Mike Katz-Lacabe

Apr 302022
 

Flock Safety is marketing its cameras to neighborhood groups and law enforcement with the promise to “reduce crime in your community by up to 70%.” Instead of selling these cameras, it leases them for about $2,500 per month. The cameras can be powered with solar panels and transmit data via a cellular modem so no extra wiring is needed. Note that the version we dissected is an older version and the modem is no longer being sold. Although the cameras capture images that include the license plates of vehicles, they are triggered by a motion detection sensor and will likely capture an image of anything that triggers the motion detector, including people, bicycles, etc.

After opening the Flock Safety camera
After opening the Flock Safety camera, the biggest item is the PHD Energy rechargeable lithium ion battery
NimbeLink Skywire LTE cellular modem in Flock Safety camera
NimbeLink Skywire LTE cellular modem inside Flock Safety camera
Lantronix SD624 Audio Kit SOM inside Flock Safety camera
Lantronix SD624 Audio Kit SOM inside Flock Safety camera
Taoglas AP.17E GPS module inside Flock Safety camera
Taoglas AP.17E GPS module inside Flock Safety camera
LEDs and motion detection sensor in Flock Safety camera
LEDs and motion detection sensor in Flock Safety camera
Another view of LEDs and motion detection sensor in Flock Safety camera
Another view of LEDs and motion detection sensor in Flock Safety camera
5MP 16mm Fixed M12 1/2 Inch IR Filter Action Camera Lens in Flock Safety camera
5MP 16mm Fixed M12 1/2 Inch IR Filter Action Camera Lens in Flock Safety camera
Back of Flock Safety camera showing antenna connector for cellular modem and connector for solar panel
Back of Flock Safety camera showing antenna connector for cellular modem and connector for solar panel

Here’s the list of component parts that we were able to identify:



Jan 152022
 

There are 32 agencies that submit license plate reader data to the Northern California Regional Intelligence Center (NCRIC), the regional fusion center for Northern California. However, many more agencies are able to access that data once it has been sent to the NCRIC.

According to records received in response to a public records request, 71 agencies queried the NCRIC license plate database between February 21 and March 21, 2021. While the agencies looking up license plates at the NCRIC are generally law enforcement agencies located in Northern California, a few of these agencies may stand out as somewhat unusual. The United States Department of Agriculture Office of Inspector General had the 11th highest number of queries to the license plate reader database. Other agencies included the National Park Service, the California Department of Motor Vehicles, and the US Postal Inspection Service.

Other agencies accessing NCRIC’s license plate reader database are to be expected, such as the police departments from the Bay Area’s three largest cities: San Francisco, San Jose, and Oakland. After the three biggest users of the NCRIC license plate reader database, the users vary from Fremont, with an estimated population of 240,000, to cities like Dixon and Atherton, with populations of less than 20,000.

Piedmont, with more than 39 automated license plate readers situated at the border with Oakland, has been one of the three largest submitters of license plate reader data to NCRIC, with 22 million images of vehicles of license plates and vehicles annually. However, during the period from February 21 to March 21, 2021, it didn’t use the NCRIC license plate reader database even once. Vallejo, which submits more than 15 million images of vehicles of license plates and vehicles to NCRIC annually, queried NCRIC’s database just four times in this one month period. Berkeley, which doesn’t submit any license plate reader data to NCRIC, queried the database 61 times during this one month period.

According to records for October 2021, Piedmont queried the NCRIC license plate reader database just once while Vallejo didn’t query the database at all.

A table showing the agencies and the number of queries to the NCRIC license plate reader database for 2/21/21 to 3/21/21 is shown below. Note that queries by a District Attorney’s office may be included for some of the agencies listed, like the San Mateo, Alameda and Solano County Sheriffs. In addition, Danville, which is listed below, is contracting out its policing to the Contra Costa County Sheriff.

