Research, ideas, and leadership for a more secure, peaceful world
Author
Rebecca Williams
In the spirit of Watching the Watchers, I thought I would share some tips for examining what "smart city" tech is deployed in your city from my research experience. Below I describe what "smart city" tech to look out for (offline and on), how to find it, and how to request related public records to learn more about how you are watched. If you see "smart city" tech, you can then follow up with your representatives and community groups to be in dialogue about what information that tech is collecting and how it is being used. As Bianca Wylie said in our Public Purpose Week seminar, the most helpful thing, you can do as a community member is to show up and ask questions.
There are many types of technology that may fall under the umbrella term of "smart city" tech, but for this post, I will cover three broad categories of cameras, mobility tracking, and sensors because of their high-risk ability to potentially collect personally identifiable information (PII) or re-identifiable information. Re-identifiable information does not contain PII on its face, but through the reverse engineering of scrubbing techniques, metadata analysis, or with the combination of other datasets may be used to identify you. Simply put, these are devices that may be watching you. While some are more conspicuous than others, much of this technology can be observed walking around your neighborhood if you know what to look out for.
When you start to look for cameras, they are everywhere, but some are more conspicuous than others, and you may have to do more research to fully grasp their capabilities and how they are used.
Conspicuous Cameras: When you think of cameras occupying public space, you may envision Closed-Circuit Television (CCTV) or security cameras. There is no "expectation of privacy" in public space, so cameras are generally permissible, and CCTV has long been hailed as a crime-fighting tool, with a range of demonstrated efficacy, the most being for preventing theft in car parks. Regardless of ranging efficacy rates, affordable and easy to use, CCTV is increasingly being deployed across cities, in the countryside, and in parks. These cameras come in various shapes and sizes, such as bookshelf cameras, dome cameras, bullet cameras, fisheye or panoramic cameras, pan-tilt-zoom cameras, or turret cameras. Dome cameras make it difficult to see exactly where the lens is facing. In addition to government cameras posted on government-owned buildings, telephone poles, and traffic lights, private entities such as businesses or residences may have similar security cameras posted outside of their entryways. Given the ample access to private cameras by the government, assume if you can see the camera, the government can see you. As of this writing, more than 1800 law enforcement agencies–1 in 10–have partnered with Amazon's Ring program and have access to private cameras without a warrant. If you live in a low-camera neighborhood (Congrats) or can't get outside and want to see what this might look like, you can participate in Amnesty International's current Decode Surveillance NYC project that asks users to observe intersections in New York City for cameras and to tag them by camera type: dome or bullet. In the app or in life, the secret is to always be looking up.
Hidden Cameras: In addition to conspicuous cameras, there are many cameras that may not be obvious or have ample signage (see @surveillance.aesthetics on Instagram for some great signs – but know that IG is watching you too). For example, mirrors, parking meters, scooters, smart street lights, smart poles, traffic cameras, and unmanned aerial vehicles (UAVs) like drones or spy planes may be wielding a camera. Not to mention body-worn cameras and that most people who are carrying a smartphone. As technology makes more powerful and smaller cameras more affordable, it may become difficult to know for sure whether or not you're being filmed.
Seeing a camera is only part of the picture and does not tell you what information is being collected or how it is being used. Unless you are familiar with the vendors, models, and your government's policies regarding camera footage, you may have to do more research to learn these crucial details.
This next bucket of tools is admittedly a bit abstract, but when you are mobile around your city, I invite you to reflect on all the ways you might be tracked, whether it be in vehicles, or other modes of transportation, or simply walking around carrying a cell phone. Mobility tracking is a sleeper candidate for most privacy-invasive surveillance by "smart city" tech because it is less obvious to the naked eye, discloses sensitive information about your life, and is so ubiquitous. Its regulation landscape in the U.S. is also a lot more confusing and nascent.
Cell Phone Location: Governments are procuring cell phone data or intercepting your cell phone data. EFF's Surveillance Self-Defense Playlist: Getting to Know Your Phone comprehensively outlines the various privacy threats related to your phone, including location tracking by mobile signal tracking from towers, mobile signal tracking from cell-site simulators, wi-fi, Bluetooth, and location information leaks from apps and web browsing. There is also subcomponent software (like X-Mode) embedded across various applications that sell location data to advertisers and the military. In terms of observations in your neighborhood, you can look out for cell-site simulators. You can also check out the location data settings on your phone. If your phone all of a sudden goes down to 2G, that could indicate a cell-site simulator is in use nearby, but also cell-site simulators work all the way up to 5G now and are notoriously difficult to track. There are few laws on how cell phone location data can be collected, shared, or stored. In Carpenter v. United States, the Supreme Court ruled that obtaining historical cell-site location information (CSLI) containing the physical locations of cell-phones without a search warrant violates the Fourth Amendment, but some lower circuit findings are beginning to challenge the bounds of that ruling.
