Aloha Chair Paltin and Members of the Maui County Council,
I strongly oppose Bills 112 and 113. While I support effective law enforcement, these bills further normalize the collection and use of highly sensitive information about innocent people, facial images and detailed records of where vehicles travel. The ability to identify, track, and reconstruct a person’s movements raises serious privacy concerns, particularly when technology can capture information about people who are not suspected of any crime.
You must consider whether expanding reliance on these technologies is necessary when Maui County is already seeing meaningful reductions in crime. Maui Police Department reports that violent crime has declined and property crime has dropped significantly. MPD has also reported a continuing downward trend in violent crime.
When crime is declining, the Council must be especially careful before expanding government surveillance capabilities. Protecting public safety does not require sacrificing the privacy of law-abiding residents and visitors.
Bills 112 and 113 may establish restrictions on how these technologies are used, but they still institutionalize systems capable of mass identification and tracking. Once such databases and surveillance infrastructure exist, future uses can expand beyond their original purpose.
Maui can protect both public safety and personal privacy. I respectfully urge the Council to vote NO on Bills 112 and 113.
Aloha DRIP Chair and Councilmembers,
I am writing on behalf of Maui Indivisible to request 112 & 113 be amended. We oppose it in its current form but not the overall intent
We know that regulating 2 spy tools will not bring sanity to Maui County’s mass spy project. That’s why scores of States, Counties, cities and towns across the US have shut these projects down in the last year, not just regulated a few tools. It’s not just liberal and Progressive places, it’s conservative and even MAGA places. Maui is very late to the party on this and on the wrong side of history. Even FL Governor DeSantis calls these projects “out of control.”
Our position is if the Council wants these mass spy tools and projects, it needs to take that responsibility seriously and provide us transparency and protections so we can hold the County accountable when our rights are violated. That's why this topic needs to be on GREAT Committee agenda too.
These 2 bills targeting 2 spy tools should pilot conditions imposed on all County spy projects and tools. In other words, while the Council has yet to put a Moratorium on the County mass spy project on the agenda, the Council should impose conditions immediately on the spy tools in 112 and 113 as a pilot: Because these bills weakly regulate only 2 spy tools and given the scope of the County's spy project, these conditions on the County’s mass spy tools should be...
1. Annual Council Evaluation of all mass spy projects and tools
2 Annual sunsets to Council approval and funding of all mass spy projects and tools so that renewing them is intentional
3. Expand the scope of these bills to cover more general types of mass spy tools and from Police (MPD) to every County dept
4. Transparency
5. Enforceable Rights and Consequences for violations
6. Reciprocity: We see Councilmembers want to track and record us with expensive cutting edge computer tools and cameras everywhere. If we, the public, must lose privacy and other freedoms for Council’s poor judgment about our safety, then the advocates and decision-makers of this project should bear the worst aspects of the spying. Most of us do not have AI software, so you should commit in the law to cameras placed at the entrance of your home driveway, office door accessed from a common area, and the grocery store you most regularly frequent and these cameras should feed to public websites where we can look at your comings and goings 24/7.
What do we mean by Transparency? Built into these bills that legitimize mass spy tools, there need to be regular...
1. Monthly agency public reporting and disclosure of statistical use and effectiveness measured by purpose of spy tool, abuse, and breach of data security.
2. Annual independent audits on mass spy tools reported to the Council including measures of use, cost, effectiveness, transparency to the public, abuse, breach of data security, and violation of civil and personal rights.
3. Publicizing of County contracts as soon as they are proposed as well as final forms including public posting of where to read all contracts, agreements, and legally enforceable documents regarding all parties. Since the MPD/County regularly violates UIPA and lengthy litigation is the only consequence so far, the burden to publicize should be on the County.
4. Verification tours open to the public of all surveillance centers
5. Data traffic revealed: Available to regular public electronic inspection should be data batch logs sorted by data category, date, dept/division/unit that record the location of all the places where County collected data travels. All County collected data must be tagged so it can be tracked. Every recipient of County collected data must agree not to not interfere with these data tracking tags and to help with any tracking obstacles.
