Report 2019-118 All Recommendation Responses

Report 2019-118: Automated License Plate Readers: To Better Protect Individuals' Privacy, Law Enforcement Must Increase Its Safeguards for the Data It Collects (Release Date: February 2020)

Recommendation #1 To: Fresno Police Department

To ensure that its ALPR policy contains all of the required elements as specified in state law, by August 2020, Fresno should review its policy and draft or revise it as necessary. Also by August 2020, Fresno should post its revised policy on its website in accordance with state law.

Annual Follow-Up Agency Response From October 2021

Policy 453 Automated License Plate Readers (06-20-21) was developed in May 2020 and staffed through the City Attorney's Office and our agency for review. Policy 453 dated 05-11-21 was signed by the Chief and adopted with an effective date of May 11, 2021. This incorporated the changes requested as a result of the audit. The Fresno Police Department Policy is available online at https://www.fresno.gov/police/wp-content/uploads/sites/5/2020/08/PolicyManual-Redacted-09022021_Redacted.pdf

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

1-Year Agency Response

The Fresno Police Department did not provide a one-year response to this recommendation.

California State Auditor's Assessment of 1-Year Status: Pending

6-Month Agency Response

The Fresno Police Department has completed review of policy and procedure 453. The policy has been updated to meet the requirements of state law as described in the audit. All Fresno Police Department policies and procedures are currently posted to the City of Fresno internet site as required by SB 978. http://fresno.gov/police/records-reports. We are in the process of revising our department policy manual in total and will be posting the updated version, to include ALPR Policy 453, by the end of this year.

California State Auditor's Assessment of 6-Month Status: Partially Implemented

60-Day Agency Response

The Fresno Police Department has every intention on complying with the audit recommendations; however, this crisis has delayed us. Prior to COVID-19, we had already restructured our sharing MOU and were in the process of working on some of the other items due in April; however, this pandemic has caused us to shift our resources.

California State Auditor's Assessment of 60-Day Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

Recommendation #2 To: Fresno Police Department

To protect ALPR data to the appropriate standard, by August 2020 Fresno should identify the types of data in its ALPR system and, as Fresno reviews or drafts its ALPR policy, ensure that it clarifies the types of information its officers may upload into its ALPR system, such as, but not limited to, information obtained through CLETS.

Annual Follow-Up Agency Response From October 2021

Fresno Policy section 453.4 DATA COLLECTION AND RETENTION, in paragraph 2. Language was added consistent with the audit findings.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

1-Year Agency Response

The Fresno Police Department did not provide a one-year response to this recommendation.

California State Auditor's Assessment of 1-Year Status: Pending

6-Month Agency Response

As the audit showed, the Fresno Police Department has not entered personal data into the ALPR system; however, we will continue to review data and incorporate into policy the parameters for types of data which can be entered.

California State Auditor's Assessment of 6-Month Status: Partially Implemented

Fresno has updated its ALPR policy, but not yet integrated it into it's policy manual. Until such time time as Fresno makes public it's update policy, we consider the actions it has taken to partially implement this recommendation.

60-Day Agency Response

The Fresno Police Department has every intention on complying with the audit recommendations; however, this crisis has delayed us. Prior to COVID-19, we had already restructured our sharing MOU and were in the process of working on some of the other items due in April; however, this pandemic has caused us to shift our resources.

California State Auditor's Assessment of 60-Day Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

Recommendation #3 To: Fresno Police Department

To protect ALPR data to the appropriate standard, by August 2020 Fresno should perform an assessment of its ALPR system data-security features, and make adjustments to its system configuration where necessary to comply with CJIS policy best practices based on that assessment.

Annual Follow-Up Agency Response From October 2021

See section 453.5.1 AUDITS, in paragraph 1 of Fresno's policy. Language was added per the audit findings, and an internal audit of the Fresno Police Department's ALPR data was conducted on June 1, 2021.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

1-Year Agency Response

The Fresno Police Department did not provide a one-year response to this recommendation.

California State Auditor's Assessment of 1-Year Status: Pending

6-Month Agency Response

The Fresno Police Department IT Manager has assessed the ALPR system and confirmed with Vigilant Solutions IT personnel that the system is compliant with CJIS Security Policy best practices. CJIS compliance language is incorporated in our new contract with Vigilant Solutions.

California State Auditor's Assessment of 6-Month Status: Pending

60-Day Agency Response

The Fresno Police Department has every intention on complying with the audit recommendations; however, this crisis has delayed us. Prior to COVID-19, we had already restructured our sharing MOU and were in the process of working on some of the other items due in April; however, this pandemic has caused us to shift our resources.

California State Auditor's Assessment of 60-Day Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

Recommendation #4 To: Fresno Police Department

To ensure that the agreement with its cloud vendor offers the strongest possible data protections, by August 2020, Fresno should enter into a new contract with Vigilant that contains the contract provisions recommended in CJIS policy.

Annual Follow-Up Agency Response From October 2021

The 2020 Vigilant Contract Amendment dated 12-20-20 has new language added under #1-3 relating to CJIS requirements on the part of the City.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

1-Year Agency Response

The Fresno Police Department did not provide a one-year response to this recommendation.

California State Auditor's Assessment of 1-Year Status: Pending

6-Month Agency Response

The Fresno Police Department has entered a new contract review process with Vigilant to ensure the contract is updated and in compliance with CJIS Security policy. The new contract has been forwarded to the Fresno City Attorney's Office for review and signatures. We anticipate the final version within 60 days.

California State Auditor's Assessment of 6-Month Status: Pending

60-Day Agency Response

The Fresno Police Department has every intention on complying with the audit recommendations; however, this crisis has delayed us. Prior to COVID-19, we had already restructured our sharing MOU and were in the process of working on some of the other items due in April; however, this pandemic has caused us to shift our resources.

California State Auditor's Assessment of 60-Day Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

Recommendation #5 To: Fresno Police Department

To ensure that ALPR images are being shared appropriately, by April 2020 Fresno should review the entities with which it currently shares images, determine the appropriateness of this sharing, and take all necessary steps to suspend those sharing relationships deemed inappropriate or unnecessary.

Annual Follow-Up Agency Response From October 2021

This was completed. With the audit recommendations and review by the City Attorney's Office, a new data sharing Memorandum of Understanding was developed and sent to our data sharing partners. Legal Review of this new MOU was completed in February, 2020.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

1-Year Agency Response

The Fresno Police Department did not provide a one-year response to this recommendation.

California State Auditor's Assessment of 1-Year Status: Pending

6-Month Agency Response

The Fresno Police Department has suspended most sharing and now only shares images with select bordering jurisdictions. We have begun a process of establishing MOU's with those agencies. This will be an ongoing process.

California State Auditor's Assessment of 6-Month Status: Pending

60-Day Agency Response

The Fresno Police Department has every intention on complying with the audit recommendations; however, this crisis has delayed us. Prior to COVID-19, we had already restructured our sharing MOU and were in the process of working on some of the other items due in April; however, this pandemic has caused us to shift our resources.

California State Auditor's Assessment of 60-Day Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

Recommendation #6 To: Fresno Police Department

To ensure that ALPR images are being shared appropriately, by August 2020 Fresno should revise its written procedures for ALPR image-sharing, as necessary, to ensure that it follows those procedures.

Annual Follow-Up Agency Response From October 2021

See section 453.6 RELEASE OR SHARING OF ALPR DATA under sections (a-c) in paragraphs 1-3. Language was added consistent with the audit findings.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

1-Year Agency Response

The Fresno Police Department did not provide a one-year response to this recommendation.

California State Auditor's Assessment of 1-Year Status: Partially Implemented

6-Month Agency Response

The Fresno Police Department has incorporated these changes into the updated policy.

California State Auditor's Assessment of 6-Month Status: Partially Implemented

Fresno has updated its ALPR policy, but not yet integrated it into it's policy manual. Until such time time as Fresno makes public it's update policy, we consider the actions it has taken to partially implement this recommendation.

60-Day Agency Response

The Fresno Police Department has every intention on complying with the audit recommendations; however, this crisis has delayed us. Prior to COVID-19, we had already restructured our sharing MOU and were in the process of working on some of the other items due in April; however, this pandemic has caused us to shift our resources.

California State Auditor's Assessment of 60-Day Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

Recommendation #7 To: Fresno Police Department

To minimize the privacy risk of retaining ALPR images for a long period of time, by August 2020 Fresno should review the age of the ALPR images its personnel are searching for and ensure that its retention period for ALPR images is based on agency needs. Fresno should reflect in its ALPR policy the updated retention period and state in its policy that it will reevaluate its retention period at least every two years.

6-Month Agency Response

Based on the results of the audit, the Fresno Police Department has reviewed our policy. Initially we believed a six-month retention period would be appropriate. In our research we have discovered California Government Code section 34090.6 requires retention of this type of video data for one year. We have updated our policy to reflect this. We will continue our practice of retaining images for one year as required by law. This has been updated in Policy 453 ALPR.

California State Auditor's Assessment of 6-Month Status: Fully Implemented

60-Day Agency Response

The Fresno Police Department has every intention on complying with the audit recommendations; however, this crisis has delayed us. Prior to COVID-19, we had already restructured our sharing MOU and were in the process of working on some of the other items due in April; however, this pandemic has caused us to shift our resources.

California State Auditor's Assessment of 60-Day Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

Recommendation #8 To: Fresno Police Department

To minimize the privacy risk of retaining ALPR images for a long period of time, Fresno should include in its ALPR policy a retention period for data or lists, such as hot lists, used to link persons of interest with license plate images, and create necessary processes to ensure that those data unrelated to ongoing investigations are periodically removed from its ALPR system.

Annual Follow-Up Agency Response From October 2021

See section 453.4 DATA COLLECTION AND RETENTION, in paragraphs 1-2. Language was added consistent with the audit findings.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

1-Year Agency Response

The Fresno Police Department did not provide a one-year response to this recommendation.

California State Auditor's Assessment of 1-Year Status: Partially Implemented

6-Month Agency Response

The Fresno Police Department will maintain active hot lists for 30 days. If an investigator requires a longer period, approval will be obtained from a commander. This has been incorporated in the revised ALPR policy.

California State Auditor's Assessment of 6-Month Status: Partially Implemented

Fresno has updated its ALPR policy, but not yet integrated it into it's policy manual. Until such time time as Fresno makes public it's update policy, we consider the actions it has taken to partially implement this recommendation.

60-Day Agency Response

The Fresno Police Department has every intention on complying with the audit recommendations; however, this crisis has delayed us. Prior to COVID-19, we had already restructured our sharing MOU and were in the process of working on some of the other items due in April; however, this pandemic has caused us to shift our resources.

California State Auditor's Assessment of 60-Day Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

Recommendation #9 To: Fresno Police Department

To ensure that ALPR system access is limited to agency staff who have a need and a right to use ALPR data, by April 2020 Fresno should review all user accounts and deactivate accounts for separated employees, inactive users, and others as necessary.

Annual Follow-Up Agency Response From October 2021

See section 453.3 AUTHORIOZED USERS AND OPERATIONS, specifically paragraph 1, subsections (a-i). Language was added consistent with the audit findings.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

1-Year Agency Response

The Fresno Police Department did not provide a one-year response to this recommendation.

