecting, retaining and/or sharing of citizen information, and the vulnerabilities of departmental data systems to the release of citizen information without their consent to third parties.

3. Require data system owners and administrators to develop and enforce citizen data security using the latest available encryption and network protection technologies, together with administrative procedures to minimize human error.

4. Annually report to the City Council on the status of data systems within the City.

Respectfully,
John Richeson
If it is worth doing, it is worth doing right"
On 08/25/2022 5:34 PM PDT Adrianna Hernandez <[email protected]> wrote:

Greetings,
After many meetings and many hours of work, the Chula Vista Technology and Privacy Advisory Task Force<https:// www.chulavistaca.gov/ businesses/ smart-city/projects/privacytaskforce> has developed a draft set of policy recommendations for the City Manager.

Now it's your turn. The task force is looking for feedback from the public. A full draft of the policy recommendations<https:// www.chulavistaca.gov/home/showpublisheddocument/ 25071> has been posted online, and community members are encouraged to provide comments in writing to [email protected]<mailto:[email protected]>.

Please send in your thoughts no later than Tuesday, Sept. 6 so they can be compiled and shared with task force members before their next meeting.

Additionally, you are welcome to attend and speak during the public comment session at the upcoming task force meeting on Monday, Sept. 12 or Monday, Sept. 26. Public comment is open from 6 to 6:20 Warning:

External
Email
Written comments received by Task Force 4/25/22 - 9/26/22: Page 88 2 p.m. and at the end of each meeting. There will be further opportunities to comment when a final report and policies are presented to the City Council in November.

Please feel free to share this information with anyone who may be interested. Thank you! Sincerely,
Adrianna Hernandez
Special Projects Manager | Office of the City Manager
City of Chula Vista | 276 Fourth Avenue, Chula Vista, CA 91910 619-691-5254 | [email protected]<mailto:[email protected]> Written comments received by Task Force 4/25/22 - 9/26/22: Page 89 1 Jeremy Ogul
From: David Stucky <[email protected]>
Sent: Saturday, August 27, 2022 12:58 PM
To: [email protected]
Subject: Task Force Recommendations
Attachments: Summary of Policy Recommendations with comments.pdf Attached is the task force document with comments and observations. Please feel free to contact me for any needed explanations or clarifications.

David Stucky
619-972-3721
[email protected]
Warning:

External
Email
Comments summary on <Public Comment - Stucky - 2022-08-29.pdf> Created on 8/29/2022 at 17:25:3 Page 1
Chula Vista Technology and Privacy Advisory Task Force
Summary of Policy Recommendations
DRAFT VERSION – August 25, 2022
Note: To facilitate discussion and review, the policy recommendations are numbered in this document. There is no particular order or significance to the numbering scheme or the section headings in this draft.

Privacy Advisory Board

1. The City should establish a Privacy Advisory Board responsible for carrying out a broad range of advisory duties.
a. The Board’ s duties are described throughout this document, including:
i. Holding regular meetings that are open to the public, including opportunities for public comment in English and other languages. ii. Reviewing Use Policies for privacy-impacting technologies and making recommendations on changes
iii. Reviewing data sharing agreements.
iv. Reviewing new technology-related contracts.

2. The Privacy Advisory Board should have nine members, at least two-thirds of whom are Chula Vista residents.
a. Chula Vista residents should comprise a super-majority of Board members because residents experience the impacts of City decisions on privacy and technology to a much greater degree than non-residents do. b. The purpose of allowing non-residents to serve on the Board is to recognize that non-residents also experience the impacts of City decisions on privacy and technology, especially if they work, own a business, or attend school in Chula Vista. Additionally, non-residents may have valuable expertise or perspectives that should be included on the Board.
c. There is no requirement to include non-residents on the Board.

3. Privacy Advisory Board members will be selected through a combination of City staff review, community review, and City Council review.
a. Members of the Board should be selected through a process that includes review and vetting by both City staff and by community leaders, similar to the process used to appoint members of the Technology and Privacy Advisory Task Force. b. All members of the Board must be approved by a majority vote of the City Council pursuant to the City Charter.
c. The purpose of involving community leaders in the selection process for some members is to ensure that Board membership is not exclusively determined by City staff or elected officials.

4. Selections to the Board should reflect the City’s diversity in terms of race, gender, and age.

Comments summary on <Public Comment - Stucky - 2022-08-29.pdf> Created on 8/29/2022 at 17:25:3 Page 2
1 581Dave 08/27/2022 12:14:

This should be the only criterion for
including non-residents
2 102Dave 08/27/2022 12:16:

Define community leader.

All Board members shall be persons who have an interest in privacy rights as demonstrated by work experience, civic participation, and/or political advocacy.

No member may be an elected official.

No member may have a financial interest, employment, or policy-making position in any commercial or for-profit facility, research center, or other organization that sells surveillance equipment or profits from decisions made by the Board.

Each of the following perspectives should be represented by at least one member of the Board:
a. A resident of Council District 1
b. A resident of Council District 2
c. A resident of Council District 3
d. A resident of Council District 4
e. A technology professional with expertise in emerging technologies and systems this perspective should be represented by three members of the board) f. A professional financial auditor or Certified Public Accountant (CPA) g. An attorney, legal scholar, or recognized academic with expertise in privacy and/or civil rights
h. A member of an organization that focuses on government transparency or individual privacy
i. A representative from an equity-based organization or a member of the Human Relations Commission.
j. A former member of the Technology and Privacy Advisory Task Force (only applies to the first year of appointments)
Chief Privacy Officer

5. The City should hire a full-time Chief Privacy Officer responsible for carrying out a broad range of duties related to privacy.
a. Until a full-time Chief Privacy Officer can be budgeted and hired, the duties of the Chief Privacy Officer should be carried out by the Chief Information Security Officer.
b. The Chief Privacy Officer should report to the City Manager to ensure they are accountable to City Council and the voters of Chula Vista. i. A minority of task force members believes the Chief Privacy Officer should report to the City Attorney to ensure they are accountable to the voters of Chula Vista.
c. The Chief Privacy Officer’ s responsibilities include, but are not limited to:
i. Provide regular training sessions and guidance to City staff on privacy issues.
ii. Serve as the primary City staff liaison to the Privacy Advisory Board, including:

1. Managing agendas and coordinating meetings
Comments summary on <Public Comment - Stucky - 2022-08-29.pdf> Created on 8/29/2022 at 17:25:3 Page 3
1 041Dave 08/27/2022 12:20:

Don't forget the need for an appropriate
level of support staff.
2 142Dave 08/27/2022 12:13:

In a representative democracy, the City
Council are the representatives of the voters.