What do we mean by Enforceable Rights and Consequences? Also built into these bills, there need to be...
1. Model Non-disclosure of data agreements (NDDA) to accompany every contract associated and enforceable on every contract party involved with these mass spy tool projects that are available online to the public
2. Meaningful consequences for violations of these bills, data breaches, other civil liberty violations such as triggering the exclusionary clause in criminal proceedings, publicizing violations and breach details and the names of people responsible for breach, civil compensation to victims, and removal of violators from data access.
These 2 bills are trying to do an impossible thing: Make it look like we have protections against Police and County spy abuse but still not undermine the spy project that Council funded. Bills 112 (FRT) and 113(ALPR)
• are constructed to undermine their stated purposes and are riddled with loopholes.
• allow the County to abuse these tools but not the vendors with which it contracts.
• do not equally regulate the 2 targeted spy tools leading to the question of why allow more abuse of one spy tool over the other.
• partly protect some of our rights but not other rights in which there has been significant historical abuse, so why discriminate against populations who experience these spy tools differently.
These two bills are very technical and that masks their shortcomings. Reading these two bills made my eyes glaze over many times. But we are taking seriously this process Council set up when Council rushed these bills after funding and building this mass spy project. We respectfully dissect these bills on the technical merits:
1. In 112, if the proposed predicate for FRT is “documented criminal investigation,” the minimum standard for FRT use should be constitutional “probable cause” and not the standard of an in-the-field Terry Stop “reasonable suspicion” which was developed for sudden, brief, temporary investigative stops which last no longer than necessary to confirm or dispel the officer's suspicion. FRT’s history of inaccuracy and police abuse is the reason why 112 avoids raising this weakened Terry standard in the purpose section. Worse, 112’s loophole allowing retroactive documenting contradicts the bill’s stated purpose that FRT “be used only in connection with a documented criminal investigation” and further undermines the probable cause standard. (see 8.37.030(E) allowing retroactive documenting an investigation)
2. 112 fails to include all biometric and person-specific tech surveillance. Limiting 112 to FRT will soon put the regulation in an irrelevant time warp.
3. 112 does not address sale and commercial use of FRT data like 113 does with ALPR data
4. 112's Defintion of where FRT can be deployed leaves almost no place for privacy except surrounded by 4 solid walls on a tropical island: "the interior of a private dwelling or lodging unit." 8.37.030(I)
5. 112 and 113 fail to address transmitting, exchanging, and integrating this data with other governments, inside and outside the US, which may use it for commercial purposes or transmit it to a private entity for commercial purposes or for purposes that are not commercial, for example, political, etc. Nor do they prohibit a private entity sharing data non commercially with another government which is what Flock has done with ICE. “8.38.020 Sale and commercial use. A. An agency must not sell, lease, trade, license, or otherwise transfer ALPR data to a private entity. B. A vendor must not sell, lease, trade, license, or otherwise transfer ALPR data to a private entity.”
6. 112 and 113 do not prohibit use of these tools to support police abuse of 4th and 14th Amendment activity
7. 113 does not establish any probable cause standards of County use for ALPR data like 112 does for FRT data. Why does the County treat these 2 forms of personal location and behavioral tracking data differently?
8. 113 only prohibits one type, immigration enforcement, of police abuse of ALPR and not other current forms of police abuse, such as those partly covered in 112, sometimes documented of MPD, widely documented of local police nation-wide, and widely documented of the Trump regime such as attacking 1st and 4th and 14th Amendment rights. (See "’Legitimate law enforcement purpose’ does not include immigration enforcement.” and 8.38.040 Immigration enforcement). Given Trump has commandeered most of his police state forces to prioritize immigration enforcement, it is not good enough to forbid local immigration enforcement when we have no oversight mechanisms to protect that blurred line for all Federal agencies and County current collaboration with them. Why does the County treat these 2 forms of surveillance differently?
