Aloha Chair Paltin and Members of the Maui County Council,
I strongly oppose Bills 112 and 113. While I support effective law enforcement, these bills further normalize the collection and use of highly sensitive information about innocent people, facial images and detailed records of where vehicles travel. The ability to identify, track, and reconstruct a person’s movements raises serious privacy concerns, particularly when technology can capture information about people who are not suspected of any crime.
You must consider whether expanding reliance on these technologies is necessary when Maui County is already seeing meaningful reductions in crime. Maui Police Department reports that violent crime has declined and property crime has dropped significantly. MPD has also reported a continuing downward trend in violent crime.
When crime is declining, the Council must be especially careful before expanding government surveillance capabilities. Protecting public safety does not require sacrificing the privacy of law-abiding residents and visitors.
Bills 112 and 113 may establish restrictions on how these technologies are used, but they still institutionalize systems capable of mass identification and tracking. Once such databases and surveillance infrastructure exist, future uses can expand beyond their original purpose.
Maui can protect both public safety and personal privacy. I respectfully urge the Council to vote NO on Bills 112 and 113.
I was going to stay on to give oral testimony but I have to leave. Below is my oral testimony for this meeting.
Aloha. My name is Keisa Liu, and I am speaking on agenda items DRIP 26 and 27. I am the Co-Vice Chair of the MPD Multicultural Advisory Council; however, I am speaking today on my own time and on my own behalf.
I want to caution against making police misuse the primary focus of this discussion. That is a risk, but I believe the larger vulnerability is the private commercial system we have connected ourselves to.
Maui chose this technology, but most of our community had very little opportunity to understand or follow that decision before the infrastructure was already here.
And now, frankly, Maui has entered a relationship with sophisticated surveillance technology without first putting adequate protections in place.
Corporations do not have the same obligation to Maui residents that our government does. Corporate executives make decisions in the financial interests of their companies. Data has enormous financial value, and our federal government is actively pursuing deregulation of AI and technology.
Companies can take risks, change policies, merge, be acquired, suffer breaches, pay fines, and continue operating. The people whose information is compromised cannot simply pay a fine and become whole again. That's our vulnerability.
And I do not believe MPD should be asked to police this risk alone.
MPD is a law-enforcement agency. Its expertise is public safety and law enforcement. Its officers are not cybersecurity engineers, privacy auditors, software quality-assurance specialists, or data-governance experts—and we should not expect them to be.
If Maui is going to operate sophisticated surveillance technology that relies on private companies, interconnected systems, and large amounts of public data, then the County needs an independent technical watchdog with the expertise and authority to audit these systems, identify vulnerabilities, examine access and data-sharing practices, test security controls, and report its findings independently of both law enforcement and the companies involved.
Because the greatest threat is not necessarily someone intentionally abusing the system.
It is creating a system capable of tremendous harm and then assuming every agency, company, employee, security control, and future decision will always get it right.
They won't. No complex system does.
The County made the decision to introduce this vulnerability into our community. The community should not be asked to carry that risk without independent protection.
If we are going to have this technology, then oversight cannot come solely from the people using it or the companies profiting from it.
We need someone whose job is to protect us from both.
WRITTEN TESTIMONY: BILLS 112 AND 113 (2026)
Protecting Law-Abiding Residents Requires Both Use Rules and Data Security
To: Chair Tamara Paltin and Members, Disaster, Resilience, International Affairs, and Planning Committee
From: Keisa Liu, Makawao
Meeting: September 2, 2026 | DRIP-26 and DRIP-27
Position: Oppose County use of ALPR and facial-recognition surveillance. If implementation proceeds, strengthen Bills 112 and 113 to reduce the resulting risks.
CORE POINT
I do not support the County's use of ALPR or facial-recognition surveillance. These systems create an infrastructure capable of tracking the movements and associations of law-abiding residents. Because implementation appears likely, I am asking the Council to make that infrastructure as safe, limited, and accountable as possible.
The requested protections are harm reduction—not endorsement.
Bills 112 and 113 establish limits on authorized use of facial-recognition and automated license plate reader (ALPR) data. Those limits are necessary, but they do not provide equally strong protection against unauthorized access. ALPR records combine a vehicle identifier with an image, date, time, and geographic location. When accumulated, they can reveal patterns in the movements of people who have never been suspected of a crime.