2. Managing the selection process for Privacy Advisory Board members

3. Assisting in the preparation and presentation of technology Use Policies for Board review
iii. Performing internal audits and ensuring compliance with data retention standards and use policies, and coordinating with external privacy auditors when applicable
iv. Evaluating new technology acquisitions for potential privacy issues Use Policies

6. The City should create written Use Policies that govern the use of each privacy-impacting technology and the data generated by those technologies. a. Each policy should clearly state the purpose of the technology, who will be allowed to access the technology, how the technology can be used, what kind of data the technology generates, how that data can be used, how that data is protected, and the retention period for that data.

7. Use Policies should be drafted by the applicable department in consultation with the Chief Privacy Officer, then reviewed by the Privacy Advisory Board. a. Departments will use a template created by the Chief Privacy Officer.

8. Use Policies should be reviewed annually and updated if necessary. Use policies should also be reviewed and updated any time there is a significant change in the function or purpose of the technology.

9. Due to the large number of use policies that may need to be created or updated, the Chief Privacy Officer and Privacy Advisory Board will perform an analysis that prioritizes current and future technologies based on the impact and risks to individual privacy.

Based on the results of this analysis, use policies will be reviewed for the highest-ranked technologies first.
a. Facial recognition technology, other biometric systems, surveillance systems, and systems that use machine learning algorithms should be a top priority for Board review.

Data Retention and Data Sharing

10. The City should never sell the data it collects nor allow third parties working on behalf of the City to sell or use data owned by the City except as necessary to provide the contracted service to the City.

11. Internal data-sharing between City Departments should be subject to a review process that includes approval by the City Manager and periodic review by the Chief Privacy Officer and Privacy Advisory Board.
a. The purpose of this policy recommendation is to ensure there is a clear understanding of how data is being used and shared between departments, and to Comments summary on <Public Comment - Stucky - 2022-08-29.pdf> Created on 8/29/2022 at 17:25:3 Page 4
prevent situations where there is uncertainty around how data is being used, such as in the case of the informal data-sharing that occurred between Engineering and the Police Department regarding traffic signal camera feeds.

12. External data-sharing between the City and third parties must be approved through a formal, auditable process that includes the Chief Privacy Officer and Privacy Advisory Board.
a. The purpose of this policy recommendation is to prevent situations like the sharing of ALPR data with law enforcement agencies that should not have had access to it.
b. The review should ensure that personal information is not being shared and that the data has been repackaged and de-identified to minimize the possibility of privacy violations.

13. The City Records Retention Schedule should be re-organized and expanded to include information on what personal data is collected and when that data will be deleted. a. As part of these updates, the Records Retention schedule should be presented in a format that provides a category for data type in addition to the existing categories. b. The Chief Privacy Officer should collaborate with the City Clerk to lead this process.

14. The City should establish a more formal process for ensuring that personal data is being deleted according to the Use Policies established for that data.

15. The City should establish a policy that it will not collect personal data unless it is absolutely necessary to provide the core service.
a. The Chula Vista Public Library’s approach to personal data is a model that should be followed citywide. Personal data is only collected and retained for the period necessary to provide the service. For example, the library keeps a record of an item checked out by an individual borrower only until that item is returned, at which point data related to that transaction is deleted. b. To ensure compliance with this policy, the Chief Privacy Officer should randomly sample Departments or data sets to review on a periodic basis.

16. Where possible, the City should anonymize, remove, or de-identify data that relates to a person.
a. It must be understood and acknowledged that anonymization strategies will not completely protect individuals from having their identities reverse-engineered from otherwise anonymized datasets, but these strategies are still valuable in mitigating risks to individual privacy.

17. The role of the City’s Data Governance Committee should be more clearly defined and communicated to the public.
a. The City should ensure that the work of the Data Governance Committee is consistent with the City’s adopted privacy policies and with the role or recommendations of the Privacy Advisory Board.

Comments summary on <Public Comment - Stucky - 2022-08-29.pdf> Created on 8/29/2022 at 17:25:3 Page 5
Transparency and Oversight

18. City staff should provide the public with full disclosures about what technologies have been acquired, what data is being collected, and how that data is being used. a. These disclosures should happen in a variety of ways, including on the City’s website, through email newsletters, social media, and in printed communications mailed to residents.
b. These disclosures should address what data is being collected, what department is collecting it, how it is being used, who has access to it, how long it is retained, etc.
c. Where feasible, signs should be posted to notify and disclose surveillance technology. For example, if surveillance cameras are added to parks, signs should be posted notifying visitors that they are under video surveillance. d. The City should hold public forums, educational seminars, and other types of community events to ensure the public is informed and has an opportunity to hold the City accountable for how privacy-impacting technologies are being used. e. All public disclosures related to technology, data, and privacy should be provided with adequate time for public review before any meeting. The 72-hour standard is not sufficient for the public to review and consider new information, especially when that time period coincides with weekends and holidays.

19. Information about privacy and technology that is provided on the City website should be easy to find and easy to understand.
a. Links to disclosures should be provided on each Department’ s page within the City website.
b. The City’s “ smart city” webpages should have their own navigational tab or section on the City website, rather than being contained under the Business / Economic Development section.

20. Contracts with technology vendors should be easy for the public to find and review. a. This should include information about the status of existing contracts, including upcoming renewal or termination dates.

21. Data breaches should be publicly disclosed as soon as possible. a. Notification should happen within 24 hours of the data breach being confirmed. b. Notification should occur through a wide range of communications channels, including social media, news media, and the City website.

22. Residents should have the opportunity to opt-out or have their data deleted if it was provided voluntarily to the City and is not needed for City operations. a. It is understood that individuals will not be able to opt-out of certain types of data collection, such as a drone responding to 9-1-1 calls, or medical data being retained following a emergency medical service call.

Comments summary on <Public Comment - Stucky - 2022-08-29.pdf> Created on 8/29/2022 at 17:25:3 Page 6
1 381Dave 08/27/2022 12:30:

Contracts with technology vendors should
be subject to the same disclosure standards
as those of any other vendor contracts.
2 342Dave 08/27/2022 12:33:

Voluntarily" provided data implies the
option to decline to provide in the first place.

And if it not needed for City operations, it
probably should not have been collected in
the first place.

Procurement

23. All contracts with privacy implications must be presented to the City Council, regardless of whether they meet standard purchasing and contracting thresholds that typically trigger City Council review.

24. Prior to City Council presentation, contracts with privacy implications must be reviewed by the Chief Privacy Officer and the Privacy Advisory Board. The evaluation provided by the Chief Privacy Officer and the Privacy Advisory Board must be included as part of the report presented to City Council.

25. When acquiring new technology systems, the Chief Information Security Officer and Chief Privacy Officer should prepare an assessment of the technology’ s potential impact on the City’s information security and detail any mitigation strategies. This assessment should be provided to the Privacy Advisory Board and the City Council at the same time as any other documents provided for review, such as the contract for the technology (Item 24) and the technology's proposed Use Policy (Item 7).

26. The City may not enter into any agreement that prohibits the City from publicly acknowledging that it has acquired or is using a particular technology. Nondisclosure agreements are acceptable only to extent that they protect a vendor’ s proprietary information without prohibiting the City’s acknowledgement of a relationship with the vendor.