California State Auditor's Assessment of 1-Year Status: Partially Implemented

6-Month Agency Response

This is already being done and is part of the quarterly audit process.

California State Auditor's Assessment of 6-Month Status: Partially Implemented

Fresno has begun implementing this recommendation. Because it is in the process of writing an Audit Plan that will be completed by February 2021--as noted in its response to another recommendation (#13), we consider this recommendation partially implemented until that Audit Plan is completed and incorporates this process.

60-Day Agency Response

The Fresno Police Department has every intention on complying with the audit recommendations; however, this crisis has delayed us. Prior to COVID-19, we had already restructured our sharing MOU and were in the process of working on some of the other items due in April; however, this pandemic has caused us to shift our resources.

California State Auditor's Assessment of 60-Day Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

Recommendation #10 To: Fresno Police Department

To ensure that ALPR system access is limited to agency staff who have a need and a right to use ALPR data, Fresno should ensure that its ALPR policy specifies the staff classifications, ranks, or other designations that may hold ALPR system user accounts and that accounts are granted based on need to know and right to know.

Annual Follow-Up Agency Response From October 2021

See section 453.2 ALPR ADMINISTRATION, et seq. See also section 453.3 AUTHORIOZED USERS AND OPERATIONS, specifically paragraph 1, subsections (a-i). Language was added consistent with the audit findings.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

1-Year Agency Response

The Fresno Police Department did not provide a one-year response to this recommendation.

California State Auditor's Assessment of 1-Year Status: Partially Implemented

6-Month Agency Response

Policy 453 has been updated to include this language. The final version will be posted to the City of Fresno website by the end of the year.

California State Auditor's Assessment of 6-Month Status: Partially Implemented

60-Day Agency Response

The Fresno Police Department has every intention on complying with the audit recommendations; however, this crisis has delayed us. Prior to COVID-19, we had already restructured our sharing MOU and were in the process of working on some of the other items due in April; however, this pandemic has caused us to shift our resources.

California State Auditor's Assessment of 60-Day Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

Recommendation #11 To: Fresno Police Department

To ensure that ALPR system access is limited to agency staff who have a need and a right to use ALPR data, by August 2020 Fresno should develop and implement procedures for granting and managing user accounts that include, but are not limited to, requiring that supervisors must approve accounts for users, providing training to users before granting accounts, suspending users after defined periods of inactivity, and requiring regular refresher training for active users and training for users before reactivating previously inactive accounts. Fresno should also ensure that it has procedures in place to deactivate an account immediately for an account holder who separates from the agency or who no longer needs a user account.

Annual Follow-Up Agency Response From October 2021

Language was added consistent with the audit findings to policy 453. Specifically, sections 453.3 e, f, and h, and section 453.9 are responsive.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

1-Year Agency Response

The Fresno Police Department did not provide a one-year response to this recommendation.

California State Auditor's Assessment of 1-Year Status: Partially Implemented

6-Month Agency Response

This has been completed. Separated employees are removed upon notification of their separation. The ALPR system automatically deactivates accounts for users who have been inactive for 365 days. Supervisor approval, training language has been incorporated into Policy 453

California State Auditor's Assessment of 6-Month Status: Partially Implemented

Fresno has modified its ALPR policy, but the policy does not yet reflect all of the procedures that the recommendation noted. For that reason we have assessed the status as Partially Implemented.

60-Day Agency Response

The Fresno Police Department has every intention on complying with the audit recommendations; however, this crisis has delayed us. Prior to COVID-19, we had already restructured our sharing MOU and were in the process of working on some of the other items due in April; however, this pandemic has caused us to shift our resources.

California State Auditor's Assessment of 60-Day Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

Recommendation #12 To: Fresno Police Department

To enable auditing of user access to and user queries of ALPR images, by April 2020 Fresno should assess the information its ALPR system captures when users access it to ensure that the system's logs are complete and accurate and that the logs form a reasonable basis for conducting necessary, periodic audits.

6-Month Agency Response

Our quarterly audit process has been implemented to assure user access logs are in compliance.

California State Auditor's Assessment of 6-Month Status: Fully Implemented

60-Day Agency Response

The Fresno Police Department has every intention on complying with the audit recommendations; however, this crisis has delayed us. Prior to COVID-19, we had already restructured our sharing MOU and were in the process of working on some of the other items due in April; however, this pandemic has caused us to shift our resources.

California State Auditor's Assessment of 60-Day Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

Recommendation #13 To: Fresno Police Department

To enable auditing of user access to and user queries of ALPR images, Fresno should ensure that its ALPR policy makes clear how frequently Fresno will audit its ALPR system, who will perform that audit, who will review and approve the audit results, and how long Fresno will retain the audit documents. Fresno should have in place by February 2021 an audit plan that describes its audit methodology, including, but not limited to, risk areas that will be audited, sampling, documentation, and resolution of findings.

Annual Follow-Up Agency Response From October 2021

See section 453.5.1 AUDITS, specifically paragraph 1, subsections (a-e). Language was added consistent with the audit findings.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

1-Year Agency Response

The Fresno Police Department did not provide a one-year response to this recommendation.

California State Auditor's Assessment of 1-Year Status: Partially Implemented

6-Month Agency Response

Policy 453 has been updated to include how frequently we will audit our ALPR system, who will perform that audit, who will review and approve the audit results, and how long we will retain the audit documents. We are in the process of writing the Audit Plan and it will be completed by February 2021.

California State Auditor's Assessment of 6-Month Status: Partially Implemented

60-Day Agency Response

The Fresno Police Department has every intention on complying with the audit recommendations; however, this crisis has delayed us. Prior to COVID-19, we had already restructured our sharing MOU and were in the process of working on some of the other items due in April; however, this pandemic has caused us to shift our resources.

California State Auditor's Assessment of 60-Day Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

Recommendation #14 To: Fresno Police Department

To enable auditing of user access to and user queries of ALPR images, by June 2021 Fresno should implement its audit plan and complete its first audit.

Annual Follow-Up Agency Response From October 2021

An Audit was conducted on June 1, 2021 complying with the provisions of Policy 453.5.1 AUDITS, specifically paragraph 1, subsections (a-e).

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

1-Year Agency Response

The Fresno Police Department did not provide a one-year response to this recommendation.

California State Auditor's Assessment of 1-Year Status: Partially Implemented

6-Month Agency Response

We have developed an audit plan and are auditing ALPR data on a quarterly basis. The final written audit plan is in draft form and should be completed by January of 2021.

California State Auditor's Assessment of 6-Month Status: Partially Implemented

60-Day Agency Response

The Fresno Police Department has every intention on complying with the audit recommendations; however, this crisis has delayed us. Prior to COVID-19, we had already restructured our sharing MOU and were in the process of working on some of the other items due in April; however, this pandemic has caused us to shift our resources.

California State Auditor's Assessment of 60-Day Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

Recommendation #15 To: Los Angeles Police Department

To ensure that its ALPR policy contains all of the required elements as specified in state law, by August 2020, Los Angeles should review its policy and draft or revise it as necessary. Also by August 2020, Los Angeles should post its revised policy on its website in accordance with state law.

Annual Follow-Up Agency Response From January 2022

The LAPD's policy is posted to the website:https://lapdonlinestrgeacc.blob.core.usgovcloudapi.net/lapdonlinemedia/2021/09/SO-31-2020-AUTOMATED-LICENSE-PLATE-RECOGNITION-USAGE.pdf

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

Annual Follow-Up Agency Response From October 2021

Special Order No. 31, dated December 10, 2020, titled Automated License Plate Recognition (ALPR) Usage and Privacy Policy, established the ALPR policy and all requirements were included in this policy.

California State Auditor's Assessment of Annual Follow-Up Status: Partially Implemented

Los Angeles did not provide evidence that it had posted the policy to its website.

6-Month Agency Response

As you know, the Los Angeles Police Department and the City of Los Angeles have faced multiple challenges from the COVID-19 pandemic, as well as the protests and civic unrest following the death of George Floyd. These dual challenges have placed significant burdens on the Department's resources, and as a result of responding to these events, the Department has been delayed in adequately crafting an Automated License Plate Reader policy. The Department realizes the importance of finishing and implementing this policy, especially considering the statutory requirement and the State Auditor's report and recommendations. The Department's ALPR policy is being reviewed by external policy experts and the details are being finalized. We hope to present a completed policy to the Los Angeles Board of Police Commissioners in the near future and will keep you apprised of our progress.

California State Auditor's Assessment of 6-Month Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

60-Day Agency Response

The Department has reviewed the State Auditor's Report and recommendations and we are in the process of drafting an ALPR usage and privacy policy. We aim to present a completed policy to the Los Angeles Board of Police Commissioners in June 2020. However, due to the significant response required to the COVID-19 pandemic, and the increase in our operational needs, please consider this our response to the Report's recommendations at this time. The Department understands the importance of drafting an ALPR policy in a timely manner and, even amid this ongoing pandemic, is striving to complete a policy that takes the many considerations into account.

California State Auditor's Assessment of 60-Day Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

Recommendation #16 To: Los Angeles Police Department

To protect ALPR data to the appropriate standard, by August 2020, Los Angeles should identify the types of data in its ALPR system and, as Los Angeles reviews or drafts its ALPR policy, ensure that it clarifies the types of information its officers may upload into its ALPR system, such as, but not limited to, information obtained through CLETS.

Annual Follow-Up Agency Response From January 2022

The policy lists the types of data that the ALPR system captures.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

Annual Follow-Up Agency Response From October 2021

See "Authorized Uses" in Special Order No. 31, dated December 10, 2020, titled Automated License Plate Recognition Usage and Privacy Policy."

Authorized Uses. The ALPR System and the recording of ALPR data shall only be retained,

accessed, and used for the following official Department purposes:

- Criminal investigations or proceedings;

- Non-criminal investigations (e.g., missing and found persons);

- Administrative investigations or proceedings (e.g., pursuit and complaint investigations);

- Civil investigations or proceedings;

- Situational awareness operations; and

- Responses to cognizable threats to public safety.

California State Auditor's Assessment of Annual Follow-Up Status: Partially Implemented

The policy specifies the purpose of the data, but the recommendation asks for clarification on the types of information that may be uploaded.

6-Month Agency Response

As you know, the Los Angeles Police Department and the City of Los Angeles have faced multiple challenges from the COVID-19 pandemic, as well as the protests and civic unrest following the death of George Floyd. These dual challenges have placed significant burdens on the Department's resources, and as a result of responding to these events, the Department has been delayed in adequately crafting an Automated License Plate Reader policy. The Department realizes the importance of finishing and implementing this policy, especially considering the statutory requirement and the State Auditor's report and recommendations. The Department's ALPR policy is being reviewed by external policy experts and the details are being finalized. We hope to present a completed policy to the Los Angeles Board of Police Commissioners in the near future and will keep you apprised of our progress.