If the County collects data capable of reconstructing residents' movements, its responsibility must extend through the entire data lifecycle: collection → access → storage → security → sharing → auditing → retention → deletion.
PROTECTIONS ALREADY INCLUDED
Bill 113: Prohibits commercial sale and exploitation; requires a documented law-enforcement nexus for queries; regulates disclosures; restricts vendor reuse; and requires disclosure records.
Bill 112: Treats facial-recognition results as investigative leads, not identifications; requires corroboration; limits access to trained users; logs each use; and requires quarterly audits.
Important but incomplete: These provisions may reduce intentional misuse by authorized users. They do not eliminate the underlying surveillance risk or fully protect the system from unauthorized access.
REQUESTED AMENDMENTS
1. Establish enforceable cybersecurity requirements. Bill 113 requires vendor notice within 24 hours after discovery of unauthorized access but notice after discovery does not ensure prevention or timely detection. Require a recognized, current cybersecurity framework covering MFA, encryption in transit and at rest, least-privilege access, credential revocation, vulnerability management, security testing, anomaly detection, incident response, and subcontractor controls.
2. Protect the audit trail itself. Query and disclosure logs are useful only if they cannot be altered or erased. Require tamper-resistant logs, independent retention, access controls, routine review for anomalous activity, and preservation after any suspected compromise.
3. Set a retention limit for ordinary ALPR detections. Bill 113 requires deletion when a vendor contract ends, but it does not appear to set a general deletion deadline for records unrelated to an investigation. Require prompt deletion after a defined period, with a documented exception only when a record has become evidence in a legitimate case.
4. Govern data-sharing platforms explicitly. Bill 113 imposes Chief approval and written documentation on certain outside requests, but requests made through an authorized data-sharing platform receive different treatment. Require Council-visible rules identifying approved platforms and participating agencies, direct-query permissions, complete outside-access logs, Maui's ability to restrict or revoke access immediately, and periodic review of each sharing relationship.
5. Require aggregate public reporting. Internal logs do not create public accountability unless results are reviewed and reported. Without identifying people or compromising investigations, require periodic publication of search totals, outside-agency requests and disclosures, receiving agencies, policy violations, unauthorized-access incidents, retention exceptions, and corrective actions. Publish aggregate results of Bill 112's quarterly audits as well.
6. Require independent security assessment and remediation. Vendor self-reporting is not enough for a database of sensitive location information. Require periodic independent assessments, prompt remediation deadlines based on severity, written verification of completed fixes, and County authority to suspend access when serious deficiencies remain unresolved.
7. Keep fundamental protections in ordinance. The Chief may adopt implementing policies, but retention, minimum security, outside sharing, audit integrity, and public transparency should not depend only on internal policy that can be changed without the same public legislative process.
DRAFTING ISSUE REQUIRING IMMEDIATE CLARIFICATION
Section 8.38.060 of Bill 113 states that the County “must execute or renew” a contract with a vendor whose practices include commercial sale, licensing, transfer, or reserved reuse rights. That language appears to conflict with the rest of the bill. Please ask Corporation Counsel whether the intended language is “must not execute or renew.”
WHY THESE CHANGES MATTER TO LAW-ABIDING RESIDENTS
1. A compromised account can be used to search a spouse, neighbor, witness, public official, or private citizen without lawful cause.
2. A vulnerable database can expose recurring travel patterns, homes, workplaces, medical visits, religious activity, meetings, or associations.
3. Long retention expands both the amount of innocent-person data available and the harm caused by a breach or misuse.
4. Broad sharing can allow agencies outside Maui to access local data under standards Maui residents did not approve.
5. Weak or alterable logs can make misuse impossible to reconstruct, prove, or correct.
THE VENDOR INCENTIVE DOES NOT MATCH THE PUBLIC RISK
A private vendor's security must be good enough to sell and operate its product, protect its reputation, and preserve profitability.
That is not the same as providing every safeguard necessary to protect residents from the full consequences of compromise.
Stronger controls cost money; the harm from weak controls is borne largely by the public.
County law must therefore establish enforceable minimums rather than relying on a vendor's assurances or standard contract terms.