9. It’s great 113 has set up standards for vendors use of ALPR data (“8.38.050 Contracts; special conditions.”). These standards should also apply to all County depts to prevent County abuse of the general public and all notice and approval provisions should also be directed to elected government leaders and subject to Sunshine laws.
10. 113 should ban providing ALPR data to any federal immigration authority and not have anything to do with the provider's intentional "purpose." In fact the ban should extend to any entity one might reasonably expect will transfer the data to any Federal agency after due diligence research.
I support the goal of Bill 112, but I ask the Committee not to recommend passage until the bill is amended.
The bill gets several important things right.
It generally requires a documented connection to a criminal investigation. Access is limited to trained and approved employees. Every use must be logged. The police chief must audit its use every three months.
Most importantly, the bill says a facial-recognition result is only an investigative lead. It is not proof of identity and cannot, by itself, establish probable cause for an arrest, search, or search warrant. The bill also limits its use for immigration enforcement, civil traffic violations, discrimination, and lawful protests, worship, or political activity.
These are good protections.
However, the bill contains one major provision that is not mentioned in the agenda summary.
Section 8.37.030(I) expressly allows facial recognition to be placed on live cameras covering public streets, sidewalks, parking areas, other places open to public view, and publicly accessible areas of private property.
A documented criminal connection would still be required, but the bill does not answer several basic questions:
* Must police obtain a warrant or written approval before using a live camera?
* How serious must the crime be?
* Who may be placed on a live-camera watchlist?
* How long may the camera operate?
* How large an area may be monitored?
* Will every person passing the camera be scanned?
* Will information about people who do not match be immediately deleted?
* Does “live camera” include body cameras, drones, traffic cameras, private security cameras, or other video systems?
This is much broader than using a photograph from a crime scene to search for a possible suspect.
I recommend deleting the live-camera provision. If Council wants to permit real-time facial recognition, that should be considered separately and openly.
If Council keeps the provision, live use should be limited to a named person connected to a serious violent crime, an imminent threat, or a missing or endangered person. It should require written approval, a strict time and location limit, and immediate deletion of information about people who do not match. A warrant should be required for live monitoring of a named suspect, with narrow emergency and missing-person exceptions.
The bill also does not identify which databases MPD may search. Its definition permits comparison against “one or more databases.” That could include mugshots, driver’s-license photographs, federal databases, or commercial systems containing photographs taken from social media and other websites.
The Justice Department’s 2024 report warns that searching larger databases increases the possibility of returning an incorrect candidate. The report also raises legal, privacy, and ethical concerns about commercial databases containing millions or billions of photographs taken from the internet.
Honolulu Police Department’s published policy is narrower. It says its system compares crime photographs or videos against known mugshots, treats any result only as a guide, and requires the detective to verify the person’s identity.
Maui should identify every database that may be searched. Council should prohibit the use of databases built from unlawfully obtained photographs or indiscriminately collected internet images.
The bill also contains no rules for vendors. It does not prohibit a company from keeping submitted photographs, using County data to train its products, sharing information with another party, or using subcontractors.
The bill requires search logs to be kept for at least two years. But it does not establish retention limits for submitted photographs, facial templates, candidate lists, search results, or live-camera images.
Vendor contracts should state that the County owns the information. Vendors should be prohibited from selling, sharing, or using it for another purpose. Contracts should require security, breach notification, auditing, control of subcontractors, and permanent deletion when the information is no longer needed.
Accuracy also matters.
The Government Accountability Office reported in 2023 that seven federal law-enforcement agencies had used four commercial or nonprofit facial-recognition services. All seven initially used the services without requiring facial-recognition training. Six agencies with available records conducted approximately 60,000 searches during that period. By April 2023, only two of the seven required training.
Bill 112 correctly requires training, but training alone does not establish that Maui’s system is accurate.
The Justice Department reported that NIST had evaluated more than 350 one-to-many facial-recognition algorithms and more than 500 one-to-one algorithms. NIST continues to report differences in false-positive performance based on the algorithm and on factors including age, sex, and race.