California State Auditor's Assessment of 6-Month Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

60-Day Agency Response

The Department has reviewed the State Auditor's Report and recommendations and we are in the process of drafting an ALPR usage and privacy policy. We aim to present a completed policy to the Los Angeles Board of Police Commissioners in June 2020. However, due to the significant response required to the COVID-19 pandemic, and the increase in our operational needs, please consider this our response to the Report's recommendations at this time. The Department understands the importance of drafting an ALPR policy in a timely manner and, even amid this ongoing pandemic, is striving to complete a policy that takes the many considerations into account.

California State Auditor's Assessment of 60-Day Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

Recommendation #17 To: Los Angeles Police Department

To protect ALPR data to the appropriate standard, by August 2020, Los Angeles should perform an assessment of its ALPR system data-security features, and make adjustments to its system configuration where necessary to comply with CJIS policy best practices based on that assessment.

Annual Follow-Up Agency Response From October 2022

On June 22, 2022, the Los Angeles Police Department entered into a new Professional Services Agreement for Automated License Plate Recognition Services with Motorola Solutions, Inc. The attached agreement contains a Data Security Section that ensures that Motorola will comply with Criminal Justice Information Systems Security Policy. Also attached is the Vigilant LEARN Security and Compliance Guide 2020 and Motorola's License Plate Recognition Usage and Privacy Policy.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

Annual Follow-Up Agency Response From October 2021

See "ALPR System Administrators" in Special Order No. 31, dated December 10, 2020, titled Automated License Plate Recognition Usage and Privacy Policy."

ALPR System Administrators —Defined. Department personnel assigned within Information

Technology Bureau (ITB) have the highest access rights to the ALPR System. The ITB is

responsible for ensuring the maintenance of the ALPR server, database, application software,

and verifying proper operation of the system. The ALPR System Administrators are also

responsible for assisting in any reports of inoperability or malfunction of ALPR-equipped

vehicles.

California State Auditor's Assessment of Annual Follow-Up Status: Partially Implemented

The policy describes levels of access but does not constitute an evaluation of ALPR system data security as the recommendation requests.

6-Month Agency Response

As you know, the Los Angeles Police Department and the City of Los Angeles have faced multiple challenges from the COVID-19 pandemic, as well as the protests and civic unrest following the death of George Floyd. These dual challenges have placed significant burdens on the Department's resources, and as a result of responding to these events, the Department has been delayed in adequately crafting an Automated License Plate Reader policy. The Department realizes the importance of finishing and implementing this policy, especially considering the statutory requirement and the State Auditor's report and recommendations. The Department's ALPR policy is being reviewed by external policy experts and the details are being finalized. We hope to present a completed policy to the Los Angeles Board of Police Commissioners in the near future and will keep you apprised of our progress.

California State Auditor's Assessment of 6-Month Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

60-Day Agency Response

The Department has reviewed the State Auditor's Report and recommendations and we are in the process of drafting an ALPR usage and privacy policy. We aim to present a completed policy to the Los Angeles Board of Police Commissioners in June 2020. However, due to the significant response required to the COVID-19 pandemic, and the increase in our operational needs, please consider this our response to the Report's recommendations at this time. The Department understands the importance of drafting an ALPR policy in a timely manner and, even amid this ongoing pandemic, is striving to complete a policy that takes the many considerations into account.

California State Auditor's Assessment of 60-Day Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

Recommendation #18 To: Los Angeles Police Department

To ensure that ALPR images are being shared appropriately, as Los Angeles develops its ALPR policy, it should be certain to list the entities with which it will share ALPR images and the process for handling image-sharing requests.

Annual Follow-Up Agency Response From October 2021

See "Sharing of ALPR Data" in Special Order No. 31, dated December 10, 2020, titled Automated License Plate Recognition Usage and Privacy Policy."

Sharing of ALPR Data. The ALPR System is a valuable investigative tool and shall be used

appropriately in accordance with this policy and the provisions of the law. When sharing

information from the ALPR System, Department employees shall do so with integrity and

confidentiality. All ALPR data recorded and/or retained by the Department shall not be sold,

shared, transferred, or otherwise disclosed for commercial purposes or to persons or entities

that are not authorized to record, retain, access or use ALPR data. The ALPR data shall only be

shared with other local law enforcement agencies that have an interagency agreement with the

Department. All current and future contracts shall be reviewed and contain a clause prohibiting

the sharing of Department ALPR data outside of the agency with whom the Department has an

agreement.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

6-Month Agency Response

As you know, the Los Angeles Police Department and the City of Los Angeles have faced multiple challenges from the COVID-19 pandemic, as well as the protests and civic unrest following the death of George Floyd. These dual challenges have placed significant burdens on the Department's resources, and as a result of responding to these events, the Department has been delayed in adequately crafting an Automated License Plate Reader policy. The Department realizes the importance of finishing and implementing this policy, especially considering the statutory requirement and the State Auditor's report and recommendations. The Department's ALPR policy is being reviewed by external policy experts and the details are being finalized. We hope to present a completed policy to the Los Angeles Board of Police Commissioners in the near future and will keep you apprised of our progress.

California State Auditor's Assessment of 6-Month Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

60-Day Agency Response

The Department has reviewed the State Auditor's Report and recommendations and we are in the process of drafting an ALPR usage and privacy policy. We aim to present a completed policy to the Los Angeles Board of Police Commissioners in June 2020. However, due to the significant response required to the COVID-19 pandemic, and the increase in our operational needs, please consider this our response to the Report's recommendations at this time. The Department understands the importance of drafting an ALPR policy in a timely manner and, even amid this ongoing pandemic, is striving to complete a policy that takes the many considerations into account.

California State Auditor's Assessment of 60-Day Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

Recommendation #19 To: Los Angeles Police Department

To minimize the privacy risk of retaining ALPR images for a long period of time, by August 2020, Los Angeles should review the age of the ALPR images its personnel are searching for and ensure that its retention period for ALPR images is based on agency needs. Los Angeles should reflect in its ALPR policy the updated retention period and state in its policy that it will reevaluate its retention period at least every two years.

Annual Follow-Up Agency Response From October 2021

See "Retaining ALPR Data Beyond the Two-Year Logical Deletion Period for Ongoing Prosecution/Administrative Purposes" in Special Order No. 31, dated December 10, 2020, titled Automated License Plate Recognition Usage and Privacy Policy."

Retaining ALPR Data Beyond the Two-Year Logical Deletion Period for Ongoing

Prosecution/Administrative Purposes. In the event ALPR data is determined to have evidentiary

value in a criminal or administrative investigation, the investigator shall submit an

Intradepartmental Correspondence, Form 15.02.00, to an ALPR System Administrator

requesting that the information be saved beyond the two year retention period. The written

request shall include the Division of Records (DR) Number or case number, the specific reason

the data should be retained, and the investigator's contact information. Once the request has

been approved by the investigator's supervisor, the ALPR System Administrator shall ensure the

requested information is retained in the ALPR System until it has been approved for deletion.

Every two years, ITB shall verify with the investigating officer zf the information is eligible for deletion.

Note: Investigating officers are encouraged to keep any related ALPR data hard copies in

their case files) for court purposes.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

While LAPD specifies a five-year retention period in its policy, it limits search capability after two years.

6-Month Agency Response

As you know, the Los Angeles Police Department and the City of Los Angeles have faced multiple challenges from the COVID-19 pandemic, as well as the protests and civic unrest following the death of George Floyd. These dual challenges have placed significant burdens on the Department's resources, and as a result of responding to these events, the Department has been delayed in adequately crafting an Automated License Plate Reader policy. The Department realizes the importance of finishing and implementing this policy, especially considering the statutory requirement and the State Auditor's report and recommendations. The Department's ALPR policy is being reviewed by external policy experts and the details are being finalized. We hope to present a completed policy to the Los Angeles Board of Police Commissioners in the near future and will keep you apprised of our progress.

California State Auditor's Assessment of 6-Month Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

60-Day Agency Response

The Department has reviewed the State Auditor's Report and recommendations and we are in the process of drafting an ALPR usage and privacy policy. We aim to present a completed policy to the Los Angeles Board of Police Commissioners in June 2020. However, due to the significant response required to the COVID-19 pandemic, and the increase in our operational needs, please consider this our response to the Report's recommendations at this time. The Department understands the importance of drafting an ALPR policy in a timely manner and, even amid this ongoing pandemic, is striving to complete a policy that takes the many considerations into account.

California State Auditor's Assessment of 60-Day Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

Recommendation #20 To: Los Angeles Police Department

To minimize the privacy risk of retaining ALPR images for a long period of time, Los Angeles should include in its ALPR policy a retention period for data or lists, such as hot lists, used to link persons of interest with license plate images, and create necessary processes to ensure that those data unrelated to ongoing investigations are periodically removed from its ALPR system.

Annual Follow-Up Agency Response From October 2021

See "Retention and Deletion of ALPR data" in Special Order No. 31, dated December 10, 2020, titled Automated License Plate Recognition Usage and Privacy Policy."

Retention and Deletion of ALPR Data. In general, ALPR data recorded or retained by the

Department shall be retained for a period of two years. After two years, ALPR data recorded or

retained by the Department will be logically deleted. Logical deletion is the process whereby the

data record is flagged in the database when deleted. The ALPR records that have been logically

deleted cannot be viewed or accessed by ALPR Data Users and can only be queried by an ALPR

System Administrator. All ALPR data shall be permanently deleted after five years, and 24 hours

and one minute, with the exception of data needed for prosecutions or administrative hearings

that are retained indefinitely upon approval.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

6-Month Agency Response

As you know, the Los Angeles Police Department and the City of Los Angeles have faced multiple challenges from the COVID-19 pandemic, as well as the protests and civic unrest following the death of George Floyd. These dual challenges have placed significant burdens on the Department's resources, and as a result of responding to these events, the Department has been delayed in adequately crafting an Automated License Plate Reader policy. The Department realizes the importance of finishing and implementing this policy, especially considering the statutory requirement and the State Auditor's report and recommendations. The Department's ALPR policy is being reviewed by external policy experts and the details are being finalized. We hope to present a completed policy to the Los Angeles Board of Police Commissioners in the near future and will keep you apprised of our progress.

California State Auditor's Assessment of 6-Month Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

60-Day Agency Response

The Department has reviewed the State Auditor's Report and recommendations and we are in the process of drafting an ALPR usage and privacy policy. We aim to present a completed policy to the Los Angeles Board of Police Commissioners in June 2020. However, due to the significant response required to the COVID-19 pandemic, and the increase in our operational needs, please consider this our response to the Report's recommendations at this time. The Department understands the importance of drafting an ALPR policy in a timely manner and, even amid this ongoing pandemic, is striving to complete a policy that takes the many considerations into account.

California State Auditor's Assessment of 60-Day Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

Recommendation #21 To: Los Angeles Police Department

To ensure that ALPR system access is limited to agency staff who have a need and a right to use ALPR data, by April 2020, Los Angeles should review all user accounts and deactivate accounts for separated employees, inactive users, and others as necessary.

Annual Follow-Up Agency Response From November 2022

On September 27, 2022, the Los Angeles Police Department's Board of Police Commissioners approved the Automated License Plate Recognition Audit that was conducted in 2021. The attached Audit states that all inactive accounts were deactivated immediately upon notification by auditors to Innovation Management Division (See Objective No. 3).