REQUEST TO THE COMMITTEE
My preference is that the County not create this surveillance infrastructure. If the Council proceeds, please preserve the bills' limits on authorized use and add protections for the database itself.
The goal should not be only to prevent MPD or a vendor from intentionally misusing surveillance data. It should be to ensure that unauthorized people cannot obtain or exploit it, ordinary records do not accumulate indefinitely, outside access remains accountable, and the public can verify that the safeguards work.
The investigative convenience of these systems does not erase the danger created by building them. Access to cameras and location data is not impossible for someone determined to obtain it. The County should not treat safeguards as proof that the technology is safe; they are the minimum protections owed to residents if the County adopts it despite those risks.
SOURCE NOTES
Bill 113 (2026), proposed Maui County Code Chapter 8.38, especially §§8.38.010, .030, .050, .060, and .080; Bill 112 (2026), proposed Chapter 8.37, especially §§8.37.030-.060; September 2, 2026 DRIP Committee agenda; August 27, 2026 correspondence to Corporation Counsel regarding the proposed Bill 112 CD1.
Automated license plate readers have a high potential for abuse, and there have been several well publicized cases of that in the national news. It also borders on police-state style spying on the public. Facial recognition is closely related to this.
I believe that while Bills 112 and 113 are a good idea, I think we need to step back and make sure we have proper restrictions in place as to when people can be subject to surveillance of this type. The harm is not license plate readers, the harm is using it to track the public. I believe it is the latter that should be addressed in legislation.
For instance, law enforcement should be prevented from Automated Tracking without a warrant issued by the court. "Automated Tracking" means identifying an individual and correlating his/her movements through automated license plate recognition, automated or AI facial recognition, or any other identification technique that is designed to follow individuals using unattended cameras and automated image processing.
Automated Tracking of individuals by private companies for private or commercial use should also be illegal in the County of Maui.
Do not let Hawai'i or Maui County use intrusive, Big Brother-ish surveillance on the public.
Mahalo,
Scott Werden
Ha'iku
scott.werden@gmail.com
Aloha Chair Paltin and Members of the Maui County Council,
I strongly oppose Bills 112 and 113. While I support effective law enforcement, these bills further normalize the collection and use of highly sensitive information about innocent people, facial images and detailed records of where vehicles travel. The ability to identify, track, and reconstruct a person’s movements raises serious privacy concerns, particularly when technology can capture information about people who are not suspected of any crime.
You must consider whether expanding reliance on these technologies is necessary when Maui County is already seeing meaningful reductions in crime. Maui Police Department reports that violent crime has declined and property crime has dropped significantly. MPD has also reported a continuing downward trend in violent crime.
When crime is declining, the Council must be especially careful before expanding government surveillance capabilities. Protecting public safety does not require sacrificing the privacy of law-abiding residents and visitors.
Bills 112 and 113 may establish restrictions on how these technologies are used, but they still institutionalize systems capable of mass identification and tracking. Once such databases and surveillance infrastructure exist, future uses can expand beyond their original purpose.
Maui can protect both public safety and personal privacy. I respectfully urge the Council to vote NO on Bills 112 and 113.
Most seriously, Faith Chase
I was going to stay on to give oral testimony but I have to leave. Below is my oral testimony for this meeting.
Aloha. My name is Keisa Liu, and I am speaking on agenda items DRIP 26 and 27. I am the Co-Vice Chair of the MPD Multicultural Advisory Council; however, I am speaking today on my own time and on my own behalf.
I want to caution against making police misuse the primary focus of this discussion. That is a risk, but I believe the larger vulnerability is the private commercial system we have connected ourselves to.
Maui chose this technology, but most of our community had very little opportunity to understand or follow that decision before the infrastructure was already here.
And now, frankly, Maui has entered a relationship with sophisticated surveillance technology without first putting adequate protections in place.
Corporations do not have the same obligation to Maui residents that our government does. Corporate executives make decisions in the financial interests of their companies. Data has enormous financial value, and our federal government is actively pursuing deregulation of AI and technology.
Companies can take risks, change policies, merge, be acquired, suffer breaches, pay fines, and continue operating. The people whose information is compromised cannot simply pay a fine and become whole again. That's our vulnerability.