Vehicle Location: Vehicle location data can be tracked by Automated License Plate Readers (ALPRs), Intelligent Transportation Systems, vehicle telematics, rideshare applications, taxis, or cell phones. ALPRs are commonly mounted on tow trucks, police cars, and surveillance cameras (like Flock's TALON program). ALPRs collect a wide range of data about what cars are on the road and where they are going. Intelligent Transportation Systems can include a variety of technologies, including cameras and sensors (see above and below) but also induction loops (a simple low-voltage wire coil buried in the roadway that sends an electrical pulse when a vehicle passes over it), infrared, radar, sound or video imaging, and Bluetooth that collect traffic data and redirect it with radio announcements, lights, and signage. Vehicle telematics is data collected and sent by the cars and their components themselves picked up and sold by a third-party broker (like The Ulysses Group). Rideshare and taxi applications collect granular trip data. Lastly, cell phones (via towers and wi-fi) can be tracked to determine who's in your car, where they're going, and how fast they're traveling. All of this trip data can easily be used to connect you to specific sensitive trips.
Other Transportation Location: In addition to vehicle tracking, other modes of public transportation track your mobility, including bike share and scooters, and as more transit systems connect personal credit card information to trips: buses, subways, and parking. LADOT's use of the Mobility Data Specification, which shared private-sector "real-time" bike and scooter trip data with the government in exchange for permit rights to operate in the city, provoked a lawsuit by ACLU and EFF on privacy grounds.
Similar to cameras, it is not obvious what information mobility tracking is collecting and how it is being used.
Information & Use: Governments using Intelligent Transportation Systems or the Mobility Data Specification could be collecting non-identifiable information for planning purposes or could be collecting PII or re-identifiable information for analyses or enforcement purposes. Even traffic systems or programs that promise "digital twin" analytics vary in the granularity and temporal nature of the information collected and their uses. In terms of legal protections, the lawsuit brought by ACLU and EFF above was dismissed (the federal district court in southern California did not think it met the Carpenter threshold), and its appeal status is TBD. But Massachusetts recently enacted a new law that prevents Massachusetts transit authorities from disclosing personal information related to individuals' transit system use for non-transit purposes and requires police to obtain a search warrant before accessing personal data collected by the authorities (spurred by a MA lawsuit) and could be a sign of mobility data regulation to come.
This section is more speculative than the others, but I'd be remiss not to mention sensors in a "smart city" watch list. The distinction that is important here is the sensor explicitly designed to watch people or something else.
People Sensors: Simply put, a sensor converts stimuli such as heat, light, sound, and motion into electrical signals. Some common applications of using these sensors to watch people in cities have been the use of audio sensors (like Shotspotter) to detect (and analyze) audio signals, infrared sensors, Light Detection and Ranging (LiDAR) sensors, and (microwave, reflective, ultrasonic, and vibration) motion sensors to detect moving people and vehicles (see above), and thermal sensors commonly used to detect the heat of suspects or victims by the police. In Andrew Ferguson's Structural Sensor Surveillance article, he examines the privacy risks of a future in which sensors are integrated and connected enough to track an individuals' movement across a city and suggests design interventions (less data, less connectivity) and how such a world would violate our Fourth Amendment protections.
Environment Sensors: Many of these sensors are not pointed at people at all, but rather environment sensors include air quality sensors, waste management sensors, water management sensors. While these sensors are not directly aimed at tracking individuals, it does not mean that information collected from them could not be paired with other data streams like facial recognition and artificial intelligence and the capabilities of 5G and used against an individual. Steve Bellovin, a computer science professor at Columbia University, offered the Wall Street Journal the following hypothetical: "might a pollution sensor detect cigarette smoke or vaping, while a Bluetooth receiver picks up the identities of nearby phones? Insurance companies might be interested." How these collections might harm people is something we should start thinking about now.
Like cameras and mobility tracking, what information sensors collect and how it is used is often not obvious by seeing the sensor in the wild.
Information & Use: For people sensors, governments may be collecting PII or re-identifiable information in their intelligent transportation systems (see above) or may simply be using sensors in sidewalks to generate energy. For environment sensors, they may collect targeted drug use analysis in water management systems for enforcement programming or may collect air quality index levels for public health warnings.
Depending on how you slice it, other "smart city" tech items that I have not covered above that are definitely watching you may include Information and Communications Technology (ICT) infrastructure (cell-phone towers powering all the way up to 5G and public wi-fi), Internet of Things (IoT) or GPS-system connectivity to various things such as electronic monitoring, and smart tags/RFID Chips, online activity (of government websites, financial transactions, social media analysis), robots (like Boston Dynamics' robodogs or Knightscope's rolling pickles), and street computers (kiosks and USB ports).
There is so much you can learn from your city's website explicitly or implicitly. You can search for explicit mentions of "smart city" practices and policies. If those are not online or are not clear, you can find related budget, spending, and legislative information that can help you ask more questions. Things you should search your city website for include:
Keywords: Search your city's website for all of the keywords bolded above. Here is a list of keywords to get you started. Using search engine's advanced options can allow you to search through all the pages of a single website. Here is an example of what a few keywords above look like for Boston.gov. In addition to the keywords above, you can do the same treatment for "smart city" vendors that interest you. Here is an example of Clearview AI for NYC.gov. Lastly, you can set up notifications with an alert service for keywords and your city. For example, Madeline Smith and I used several keyword alerts, like "facial recognition technology," on Feedly to power the Whose Streets? Our Streets! Newsletter weekly updates.