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

Annual Follow-Up Agency Response From October 2021

See "Note" on page 2 in Special Order No. 31, dated December 10, 2020, titled Automated License Plate Recognition Usage and Privacy Policy."

Note: Any ALPR Data User or ALPR System Administrator who has not used their ALPR

System account for one year and whose duties require their use of the ALPR System, shall

complete a reorientation training course prior to accessing the ALPR System.

California State Auditor's Assessment of Annual Follow-Up Status: Partially Implemented

Although Los Angeles has developed a policy related to who may use the ALPR system, it did not provide evidence that it reviewed user accounts to ensure access was appropriate.

6-Month Agency Response

As you know, the Los Angeles Police Department and the City of Los Angeles have faced multiple challenges from the COVID-19 pandemic, as well as the protests and civic unrest following the death of George Floyd. These dual challenges have placed significant burdens on the Department's resources, and as a result of responding to these events, the Department has been delayed in adequately crafting an Automated License Plate Reader policy. The Department realizes the importance of finishing and implementing this policy, especially considering the statutory requirement and the State Auditor's report and recommendations. The Department's ALPR policy is being reviewed by external policy experts and the details are being finalized. We hope to present a completed policy to the Los Angeles Board of Police Commissioners in the near future and will keep you apprised of our progress.

California State Auditor's Assessment of 6-Month Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

60-Day Agency Response

The Department has reviewed the State Auditor's Report and recommendations and we are in the process of drafting an ALPR usage and privacy policy. We aim to present a completed policy to the Los Angeles Board of Police Commissioners in June 2020. However, due to the significant response required to the COVID-19 pandemic, and the increase in our operational needs, please consider this our response to the Report's recommendations at this time. The Department understands the importance of drafting an ALPR policy in a timely manner and, even amid this ongoing pandemic, is striving to complete a policy that takes the many considerations into account.

California State Auditor's Assessment of 60-Day Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

Recommendation #22 To: Los Angeles Police Department

To ensure that ALPR system access is limited to agency staff who have a need and a right to use ALPR data, Los Angeles should ensure that its ALPR policy specifies the staff classifications, ranks, or other designations that may hold ALPR system user accounts and that accounts are granted based on need to know and right to know.

Annual Follow-Up Agency Response From October 2021

See page one in Special Order No. 31, dated December 10, 2020, titled Automated License Plate Recognition Usage and Privacy Policy."

Authorized Uses. The ALPR System and the recording of ALPR data shall only be retained,

accessed, and used for the following official Department purposes:

- Criminal investigations or proceedings;

- Non-criminal investigations (e.g., missing and found persons);

- Administrative investigations or proceedings (e.g., pursuit and complaint investigations);

- Civil investigations or proceedings;

- Situational awareness operations; and

- Responses to cognizable threats to public safety.

Persons Authorized to Access and Use the ALPR Data. There are two type of users authorized

to use the ALPR System: ALPR System Administrators and ALPR Data Users. Each type of user

is given different access controls, responsibilities, and training.

ALPR System Administrators —Defined. Department personnel assigned within Information

Technology Bureau (ITB) have the highest access rights to the ALPR System. The ITB is

responsible for ensuring the maintenance of the ALPR server, database, application software,

and verifying proper operation of the system. The ALPR System Administrators are also

responsible for assisting in any reports of inoperability or malfunction ofALPR-equipped

vehicles.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

6-Month Agency Response

As you know, the Los Angeles Police Department and the City of Los Angeles have faced multiple challenges from the COVID-19 pandemic, as well as the protests and civic unrest following the death of George Floyd. These dual challenges have placed significant burdens on the Department's resources, and as a result of responding to these events, the Department has been delayed in adequately crafting an Automated License Plate Reader policy. The Department realizes the importance of finishing and implementing this policy, especially considering the statutory requirement and the State Auditor's report and recommendations. The Department's ALPR policy is being reviewed by external policy experts and the details are being finalized. We hope to present a completed policy to the Los Angeles Board of Police Commissioners in the near future and will keep you apprised of our progress.

California State Auditor's Assessment of 6-Month Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

60-Day Agency Response

The Department has reviewed the State Auditor's Report and recommendations and we are in the process of drafting an ALPR usage and privacy policy. We aim to present a completed policy to the Los Angeles Board of Police Commissioners in June 2020. However, due to the significant response required to the COVID-19 pandemic, and the increase in our operational needs, please consider this our response to the Report's recommendations at this time. The Department understands the importance of drafting an ALPR policy in a timely manner and, even amid this ongoing pandemic, is striving to complete a policy that takes the many considerations into account.

California State Auditor's Assessment of 60-Day Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

Recommendation #23 To: Los Angeles Police Department

To ensure that ALPR system access is limited to agency staff who have a need and a right to use ALPR data, by August 2020, Los Angeles should develop and implement procedures for granting and managing user accounts that include, but are not limited to, requiring that supervisors must approve accounts for users, providing training to users before granting accounts, suspending users after defined periods of inactivity, and requiring regular refresher training for active users and training for users before reactivating previously inactive accounts. Los Angeles should also ensure that it has procedures in place to deactivate an account immediately for an account holder who separates from the agency or who no longer needs a user account.

Annual Follow-Up Agency Response From October 2021

See page 2 in Special Order No. 31, dated December 10, 2020, titled Automated License Plate Recognition Usage and Privacy Policy."

ALPR Data Users —Defined. Any active Department employees (both sworn and civilian) or

independent contractors, who have received written authorization from their supervisor and

have been granted permission from ITB to query the ALPR System.

Note: Employees equipped with the ALPR Cameras in their Department vehicles may

receive an ALPR Hit, and when used for this purpose officers receive on-the job training.

They have no ability to add, remove, or change any information in the ALPR System.

ALPR Data Users Training. All ALPR Data Users shall complete one of the Department's

POST-certified training courses on accessing and using ALPR data prior to querying the ALPR

System. A second course is offered as supplemental training for ALPR Data Users on search

capabilities.

ALPR System Administrators. All ALPR System Administrators shall receive training to fulfill

their job responsibilities by a current ALPR System Administrator and/or vendor prior to

accessing the ALPR System as an ALPR System Administrator.

Note: Any ALPR Data User or ALPR System Administrator who has not used their ALPR

System account for one year and whose duties require their use of the ALPR System, shall

complete a reorientation training course prior to accessing the ALPR System.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

6-Month Agency Response

As you know, the Los Angeles Police Department and the City of Los Angeles have faced multiple challenges from the COVID-19 pandemic, as well as the protests and civic unrest following the death of George Floyd. These dual challenges have placed significant burdens on the Department's resources, and as a result of responding to these events, the Department has been delayed in adequately crafting an Automated License Plate Reader policy. The Department realizes the importance of finishing and implementing this policy, especially considering the statutory requirement and the State Auditor's report and recommendations. The Department's ALPR policy is being reviewed by external policy experts and the details are being finalized. We hope to present a completed policy to the Los Angeles Board of Police Commissioners in the near future and will keep you apprised of our progress.

California State Auditor's Assessment of 6-Month Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

60-Day Agency Response

The Department has reviewed the State Auditor's Report and recommendations and we are in the process of drafting an ALPR usage and privacy policy. We aim to present a completed policy to the Los Angeles Board of Police Commissioners in June 2020. However, due to the significant response required to the COVID-19 pandemic, and the increase in our operational needs, please consider this our response to the Report's recommendations at this time. The Department understands the importance of drafting an ALPR policy in a timely manner and, even amid this ongoing pandemic, is striving to complete a policy that takes the many considerations into account.

California State Auditor's Assessment of 60-Day Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

Recommendation #24 To: Los Angeles Police Department

To enable auditing of user access to and user queries of ALPR images, by April 2020, Los Angeles should assess the information its ALPR system captures when users access it to ensure that the system's logs are complete and accurate and that the logs form a reasonable basis for conducting necessary, periodic audits.

Annual Follow-Up Agency Response From October 2021

See "Records of Access and Periodic System Audits" in Special Order No. 31, dated December 10, 2020, titled Automated License Plate Recognition Usage and Privacy Policy."

Records of Access and Periodic System Audits. The ITB shall ensure that a database of records of

ALPR end-user activity, including all queries to the ALPR System is maintained. The records of

access shall be maintained for at least five (5) years. At a minimum, the records of access shall

include all of the following:

- The date and time the information is accessed;

- The license plate number or other data elements used to query the ALPR System;

- The username of the person who accessed the information; and,

- The identified authorized purpose for accessing the information.

The access and use of ALPR data through Department systems shall be subject to review and

audit by Audit Division. Audit Division shall conduct periodic audits in accordance with Audit

Division's Annual Audit Plan. Audit reports shall be maintained by the Department and

accessible for public view indefinitely. Moreover,

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

6-Month Agency Response

As you know, the Los Angeles Police Department and the City of Los Angeles have faced multiple challenges from the COVID-19 pandemic, as well as the protests and civic unrest following the death of George Floyd. These dual challenges have placed significant burdens on the Department's resources, and as a result of responding to these events, the Department has been delayed in adequately crafting an Automated License Plate Reader policy. The Department realizes the importance of finishing and implementing this policy, especially considering the statutory requirement and the State Auditor's report and recommendations. The Department's ALPR policy is being reviewed by external policy experts and the details are being finalized. We hope to present a completed policy to the Los Angeles Board of Police Commissioners in the near future and will keep you apprised of our progress.

California State Auditor's Assessment of 6-Month Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

60-Day Agency Response

The Department has reviewed the State Auditor's Report and recommendations and we are in the process of drafting an ALPR usage and privacy policy. We aim to present a completed policy to the Los Angeles Board of Police Commissioners in June 2020. However, due to the significant response required to the COVID-19 pandemic, and the increase in our operational needs, please consider this our response to the Report's recommendations at this time. The Department understands the importance of drafting an ALPR policy in a timely manner and, even amid this ongoing pandemic, is striving to complete a policy that takes the many considerations into account.

California State Auditor's Assessment of 60-Day Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

Recommendation #25 To: Los Angeles Police Department

To enable auditing of user access to and user queries of ALPR images, Los Angeles should ensure that its ALPR policy makes clear how frequently Los Angeles will audit its ALPR system, who will perform that audit, who will review and approve the audit results, and how long Los Angeles will retain the audit documents. Los Angeles should have in place by February 2021 an audit plan that describes its audit methodology, including, but not limited to, risk areas that will be audited, sampling, documentation, and resolution of findings.

Annual Follow-Up Agency Response From October 2022

On December 8, 2020, Los Angeles Police Department's Board of Police Commissioners approved the Automated License Plate Recognition Usage and Privacy Policy.

On February 9, 2021, Los Angeles Police Department's Board of Police Commissioners approved the Annual Audit Plan that included an audit of the Automated License Plate Reader system.

On September 27, 2022, the Los Angeles Police Department's Board of Police Commissioners approved the Automated License Plate Recognition Audit that was conducted in 2021.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

Annual Follow-Up Agency Response From October 2021

See "Records of Access and Periodic System Audits" in Special Order No. 31, dated December 10, 2020, titled Automated License Plate Recognition Usage and Privacy Policy."