27. Contracts should include a clause of convenience that allows the City to terminate the agreement in the event the vendor violates any restriction on the sale or sharing of data or otherwise violates individual privacy protections.

28. Technology contracts should require that vendors provide the City with the capability to audit or review who has accessed what information.
a. These access reports should be provided at pre-designated intervals to City staff or third-party auditors.

29. City staff should be provided with additional training to assist in recognizing potential data privacy issues in contracts.
a. Key staff to receive additional training includes the Chief Privacy Officer, Chief Information Security Officer, City Attorney staff, and purchasing and contracting staff.

30. Changes in the ownership of a privacy-impacting technology that has already been reviewed by the Privacy Advisory Board should trigger a new review by the Privacy Advisory Board.

Comments summary on <Public Comment - Stucky - 2022-08-29.pdf> Created on 8/29/2022 at 17:25:3 Page 7
1 171Dave 08/27/2022 12:36:

Privacy implications" is too broad a term.

The standard needs to be more narrowly
defined.
2 592Dave 08/27/2022 12:38:

It is not inconceivable that an agreement
with, for example, a federal agency could
reasonably prohibit public disclosure.
3 153Dave 08/27/2022 12:40:

Virtually all municipal contracts should
already include the right to terminate for
convenience.

Information Security

31. Establish a comprehensive information security policy that addresses procedures for maintaining and controlling access to data and articulates the roles and responsibilities of data stewards and data custodians.
a. An outline of such a policy has been developed by the Information Security subcommittee of this Task Force and will be submitted as part of this recommendation.
b. The policy should make clear that only City-owned mobile equipment using twofactor authentication should be allowed to connect to the City’s primary network.

Any personal devices connecting to the City’s network must use restricted “ guest” access.
c. The policy should provide for audits of all City-owned equipment to protect against unauthorized storage of regulated data.
d. The policy should require data security breaches to be reviewed and addressed by an established panel that includes the Director of Information Technology Services, the Chief Information Security Officer, the Chief of Police, the City Attorney, and the Chief Privacy Officer.
e. The policy should require that data is stored and transmitted in encrypted formats whenever possible and prohibit the communication of confidential data through end-user messaging technologies such as email, instant messaging, chat, or other communication methods.
f. The policy should specifically address mobile computing devices, including recovery of data in the event a mobile computing device is lost or stolen.

Additional Comments
The Task Force has received multiple public comments regarding the methodology used to conduct the public opinion survey and focus groups. The Task Force encourages City staff and City Councilmembers to consider the potential for bias in the results of the public opinion research, particularly as described in the letter from Dr. Norah Shultz of San Diego State University, which was provided as part of the August 15 Task Force meeting agenda.

Comments summary on <Public Comment - Stucky - 2022-08-29.pdf> Created on 8/29/2022 at 17:25:3 Page 8
Appendix A: Definitions
DRAFT – August 25, 2022

1.“Annual Surveillance Report” means a written report concerning a specific surveillance technology that includes all the following:
a. A description of how the surveillance technology was used, including the type and quantity of data gathered or analyzed by the technology; b. Whether and how often data acquired through the use of the surveillance technology was shared with internal or external entities, the name of any recipient entity, the type(s) of data disclosed, under what legal standard(s) the information was disclosed, and the justification for the disclosure(s) except that no confidential or sensitive information should be disclosed that would violate any applicable law or would undermine the legitimate security interests of the City;
c. Where applicable, a description of the physical objects to which the surveillance technology hardware was installed without revealing the specific location of such hardware; for surveillance technology software, a breakdown of what data sources the surveillance technology was applied to;
d. Where applicable, a description of where the surveillance technology was deployed geographically, by each Police Area in the relevant year; e. A summary of community complaints or concerns about the surveillance technology, and an analysis of its Surveillance Use Policy and whether it is adequate in protecting civil rights and civil liberties. The analysis shall consider whether, and to what extent, the use of the surveillance technology disproportionately impacts certain groups or individuals;
f. The results of any internal audits or investigations relating to surveillance technology, any information about violations or potential violations of the Surveillance Use Policy, and any actions taken in response. To the extent that the public release of such information is prohibited by law, City staff shall provide a confidential report to the City Council regarding this information to the extent allowed by law; g. Information about any data breaches or other unauthorized access to the data collected by the surveillance technology, including information about the scope of the breach and the actions taken in response, except that no confidential or sensitive information should be disclosed that would violate any applicable law or would undermine the legitimate security interests of the City;
h. A general description of all methodologies used to detect incidents of data breaches or unauthorized access, except that no confidential or sensitive information should be disclosed that would violate any applicable law or would undermine the legitimate Comments summary on <Public Comment - Stucky - 2022-08-29.pdf> Created on 8/29/2022 at 17:25:3 Page 9
1 451Dave 08/27/2022 12:52:

Nowhere in this report is surveillance
mentioned until now. Where does this come
from and how does this fit into the overall
scheme of the report? Who is responsible
for the creation of this "Annual Surveillance
Report" and to whom is it presented?
security interests of the City;
I. Information, including crime statistics, that helps the community assess whether the surveillance technology has been effective at achieving its identified purposes; i. Statistics and information about Public Records Act requests regarding the relevant subject surveillance technology, including response rates, such as the number of Public Records Act requests on such surveillance technology and the open and close date for each of these Public Records Act requests;
j. Total annual costs for the surveillance technology, including personnel and other ongoing costs, and what source of funding will fund the surveillance technology in the coming year; and
k. Any requested modifications to the Surveillance Use Policy and a detailed basis for the request.

2. “City” means any department, unit, program, and/or subordinate division of the City of Chula Vista as provided by Chapter XXXX of the Chula Vista Municipal Code.

3. “City staff” means City personnel authorized by the City Manager or appropriate City department head to seek City Council Approval of Surveillance Technology in conformance with this Chapter.

4. “Community meeting” means a publicly held meeting that is accessible, noticed at least seventy-two hours in advance in at least two languages, for the purpose of educating communities, answering questions, and learning about potential impacts of surveillance technology on disadvantaged groups.

5. “Continuing agreement” means a written agreement that automatically renews unless terminated by one or more parties.

6. “Exigent circumstances” means a City department’ s good faith belief that an emergency involving imminent danger of death or serious physical injury to any individual requires the use of surveillance technology that has not received prior approval by City Council.

7. “Facial recognition technology” means an automated or semi-automated process that assists in identifying or verifying an individual based on an individual’s face.

8. “Individual” means a natural person.

9. “Personal communication device” means a mobile telephone, a personal digital assistant, a wireless capable tablet and a similar wireless two-way communications and/or portable internetaccessing device, whether procured or subsidized by a City entity or personally owned, that is used in the regular course of City business.