The Justice Department recommends testing the actual system, setting minimum image-quality and similarity standards, reviewing all leading candidates, and using a trained human examiner who is ideally independent from the investigating team.
Bill 112 does not require any of those protections.
Before MPD uses a system, the County should require independent accuracy testing under real-world conditions. The bill should require a minimum match threshold and new testing whenever the vendor makes a major change to the algorithm.
The audit requirements also need strengthening. The present log records only the user, time, case number, and purpose. It should also record:
* The system, vendor, database, and algorithm version used;
* The source and quality of the submitted image;
* The similarity threshold and candidate results;
* The employee who reviewed the results;
* The independent facts used to corroborate a possible match; and
* Whether the search contributed to a stop, search, arrest, correct identification, or mistaken identification.
Council should require an annual public report with totals and audit findings. Information about active cases and private individuals can be protected.
The bill must also apply to contractors, vendors, task-force members, and outside agencies acting for or with the County. MPD should not be able to avoid the law by asking another agency or private company to perform the search.
Finally, the bill contains incorrect cross-references. Its training section refers employees to “section 3” for the criminal-nexus requirements and “section 4” for the limitations. Those requirements are actually found in Sections 8.37.020 and 8.37.030. These references must be corrected.
Before passing this bill, Council should require MPD to answer:
1. Does MPD currently use facial recognition?
2. What company, system, and databases does it use?
3. How many searches has MPD performed?
4. How many searches contributed to stops, searches, arrests, or mistaken identifications?
5. Does MPD have live facial-recognition capability?
6. How long are photographs and results retained?
7. Have federal agencies or task-force partners conducted or received searches involving MPD?
8. What contracts, costs, grants, accuracy tests, audits, and written policies currently exist?
Bill 112 has a good purpose, but good intentions are not enough when government can identify and track people through public cameras.
Please amend the bill before moving it forward. If these questions and protections cannot be addressed now, defer the bill and return with a complete and properly reviewed draft.
Aloha Chair Paltin and Members of the Maui County Council,
I strongly oppose Bills 112 and 113. While I support effective law enforcement, these bills further normalize the collection and use of highly sensitive information about innocent people, facial images and detailed records of where vehicles travel. The ability to identify, track, and reconstruct a person’s movements raises serious privacy concerns, particularly when technology can capture information about people who are not suspected of any crime.
You must consider whether expanding reliance on these technologies is necessary when Maui County is already seeing meaningful reductions in crime. Maui Police Department reports that violent crime has declined and property crime has dropped significantly. MPD has also reported a continuing downward trend in violent crime.
When crime is declining, the Council must be especially careful before expanding government surveillance capabilities. Protecting public safety does not require sacrificing the privacy of law-abiding residents and visitors.
Bills 112 and 113 may establish restrictions on how these technologies are used, but they still institutionalize systems capable of mass identification and tracking. Once such databases and surveillance infrastructure exist, future uses can expand beyond their original purpose.
Maui can protect both public safety and personal privacy. I respectfully urge the Council to vote NO on Bills 112 and 113.
Most seriously, Faith Chase
Aloha DRIP Chair and Councilmembers,
I am writing on behalf of Maui Indivisible to request 112 & 113 be amended. We oppose it in its current form but not the overall intent
We know that regulating 2 spy tools will not bring sanity to Maui County’s mass spy project. That’s why scores of States, Counties, cities and towns across the US have shut these projects down in the last year, not just regulated a few tools. It’s not just liberal and Progressive places, it’s conservative and even MAGA places. Maui is very late to the party on this and on the wrong side of history. Even FL Governor DeSantis calls these projects “out of control.”
Our position is if the Council wants these mass spy tools and projects, it needs to take that responsibility seriously and provide us transparency and protections so we can hold the County accountable when our rights are violated. That's why this topic needs to be on GREAT Committee agenda too.
These 2 bills targeting 2 spy tools should pilot conditions imposed on all County spy projects and tools. In other words, while the Council has yet to put a Moratorium on the County mass spy project on the agenda, the Council should impose conditions immediately on the spy tools in 112 and 113 as a pilot: Because these bills weakly regulate only 2 spy tools and given the scope of the County's spy project, these conditions on the County’s mass spy tools should be...