AgencyCount
San Francisco PD650
Oakland PD277
San Jose PD230
Fremont PD88
San Mateo Co. Sheriff73
San Leandro PD66
FBI63
Berkeley PD61
California Highway Patrol69
East Bay Parks PD57
USDA OIG51
South San Francisco PD46
Hayward PD31
Newark PD30
Dixon PD30
Marina PD27
Alameda Co. Sheriff26
NCRIC26
Redwood City PD26
Palo Alto PD24
Milpitas PD19
National Park Service18
Chico PD26
CA DMV14
Sunnyvale DPS14
Belmont PD12
Napa PD12
Napa Co. Sheriff13
Monterey PD10
Santa Clara Co. Sheriff9
FBI IC9
Santa Rosa PD8
Daly City PD8
Menlo Park PD8
Hercules PD8
Atherton PD8
Colma PD7
Vacaville PD7
San Mateo PD8
Burlingame PD6
Novato PD6
Santa Clara District Attorney5
Antioch PD5
Morgan Hill PD5
Solano Co. Sheriff5
Union City PD4
Dept. of Homeland Security4
CA Dept. of Justice4
Santa Clara PD4
US Postal Inspection Service4
Conta Costa Co. Sheriff4
Benicia PD4
Vallejo PD4
Mountain View PD4
Stanislaus Co. Sheriff3
Hillsborough PD3
Pleasant Hill PD3
Livermore PD3
Santa Cruz Co. Sheriff3
Foster City PD2
Seaside PD2
Contra Costa Co. DA2
Rocklin PD2
US Dept. of Justice2
Pacifica PD2
Richmond PD1
Sacramento Co. Sheriff1
San Bruno PD1
Tracy PD1
Central Marin PD1
Danville PD1
Agencies using NCRIC License Plate Reader Database from February 21 to March 21, 2021
Jan 032022
 

Although some law enforcement agencies publish data on the number of license plates photographed by license plate readers, few provide information on why police search for license plates. According to a document released by the Northern California Regional Intelligence Center, (NCRIC) the most common search in October 2021 was related to “Locate Stolen, Wanted, or Suspect Vehicles.”

When law enforcement agencies search NCRIC’s license plate database, they select one of six reasons for why they are searching for a license plate in the database:

  • Locate Stolen, Wanted, or Suspect Vehicles
  • Locate Suspect(s) of Criminal Investigation or Arrest Warrant
  • Locate Witnesses or Victims of Violent Crime
  • Locate Missing Children and Elderly individuals (Amber / Silver Alerts)
  • Protect Critical Infrastructure
  • Protect the Public during Special Events / Situational Awareness

For October 2021, 1015 or 67% of the searches were for stolen, wanted or suspect vehicles. The next was common search was to locate suspects with 442 searches or 29%.

The least frequent searches were to locate witnesses or victims with 33 searches (2%), locating people for amber or silver alerts with 12 searches (0.8%), protecting critical infrastructure with 8 searches (0.5%) and protecting the public/situation awareness with 4 searches (0.25%).

NCRIC ALPR Data Warehouse Search Purpose for October 2021

Oct 162020
 

With Harris Corporation no longer selling its cell site simulators to local law enforcement, Anaheim has joined a growing list of police departments replacing them with cell site simulators manufactured by Nyxcell and KeyW.

Nyxcell high power base station for its CSS
Nyxcell base station for its CSS

At a meeting of the Anaheim City Council on June 9, 2020, the Anaheim City Council approved the $755,000 purchase of a Nyxcell cell site simulator (CSS) from Tactical Support Equipment by a vote of 6-0-1, with Councilmember Jose Moreno abstaining because he felt he needed to learn more about how the CSS was used in the past. Although the name of the cell site simulator is redacted in documents, we were able to confirm that it is manufactured by Nyxcell.

Cell site simulators are used by law enforcement to track the location of cellular phones. They work by pretending to be a cell phone tower to which nearby cell phones will connect. Once connected to the CSS, the CSS obtains information unique to the cellular phone that allows it to be tracked. In order to connect to a target cell phone, the CSS is typically installed in a vehicle and once the cell phone is tracked to a general location, a handheld device is used to track the cell phone to a specific room or person. A CSS can also be used to eavesdrop on phone calls and text messages. The EFF has more information about how cell site simulators work.

This item was on the consent portion of the agenda, meaning that it was expected to be passed with a much larger group of items without any discussion at all by the Anaheim City Council. However, Councilmember Denise Barnes asked for the agenda item to be pulled from consent for a staff report. Barnes wanted more information so she could get her “mind around spending this money….on a cell phone site simulator.”