Comments summary on <Public Comment - Stucky - 2022-08-29.pdf> Created on 8/29/2022 at 17:25:3 Page 10

10. “Police area” refers to each of the geographic districts assigned to a Chula Vista Police Department captain or commander and as such districts are amended from time to time.

11. “Sensitive personal information” will reflect the California Privacy Rights Act (CPRA) definition of personal information which defines the term to include:
l) personal information that reveals:

A) a consumer’ s social security, driver’ s license, state identification card, or passport number;
B) a consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account;
C) a consumer’s precise geolocation;
D) a consumer’ s racial or ethnic origin, religious or philosophical beliefs, or union membership;
E) the contents of a consumer’ s mail, email and text messages, unless the business is the intended recipient of the communication; F) a consumer’ s genetic data; and
2) ( A) the processing of biometric information for the purpose of uniquely identifying a consumer;
B) personal information collected and analyzed concerning a consumer’s health; or
C) personal information collected and analyzed concerning a consumer’ s sex life or sexual orientation.

12. “Surveillance” ( or “spying”) means to observe or analyze the movements, behavior, data, or actions of individuals. Individuals include those whose identity can be revealed by data or combinations of data, such as license plate data, images, IP addresses, user identifications, unique digital identifiers, or data traces left by the individual.

13. “Surveillance technology” means any software (e.g., scripts, code, Application Programming Interfaces), electronic device, or system utilizing an electronic device used, designed, or primarily intended to observe, collect, retain, analyze, process, or share audio, electronic, visual, location, thermal, olfactory, biometric, or similar information specifically associated with, or capable of being associated with, any individual or group. It also includes the product (e.g., audiovisual recording, data, analysis, report) of such surveillance technology. Examples of surveillance technology include, but are not limited to the following: cell site simulators Stingrays); automated license plate readers; gunshot detectors (ShotSpotter); drone-mounted data collection; facial recognition software; thermal imaging systems; body-worn cameras; social media analytics software; gait analysis software; video cameras that can record audio or video and transmit or be remotely accessed. It also includes software designed to monitor social media services or forecast and/or predict criminal activity or criminality, and biometric identification hardware or software. “Surveillance technology” does not include devices, software, or hardware, unless they have been equipped with, or are modified to become or include, a surveillance technology beyond what is set forth below or used beyond a purpose as set forth below:

Comments summary on <Public Comment - Stucky - 2022-08-29.pdf> Created on 8/29/2022 at 17:25:3 Page 11
a. Routine office hardware, such as televisions, computers, credit card machines, badge readers, copy machines, and printers, that is in widespread use and will not be used for any public surveillance or law enforcement functions related to the public; b. Parking Ticket Devices (PTDs) used solely for parking enforcement-related purposes, including any sensors embedded in parking sensors to detect the presence of a car in the space;
c. Manually-operated, non-wearable, handheld digital cameras, audio recorders, and video recorders that are not designed to be used surreptitiously and whose functionality is limited to manually-capturing and manually-downloading video and/or audio recordings; d. Surveillance devices that cannot record or transmit audio or video or be remotely accessed, such as image stabilizing binoculars or night vision goggles; e. Manually-operated technological devices used primarily for internal municipal entity communications and are not designed to surreptitiously collect surveillance data, such as radios and email systems;
f. City databases that do not contain any data or other information collected, captured, recorded, retained, processed, intercepted, or analyzed by surveillance technology, including payroll, accounting, or other fiscal databases; g. Medical equipment used to diagnose, treat, or prevent disease or injury, provided that any information obtained from this equipment is used solely for medical purposes; h. Police department interview room cameras;
i. City department case management systems;
j. Personal Communication Devices that have not been modified beyond stock manufacturer capabilities in a manner described above;
k. Surveillance technology used by the City solely to monitor and conduct internal investigations involving City employees, contractors, and volunteers; and, l. Systems, software, databases, and data sources used for revenue collection on behalf of the City by the City Treasurer, provided that no information from these sources is shared by the City Treasurer with any other City department or third-party except as part of efforts to collect revenue that is owed to the City.

14. “Surveillance Impact Report” means a publicly-posted written report including, at a minimum, the following:
a. Description: Information describing the surveillance technology and how it works, including product descriptions from manufacturers;
Comments summary on <Public Comment - Stucky - 2022-08-29.pdf> Created on 8/29/2022 at 17:25:3 Page 12
b. Purpose: Information on the proposed purposes(s) for the surveillance technology; c. Location: The physical or virtual location(s) it may be deployed, using general descriptive terms, and crime statistics for any location(s); d. Impact: An assessment of the Surveillance Use Policy for the particular technology and whether it is adequate in protecting civil rights and liberties and whether the surveillance technology was used or deployed, intentionally or inadvertently, in a manner that may disproportionately affect marginalized communities;
e. Mitigations: Identify specific, affirmative technical and procedural measures that will be implemented to safeguard the public from each identified impact; f. Data Types and Sources: A list of all types and sources of data to be collected, analyzed, or processed by the surveillance technology, including open source data, scores, reports, logic or algorithm used, and any additional information derived therefrom;
g. Data Security: Information about the controls that will be designed and implemented to ensure that adequate security objectives are achieved to safeguard the data collected or generated by the surveillance technology from unauthorized access or disclosure; h. Fiscal Costs and Sources: The forecasted, prior, and ongoing fiscal costs for the surveillance technology, including initial purchase, personnel, and other ongoing costs, and any past, current or potential sources of funding;
i. Third-Party Dependence: Whether use or maintenance of the surveillance technology will require data gathered by the surveillance technology to be handled or stored by a third-party vendor at any time;
j. Alternatives: A summary of all alternative methods (whether involving the use of a new technology or not) considered before deciding to use the proposed surveillance technology, including the costs and benefits associated with each alternative and an explanation of the reasons why each alternative is inadequate; k. Track Record: A summary of the experience (if any) other entities, especially government entities, have had with the proposed technology, including, if available, quantitative information about the effectiveness of the proposed surveillance technology in achieving its stated purpose in other jurisdictions, and any known adverse information about the surveillance technology such as unanticipated costs, failures, or civil rights and civil liberties abuses, existing publicly reported controversies, and any court rulings in favor or in opposition to the surveillance; and l. Public engagement and comments: A description of any community engagement held and any future community engagement plans, number of attendees, a compilation of all comments received and City departmental responses given, and City departmental Comments summary on <Public Comment - Stucky - 2022-08-29.pdf> Created on 8/29/2022 at 17:25:3 Page 13
conclusions about potential neighborhood impacts and how such impacts may differ as it pertains to different segments of the community that may result from the acquisition of surveillance technology.