1. Annual Council Evaluation of all mass spy projects and tools
2 Annual sunsets to Council approval and funding of all mass spy projects and tools so that renewing them is intentional
3. Expand the scope of these bills to cover more general types of mass spy tools and from Police (MPD) to every County dept
4. Transparency
5. Enforceable Rights and Consequences for violations
6. Reciprocity: We see Councilmembers want to track and record us with expensive cutting edge computer tools and cameras everywhere. If we, the public, must lose privacy and other freedoms for Council’s poor judgment about our safety, then the advocates and decision-makers of this project should bear the worst aspects of the spying. Most of us do not have AI software, so you should commit in the law to cameras placed at the entrance of your home driveway, office door accessed from a common area, and the grocery store you most regularly frequent and these cameras should feed to public websites where we can look at your comings and goings 24/7.
What do we mean by Transparency? Built into these bills that legitimize mass spy tools, there need to be regular...
1. Monthly agency public reporting and disclosure of statistical use and effectiveness measured by purpose of spy tool, abuse, and breach of data security.
2. Annual independent audits on mass spy tools reported to the Council including measures of use, cost, effectiveness, transparency to the public, abuse, breach of data security, and violation of civil and personal rights.
3. Publicizing of County contracts as soon as they are proposed as well as final forms including public posting of where to read all contracts, agreements, and legally enforceable documents regarding all parties. Since the MPD/County regularly violates UIPA and lengthy litigation is the only consequence so far, the burden to publicize should be on the County.
4. Verification tours open to the public of all surveillance centers
5. Data traffic revealed: Available to regular public electronic inspection should be data batch logs sorted by data category, date, dept/division/unit that record the location of all the places where County collected data travels. All County collected data must be tagged so it can be tracked. Every recipient of County collected data must agree not to not interfere with these data tracking tags and to help with any tracking obstacles.
What do we mean by Enforceable Rights and Consequences? Also built into these bills, there need to be...
1. Model Non-disclosure of data agreements (NDDA) to accompany every contract associated and enforceable on every contract party involved with these mass spy tool projects that are available online to the public
2. Meaningful consequences for violations of these bills, data breaches, other civil liberty violations such as triggering the exclusionary clause in criminal proceedings, publicizing violations and breach details and the names of people responsible for breach, civil compensation to victims, and removal of violators from data access.
These 2 bills are trying to do an impossible thing: Make it look like we have protections against Police and County spy abuse but still not undermine the spy project that Council funded. Bills 112 (FRT) and 113(ALPR)
• are constructed to undermine their stated purposes and are riddled with loopholes.
• allow the County to abuse these tools but not the vendors with which it contracts.
• do not equally regulate the 2 targeted spy tools leading to the question of why allow more abuse of one spy tool over the other.
• partly protect some of our rights but not other rights in which there has been significant historical abuse, so why discriminate against populations who experience these spy tools differently.
These two bills are very technical and that masks their shortcomings. Reading these two bills made my eyes glaze over many times. But we are taking seriously this process Council set up when Council rushed these bills after funding and building this mass spy project. We respectfully dissect these bills on the technical merits:
1. In 112, if the proposed predicate for FRT is “documented criminal investigation,” the minimum standard for FRT use should be constitutional “probable cause” and not the standard of an in-the-field Terry Stop “reasonable suspicion” which was developed for sudden, brief, temporary investigative stops which last no longer than necessary to confirm or dispel the officer's suspicion. FRT’s history of inaccuracy and police abuse is the reason why 112 avoids raising this weakened Terry standard in the purpose section. Worse, 112’s loophole allowing retroactive documenting contradicts the bill’s stated purpose that FRT “be used only in connection with a documented criminal investigation” and further undermines the probable cause standard. (see 8.37.030(E) allowing retroactive documenting an investigation)
2. 112 fails to include all biometric and person-specific tech surveillance. Limiting 112 to FRT will soon put the regulation in an irrelevant time warp.