Records of Access and Periodic System Audits. The ITB shall ensure that a database of records of

ALPR end-user activity, including all queries to the ALPR System is maintained. The records of

access shall be maintained for at least five (5) years. At a minimum, the records of access shall

include all of the following:

- The date and time the information is accessed;

- The license plate number or other data elements used to query the ALPR System;

- The username of the person who accessed the information; and,

- The identified authorized purpose for accessing the information.

The access and use of ALPR data through Department systems shall be subject to review and

audit by Audit Division. Audit Division shall conduct periodic audits in accordance with Audit

Division's Annual Audit Plan. Audit reports shall be maintained by the Department and

accessible for public view indefinitely. Moreover, ITB should regularly conduct inspections on

the use and the operations of the ALPR System.

California State Auditor's Assessment of Annual Follow-Up Status: Pending

6-Month Agency Response

As you know, the Los Angeles Police Department and the City of Los Angeles have faced multiple challenges from the COVID-19 pandemic, as well as the protests and civic unrest following the death of George Floyd. These dual challenges have placed significant burdens on the Department's resources, and as a result of responding to these events, the Department has been delayed in adequately crafting an Automated License Plate Reader policy. The Department realizes the importance of finishing and implementing this policy, especially considering the statutory requirement and the State Auditor's report and recommendations. The Department's ALPR policy is being reviewed by external policy experts and the details are being finalized. We hope to present a completed policy to the Los Angeles Board of Police Commissioners in the near future and will keep you apprised of our progress.

California State Auditor's Assessment of 6-Month Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

60-Day Agency Response

The Department has reviewed the State Auditor's Report and recommendations and we are in the process of drafting an ALPR usage and privacy policy. We aim to present a completed policy to the Los Angeles Board of Police Commissioners in June 2020. However, due to the significant response required to the COVID-19 pandemic, and the increase in our operational needs, please consider this our response to the Report's recommendations at this time. The Department understands the importance of drafting an ALPR policy in a timely manner and, even amid this ongoing pandemic, is striving to complete a policy that takes the many considerations into account.

California State Auditor's Assessment of 60-Day Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

Recommendation #26 To: Los Angeles Police Department

To enable auditing of user access to and user queries of ALPR images, by June 2021, Los Angeles should implement its audit plan and complete its first audit.

Annual Follow-Up Agency Response From October 2022

On February 9, 2021, Los Angeles Police Department's Board of Police Commissioners approved the Annual Audit Plan that included an audit of the Automated License Plate Reader system.

The policy to be audited was approved on December 8, 2020. The audit period was set as January 1, 2021, to May 31, 2021. The audit was completed by September 30, 2021, however, on it was not approved by the Los Angeles Police Department's Board of Police Commissioners until September 27, 2022.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

Annual Follow-Up Agency Response From October 2021

Audit Division is in the process of conducting an ALPR audit. This audit began on February 16, 2021.

California State Auditor's Assessment of Annual Follow-Up Status: Pending

1-Year Agency Response

Audit pending completion.

California State Auditor's Assessment of 1-Year Status: Pending

6-Month Agency Response

As you know, the Los Angeles Police Department and the City of Los Angeles have faced multiple challenges from the COVID-19 pandemic, as well as the protests and civic unrest following the death of George Floyd. These dual challenges have placed significant burdens on the Department's resources, and as a result of responding to these events, the Department has been delayed in adequately crafting an Automated License Plate Reader policy. The Department realizes the importance of finishing and implementing this policy, especially considering the statutory requirement and the State Auditor's report and recommendations. The Department's ALPR policy is being reviewed by external policy experts and the details are being finalized. We hope to present a completed policy to the Los Angeles Board of Police Commissioners in the near future and will keep you apprised of our progress.

California State Auditor's Assessment of 6-Month Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

60-Day Agency Response

The Department has reviewed the State Auditor's Report and recommendations and we are in the process of drafting an ALPR usage and privacy policy. We aim to present a completed policy to the Los Angeles Board of Police Commissioners in June 2020. However, due to the significant response required to the COVID-19 pandemic, and the increase in our operational needs, please consider this our response to the Report's recommendations at this time. The Department understands the importance of drafting an ALPR policy in a timely manner and, even amid this ongoing pandemic, is striving to complete a policy that takes the many considerations into account.

California State Auditor's Assessment of 60-Day Status: Pending

We acknowledge the difficulty of the current situation with COVID-19. We look forward to the department's future status reports.

Recommendation #27 To: Marin County Sheriff's Department

To ensure that its ALPR policy contains all of the required elements as specified in state law, by August 2020, Marin should review its policy and draft or revise it as necessary. Also by August 2020, Marin should post its revised policy on its website in accordance with state law.

Annual Follow-Up Agency Response From September 2023

The Marin County Sheriff's Office ALPR policy complies with all elements of state law. It was revised based on the State Auditor's recommendations, specifically numbers 37, 39 and 40. The current policy will be provided to the State Auditor's Office by email as requested.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

1-Year Agency Response

The policy has been revised and/or updated. The new policy number is 429. The current policy will be provided to you via the process for submitting supporting documents.

The new policy has not been updated on the website as the Marin County Sheriff's Office is still in the process of updating all of its policies as previously stated. Once this has been completed, all required policies will also be updated on the Marin County Sheriff's Office's website.

California State Auditor's Assessment of 1-Year Status: Pending

6-Month Agency Response

The Policy has been updated and has been sent up the chain of command for review and approval. As we are currently re-formatting our Department Policy Manual, we expect the policy to be posted on our website in the near future.

California State Auditor's Assessment of 6-Month Status: Pending

Marin County Sheriff's Department has made progress toward implementing this recommendation. We will anticipate receiving the updated policy soon.

60-Day Agency Response

The Marin Sheriff's Department did not provide a 60 day response.

California State Auditor's Assessment of 60-Day Status: Pending

Recommendation #28 To: Marin County Sheriff's Department

To protect ALPR data to the appropriate standard, by August 2020, Marin should identify the types of data in its ALPR system and, as Marin reviews or drafts its ALPR policy, ensure that it clarifies the types of information its officers may upload into its ALPR system, such as, but not limited to, information obtained through CLETS.

1-Year Agency Response

The policy has been revised and/or updated. The new policy number is 429. The current policy has been provided to you via the process for submitting supporting documents.

California State Auditor's Assessment of 1-Year Status: Fully Implemented

6-Month Agency Response

The Policy has been updated to state, "Hot Plate data shall not include names, address, or information obtained through CLETs data."

California State Auditor's Assessment of 6-Month Status: Pending

60-Day Agency Response

The Marin Sheriff's Department did not provide a 60 day response.

California State Auditor's Assessment of 60-Day Status: Pending

Recommendation #29 To: Marin County Sheriff's Department

To protect ALPR data to the appropriate standard, by August 2020, Marin should perform an assessment of its ALPR system data-security features, and make adjustments to its system configuration where necessary to comply with CJIS policy best practices based on that assessment.

6-Month Agency Response

Dual layer authentication has been enabled on our Vigilant account and an email or text must be sent to either the user's department email or department issued cellphone with a verification code to login.

California State Auditor's Assessment of 6-Month Status: Fully Implemented

Recommendation #30 To: Marin County Sheriff's Department

To ensure that the agreement with its cloud vendor offers the strongest possible data protections, by August 2020, Marin should enter into a new contract with Vigilant that contains the contract provisions recommended in CJIS policy.

6-Month Agency Response

A new contract has been acquired and signed by Vigilant and the Sheriff as of 7/22/2020.

California State Auditor's Assessment of 6-Month Status: Fully Implemented

Recommendation #31 To: Marin County Sheriff's Department

To ensure that ALPR images are being shared appropriately, by April 2020, Marin should review the entities with which it currently shares images, determine the appropriateness of this sharing, and take all necessary steps to suspend those sharing relationships deemed inappropriate or unnecessary.

60-Day Agency Response

The Marin County Sheriff's Office has completed this recommendation. Detective John Pence has carefully and thoroughly reviewed every agency the Marin County Sheriff's Office currently shares APLR images with and does not believe that any current sharing relationship is inappropriate or unnecessary. Based on the report, it is the understanding of the Marin County Sheriff's Office that its sharing relationships with California Border Patrol and the Honolulu Police Department are of concern to the California State Auditor. However, the Marin County Sheriff's Office continues its sharing relationship with the California Border Patrol because of a pending capital criminal case with multiple fugitives. When this criminal case has resolved, then the Marin County Sheriff's Office will re-evaluate its sharing relationship with the California Border Patrol as to both appropriateness and necessity. As to Honolulu Police Department, despite the physical distance between the Marin County Sheriff's Office and this law enforcement agency, the multiple, daily direct routes via air travel between California and Hawaii warrant the sharing of information for legitimate law enforcement purposes.

California State Auditor's Assessment of 60-Day Status: Fully Implemented

Recommendation #32 To: Marin County Sheriff's Department

To ensure that ALPR images are being shared appropriately, by August 2020, Marin should develop a process for handling ALPR image-sharing requests that includes maintaining records separate from the Vigilant system of when and with whom it shares images. The process should verify a requesting agency's law enforcement purpose for obtaining the images and consider the requesting agency's need for the images. The process should be documented in Marin's ALPR policy and/or procedures.

6-Month Agency Response

A separate database has been created to document sharing requests. The list of current shares are documented as legacy and reviewed as we will not have a date as to when that share started. Accounts that could not be identified as law enforcement or did not seem to have a need to know have been removed.

California State Auditor's Assessment of 6-Month Status: Fully Implemented

Recommendation #33 To: Marin County Sheriff's Department

To minimize the privacy risk of retaining ALPR images for a long period of time, by August 2020, Marin should review the age of the ALPR images its personnel are searching for and ensure that its retention period for ALPR images is based on agency needs. Marin should reflect in its ALPR policy the updated retention period and state in its policy that it will reevaluate its retention period at least every two years.

1-Year Agency Response

The policy has been revised and/or updated. The new policy number is 429. The current policy has been provided to you via the process for submitting supporting documents.

California State Auditor's Assessment of 1-Year Status: Fully Implemented

6-Month Agency Response

The policy has been updated to read, "The retention period for ALPR data should be reevaluated every two years."

California State Auditor's Assessment of 6-Month Status: Pending

60-Day Agency Response

The Marin Sheriff's Department did not provide a 60-day response.

California State Auditor's Assessment of 60-Day Status: Pending

Recommendation #34 To: Marin County Sheriff's Department

To minimize the privacy risk of retaining ALPR images for a long period of time, Marin should include in its ALPR policy a retention period for data or lists, such as hot lists, used to link persons of interest with license plate images, and create necessary processes to ensure that those data unrelated to ongoing investigations are periodically removed from its ALPR system.

1-Year Agency Response

The policy has been revised and/or updated. The new policy number is 429. The current policy has been provided to you via the process for submitting supporting documents.

California State Auditor's Assessment of 1-Year Status: Fully Implemented

6-Month Agency Response

The policy has been updated to read, "The information collected by the ALPR system should be stored for a minimum of one year (Government Code section 34090.6) and shall be maintained for two years. Thereafter, ALPR data should be purged unless it has become, or it is reasonable to believe it will become, evidence in a criminal or civil action or is subject to a discovery request or other lawful action to produce records. In those circumstances the applicable data should be downloaded from the server onto portable media and booked into evidence. This information includes hotlist data which must be manually deleted by the user at the conclusion of their investigation."