And I do not believe MPD should be asked to police this risk alone.
MPD is a law-enforcement agency. Its expertise is public safety and law enforcement. Its officers are not cybersecurity engineers, privacy auditors, software quality-assurance specialists, or data-governance experts—and we should not expect them to be.
If Maui is going to operate sophisticated surveillance technology that relies on private companies, interconnected systems, and large amounts of public data, then the County needs an independent technical watchdog with the expertise and authority to audit these systems, identify vulnerabilities, examine access and data-sharing practices, test security controls, and report its findings independently of both law enforcement and the companies involved.
Because the greatest threat is not necessarily someone intentionally abusing the system.
It is creating a system capable of tremendous harm and then assuming every agency, company, employee, security control, and future decision will always get it right.
They won't. No complex system does.
The County made the decision to introduce this vulnerability into our community. The community should not be asked to carry that risk without independent protection.
If we are going to have this technology, then oversight cannot come solely from the people using it or the companies profiting from it.
We need someone whose job is to protect us from both.
Mahalo for your time and consideration.
Testimonies received by DRIP Committee
WRITTEN TESTIMONY: BILLS 112 AND 113 (2026)
Protecting Law-Abiding Residents Requires Both Use Rules and Data Security
To: Chair Tamara Paltin and Members, Disaster, Resilience, International Affairs, and Planning Committee
From: Keisa Liu, Makawao
Meeting: September 2, 2026 | DRIP-26 and DRIP-27
Position: Oppose County use of ALPR and facial-recognition surveillance. If implementation proceeds, strengthen Bills 112 and 113 to reduce the resulting risks.
CORE POINT
I do not support the County's use of ALPR or facial-recognition surveillance. These systems create an infrastructure capable of tracking the movements and associations of law-abiding residents. Because implementation appears likely, I am asking the Council to make that infrastructure as safe, limited, and accountable as possible.
The requested protections are harm reduction—not endorsement.
Bills 112 and 113 establish limits on authorized use of facial-recognition and automated license plate reader (ALPR) data. Those limits are necessary, but they do not provide equally strong protection against unauthorized access. ALPR records combine a vehicle identifier with an image, date, time, and geographic location. When accumulated, they can reveal patterns in the movements of people who have never been suspected of a crime.
If the County collects data capable of reconstructing residents' movements, its responsibility must extend through the entire data lifecycle: collection → access → storage → security → sharing → auditing → retention → deletion.
PROTECTIONS ALREADY INCLUDED
Bill 113: Prohibits commercial sale and exploitation; requires a documented law-enforcement nexus for queries; regulates disclosures; restricts vendor reuse; and requires disclosure records.
Bill 112: Treats facial-recognition results as investigative leads, not identifications; requires corroboration; limits access to trained users; logs each use; and requires quarterly audits.
Important but incomplete: These provisions may reduce intentional misuse by authorized users. They do not eliminate the underlying surveillance risk or fully protect the system from unauthorized access.
REQUESTED AMENDMENTS
1. Establish enforceable cybersecurity requirements. Bill 113 requires vendor notice within 24 hours after discovery of unauthorized access but notice after discovery does not ensure prevention or timely detection. Require a recognized, current cybersecurity framework covering MFA, encryption in transit and at rest, least-privilege access, credential revocation, vulnerability management, security testing, anomaly detection, incident response, and subcontractor controls.
2. Protect the audit trail itself. Query and disclosure logs are useful only if they cannot be altered or erased. Require tamper-resistant logs, independent retention, access controls, routine review for anomalous activity, and preservation after any suspected compromise.
3. Set a retention limit for ordinary ALPR detections. Bill 113 requires deletion when a vendor contract ends, but it does not appear to set a general deletion deadline for records unrelated to an investigation. Require prompt deletion after a defined period, with a documented exception only when a record has become evidence in a legitimate case.
4. Govern data-sharing platforms explicitly. Bill 113 imposes Chief approval and written documentation on certain outside requests, but requests made through an authorized data-sharing platform receive different treatment. Require Council-visible rules identifying approved platforms and participating agencies, direct-query permissions, complete outside-access logs, Maui's ability to restrict or revoke access immediately, and periodic review of each sharing relationship.