3. 112 does not address sale and commercial use of FRT data like 113 does with ALPR data
4. 112's Defintion of where FRT can be deployed leaves almost no place for privacy except surrounded by 4 solid walls on a tropical island: "the interior of a private dwelling or lodging unit." 8.37.030(I)
5. 112 and 113 fail to address transmitting, exchanging, and integrating this data with other governments, inside and outside the US, which may use it for commercial purposes or transmit it to a private entity for commercial purposes or for purposes that are not commercial, for example, political, etc. Nor do they prohibit a private entity sharing data non commercially with another government which is what Flock has done with ICE. “8.38.020 Sale and commercial use. A. An agency must not sell, lease, trade, license, or otherwise transfer ALPR data to a private entity. B. A vendor must not sell, lease, trade, license, or otherwise transfer ALPR data to a private entity.”
6. 112 and 113 do not prohibit use of these tools to support police abuse of 4th and 14th Amendment activity
7. 113 does not establish any probable cause standards of County use for ALPR data like 112 does for FRT data. Why does the County treat these 2 forms of personal location and behavioral tracking data differently?
8. 113 only prohibits one type, immigration enforcement, of police abuse of ALPR and not other current forms of police abuse, such as those partly covered in 112, sometimes documented of MPD, widely documented of local police nation-wide, and widely documented of the Trump regime such as attacking 1st and 4th and 14th Amendment rights. (See "’Legitimate law enforcement purpose’ does not include immigration enforcement.” and 8.38.040 Immigration enforcement). Given Trump has commandeered most of his police state forces to prioritize immigration enforcement, it is not good enough to forbid local immigration enforcement when we have no oversight mechanisms to protect that blurred line for all Federal agencies and County current collaboration with them. Why does the County treat these 2 forms of surveillance differently?
9. It’s great 113 has set up standards for vendors use of ALPR data (“8.38.050 Contracts; special conditions.”). These standards should also apply to all County depts to prevent County abuse of the general public and all notice and approval provisions should also be directed to elected government leaders and subject to Sunshine laws.
10. 113 should ban providing ALPR data to any federal immigration authority and not have anything to do with the provider's intentional "purpose." In fact the ban should extend to any entity one might reasonably expect will transfer the data to any Federal agency after due diligence research.
Aloha Chair and Members of the DRIP Committee,
My name is Edward Codelia, a resident of Kula.
I support the goal of Bill 112, but I ask the Committee not to recommend passage until the bill is amended.
The bill gets several important things right.
It generally requires a documented connection to a criminal investigation. Access is limited to trained and approved employees. Every use must be logged. The police chief must audit its use every three months.
Most importantly, the bill says a facial-recognition result is only an investigative lead. It is not proof of identity and cannot, by itself, establish probable cause for an arrest, search, or search warrant. The bill also limits its use for immigration enforcement, civil traffic violations, discrimination, and lawful protests, worship, or political activity.
These are good protections.
However, the bill contains one major provision that is not mentioned in the agenda summary.
Section 8.37.030(I) expressly allows facial recognition to be placed on live cameras covering public streets, sidewalks, parking areas, other places open to public view, and publicly accessible areas of private property.
A documented criminal connection would still be required, but the bill does not answer several basic questions:
* Must police obtain a warrant or written approval before using a live camera?
* How serious must the crime be?
* Who may be placed on a live-camera watchlist?
* How long may the camera operate?
* How large an area may be monitored?
* Will every person passing the camera be scanned?
* Will information about people who do not match be immediately deleted?
* Does “live camera” include body cameras, drones, traffic cameras, private security cameras, or other video systems?
This is much broader than using a photograph from a crime scene to search for a possible suspect.
I recommend deleting the live-camera provision. If Council wants to permit real-time facial recognition, that should be considered separately and openly.
If Council keeps the provision, live use should be limited to a named person connected to a serious violent crime, an imminent threat, or a missing or endangered person. It should require written approval, a strict time and location limit, and immediate deletion of information about people who do not match. A warrant should be required for live monitoring of a named suspect, with narrow emergency and missing-person exceptions.