Police Chief Cisneros stated that the cell phone tracking equipment “has been in existence with the Anaheim Police Department since 2008. This will be the third vendor we have used since we began tracking cell phones.” [The other two were DRT and Harris.] According to Cisneros, the equipment was used “for search and rescue, critical missing people, locating injured or suicidal people who are unable to call for help, kidnap or ransom victims, hostage rescues, mass casualty threats, credible hostile threats against churches and religious groups throughout our community, human trafficking, mass murder fugitives… serial rapist investigations, etc.” Cisneros went on to say that the CSS has been used 1200 times in the last four years. However, the staff report stated, “The simulator is utilized an average of 150 times per year.” CSS logs provided in response to a public records request show that the CSS was used 86 times in 2018 and 196 times in 2019.

The reason for the purchase, Cisneros stated, is that “Our current generation of cell phone tracking equipment that we currently have… it is no longer going to be supported after July 2020.” According to the staff report, “The service contract with the existing manufacturer [Harris Corporation] ends in June 2020 and at that time the manufacturer will no longer support the existing equipment, rendering it obsolete.”

Councilmember Barnes asked how many time the equipment had been effective for locating at-risk persons or missing children, Cisneros said he didn’t have that information available. Barnes said that “if we’ve been using this [the CSS] since ’08, I take it that it’s been extremely effective for your department,” although no data was provided to the City Council about its effectiveness. Cisneros notes that Anaheim had to use the existing CSS for the county because of funding it received for the CSS from the Urban Areas Security Initiative (UASI), but now the CSS will be used mainly for Anaheim.

After Barnes moved to pass the item, Councilmember Moreno noted that he had express concerns about the technology that predated Cisneros. Moreno stated that the ACLU raised surveillance, privacy, and civil liberties concerns about CSS devices in 2016. Moreno also noted that the ACLU had to sue Anaheim to obtain public records pertaining to its CSS. Cisneros was happy to note that the policy required obtaining a search warrant before the CSS was used, but failed to note that the requirement for a search warrant was because of the California Electronic Communications Privacy Act, which was signed into law in 2015.

The equipment purchase includes all the tools needed to locate a cellular phone, cellular device, or wi-fi device. It includes an 8-channel base station unit designed to be installed in a vehicle for $518,600, a vehicular location system (which includes software and likely an antenna for the vehicle) for $60,000, a handheld Covert Hostile Emitter Angle Tracker Revised (C-HEATR), “rugged, portable, direction finding (DF) system used to locate RF emitters” for $40,716, and a 3-channel wi-fi direction finder for $60,000.

Supporting documents and audio:

Aug 162020
 

San Ramon, a small city in Contra Costa County with a very low crime rate, approved spending more than $1.2 million to blanket the city in automated license plate readers (ALPRs) and surveillance cameras at its April 28, 2020, meeting.

The amount includes 12 stationary ALPRs at five locations from Vigilant Solutions, 35 ALPRs from Flock Safety and 46 Avigilon surveillance cameras. Eight police vehicles are already equipped with Vigilant ALPRs and Flock Safety cameras are already installed at the intersection of Camino Ramon and Crow Canyon and the northeast intersection of Crow Canyon Boulevard and Crow Canyon Place.

Map of proposed Flock Safety camera locations in San Ramon.
Purple icons represent proposed locations of Flock Safety ALPRs in San Ramon.

According to a presentation by San Ramon Police Lieutenant Cary Goldberg on April 28, 2020, the surveillance cameras would offer “coverage on every route of ingress/egress,” “184 viewing angles throughout out the city” and vehicles would likely pass “multiple cameras when travelling [sic] in San Ramon.”

Map of proposed locations for surveillance cameras in San Ramon.
The video camera icon indicates the proposed locations of surveillance cameras in San Ramon.

Goldberg said that data from Flock Safety cameras can be searched for animals and “If the camera detects an animal in the car, it will bring up that particular picture of the vehicle if it, in fact, captured it.” The data can also be searched for bicycles and people. “If it detects a person in a car, it’s going to show you an image of that person.” Goldberg said the locations were chosen so “we can capture all our routes of ingress, coupled with the situational [surveillance] cameras so we have a virtual fence around the city.”

During the presentation, Goldberg showed an image captured by a Flock Safety ALPR at Crow Canyon Place at Crow Canyon Road of a Honda Odyssey van with its California license plate clearly visible. Another image from the same location at night provided the license plate of a Ford pickup and the fact that the license plate had been seen 13 of the last 26 days (indicating that it was likely driven by a resident of San Ramon). We have redacted the license plate numbers in the presentation produced in response to our public records request.