Documents: In addition to searching the city website for keywords to uncover current "smart city" tech practices and policies, you can search for specific documents such as contracts, data sharing agreements, and privacy policies. If your city does not post this information proactively, you can request those records (see below). Most importantly, you can look up City Council contact information, meeting times, and meeting minutes to engage your representative on these matters.
Data: In addition to searching the city website for keywords and documents to uncover current "smart city" tech practices and policies, you can search for specific open datasets, including spending data and CCTV location data. If your city does not post this information proactively, you can request those records (see below), or check out third-party sites like EFF's Atlas of Surveillance or if you're in Chicago Lucy Parson Lab's Police Surveillance guide to see if your city's surveillance technologies have been mapped.
Public records access via local Freedom of Information and Right to Know laws are a right available to us all that you should use for your own knowledge and the overall civic health of your community. As part of my research, I conducted 60+ public records requests through the public records service, Muckrock. You can check out the template I used and the records I received back via their public platform, as well as their tips on filing your first records request.
See the types of records received here:
I conducted 62 requests for 30 cities who had smart city projects that had been prominently featured in the news or had submitted to the Department of Transportation Smart City Challenge in 2015. I received back records for about half of my submissions on a wide variety of technologies and document types:
In addition to seeing my work, below are some tips and lessons learned that might help you as you submit "smart city" records requests.
Departments with Records: "Smart city" and other surveillance technologies span departments. I did some sleuthing online (see Watch Your City Website above) before submitting requests to try to get a sense of which department might be procuring or managing the technology I was interested in. Some common departments that I included in my requests: Department of Innovation, Department of Information Technology, Department of Transportation, Department of Public Works, the Mayor's Office, and the Police Department. Generally, Public Works did not have what I was looking for. Otherwise, it depended on the city. I also included in my request a note asking that the receiver kindly point me to the correct department if it is not them if possible. Very rarely, they would point me to the Procurement Department for all contracts. (A note on Muckrock specifically: Many of these departments had never been requested via the Muckrock service before and took some back-in-forth with the Muckrock team to ensure the message was getting through properly. If you choose to use Muckrock for multi-city requests, I recommend following very closely to ensure they have all reached their sender from the beginning.)
Procurement Records: One of the best ways to watch any watcher is to follow the money. For government tech, including "smart city" tech, this means tracking down what the city is buying via contracts. Some cities, like Chicago and Los Angeles, proactively post contract data online, but you may still need a public records request for the full contract record. I asked cities for contracts with any vendor that used a list of "smart city" keywords. This approach did not work as effectively as I had hoped – while it was a specific term to search, often cities could not search across their documents for keywords. It was easier for them to look up vendor names based on their procurement systems. Here is a list of vendor names to get you started. But you may also want to search for vendors that you hear about in other cities in the news. When asking for contracts, you can also specifically request data exchange agreements, proof-of-concept agreements, public-private partnership agreements, license and subscription agreements, privacy policies, and terms of service. It may be helpful to also request lists of contracts or vendor distribution lists for related Requests for Information (RFI) or Requests for Proposals (RFP). Lastly, you may also want to request purchase orders to better understand the spending scheme and overall procurement relationship.
Documentation Records: In addition to procurement records, you may request any records related to how these technologies collect and use information with as much specification as possible. For example, you can request:
any technical documentation (including but not limited to sales brochures, technology manuals, and API/metadata specifications),
any documentation of how public input was incorporated into the procurement and implementation process (including but not limited to public comment analysis, documentation of engagement with the city council, etc.),
any guidelines, manuals, policies, procedures, or agreements, on department use of "smart city" technology and data, (including but not limited to sharing with other government agencies and including the legal standard, if any, e.g., probable cause, court order, relevance, consent, that is required before accessing data from the "smart city" system by law enforcement, and
any audits of the "smart city" technology or data use (including but not limited to: audits of the system, misuse reports, and reports to oversight bodies.)
This is a lot of information and may be flagged as too broad by public records officials, so consider requesting these types of records one at a time or indicate that you are happy to receive records on a rolling basis. While I asked for contracts in my public records research, I did not request documentation regarding those contracts. I would love to see folks follow up on contract data available on Muckrock for more details.
There is no need to watch the watchers alone; there are many organizations that are already doing this work.
Check out: ACLU, Action Center on Race and the Economy, Adversarial Fashion, Amnesty International, Ars Technica, Buzzfeed News, Center for Democracy and Technology, Data 4 Black Lives, EFF, EPIC, Gizmodo, Hiljade.Kamera.rs, The Intercept, Logic Magazine, Lucy Parson Labs, The Markup, MIT Tech Review, OneZero, Propublica, Reclaimyourface.eu, STOP LAPD Spying Coalition, STOP Spying NY, Techdirt, The Verge, VICE, and more in the Whose Streets? Our Streets! Newsletter.
Together we can turn the camera lens in the other direction.
Williams, Rebecca . “Your Guide to Watching the Watchers.” May 25, 2021