The bill also does not identify which databases MPD may search. Its definition permits comparison against “one or more databases.” That could include mugshots, driver’s-license photographs, federal databases, or commercial systems containing photographs taken from social media and other websites.
The Justice Department’s 2024 report warns that searching larger databases increases the possibility of returning an incorrect candidate. The report also raises legal, privacy, and ethical concerns about commercial databases containing millions or billions of photographs taken from the internet.
Honolulu Police Department’s published policy is narrower. It says its system compares crime photographs or videos against known mugshots, treats any result only as a guide, and requires the detective to verify the person’s identity.
Maui should identify every database that may be searched. Council should prohibit the use of databases built from unlawfully obtained photographs or indiscriminately collected internet images.
The bill also contains no rules for vendors. It does not prohibit a company from keeping submitted photographs, using County data to train its products, sharing information with another party, or using subcontractors.
The bill requires search logs to be kept for at least two years. But it does not establish retention limits for submitted photographs, facial templates, candidate lists, search results, or live-camera images.
Vendor contracts should state that the County owns the information. Vendors should be prohibited from selling, sharing, or using it for another purpose. Contracts should require security, breach notification, auditing, control of subcontractors, and permanent deletion when the information is no longer needed.
Accuracy also matters.
The Government Accountability Office reported in 2023 that seven federal law-enforcement agencies had used four commercial or nonprofit facial-recognition services. All seven initially used the services without requiring facial-recognition training. Six agencies with available records conducted approximately 60,000 searches during that period. By April 2023, only two of the seven required training.
Bill 112 correctly requires training, but training alone does not establish that Maui’s system is accurate.
The Justice Department reported that NIST had evaluated more than 350 one-to-many facial-recognition algorithms and more than 500 one-to-one algorithms. NIST continues to report differences in false-positive performance based on the algorithm and on factors including age, sex, and race.
The Justice Department recommends testing the actual system, setting minimum image-quality and similarity standards, reviewing all leading candidates, and using a trained human examiner who is ideally independent from the investigating team.
Bill 112 does not require any of those protections.
Before MPD uses a system, the County should require independent accuracy testing under real-world conditions. The bill should require a minimum match threshold and new testing whenever the vendor makes a major change to the algorithm.
The audit requirements also need strengthening. The present log records only the user, time, case number, and purpose. It should also record:
* The system, vendor, database, and algorithm version used;
* The source and quality of the submitted image;
* The similarity threshold and candidate results;
* The employee who reviewed the results;
* The independent facts used to corroborate a possible match; and
* Whether the search contributed to a stop, search, arrest, correct identification, or mistaken identification.
Council should require an annual public report with totals and audit findings. Information about active cases and private individuals can be protected.
The bill must also apply to contractors, vendors, task-force members, and outside agencies acting for or with the County. MPD should not be able to avoid the law by asking another agency or private company to perform the search.
Finally, the bill contains incorrect cross-references. Its training section refers employees to “section 3” for the criminal-nexus requirements and “section 4” for the limitations. Those requirements are actually found in Sections 8.37.020 and 8.37.030. These references must be corrected.
Before passing this bill, Council should require MPD to answer:
1. Does MPD currently use facial recognition?
2. What company, system, and databases does it use?
3. How many searches has MPD performed?
4. How many searches contributed to stops, searches, arrests, or mistaken identifications?
5. Does MPD have live facial-recognition capability?
6. How long are photographs and results retained?
7. Have federal agencies or task-force partners conducted or received searches involving MPD?
8. What contracts, costs, grants, accuracy tests, audits, and written policies currently exist?
Bill 112 has a good purpose, but good intentions are not enough when government can identify and track people through public cameras.
Please amend the bill before moving it forward. If these questions and protections cannot be addressed now, defer the bill and return with a complete and properly reviewed draft.
Mahalo,
Edward Codelia
Kula
Testimonies received by DRIP Committee