Each of the Avigilon surveillance cameras actually has four cameras to provide 360-degree coverage. In addition to recording video 24×7, “The officers also have the ability to watch this live. Let’s say if we had an event, we had a protest, whatever the case is, the officers would have the ability to log in to one of these through the software and watch these live, watch any number of these cameras live.” According to Goldberg, a vehicle can be tagged and the software can display any video captured of that vehicle without searching individual camera footage. The software can also generate alerts for unusual motion detection, such as a car crash, according to Goldberg.

Proposed locations for the Vigilant Solutions ALPRs include Dougherty Road, the intersection of Camino Tassajara and Windermere Parkway, Crow Canyon Road, and the intersection of Alcosta Blvd and San Ramon Rd. [Note: The slide describing the Vigilant ALPRs showed an image of 3M ALPRs.]

Data Retention

The presentation to the San Ramon City Council said that the data collected by Vigilant Systems ALPRs would be retained for two years. Data from the Flock Safety ALPRs would be retained for 30 days. Data collected by the Avigilon surveillance cameras would be retained for 30 days. The San Ramon Police Department policy for license plate readers only states that the data will be retained for a minimum of one year. The police didn’t explain the difference in retention periods or the conflict with the existing policy and the City Council didn’t ask. When we asked Lt. Goldberg about why images from the surveillance cameras and Flock license plate readers were retained for 30 days while data captured by Vigilant Solutions license plate readers is retained for two years, he responded (but didn’t explain), “we have continuously maintained a 2 year retention period for the images uploaded into the LEARN [Vigilant Solutions] database.”

San Ramon Councilmember Phil O’Loane raised the only objection, based on the cost of the project, which was nearly double what he was expecting. O’Loane said, “My understanding of where we were starting was stationary license plate readers at key intersections and such and we’ve gone to something between zero and the City of London” noting that San Ramon has one of the lowest crime rates in the state. “I thought we were going to spend six or seven hundred thousand dollars and we’re doubling that. There’s been significant scope creep on this.” “We’ve got the same crime rate we’ve had since I was on the Council on average.” In fact, San Ramon’s crime rate is not only low but has declined significantly in the past 30 years.

The figure below is based on data reported by the San Ramon Police Department to the FBI and represents the annual crime rate per 100,000 people from 1985 to 2018.

Documents:

Jun 272020
 

Police aircraft are frequently spotted circling around peaceful protests around the country. These aircraft are typically equipped with high-powered cameras with equipment capable of recording and transmitting the video captured by the equipment. This article focuses on law enforcement aircraft used in the San Francisco Bay Area.

At a protest one week after San Leandro Police shot and killed Steven Taylor on April 18, 2020, an Oakland Police helicopter with the tail number N220PD was observed circling protesters as they drove to the Walmart where Taylor was killed.

Oakland Police Department McDonnell Douglas 369E helicopter N220PD. Photo by Mike Katz-Lacabe.
Oakland Police Department McDonnell Douglas 369E helicopter N220PD

N220PD has a FLIR 8500 camera that installed in Jan. 2016. According to the manufacturer, the camera has thermal imaging and can auto track a target or scene and point a laser to direct ground forces.

Examples of what the FLIR 8500 camera is capable of can be seen in this promotional video from YouTube.

The Oakland Police Department’s other helicopter, tail number N510PD, also has a FLIR 8500 camera.

Oakland Police Department McDonnell Douglas 369E helicopter N510PD. Source: flickr.com
Oakland Police Department McDonnell Douglas 369E helicopter N510PD

An East Bay Regional Park District Police helicopter with tail number N996PD was seen circling Oakland during protests against police brutality in the wake of the murder of George Floyd in Minneapolis. N996PD has a FLIR U8500XRLP camera that was installed in 2010.

East Bay Regional Park District Police Eurocopter AS350B2 helicopter N996PD. Source: flickr.com
East Bay Regional Park District Police Eurocopter AS350B2 helicopter N996PD

A second East Bay Regional Park District Police helicopter with tail number N708PD also has a FLIR 8500 camera, a high-intensity SX-16 searchlight and a basket/pod attachment for rescues.