15. "Surveillance Use Policy" means a publicly-released and legally-enforceable policy for use of the surveillance technology that at a minimum specifies the following:
a. Purpose: The specific purpose(s) that the surveillance technology is intended to advance;
b. Use: The specific uses that are authorized, and the rules and processes required prior to such use;
c. Data Collection: The information that can be collected, captured, recorded, intercepted, or retained by the surveillance technology, as well as data that might be inadvertently collected during the authorized uses of the surveillance technology and what measures will be taken to minimize and delete such data. Where applicable, any data sources the surveillance technology will rely upon, including open source data, should be listed; d. Data Access: The job classification of individuals who can access or use the collected information, and the rules and processes required prior to access or use of the information;
e. Data Protection: The safeguards that protect information from unauthorized access, including logging, encryption, and access control mechanisms; f. Data Retention: The time period, if any, for which information collected by the surveillance technology will be routinely retained, the reason such retention period is appropriate to further the purpose(s), the process by which the information is regularly deleted after that period lapses, and the specific conditions that must be met to retain information beyond that period;
g. Public Access: A description of how collected information can be accessed or used by members of the public, including criminal defendants;
h. Third Party Data Sharing: If and how information obtained from the surveillance technology can be used or accessed, including any required justification or legal standard necessary to do so and any obligations imposed on the recipient of the information;
i. Training: The training required for any individual authorized to use the surveillance technology or to access information collected by the surveillance technology; j. Auditing and Oversight: The procedures used to ensure that the Surveillance Use Policy is followed, including internal personnel assigned to ensure compliance with the policy, internal recordkeeping of the use of the surveillance technology or access to information Comments summary on <Public Comment - Stucky - 2022-08-29.pdf> Created on 8/29/2022 at 17:25:3 Page 14
collected by the surveillance technology, technical measures to monitor for misuse, any independent person or entity with oversight authority, and the legally enforceable sanctions for violations of the policy; and
k. Maintenance: The procedures used to ensure that the security and integrity of the surveillance technology and collected information will be maintained.

Comments summary on <Public Comment - Stucky - 2022-08-29.pdf> Created on 8/29/2022 at 17:25:2 Page 15
Information Security Subcommittee Report
August 15, 2022
Members: Charles Walker and Carlos De La Toba
Recommended City Information Security Policies
PURPOSE: To provide guidelines with regard to the responsibility of every City of Chula Vista (City) employee who accesses Data and information in electronic formats and to provide for the security of that Data and to restrict unauthorized access to such information.

POLICY: Electronic Data is important to the City assets that must be protected by appropriate safeguards and managed with respect to Data stewardship. This policy defines the required Electronic Data management environment and classifications of Data, and assigns responsibility for ensuring Data and information privacy and security at each level of access and control.

SCOPE AND APPLICABILITY: This policy applies to all City personnel and affiliated users with access to City Data.

DEFINITIONS:

Affiliated Users: Vendors and guests who have a relationship to the City and need access to City systems.

Application or App: A software program run on a computer or mobile device for the purpose of providing a business/ academic/ social function.

Cloud: An on-demand availability, geographically dispersed infrastructure of computer system resources, especially data storage (cloud storage) and computing power, without direct active management by the end user. Clouds may be limited to a single organization (Private Cloud), or be available to many organizations Public Cloud). Cloud-computing providers offer their “services” according to three standard models:

Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS).

Confidential Data: Data that are specifically restricted from open disclosure to the public by law are classified as Confidential Data. Confidential Data requires a high level of protection against unauthorized disclosure, modification, transmission, destruction, and use. Confidential Data include, but are not limited to:

Medical Data, such as Electronic Protected Health Information and Data protected by the Health Insurance Portability and Accountability Act (HIPAA);
Investigation. Only investigation data and information within the following broad categories is to be considered Confidential Data:
o Active Investigations;
o Activity that is covered by a fully executed non-disclosure agreement (NDA); o Information, data, etc., that is proprietary or confidential (whether it belongs to an internal investigator or an outside collaborator), regardless of whether it is subject to an NDA; o Information or data that is required to be deemed confidential by state or federal law (e.g., personally identifying information about research subjects, HIPAA or FERPA protected information, etc.); and
o Information related to an allegation or investigation into misconduct.

Information access security, such as login passwords, Personal Identification Numbers (PINS), logs with personally identifiable Data, digitized signatures, and encryption keys; Comments summary on <Public Comment - Stucky - 2022-08-29.pdf> Created on 8/29/2022 at 17:25:2 Page 16
Primary account numbers, cardholder Data, credit card numbers, payment card information, banking information, employer or taxpayer identification number, demand deposit account number, savings account number, financial transaction device account number, account password , stock or other security certificate or account number (such as Data protected by the Payment Card Industry Data Security Standard) ;
Personnel file, including Social Security Numbers;
Library records;
Driver’s license numbers, state personal identification card numbers, Social Security Numbers, employee identification numbers, government passport numbers, and other personal information that is protected from disclosure by state and federal identity theft laws and regulations.

Data Classifications: All Electronic Data covered by this policy are assigned one of three classifications:

Confidential
Operation Critical
Unrestricted
Data Custodian: Persons or departments providing operational support for an information system and having responsibility for implementing the Data Maintenance and Control Method defined by the Data Steward.

Data Maintenance and Control Method: The process defined and approved by the Data Steward to handle the following tasks:

Definition of access controls with assigned access, privilege enablement, and documented management approval, based on job functions and requirements.

Identification of valid Data sources
Acceptable methods for receiving Data from identified sources Process for the verification of received Data
Rules, standards and guidelines for the entry of new Data, change of existing Data or deletion of Data Rules, standards and guidelines for controlled access to Data Process for Data integrity verification
Acceptable methods for distributing, releasing, sharing, storing or transferring Data Acceptable Data locations
Providing for the security of Confidential Data and Operation Critical Data Assuring sound methods for handling, processing, security and disaster recovery of Data Assuring that Data are gathered, processed, shared and stored in accordance with the City privacy statement (to be written).

Data Steward: The persons responsible for City functions and who determine Data Maintenance and Control Methods are Data Stewards.

Electronic Data/ Data: Distinct pieces of information, intentionally or unintentionally provided to the City in a variety of administrative, academic and business processes. This policy covers all Data stored on any electronic media, and within any computer systems defined as a City information technology resource.

Mobile Computing Devices: Information technology resources of such devices include, but are not limited to, laptops, tablets, cell phones, smart phones, and other portable devices.

Operation Critical Data: Data determined to be critical and essential to the successful operation of the City as a whole, and whose loss or corruption would cause a severe detrimental impact to continued operations.

Comments summary on <Public Comment - Stucky - 2022-08-29.pdf> Created on 8/29/2022 at 17:25:2 Page 17
Data receiving this classification require a high level of protection against accidental distribution, exposure or destruction, and must be covered by high quality disaster recovery and business continuity measures. Data in this category include Data stored on Enterprise Systems such as Data passed through networked communications systems. Such Data may be released or shared under defined, specific procedures for disclosure, such as departmental guidelines, documented procedures or policies.

City Provided Data Systems: Information technology resources, as defined and described by the City and used for the storage, maintenance and processing of City Data.

Unrestricted Data: Information that may be released or shared as needed.

