Our data, our decisions: Why Waltham residents must have a voice on surveillance

By Anne E. Thessen

Waltham’s use of Flock Safety’s automated license plate recognition cameras raises concerns about how surveillance technology is used in our city. Because of this, the Waltham City Council’s Ordinances and Rules Committee has asked the Law Department to write a new ordinance by Jan. 20. This ordinance should explain what surveillance technology can be used and how it can be used. Right now, the city’s rules do not adequately address issues around data sharing and reuse that come with advances in AI and other technologies.

According to its website, Flock describes itself as a “public safety technology ecosystem” that provides tools for police, neighborhoods and businesses. Many Waltham residents are worried about what Flock does with their data and how this data collection could affect the city. These concerns have been discussed at City Council meetings and reported in The Waltham Times. People have asked important questions, such as how long Flock keeps data, who owns it and who can access it.

The Waltham Police Department, which chose to work with Flock, has taken steps to respond to these concerns. This happened after the city of Cambridge canceled its contract with Flock. Cambridge officials said the cameras were installed without the city’s knowledge, which broke trust and the contract. In addition, lawyers from the ACLU of Massachusetts found that Flock’s standard contract allows the company to share data with federal and local agencies for investigations, even if the customer chooses not to share. This has already led to a violation of Massachusetts Shield Laws, said the ACLU.

Because of this, Waltham cannot rely only on Flock’s terms and conditions to protect its data. 

The new ordinance should make sure that Waltham residents have control over their data (via their elected City Councilors) and that it reflects the values of the community. The city should not work with any company that cannot or will not follow these rules.

There are three important issues that have not been talked about enough and should be included in the ordinance.

First, the ordinance should clearly address “derived data.” Flock says that customers own their data and that customer data is deleted after 30 days. However, Flock does not clearly limit the creation or storage of new data made by changing or analyzing the original data. It is unclear who owns this new data, how long it can be kept or how it can be used. Even if the original data is deleted, it is not clear whether this transformed data could still exist or be used to recreate the original data later.

Second, the ordinance should clearly address access to data by third parties. Flock offers an API that allows outside developers to work with Flock’s data. It is unclear who already has access through this API, what these developers plan to do with the data or whether customers can choose to block this access. This kind of access could lead to serious harm, ranging from too much government or corporate surveillance to individuals being tracked by abusive partners. The City Council should think carefully about how surveillance data could be used in the future, especially when combined with large amounts of data and AI, and whether those uses match the future Waltham wants.

Third, the ordinance should clearly address data integration. ALPR cameras collect license plate numbers, vehicle color and type, location, and date and time. On their own, and if kept for a very short time, these data points pose little risk and can help solve crimes such as hit-and-runs or child abductions. However, keeping this data for longer periods or combining it with other data—such as vehicle registration records, event schedules or home addresses—could violate people’s privacy. The ordinance should limit how this data can be combined with other data, and the City Council should reduce how long Flock can keep the data as much as possible based on specific police needs.

As the City Council reviews this ordinance, it should also think more broadly about data governance in Waltham. The city needs clear rules that reflect shared community values and apply to more than just surveillance data. I suggest creating a data governance policy that focuses on people and purpose, not just business benefits or benefits to a single group. This policy should require that data collection improves quality of life, supports good government and leads to fair outcomes for everyone.

The rights and well-being of Waltham residents should be the top priority in any data collection effort. This helps reduce harm, increase benefits and promote fairness. A strong data governance system must include the voices of Waltham residents, who should help decide what the benefits and risks are and how data may be used in the future.

In addition to a surveillance ordinance, Waltham should adopt a broader data governance policy created with active community participation. This policy would guide future decisions about what data the city collects and which companies it works with. For example, such data governance policies can prohibit police departments from accumulating surveillance data about residents on its own servers for an unlimited amount of time. Because there will always be special cases, I also suggest creating a Waltham Data Governance Committee, similar to an Institutional Review Board. This committee would review and approve or deny requests for exceptions to the data governance policy.

Anne E. Thessen, PhD, is a data scientist with over 20 years experience in academia and industry. She currently works on the cutting edge of responsible use of sensitive data in AI and medicine. Anne has been a Waltham resident since 2012. She lives in Cedarwood with her husband, three cats, and one dog.

This article was edited with the help of ChatGPT to increase readability.

These ideas were informed by the following resources:

Carroll, S. R., Garba, I., Figueroa-Rodríguez, O. L., Holbrook, J., Lovett, R., Materechera, S., Parsons, M., Raseroka, K., Rodriguez-Lonebear, D., Rowe, R., Sara, R., Walker, J. D., Anderson, J., & Hudson, M. (2019). The CARE Principles for Indigenous Data Governance. Data Science Journal, 18(1), 43.

Kearns, M., & Roth, A. (2019). The Ethical Algorithm: The Science of Socially Aware Algorithm Design. Oxford University Press.

Lamdan, S. (2022). Data Cartels: The Companies That Control and Monopolize Our Information. MIT Press.

O’Neil, C. (2016). Weapons of Math Destruction: How Big Data Increases Inequality and Threatens Democracy. Crown.