5. Require aggregate public reporting. Internal logs do not create public accountability unless results are reviewed and reported. Without identifying people or compromising investigations, require periodic publication of search totals, outside-agency requests and disclosures, receiving agencies, policy violations, unauthorized-access incidents, retention exceptions, and corrective actions. Publish aggregate results of Bill 112's quarterly audits as well.
6. Require independent security assessment and remediation. Vendor self-reporting is not enough for a database of sensitive location information. Require periodic independent assessments, prompt remediation deadlines based on severity, written verification of completed fixes, and County authority to suspend access when serious deficiencies remain unresolved.
7. Keep fundamental protections in ordinance. The Chief may adopt implementing policies, but retention, minimum security, outside sharing, audit integrity, and public transparency should not depend only on internal policy that can be changed without the same public legislative process.
DRAFTING ISSUE REQUIRING IMMEDIATE CLARIFICATION
Section 8.38.060 of Bill 113 states that the County “must execute or renew” a contract with a vendor whose practices include commercial sale, licensing, transfer, or reserved reuse rights. That language appears to conflict with the rest of the bill. Please ask Corporation Counsel whether the intended language is “must not execute or renew.”
WHY THESE CHANGES MATTER TO LAW-ABIDING RESIDENTS
1. A compromised account can be used to search a spouse, neighbor, witness, public official, or private citizen without lawful cause.
2. A vulnerable database can expose recurring travel patterns, homes, workplaces, medical visits, religious activity, meetings, or associations.
3. Long retention expands both the amount of innocent-person data available and the harm caused by a breach or misuse.
4. Broad sharing can allow agencies outside Maui to access local data under standards Maui residents did not approve.
5. Weak or alterable logs can make misuse impossible to reconstruct, prove, or correct.
THE VENDOR INCENTIVE DOES NOT MATCH THE PUBLIC RISK
A private vendor's security must be good enough to sell and operate its product, protect its reputation, and preserve profitability.
That is not the same as providing every safeguard necessary to protect residents from the full consequences of compromise.
Stronger controls cost money; the harm from weak controls is borne largely by the public.
County law must therefore establish enforceable minimums rather than relying on a vendor's assurances or standard contract terms.
REQUEST TO THE COMMITTEE
My preference is that the County not create this surveillance infrastructure. If the Council proceeds, please preserve the bills' limits on authorized use and add protections for the database itself.
The goal should not be only to prevent MPD or a vendor from intentionally misusing surveillance data. It should be to ensure that unauthorized people cannot obtain or exploit it, ordinary records do not accumulate indefinitely, outside access remains accountable, and the public can verify that the safeguards work.
The investigative convenience of these systems does not erase the danger created by building them. Access to cameras and location data is not impossible for someone determined to obtain it. The County should not treat safeguards as proof that the technology is safe; they are the minimum protections owed to residents if the County adopts it despite those risks.
SOURCE NOTES
Bill 113 (2026), proposed Maui County Code Chapter 8.38, especially §§8.38.010, .030, .050, .060, and .080; Bill 112 (2026), proposed Chapter 8.37, especially §§8.37.030-.060; September 2, 2026 DRIP Committee agenda; August 27, 2026 correspondence to Corporation Counsel regarding the proposed Bill 112 CD1.
Aloha DRIP committee -
Automated license plate readers have a high potential for abuse, and there have been several well publicized cases of that in the national news. It also borders on police-state style spying on the public. Facial recognition is closely related to this.
I believe that while Bills 112 and 113 are a good idea, I think we need to step back and make sure we have proper restrictions in place as to when people can be subject to surveillance of this type. The harm is not license plate readers, the harm is using it to track the public. I believe it is the latter that should be addressed in legislation.
For instance, law enforcement should be prevented from Automated Tracking without a warrant issued by the court. "Automated Tracking" means identifying an individual and correlating his/her movements through automated license plate recognition, automated or AI facial recognition, or any other identification technique that is designed to follow individuals using unattended cameras and automated image processing.
Automated Tracking of individuals by private companies for private or commercial use should also be illegal in the County of Maui.
Do not let Hawai'i or Maui County use intrusive, Big Brother-ish surveillance on the public.
Mahalo,
Scott Werden
Ha'iku
scott.werden@gmail.com