Usage/ Data Use: Usage and Data Use are used interchangeably and are defined as gathering, viewing, storing, sharing, transferring, distributing, modifying, printing and otherwise acting to provide a Data maintenance environment.

PROCEDURES:

1. Data Stewardship
Data Stewards are expected to create, communicate and enforce Data Maintenance and Control Methods.

Data Stewards are also expected to have knowledge of functions in their areas and the Data and information used in support of those functions. The Chief Information Officer(CIO) is ultimately accountable for the Data management and stewardship of all the City data. The CIO may appoint others in their respective areas of responsibility.

2. Data Maintenance and Control Method
Data Stewards will develop and maintain Data Maintenance and Control Methods for their assigned systems.

When authorizing and assigning access controls defined in the Data Maintenance and Control Methods involving Confidential Data and Operation Critical Data, Data Stewards will restrict user privileges to the least access necessary to perform job functions based on job role and responsibility.

If the system is a City Provided Data System, City Technology Services will provide, upon request, guidance and services for the tasks identified in the Data Maintenance and Control Method.

If the system is provided by a Public Cloud, the Data Steward must still verify that the Data Maintenance and Control Method used by the Public Cloud provider meets current City technology standards (to be written)?.

Further, ongoing provisions for meeting current City technology and security standards (to be written)? must be included in the service contract.

Review of Public Cloud solutions must include City Technology Services and City Attorney prior to final solution selection and purchase.

Use of personal equipment to conduct City business must comply with all guidance provided by City policies to be written)?.

3. Data Custodianship
Data Custodians will use Data in compliance with the established Data Maintenance and Control Method.

Failure to process or handle Data in compliance with the established method for a system will be considered a violation of the City policies.

Comments summary on <Public Comment - Stucky - 2022-08-29.pdf> Created on 8/29/2022 at 17:25:2 Page 18

4. Data Usage
In all cases, Data provided to the City will be used in accordance with the Privacy Statement (to be written) Software solutions, including SaaS solutions, are selected to manage Data and are procured, purchased and installed in conjunction with City (to be written)
Data will be released in accordance with City (to be written). Requests for information from external agencies such as Freedom of Information Act requests, subpoenas, law enforcement agency requests, or any other request for Data from an external source) must be directed to the City Attorney and processed in accordance with existing policies.

Standards for secure file transmissions, or Data exchanges, must be evaluated by the CIO when a system other than a City Provided Data System is selected or when a Public Cloud is utilized. Specific contract language may be required. The City Attorney must be consulted regarding such language.

Unencrypted authorization and Data transmission are not acceptable.

Communication of Confidential Data via end-user messaging technologies (i.e., email, instant messaging, chat or other communication methods) is prohibited

5. Storing Data
Data cannot be stored on a system other than a City Provided Data System without the advance permission of the Data Steward and demonstrated legitimate need.

Data should be stored in encrypted formats whenever possible. Confidential Data must be stored in encrypted formats. Encryption strategies should be reviewed with City Technology Services in advance to avoid accidental Data lockouts.

Data cannot be stored on a City-provided Computing Device unless the device is encrypted without the advance permission of the Data Steward and demonstrated legitimate need.

Data must be stored on devices and at locations approved by Data Stewards. If information technology resources (computers, printers and other items) are stored at an off-campus location, the location must be approved by Data Stewards prior to using such resources to store City Data.

Technology enables the storage of Data on fax machines, copiers, cell phones, point-of-sale devices and other electronic equipment. Data Stewards are responsible for discovery of stored Data and removal of the Data prior to release of the equipment.

When approving Mobile Computing Device Usage, Data Stewards must verify that those using Mobile Computing Devices can provide information about what Data was stored on the device (such as a copy of the last backup) in the event the device is lost or stolen.

In all cases, Data storage must comply with City retention policies. Data Usage in a Public Cloud system must have specific retention standards(to be written)? written in the service contract. The City Attorney must be consulted regarding such language.

Provisions for the return of all City Data in the event of contract termination must be included in the contract, when Data is stored on a Public Cloud. The City Attorney must be consulted regarding such language. Current Comments summary on <Public Comment - Stucky - 2022-08-29.pdf> Created on 8/29/2022 at 17:25:2 Page 19
security standards (to be written)? (such as controlled access, personal firewalls, antivirus, fully updated and patched operating systems, etc.) will be evaluated when a system other than a City Provided Data System is selected and must be covered in contract language. The City Attorney must be consulted regarding such language.

Data stored on Mobile Computing Devices must be protected by current security standard methods (such as controlled access, firewalls, antivirus, fully updated and patched operating systems, etc.).

City standard procedures (to be written) for the protection and safeguarding of Confidential Data and Operation Critical Data must be applied equally and without exception to City Provided Data Systems, Mobile Computing Devices and systems other than City Provided Data Systems, such as Public Cloud solution.

6. Systems and network Data
Systems and network Data, generated through systems or network administration, logs or other system recording activities, cannot be used, or captured, gathered, analyzed or disseminated, without the advance permission of the Chief Information Officer.

7. Value of Data
In all cases where Data are to be processed through a Public Cloud, the following assessment must be done:

The value of the Data must be determined in some tangible way.

Signature approval from the Data Steward’s division vice president or appropriate party with the ability to authorize activity at the level of the value of the Data must be obtained.

8. Sanctions
Failure to follow the guidelines contained in this document will be considered inappropriate use of a City information technology resource and therefore a violation of the City policy(to be written).

9. Data Security Breach Review Panel
A Data Security Breach Review Panel (Panel) comprised of the following members will be established:
o Chief Information Officer
o Chief of Police
o City Attorney
o Chief Privacy Officer

10. Data Loss Prevention Software
Define granular access rights for removable devices and peripheral ports and establish policies for users, computers and groups, maintaining productivity while enforcing device security

11. Audits
All City owned equipment is subject to audit for unauthorized storage of regulated data. Devices authorized to store regulated data are subject to audits as deemed necessary by the CIO. Reasonable prior notification of an audit will be provided. Audit results are handled confidentially by Information Security staff and are reported to the CIO in aggregate.

12. Mobile Devices
City owned mobile equipment will be exclusively allowed on the City’s primary network and use two factor authentication. All personal devices must use “guest” access if provided.

Comments summary on <Public Comment - Stucky - 2022-08-29.pdf> Created on 8/29/2022 at 17:25:2 Page 20
1 Jeremy Ogul
From:

Sent: Tuesday, September 6, 2022 2:09 PM
To: [email protected]
Subject: Community input
Warning: External Email
To whom it may concern,
I am a Chula Vista resident, home owner in Otay Ranch community since 2008, a working RN, married with 3 children.