California State Auditor's Assessment of 6-Month Status: Pending

60-Day Agency Response

The Marin Sheriff's Department did not provide a 60-day response.

California State Auditor's Assessment of 60-Day Status: Pending

Recommendation #35 To: Marin County Sheriff's Department

To ensure that ALPR system access is limited to agency staff who have a need and a right to use ALPR data, Marin should, by April 2020, review all user accounts and deactivate accounts for separated employees, inactive users, and others as necessary.

60-Day Agency Response

The Marin County Sheriff's Office has completed this recommendation. Detective Pence has reviewed all accounts and all active accounts are only for eligible current employees. The Marin County Sheriff's Office has also implemented a procedure for documenting these checks, ensuring that only eligible employees have access to ALPR system.

California State Auditor's Assessment of 60-Day Status: Fully Implemented

Recommendation #36 To: Marin County Sheriff's Department

To ensure that ALPR system access is limited to agency staff who have a need and a right to use ALPR data, Marin should ensure that its ALPR policy specifies the staff classifications, ranks, or other designations that may hold ALPR system user accounts and that accounts are granted based on need to know and right to know.

1-Year Agency Response

The policy has been revised and/or updated. The new policy number is 429. The current policy has been provided to you via the process for submitting supporting documents.

California State Auditor's Assessment of 1-Year Status: Fully Implemented

6-Month Agency Response

The policy has been updated to read, "Approved personnel are sworn staff with current CLETs clearance and a need to access ALPR data and TSU staff responsible for installing and maintaining ALPR related equipment."

California State Auditor's Assessment of 6-Month Status: Pending

60-Day Agency Response

As stated in its response to the draft report, the Marin County Sheriff's Office through its command staff and other appropriate staff has been and continues to be in the process of reviewing and updating all its policies, including the policies that address ALPR. Per the final report's recommendation, the ALPR policy will be reviewed and updated by the six (6) month time frame.

California State Auditor's Assessment of 60-Day Status: Pending

Recommendation #37 To: Marin County Sheriff's Department

To ensure that ALPR system access is limited to agency staff who have a need and a right to use ALPR data, by August 2020, Marin should develop and implement procedures for granting and managing user accounts that include, but are not limited to, requiring that supervisors must approve accounts for users, providing training to users before granting accounts, suspending users after defined periods of inactivity, and requiring regular refresher training for active users and training for users before reactivating previously inactive accounts. Marin should also ensure that it has procedures in place to deactivate an account immediately for an account holder who separates from the agency or who no longer needs a user account.

Annual Follow-Up Agency Response From September 2023

The recommended policies have been developed and implemented concerning account approval, training, suspension, and deactivation. Per MCSO Policy 426.5 the ALPR Program Manager is responsible for approving user accounts. Training will be provided to users before granting accounts, after re-activation and biannually as a refresher. Users must acknowledge review of ALPR policy and training records will be maintained by the Professional Standards Unit. These procedures are mandated by Policy 426.4, which reads: "Training will be provided prior to account creation or reactivation. Biannual refresher training will be provided to active account holders. Training records will be maintained by the Professional Standards Unit." Users will be suspended after 90 days of inactivity. Under Policy 426.4, "[i]f a user does not log into their account for 90 days, the account will automatically be deactivated. When an employee is no longer employed by the Department, their account will immediately be closed."

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

1-Year Agency Response

The policy has been revised and/or updated. The new policy number is 429. The current policy has been provided to you via the process for submitting supporting documents.

California State Auditor's Assessment of 1-Year Status: Partially Implemented

Marin has not addressed all aspects of the recommendation. Its current policy omits mention of supervisor approval, user training, and user refresher training.

60-Day Agency Response

Marin did not provide a 60-day response.

California State Auditor's Assessment of 60-Day Status: Pending

Recommendation #38 To: Marin County Sheriff's Department

To enable auditing of user access to and user queries of ALPR images, by April 2020, Marin should assess the information its ALPR system captures when users access it to ensure that the system's logs are complete and accurate and that the logs form a reasonable basis for conducting necessary, periodic audits.

60-Day Agency Response

The Marin County Sheriff's Office is already in compliance with this recommendation. Eligible users of the Marin County Sheriff's Office's ALPR system are required to input a case or incident number as well as a legitimate reason for conducting a search in the ALPR data base. In addition, this information is logged and is searchable in the system. However, in response to the final report's recommendation, the Marin County Sheriff's Office reiterated and stressed to all current users the importance of continuing to input the case or incident number and authorized purpose before accessing the ALPR system.

California State Auditor's Assessment of 60-Day Status: Fully Implemented

Recommendation #39 To: Marin County Sheriff's Department

To enable auditing of user access to and user queries of ALPR images, Marin should ensure that its ALPR policy makes clear how frequently Marin will audit its ALPR system, who will perform that audit, who will review and approve the audit results, and how long Marin will retain the audit documents. Marin should have in place by February 2021 an audit plan that describes its audit methodology, including, but not limited to, risk areas that will be audited, sampling, documentation, and resolution of findings.

Annual Follow-Up Agency Response From September 2023

Marin's ALPR policy regarding audits has been clarified as recommended. The audit plan is described in Policy 426.6. Per that policy, audits will be conducted each year. All user inquiries will be reviewed. The Vehicle Theft Investigator will serve as the ALPR Program Manager and will be responsible for performing the yearly audit. Audited data will include the following risk areas: User Logins, and categories related to Hit List Browsing, Sharing Reports, Hot List Browsing, Hot List Upload, Hot Plate Upload, Hot List Delete, Hot Plate Delete, Stakeout Browsing, Detections Shared, Hot Lists Shared, Hot Lists Received, and any other data relating to the sharing of ALPR information with other agencies. Audit records will be retained for two years. If a violation is suspected, it will be reported to the sergeant in command of the Auto Theft Task force for further investigation. The results of the audit will be forwarded to the Sheriff or his designee for review, approval, and any necessary remediation.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

1-Year Agency Response

The policy has been revised and/or updated. The new policy number is 429. The current policy has been provided to you via the process for submitting supporting documents.

California State Auditor's Assessment of 1-Year Status: Partially Implemented

Marin's policy does not address all elements of the recommendation; the policy omits information about who will review and approve the audit results. In addition, Marin did not provide its audit plan and the policy does not include information that the recommendation specified be included in the audit plan. Absent the noted information, we determined that Marin partially implemented this recommendation.

6-Month Agency Response

The policy now reads, "Audits will be conducted once a year for indications of inappropriate or unusual activity. Data to be audited will include User Logins, and categories related to Hit List Browsing, Hot List Browsing, Hot List Upload, Hot Plate Upload, Hot List Delete, Hot Plate Delete, and Stakeout Browsing. If a violation is suspected, it will be reported to the Sergeant overseeing the Auto Theft Task Force for further investigation."

California State Auditor's Assessment of 6-Month Status: Partially Implemented

60-Day Agency Response

Marin did not provide a 60-day response.

California State Auditor's Assessment of 60-Day Status: Pending

Recommendation #40 To: Marin County Sheriff's Department

To enable auditing of user access to and user queries of ALPR images, by June 2021, Marin should implement its audit plan and complete its first audit.

Annual Follow-Up Agency Response From September 2023

Marin has conducted its first audit. Supporting documentation of its findings will be send to the State Auditor's Office as requested.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

1-Year Agency Response

The Marin County Sheriff's Office completed its first audit this month.

California State Auditor's Assessment of 1-Year Status: Pending

Marin did not substantiate that it prepared an audit plan per Recommendation 39. Further, it did not share its audit report demonstrating who reviewed the audit and who approved the results. Because Marin did not substantiate that it fully implemented this recommendation, we assessed its status as Pending.

60-Day Agency Response

Marin did not provide a 60-day response.

California State Auditor's Assessment of 60-Day Status: Pending

Recommendation #41 To: Sacramento County Sheriff's Department

To ensure that its ALPR policy contains all of the required elements as specified in state law, by August 2020, Sacramento should review its policy and draft or revise it as necessary. Also by August 2020, Sacramento should post its revised policy on its website in accordance with state law.

Annual Follow-Up Agency Response From October 2021

The Sacramento County Sheriff's Office reviewed General Order 10/12 (Automated License Plate Reader Program) and revised the policy as necessary to reflect elements specified in state law and as noted in this audit. The revised policy has been posted to the department's public website (https://www.sacsheriff.com/pages/transparency.php) as required by SB 978

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

1-Year Agency Response

As of April 20, 2021, the Sacramento County Sheriff's Department had not provided a response on the recommendations in this audit.

California State Auditor's Assessment of 1-Year Status: Pending

6-Month Agency Response

The Sacramento County Sheriff's Department did not provide a six-month response to this recommendation.

California State Auditor's Assessment of 6-Month Status: Pending

60-Day Agency Response

The Sacramento County Sheriff's Department did not provide a 60-day response.

California State Auditor's Assessment of 60-Day Status: Pending

Recommendation #42 To: Sacramento County Sheriff's Department

To protect ALPR data to the appropriate standard, by August 2020, Sacramento should identify the types of data in its ALPR system and, as Sacramento reviews or drafts its ALPR policy, ensure that it clarifies the types of information its officers may upload into its ALPR system, such as, but not limited to, information obtained through CLETS.

Annual Follow-Up Agency Response From October 2021

The Sacramento County Sheriff's Office reviewed General Order 10/12 (Automated License Plate Reader Program) and revised the policy to clarify the types of information deputies shall not include, such as Criminal Justice Information (CJI) obtained through CLETS or other law enforcement databases, in the Hot List description or notes sections of the system. The policy lists the types of information deputies may enter into the ALPR system, including entering the officer's name and contact telephone number, the related Sheriff's department or outside agency event number, and a short synopsis of the nature of the originating call.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

1-Year Agency Response

As of April 20, 2021, the Sacramento County Sheriff's Department had not provided a response on the recommendations in this audit.

California State Auditor's Assessment of 1-Year Status: Pending

6-Month Agency Response

The Sacramento County Sheriff's Department did not provide a six-month response to this recommendation.

California State Auditor's Assessment of 6-Month Status: Pending

60-Day Agency Response

The Sacramento County Sheriff's Department did not provide a 60-day response.

California State Auditor's Assessment of 60-Day Status: Pending

Recommendation #43 To: Sacramento County Sheriff's Department

To protect ALPR data to the appropriate standard, by August 2020, Sacramento should perform an assessment of its ALPR system data-security features, and make adjustments to its system configuration where necessary to comply with CJIS policy best practices based on that assessment.

Annual Follow-Up Agency Response From October 2021

The Sacramento County Sheriff's Office assessed the ALPR system data-security settings and made adjustments based upon the assessment to comply with recommendations. The adjustments included limiting the number of administrators and normalizing the expiration date for inactivity to the CJIS recommendation.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

1-Year Agency Response

As of April 20, 2021, the Sacramento County Sheriff's Department had not provided a response on the recommendations in this audit.

