Report 2019-118 Recommendation 17 Responses

Report 2019-118: Automated License Plate Readers: To Better Protect Individuals' Privacy, Law Enforcement Must Increase Its Safeguards for the Data It Collects (Release Date: February 2020)

Recommendation #17 To: Los Angeles Police Department

To protect ALPR data to the appropriate standard, by August 2020, Los Angeles should perform an assessment of its ALPR system data-security features, and make adjustments to its system configuration where necessary to comply with CJIS policy best practices based on that assessment.

Annual Follow-Up Agency Response From October 2022

On June 22, 2022, the Los Angeles Police Department entered into a new Professional Services Agreement for Automated License Plate Recognition Services with Motorola Solutions, Inc. The attached agreement contains a Data Security Section that ensures that Motorola will comply with Criminal Justice Information Systems Security Policy. Also attached is the Vigilant LEARN Security and Compliance Guide 2020 and Motorola's License Plate Recognition Usage and Privacy Policy.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

Annual Follow-Up Agency Response From October 2021

See "ALPR System Administrators" in Special Order No. 31, dated December 10, 2020, titled Automated License Plate Recognition Usage and Privacy Policy."

ALPR System Administrators —Defined. Department personnel assigned within Information

Technology Bureau (ITB) have the highest access rights to the ALPR System. The ITB is

responsible for ensuring the maintenance of the ALPR server, database, application software,

and verifying proper operation of the system. The ALPR System Administrators are also

responsible for assisting in any reports of inoperability or malfunction of ALPR-equipped

vehicles.

California State Auditor's Assessment of Annual Follow-Up Status: Partially Implemented

The policy describes levels of access but does not constitute an evaluation of ALPR system data security as the recommendation requests.

6-Month Agency Response

As you know, the Los Angeles Police Department and the City of Los Angeles have faced multiple challenges from the COVID-19 pandemic, as well as the protests and civic unrest following the death of George Floyd. These dual challenges have placed significant burdens on the Department's resources, and as a result of responding to these events, the Department has been delayed in adequately crafting an Automated License Plate Reader policy. The Department realizes the importance of finishing and implementing this policy, especially considering the statutory requirement and the State Auditor's report and recommendations. The Department's ALPR policy is being reviewed by external policy experts and the details are being finalized. We hope to present a completed policy to the Los Angeles Board of Police Commissioners in the near future and will keep you apprised of our progress.

California State Auditor's Assessment of 6-Month Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

60-Day Agency Response

The Department has reviewed the State Auditor's Report and recommendations and we are in the process of drafting an ALPR usage and privacy policy. We aim to present a completed policy to the Los Angeles Board of Police Commissioners in June 2020. However, due to the significant response required to the COVID-19 pandemic, and the increase in our operational needs, please consider this our response to the Report's recommendations at this time. The Department understands the importance of drafting an ALPR policy in a timely manner and, even amid this ongoing pandemic, is striving to complete a policy that takes the many considerations into account.

California State Auditor's Assessment of 60-Day Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

All Recommendations in 2019-118

Agency responses received are posted verbatim.