Me and my husband both support the increased monitoring in our city/community. We are happy that our hard earned tax dollars were spent to provide the drone first responder service to our CVPD. In my opinion the more eyes we have on our community the better, the safer our city community our neighborhoods will be. I do not care if I have camera’s on my house, drones flying over my backyard ext. That makes me and my children feel safer. Our neighborhood so far has been a very safe and family welcoming neighborhood- with kids walking and riding bike independently, seniors walking there dogs, parks without issues of homelessness or petty crime, absence of graffiti ext. So I trust our CVPD to use the monitor technology at there will- whatever they have been doing so far has been working great. Keep up the good work for people like me and my family CVPD!
Gina Velasco
Zip 91913
Written comments received by Task Force 4/25/22 - 9/26/22: Page 110 1 Jeremy Ogul
From: Eric Wood <
Sent: Sunday, August 28, 2022 10:03 PM
To: [email protected]
Subject: Feedback on DRAFT Policy Recommendations
Hello,
My name is Eric Wood and I am a resident of Chula Vista. In the past, I was the Police Technology Manager and Smart Technology Officer for the City of Chula Vista. I currently have no official or formal relationship or role with the city aside from being a resident and former employee. I have spent over 20 years as a technology consultant, much of that was under the employment of Microsoft. I have also worked in the public sector driving technology innovation, security and compliance. I hold CISSP and CCSP credentials for information system security. I’m currently employed by a private sector firm which helps law enforcement gain insights from their existing data systems; which are often separated in vendor, departmental or technology silos. I’m accustomed to dealing with very sensitive data sets and security compliance that must meet FBI standards (CJIS) and NIST:800-53.

I have attended several of the task force meetings at the Council Chambers and the public engagement event at the Otay Ranch Library.

With that background, let me offer you some of my feedback after reviewing the DRAFT Policy Recommendations that the task force has published for comment.

General Feedback:

As a whole, I believe that the task force is misguided with their approach in several aspects. It is my opinion that the purpose of the task force was to propose policies or practices for the purpose of establishing safe and reasonable protections against the misuse or abuse of Personally Identifiable Information within the city. However, what I notice in the discussions at meetings and within the proposed policies and practices is a much more controlling or gating role in city operations born from a foundation of mistrust. I will provide some specific examples to support this observation.

This DRAFT policy recommendations document reads as if this was a Surveillance Task Force. There are 68 occurrences of the word ‘Surveillance’ in the document. Please consider the impression that your language will leave on the public and be leveraged by the media to create negative connotations that are unwarranted in my opinion. The focus should be on data privacy protections…yes surveillance systems are an element of privacy protections but the systems this task force is aware of and have described as surveillance systems include the Police Drones and LPR cameras, neither of which collect identifiable information…you would have to take information from those and have access and cause to search another system in order to make any identification….and that’s not identifying the occupants…just the registered owner. My ask here is for the task force to rebalance the language used with the purpose and real risk that exists today to privacy. An ongoing PAB would keep those in check down the road…but I believe this heavy lean on the use of surveillance is not warranted and does not serve the city or the citizens. It’s unnecessarily alarming and if you outline these to the average citizen, as has been done for each of you, they would agree that it’s been overblown.

Specific Points of Feedback:

Section 1.A.II through 1.A.IV – The language used here implies (based on other language and open discussion at the task force meetings) that the Policy Advisory Board (will review Use Policies, Data Sharing Agreements and new technologyrelated contracts) in a gating function…meaning if the outcome of the review is not satisfactory then some delay or denial will occur as a result. In reality, Use Policies, Data Sharing Agreements and Contracts are all discoverable and there’s no need to include this within the recommendations unless the intent is for the PAB to act as a gating function. The PAB should absolutely review those and provide any recommended changes to the city manager’s office Warning:

External
Email
Written comments received by Task Force 4/25/22 - 9/26/22: Page 111 2 and the CISO. The PAB will not have the requisite background and training in Federal, State and Local laws on contracting, interagency collaboration, mutual-aid and jurisdiction. I recommend clarifying that these types of documents may be reviewed along with other established (not proposed, planned or work-in-progress) policies, practices and contracts, just as any member of the public is able to.

Section 5 – I strongly disagree with the recommendation for a Chief Privacy Officer. Managing and being accountable for data privacy is included in the discipline and profession of a Chief Information Security Officer. Data is both an asset and a liability. If PII data is not adequately protected against misuse, abuse, manipulation, denial of access or unwanted disclosure then this is an Information Security problem. How many other cities that are comparable to Chula Vista do you see with a Chief Privacy Officer? This would be an anomaly and it’s poorly envisioned in my opinion. I would not be surprised if this recommendation was not supported by the City Manager. If what you are concerned about is that there is clear accountability and job focus, then a more preferred approach in my opinion would be to recommend that the CISO must personally report progress/ challenges regarding Data Privacy to the City Attorney and Risk Management Officer and in order to conduct the desired level of internal audits, investigations of practices not aligned with policy, then an analyst position should be created to perform the discovery, monitoring and reporting of data privacy related activities, developments, areas of non-compliance to the CISO. The CISO must be capable of managing the city’s cybersecurity posture and strike a balance between usability for city functions and security and compliance for risk management. The CISO should have direct oversight of external audits or vendors which may periodically augment the data privacy or cyber security functions.

Section 11 – Internal data sharing between city departments should be encouraged. This is actually a core competency that underpins smart-cities and more effective/efficient government services. The Data owner is ultimately the department head that is deciding the if, who, what, where, when, how and why they would share their departments data with another city department. Are there concerns about oversharing or how the information will be utilized by the other city department, absolutely. But I guarantee that those city department heads and their senior managers will work through those details. I know this because I was involved in the example used by the task force. The ‘informal sharing agreement’ between Traffic Engineering and the Police Department. I directly led this effort from the PD by requesting access from Traffic Engineering. The Distinguished Traffic Engineer went directly to the department head to seek authorization. We outlined use cases, permissions, authorized personnel, etc. This was handled in email, phone calls and face-to-face meetings. To what degree of formality does the task force desire department heads to work together to save the taxpayer money while also improving service delivery? The video management system that enabled this sharing was under the control of the Data Owner and the permissions and audit logs assured that only the agreed upon people and permissions were utilized. This is another area where the Task Force is over-stepping what is being asked….describe the safe-guards you would like to see, don’t inject a review process and a board that bogs down good public service leaders making responsible decisions. Please focus on transparency and trust…let periodic audits by the CISO verify that the safety measures are having the desired effect.