California State Auditor's Assessment of 1-Year Status: Pending

6-Month Agency Response

The Sacramento County Sheriff's Department did not provide a six-month response to this recommendation.

California State Auditor's Assessment of 6-Month Status: Pending

60-Day Agency Response

The Sacramento County Sheriff's Department did not provide a 60-day response.

California State Auditor's Assessment of 60-Day Status: Pending

Recommendation #44 To: Sacramento County Sheriff's Department

To ensure that the agreement with its cloud vendor offers the strongest possible data protections, by August 2020, Sacramento should enter into a new contract with Vigilant that contains the contract provisions recommended in CJIS policy.

Annual Follow-Up Agency Response From October 2021

The Sacramento County Sheriff's Office's current contract with Vigilant Solutions LLC is effective from July 2020 to June 2022. The data protection controls follow the National Institute of Standards and Technology (NIST) Special Publications (SP) 800-53 r4 and 800-45 administrative, technical, and organizational security controls.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

1-Year Agency Response

As of April 20, 2021, the Sacramento County Sheriff's Department had not provided a response on the recommendations in this audit.

California State Auditor's Assessment of 1-Year Status: Pending

6-Month Agency Response

The Sacramento County Sheriff's Department did not provide a six-month response to this recommendation.

California State Auditor's Assessment of 6-Month Status: Pending

60-Day Agency Response

The Sacramento County Sheriff's Department did not provide a 60-day response.

California State Auditor's Assessment of 60-Day Status: Pending

Recommendation #45 To: Sacramento County Sheriff's Department

To ensure that ALPR images are being shared appropriately, by April 2020, Sacramento should review the entities with which it currently shares images, determine the appropriateness of this sharing, and take all necessary steps to suspend those sharing relationships deemed inappropriate or unnecessary.

Annual Follow-Up Agency Response From October 2021

The Sacramento County Sheriff's Office audited the entities with which it shares images and removed those that did not meet agency standards.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

1-Year Agency Response

As of April 20, 2021, the Sacramento County Sheriff's Department had not provided a response on the recommendations in this audit.

California State Auditor's Assessment of 1-Year Status: Pending

6-Month Agency Response

The Sacramento County Sheriff's Department did not provide a six-month response to this recommendation.

California State Auditor's Assessment of 6-Month Status: Pending

60-Day Agency Response

The Sacramento County Sheriff's Department did not provide a 60-day response.

California State Auditor's Assessment of 60-Day Status: Pending

Recommendation #46 To: Sacramento County Sheriff's Department

To ensure that ALPR images are being shared appropriately, by August 2020, Sacramento should develop a process for handling ALPR image-sharing requests that includes maintaining records separate from the Vigilant system of when and with whom it shares images. The process should verify a requesting agency's law enforcement purpose for obtaining the images and consider the requesting agency's need for the images. The process should be documented in Sacramento's ALPR policy and/or procedures.

Annual Follow-Up Agency Response From October 2021

The Sacramento County Sheriff's Office implemented a process for handling ALPR data-sharing requests and documented the process in General Order 10/12 (Automated License Plate Reader Program). Data sharing requests are processed, maintained, and recorded using a ticketing system. This process includes verifying that the requesting agency has an Originating Agency Identification (ORI) number, law enforcement status, a law enforcement purpose and a need for obtaining the images, and verifiable contact information.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

1-Year Agency Response

As of April 20, 2021, the Sacramento County Sheriff's Department had not provided a response on the recommendations in this audit.

California State Auditor's Assessment of 1-Year Status: Pending

6-Month Agency Response

The Sacramento County Sheriff's Department did not provide a six-month response to this recommendation.

California State Auditor's Assessment of 6-Month Status: Pending

60-Day Agency Response

The Sacramento County Sheriff's Department did not provide a 60-day response.

California State Auditor's Assessment of 60-Day Status: Pending

Recommendation #47 To: Sacramento County Sheriff's Department

To minimize the privacy risk of retaining ALPR images for a long period of time, by August 2020, Sacramento should review the age of the ALPR images its personnel are searching for and ensure that its retention period for ALPR images is based on agency needs. Sacramento should reflect in its ALPR policy the updated retention period and state in its policy that it will reevaluate its retention period at least every two years.

Annual Follow-Up Agency Response From October 2021

The Sacramento County Sheriff's Office reviewed the retention period for ALPR images downloaded to the server and confirmed the images are purged after two years per policy. ALPR images downloaded to the server will be stored for two years based on agency investigative needs and California Government Code section 34090. General Order 10/12 (Automated License Plate Reader Program) was updated to include a statement that the ALPR data retention period will be reevaluated every two years.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

1-Year Agency Response

As of April 20, 2021, the Sacramento County Sheriff's Department had not provided a response on the recommendations in this audit.

California State Auditor's Assessment of 1-Year Status: Pending

6-Month Agency Response

The Sacramento County Sheriff's Department did not provide a six-month response to this recommendation.

California State Auditor's Assessment of 6-Month Status: Pending

60-Day Agency Response

The Sacramento County Sheriff's Department did not provide a 60-day response.

California State Auditor's Assessment of 60-Day Status: Pending

Recommendation #48 To: Sacramento County Sheriff's Department

To minimize the privacy risk of retaining ALPR images for a long period of time, Sacramento should include in its ALPR policy a retention period for data or lists, such as hot lists, used to link persons of interest with license plate images, and create necessary processes to ensure that those data unrelated to ongoing investigations are periodically removed from its ALPR system.

Annual Follow-Up Agency Response From October 2021

The Sacramento County Sheriff's Office automatically uploads Hot Lists into the ALPR system a minimum of once a day, with the most current data overwriting the old data. Hot plates added to the database by LEARN/CDMS users will have an expiration date of no longer than 30 days. Furthermore, the department implemented a new records management system with the ability to collect data regarding when detectives use ALPR data. The department is in the first year of collecting data in a multi-year study.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

1-Year Agency Response

As of April 20, 2021, the Sacramento County Sheriff's Department had not provided a response on the recommendations in this audit.

California State Auditor's Assessment of 1-Year Status: Pending

6-Month Agency Response

The Sacramento County Sheriff's Department did not provide a six-month response to this recommendation.

California State Auditor's Assessment of 6-Month Status: Pending

60-Day Agency Response

The Sacramento County Sheriff's Department did not provide a 60-day response.

California State Auditor's Assessment of 60-Day Status: Pending

Recommendation #49 To: Sacramento County Sheriff's Department

To ensure that ALPR system access is limited to agency staff who have a need and a right to use ALPR data, by April 2020, Sacramento should review all user accounts and deactivate accounts for separated employees, inactive users, and others as necessary.

Annual Follow-Up Agency Response From October 2021

The Sacramento County Sheriff's Office initially reviewed all user accounts and deactivated accounts for employees who had not accessed their accounts within six (6) months. All ALPR accounts are currently set to deactivate after 90 days of inactivity automatically. Furthermore, user accounts for personnel who separate from the Sheriff's Office or no longer need access to the ALPR system are deactivated. When an account is deactivated after 90 days, and the user account needs to be reactivated, the employee must go through the approval process and complete the required ALPR training course before being granted access. As of October 2021, 495 of 2237 employees (22.1%) have access to the ALPR system.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

1-Year Agency Response

As of April 20, 2021, the Sacramento County Sheriff's Department had not provided a response on the recommendations in this audit.

California State Auditor's Assessment of 1-Year Status: Pending

6-Month Agency Response

The Sacramento County Sheriff's Department did not provide a six-month response to this recommendation.

California State Auditor's Assessment of 6-Month Status: Pending

60-Day Agency Response

The Sacramento County Sheriff's Department did not provide a 60-day response.

California State Auditor's Assessment of 60-Day Status: Pending

Recommendation #50 To: Sacramento County Sheriff's Department

To ensure that ALPR system access is limited to agency staff who have a need and a right to use ALPR data, Sacramento should ensure that its ALPR policy specifies the staff classifications, ranks, or other designations that may hold ALPR system user accounts and that accounts are granted based on need to know and right to know.

Annual Follow-Up Agency Response From October 2021

The Sacramento County Sheriff's Office updated General Order 10/12 (Automated License Plate Reader Program) to specify the personnel that may hold ALPR system user accounts based on a need-to-know and right-to-know basis. The personnel authorized to have ALPR user accounts are sworn personnel assigned to an enforcement position, professional staff assigned to investigative functions, and other personnel approved on an individual basis by the Field Support Division Commander.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

1-Year Agency Response

As of April 20, 2021, the Sacramento County Sheriff's Department had not provided a response on the recommendations in this audit.

California State Auditor's Assessment of 1-Year Status: Pending

6-Month Agency Response

The Sacramento County Sheriff's Department did not provide a six-month response to this recommendation.

California State Auditor's Assessment of 6-Month Status: Pending

60-Day Agency Response

The Sacramento County Sheriff's Department did not provide a 60-day response.

California State Auditor's Assessment of 60-Day Status: Pending

Recommendation #51 To: Sacramento County Sheriff's Department

To ensure that ALPR system access is limited to agency staff who have a need and a right to use ALPR data, by August 2020, Sacramento should develop and implement procedures for granting and managing user accounts that include, but are not limited to, requiring that supervisors must approve accounts for users, providing training to users before granting accounts, suspending users after defined periods of inactivity, and requiring regular refresher training for active users and training for users before reactivating previously inactive accounts. Sacramento should also ensure that it has procedures in place to deactivate an account immediately for an account holder who separates from the agency or who no longer needs a user account.

Annual Follow-Up Agency Response From October 2021

The Sacramento County Sheriff's Office has procedures for granting and managing ALPR user accounts. Individual ALPR user requests are submitted using a ticketing system, which requires supervisor approval. Department ALPR users are required to complete an ALPR training course before being granted access and are required to complete an approved retraining program and review the ALPR policy every two years. All ALPR accounts are currently set to deactivate after 90 days of inactivity automatically, and users with deactivated accounts must complete an approved ALPR training course before the inactive accounts are reactivated. Lastly, user accounts for personnel who separate from the Sheriff's Office or no longer need access to the ALPR system are deactivated.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

1-Year Agency Response

As of April 20, 2021, the Sacramento County Sheriff's Department had not provided a response on the recommendations in this audit.

California State Auditor's Assessment of 1-Year Status: Pending

6-Month Agency Response

The Sacramento County Sheriff's Department did not provide a six-month response to this recommendation.

California State Auditor's Assessment of 6-Month Status: Pending

60-Day Agency Response

The Sacramento County Sheriff's Department did not provide a 60-day response.

California State Auditor's Assessment of 60-Day Status: Pending

Recommendation #52 To: Sacramento County Sheriff's Department

To enable auditing of user access to and user queries of ALPR images, by April 2020, Sacramento should assess the information its ALPR system captures when users access it to ensure that the system's logs are complete and accurate and that the logs form a reasonable basis for conducting necessary, periodic audits.

Annual Follow-Up Agency Response From October 2021

The Sacramento County Sheriff's Office ALPR system maintains logs of user management, system management, data management, and user actions. These logs are reviewed during the scheduled monthly and annual ALPR audits, and they contain complete and accurate information required to conduct audits.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

1-Year Agency Response

As of April 20, 2021, the Sacramento County Sheriff's Department had not provided a response on the recommendations in this audit.