Section 12 – External data sharing between the city and third parties must be approved through a formal, auditable process that includes the PAB? Data is shared with 3rd party agencies and entities on a regular basis and cannot be gated by the PAB who doesn’t meet often enough or have a working understanding of the nature of the data sharing. The Police Department shares data with investigators from other agencies in the region and with the District Attorney’s office. Traffic engineering collect non-identifiable data on traffic flow and patterns based on cell phones passing by various points on surface streets and that data can be shared with 3rd parties to help inform commuters where there is congestion so that they can choose an alternate/faster route. This section of your recommendations needs significant revision in my opinion and frankly, I would focus on requiring that the data owners document the current practices sharing of Identifiable data to 3rd parties, rather than submitting all data sharing to 3rd parties for review. I would also like to add some insight to the example the task force used in section 12 with regard to the sharing of LPR data with law enforcement agencies that should not have had access to it. I suspect the task force is not aware that this was a result of a software user interface design flaw which I, as the Police Technology Manager at the time, had reported to the vendor. The vendor said it was not a bug and it was by design. If so, it was a design to trick people into clicking a ‘Yes’ button about data sharing broadly right after a typical prompt appears during user login where clicking ‘Yes’ is necessary to continue into the platform. The look and feel between the two dialogs was nearly identical yet the impact of clicking Written comments received by Task Force 4/25/22 - 9/26/22: Page 112 3 the second ‘Yes’ button was dramatically different than the first. We had no leverage to force the vendor to change the behavior and it was inevitable that a user would Click ‘Yes’ twice in order to get into the platform to do their job. There was no alert email to indicate that this sharing was enabled. It was a horrible design but it is not a reason to throw shame on the city and employ some level of oversight that wouldn’t have prevented the sharing or detected in for perhaps months. Allowing the city to have legal language in the contract to terminate at our convenience if the vendor is putting our data privacy/sharing policies in jeopardy would have resolved this. I defer to the City attorney’s office for the best way to proceed.

Section 22 – In general, I agree with this section as it’s also already supported by California Privacy laws and is therefore redundant and unnecessary to include in your recommendations. This section should be more about tracking and reporting on compliance with existing applicable laws and statutes and less about trying to implement what you believed to be new technical controls. I also wanted to take a moment to highlight that last sentence of 22.a which should include LPR data as a type of data collection that a person cannot reasonably opt-out of. And for the same reason, why signage of ‘surveillance cameras in use’ should not be posted as it gives an improper expectation that if they are nowhere near one of those signs, they are not subject to LPR cameras which would generate plate reads that are available to the city (which I believe is the intent based on conversation at a public meeting of the task force). Commercial vehicles such as tow trucks, garbage trucks and HOA owned LPR cameras are everywhere and moving constantly. That’s technically where most of the license plate reads come from that all law enforcement agencies utilize to investigate crimes that have occurred. A reasonable control to request for LPR systems is that whenever a search of LPR data is done by authorized personnel, the reason for the search must include a CAD incident number or a crime case number. This would make audits of the approved use of LPR data much more usable in terms of finding abuses/ misuses.

I am happy to take calls and meetings to respond to any of my comments here. But I also know that each of you are also very busy and so I understand that I will likely hear nothing in response. I do empathize with each of you. You have volunteered to do a job that you only discover the challenges in doing it well once you’re already in the midst of it. I know that you all have great intentions but I do encourage you to take a trust but verify approach rather than mistrust and review approach. The city has done nothing to deserve that posture.

Best Regards,
Eric Wood
Written comments received by Task Force 4/25/22 - 9/26/22: Page 113 1 Jeremy Ogul
From: Jim Zuffoletto < >
Sent: Sunday, September 18, 2022 11:07 AM
To: [email protected]
Cc: [email protected]; [email protected] Subject: Summary of Policy Recommendations
Members of the Privacy Task Force
Let me preface my remarks by thanking you for the opportunity to comment on the proposed Summary of Policy Recommendations.

My comments are limited to the application of these recommendations as they impact law enforcement and more specifically the CVPD, Sheriff and National City.

I speak from a background in law and law enforcement having been a sworn member of the CVPD and SDSO and a licensed attorney representing clients in various area of civil litigation. I served on the 2021-22 County Grand Jury where my Law and Justice committee examined and extensively studied the issue of privacy rights and the impact of surveillance and modern technology on the public. The 2021-2022 Grand Jury published its findings and recommendations which can be found at: http://www.sdcounty.ca.gov/grandjury.

That being said, the recommendations being proposed are, I believe, incomplete and present potential serious issues concerning public welfare and safety.

The Privacy Advisory Board should have nine members, at least two-thirds of whom are Chula Vista residents.”
It is no surprise that the authors specifically left out inclusion of representatives from law enforcement and victim’s rights advocates. The special interest groups, working under the guise of the San Diego TRUST coalition, drafted and presented the exact same recommendations for the City of San Diego.

One only need look at the composition of that group to understand the real purpose behind their agenda. Best practices studies show that “city council decisions are more likely to be seen as fair and considerate if all people having a stake in the outcome” are involved. Asking nine people, none of whom have any experience in law enforcement, to make recommendations on what is acceptable use of a piece of modern technology is like asking a jury of nine to determine guilt or innocents after hearing testimony and seeing evidence from only one party to a case. At the August meeting of the Advisory group, a member of TRUST stated they were only interested in being sure that all members of the community were represented. That being said, it appears TRUST does not view law enforcement or victims of crime to be part of the Chula Vista community.

Using that as background, and as mentioned earlier, it is my opinion the recommendations fail to address serious concerns unique to law enforcement.

Sharing of information with neighboring law enforcement agencies Warning:

External
Email
Written comments received by Task Force 4/25/22 - 9/26/22: Page 114 2 The CVPD works closely with the SDSO, which serves the unincorporated area of Bonita, and with the NCPD. The departments are often called upon to assist each other. This close symbiotic working relationship often requires sharing of information by each organization. That need for sharing must be recognized and incorporated within the guidelines the advisory board works with and in collaboration with outside agencies and must be considered when recommending any rules on sharing surveillance or the use of equipment, i.e.; drones.

Law Enforcement Consultation and Contribution
Along the same lines, often, the use of surveillance technology as it specifically applies to law enforcement cannot be adequately explained by a non-law enforcement lay person. Hence, any recommendations concerning use of technology must include specific and articulable rationale from the CVPD (or other L.E. sources) as to the appropriateness of the board’s recommendation. If necessary, provisions should be included allowing such presentation to be made in a closed-door session with city council, city attorney, city manager, mayor, and privacy director.

Cooperation and contribution with State and Federal Authorities In addition, the CVPD has officers assigned to, and cross-sworn with, various state and federal agencies and task forces such as FBI, DEA, HSA, etc. In their roles, secret and sensitive information must be shared. Any attempt to quash that sharing might jeopardize further participation by CVPD personnel and affect public safety. Clarification with regard to sharing of such data should be included. Once again, this will require input from high level members of the city administration and the CVPD,
Secrecy and Confidentiality
Finally, I see no provision for discussion of sensitive material among the advisory board members.

Secrecy should be addressed and required as it is with the members of the grand jury. All members must be held to a strict level of confidentiality and subject to fines or prosecution for violating their oath.

I would like to present further discussion at the upcoming meeting and will request the same in a separate writing.

Thank you again,
James M. Zuffoletto, Esq. (Ret)
Virus-free.www.avast.com
Written comments received by Task Force 4/25/22 - 9/26/22: Page 115