California State Auditor's Assessment of 1-Year Status: Pending

6-Month Agency Response

The Sacramento County Sheriff's Department did not provide a six-month response to this recommendation.

California State Auditor's Assessment of 6-Month Status: Pending

60-Day Agency Response

The Sacramento County Sheriff's Department did not provide a 60-day response.

California State Auditor's Assessment of 60-Day Status: Pending

Recommendation #53 To: Sacramento County Sheriff's Department

To enable auditing of user access to and user queries of ALPR images, Sacramento should ensure that its ALPR policy makes clear how frequently Sacramento will audit its ALPR system, who will perform that audit, who will review and approve the audit results, and how long Sacramento will retain the audit documents. Sacramento should have in place by February 2021 an audit plan that describes its audit methodology, including, but not limited to, risk areas that will be audited, sampling, documentation, and resolution of findings.

Annual Follow-Up Agency Response From October 2021

The Sacramento County Sheriff's Office updated General Order 10/12 (Automated License Plate Reader Program) to reflect the policy that ALPR system audits shall be minimally conducted annually, and the audit documents will be saved for two years. Furthermore, the policy mandates that the Field Support Division Security Operations Group conduct the audits, and the Field Support Division Commander is responsible for reviewing and approving the audits. The Security Operations Group created a desk procedure document describing the audit methodology for conducting an annual ALPR audit to ensure compliance with department policy.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

1-Year Agency Response

As of April 20, 2021, the Sacramento County Sheriff's Department had not provided a response on the recommendations in this audit.

California State Auditor's Assessment of 1-Year Status: Pending

6-Month Agency Response

The Sacramento County Sheriff's Department did not provide a six-month response to this recommendation.

California State Auditor's Assessment of 6-Month Status: Pending

60-Day Agency Response

The Sacramento County Sheriff's Department did not provide a 60-day response.

California State Auditor's Assessment of 60-Day Status: Pending

Recommendation #54 To: Sacramento County Sheriff's Department

To enable auditing of user access to and user queries of ALPR images, by June 2021, Sacramento should implement its audit plan and complete its first audit.

Annual Follow-Up Agency Response From October 2021

The Sacramento County Sheriff's Office implemented the annual audit plan and completed the first ALPR annual audit in July 2021.

California State Auditor's Assessment of Annual Follow-Up Status: Fully Implemented

1-Year Agency Response

As of April 20, 2021, the Sacramento County Sheriff's Department had not provided a response on the recommendations in this audit.

California State Auditor's Assessment of 1-Year Status: Pending

6-Month Agency Response

The Sacramento County Sheriff's Department did not provide a six-month response to this recommendation.

California State Auditor's Assessment of 6-Month Status: Pending

60-Day Agency Response

The Sacramento County Sheriff's Department did not provide a 60-day response.

California State Auditor's Assessment of 60-Day Status: Pending

Recommendation for Legislative Action

To better protect individual's privacy and to help ensure that local law enforcement agencies structure their ALPR programs in a manner that supports accountability for proper database use, the Legislature should amend state law to require Justice to draft and make available on its website a policy template that local law enforcement agencies can use as a model for their ALPR policies.

Description of Legislative Action

AB 1076 (Kiley, 2021) would have required Justice to draft and make available on its website an ALPR system policy template for local law enforcement agencies. This bill died in the Assembly.

SB 210 (Weiner, 2021) would have required Justice, on or before July 1, 2022, to draft and make available on its website a policy template and would permit local law enforcement agencies to use the template as a model for their ALPR policies. This bill died in the Senate.

California State Auditor's Assessment of Annual Follow-Up Status: Legislation Proposed But Not Enacted

Description of Legislative Action

SB 210 (Weiner) was introduced on January 12, 2021, and would require Justice, on or before July 1, 2022, to draft and make available on its website a policy template and would permit local law enforcement agencies to use the template as a model for their ALPR policies.

California State Auditor's Assessment of 1-Year Status: Legislation Introduced

Description of Legislative Action

SB 1143 (Wiener) would require Justice, on or before July 1, 2021, to draft and make available on its website a policy template and would permit local law enforcement agencies to use the template as a model for their ALPR policies. As of August 13, 2020, this bill is pending in the Senate Transportation Committee.

California State Auditor's Assessment of 6-Month Status: Legislation Introduced

Recommendation for Legislative Action

To better protect individual's privacy and to help ensure that local law enforcement agencies structure their ALPR programs in a manner that supports accountability for proper database use, the Legislature should amend state law to require Justice to develop and issue guidance to help local law enforcement agencies identify and evaluate the types of data they are currently storing in their ALPR systems. The guidance should include the necessary security requirements agencies should follow to protect the data in their ALPR systems.

Description of Legislative Action

AB 1076 (Kiley, 2021) would have required Justice to develop and issue guidance for local law enforcement agencies to help them identify and evaluate the types of data they are storing in their systems. Such guidance would have included the necessary security requirements agencies should follow to protect the data in their ALPR systems. This bill died in the Assembly.

SB 210 (Wiener, 2021) would have required Justice to develop and issue guidance, which would include necessary security requirements agencies should follow, to help local law enforcement agencies identify and evaluate the types of data they are currently storing in their ALPR database systems. This bill died in the Senate.

California State Auditor's Assessment of Annual Follow-Up Status: Legislation Proposed But Not Enacted

Description of Legislative Action

SB 210 (Weiner) would require Justice to develop and issue guidance to help local law enforcement agencies identify and evaluate the types of data they are currently storing in their ALPR database systems.

California State Auditor's Assessment of 1-Year Status: Legislation Introduced

Description of Legislative Action

SB 1143 would require Justice to develop and issue guidance to help local law enforcement agencies identify and evaluate the types of data they are currently storing in their ALPR database systems.

California State Auditor's Assessment of 6-Month Status: Legislation Introduced

Recommendation for Legislative Action

To better protect individual's privacy and to help ensure that local law enforcement agencies structure their ALPR programs in a manner that supports accountability for proper database use, the Legislature should amend state law to establish a maximum data retention period for ALPR images. The Legislature should also establish a maximum data retention period for data or lists, such as hot lists, that are used to link persons of interest with license plate images.

Description of Legislative Action

SB 210 (Wiener, 2021) would have required an ALPR operator's security procedures and practices to include an annual audit to review ALPR end-user searches during the previous year and, where the ALPR operator or ALPR end-user is a public agency and not an airport authority, the destruction of all ALPR information that does not match information on a hot list within 24 hours. This bill also would have required the ALPR operator or ALPR end-user, if they access or provide access to ALPR information, to annually review ALPR end-user searches during the previous year to assess user searches, determine if all searches were in compliance with the usage and privacy policy, and, if the ALPR operator or ALPR end-user is a public agency and not an airport authority, confirm that all ALPR data that does not match hot list information has been routinely destroyed in 24 hours or less. This bill died in the Senate.

California State Auditor's Assessment of Annual Follow-Up Status: Legislation Proposed But Not Enacted

Description of Legislative Action

SB 210 (Wiener) would require usage and privacy policies implemented by an ALPR system operator or an ALPR end user include a requirement that ALPR data that does not match a hot list be destroyed within 24 hours.

California State Auditor's Assessment of 1-Year Status: Legislation Introduced

Description of Legislative Action

SB 1143 would prohibit the usage and privacy policies implemented by an ALPR operator or an ALPR end-user from including a length of time longer than two weeks that ALPR information will be retained.

California State Auditor's Assessment of 6-Month Status: Legislation Introduced

Recommendation for Legislative Action

To better protect individual's privacy and to help ensure that local law enforcement agencies structure their ALPR programs in a manner that supports accountability for proper database use, the Legislature should amend state law to require periodic evaluation of a retention period for ALPR images to ensure that the period is as short as practicable.

Description of Legislative Action

As of February 13, 2022, the Legislature has not taken action to address this specific recommendation.

California State Auditor's Assessment of Annual Follow-Up Status: No Action Taken

Description of Legislative Action

As of February 13, 2021, the Legislature has not taken action to address this specific recommendation.

California State Auditor's Assessment of 1-Year Status: No Action Taken

Description of Legislative Action

As of August 13, 2020, the Legislature has not taken action to address this specific recommendation.

California State Auditor's Assessment of 6-Month Status: No Action Taken

Recommendation for Legislative Action

To better protect individual's privacy and to help ensure that local law enforcement agencies structure their ALPR programs in a manner that supports accountability for proper database use, the Legislature should amend state law to specify how frequently ALPR system use must be audited and that the audits must include assessing user searches.

Description of Legislative Action

SB 210 (Wiener, 2021) would have required the ALPR operator or ALPR end-user, if they access or provide access to ALPR information, to conduct an annual audit to review ALPR end-user searches during the previous year to assess user searches, determine if all searches were in compliance with the usage and privacy policy, and, if the ALPR operator or ALPR end-user is a public agency and not an airport authority, confirm that all ALPR data that does not match hot list information has been routinely destroyed in 24 hours or less. This bill died in the Senate.

California State Auditor's Assessment of Annual Follow-Up Status: Legislation Proposed But Not Enacted

Description of Legislative Action

SB 210 (Wiener) would require an ALPR operator's security procedures and practices to include an annual audit to review ALPR end-user searches during the previous year and the destruction of all ALPR information that does not match information on a hot list within 24 hours. This bill would additionally require an ALPR operator that accesses or provides access to ALPR information to conduct an annual audit to review ALPR end-user searches during the previous year and to confirm that all ALPR information that does not match a hot list is routinely destroyed in 24 hours or less.

California State Auditor's Assessment of 1-Year Status: Legislation Introduced

Description of Legislative Action

SB 1143 would require ALPR operator security procedures and practices to include an annual audit to review ALPR end-user searches during the previous year and the destruction of all ALPR information retained for longer than two weeks. This bill also would require an ALPR operator that accesses or provides access to ALPR information to conduct an annual audit to review ALPR end-user searches during the previous year and to confirm that all ALPR information retained for longer than two weeks has been routinely destroyed.

California State Auditor's Assessment of 6-Month Status: Legislation Introduced

Recommendation for Legislative Action

To better protect individual's privacy and to help ensure that local law enforcement agencies structure their ALPR programs in a manner that supports accountability for proper database use, the Legislature should amend state law to specify that those with access to ALPR systems must receive data privacy and data security training. The Legislature should require law enforcement agencies to include training on the appropriateness of including certain data in an ALPR system, such as data from CLETS.

Description of Legislative Action

As of February 13, 2022, the Legislature has not taken action to address this specific recommendation.

California State Auditor's Assessment of Annual Follow-Up Status: No Action Taken

Description of Legislative Action

As of February 13, 2021, the Legislature has not taken action to address this specific recommendation.

California State Auditor's Assessment of 1-Year Status: No Action Taken

Description of Legislative Action

As of August 13, 2020, the Legislature has not taken action to address this specific recommendation.

California State Auditor's Assessment of 6-Month Status: No Action Taken

All Recommendations in 2019-118

Agency responses received are posted verbatim.