East Bay Regional Park District Poice Eurocopter AS350B3 helicopter N708PD. Source: flickr.com
East Bay Regional Park District Police Eurocopter AS350B3 helicopter N708PD

The Alameda County Sheriff’s Office has a Cessna U206G airplane, tail number N5525U, with a FLIR 8500 camera, Avalex AVR8000 digital video recorder, and BMS BMT75-9P Microwave Downlink System.

Alameda County Sheriff Cessna U206G airplane N5525U

The Alameda County Sheriff’s Office will soon have its own helicopter: a Bell Textron 505 Jet Ranger X equipped with a Wescam MX-10 camera system, Trakkabeam TLX Searchlight, AEM 300 watt Loudhailer loudspeaker, and Churchill ARS700 Map System connected to the MX-10 camera and TLX Searchlight. The no-bid $3 million helicopter purchase was approved on October 29, 2019, by the Alameda County Board of Supervisors.

Alameda County Sheriff Bell Textron 505 Jet Ranger X Helicopter N911AC

A California Highway Patrol airplane, tail number N137HP, was also seen circling the George Floyd protests in Oakland in June 2020. This Gippsaero is equipped with a Wescam MX-15 camera, Uniden BCD536HP scanner, and Rho Theta RT-600 Multi-Band Direction Finder.

California Highway Patrol Gippsaero GA8-TC230 airplane N137HP.

According to the manufacturer, the Wescam MX-15 camera is ideal for “covert intelligence, surveillance & reconnaissance,” has thermal imaging, a laser illuminator to highlight targets and can track targets. A demonstration of its capabilities can be seen on YouTube.

The Contra Costa County Sheriff helicopter, tail number N408CC, is a Textron Canada 407, with a FLIR Star Safire 380-HDc camera system with a thermal image infrared sensor. The camera is interfaced to a searchlight slaving system, two video monitors and a Churchill augmented reality system (ARS-600). Like other surveillance cameras, it can automatically track targets. The FLIR Star Safire 380-HDc camera and its capabilities can be seen in this YouTube video.

Contra Costa County Sheriff Bell N408CC Textron Canada 407 helicopter N408CC

The San Jose Police Department helicopter, tail number N408PD, is an Airbus AS 350B3, with a Wescam MX-10 camera, Trakkabeam A800 Searchlight, Churchill ARS700 Map System, and a Power Sonix (“The Sound of Homeland Security”) loudspeaker.

San Jose Police Department Airbus AS350B3 helicopter N408PD
San Jose Police Department Airbus AS350B3 helicopter N408PD

The Sonoma County Sheriff helicopter, tail number N108SC, is a Bell Textron 407 with a Wescam MX-10 camera, Aerocomputers UC6000 digital mapping system, Aero Dynamix night vision imaging system, Luminator HSL-1600 searchlight, and an AEM LS600 loudspeaker.

Sonoma County Sheriff Bell Textron Helicopter N108SC. Source: flickr.com
Sonoma County Sheriff Bell Textron Helicopter N108SC

Note: An earlier version of this article was posted to Oakland Privacy.

May 162020
 

According to a $60,000 grant the Novato Police Department recently received from the Bay Area Urban Areas Security Initiative, new automated license plate readers (ALPRs) will be installed on Highway 37 to track terrorists.

However, no suspected terrorists have been tracked or identified with Novato’s existing ALPRs, which have been in use since 2012. We asked Novato City Manager Adam McGill for information on how many suspected terrorists had been detected or tracked with Novato’s existing ALPRs. McGill forwarded the request to Novato Police Lieutenant Christopher Jacob, who responded, “According to our records, we have not detected any hot plates related to or associated with terrorism.”

The grant application, filed in September 2019, claims that “License plates captured and identified by ALPR can alert authorities to wanted vehicles associated with suspected terrorists…”

“This project will install a 4 camera ALPR system on a preexisting CalTrans traffic operations pole located along the southern edge of US Hwy 37. This route connects US Hwy 101 to US Hwy 80 and serves as the primary route of travel into and between Marin, Sonoma and Solano counties. This location, according to recent CalTrans vehicle census information, has the potential of capturing and identifying no less than 12.7 million license plates a year.”

According to the FY 2016/2017 Proposed Budget and the 2016 Novato Police Annual Report, the existing ALPRs captured 1,195,272 images of vehicles and license plates in 2015 and 1,204,854 in 2016. With an estimated 2018 population of 55,655, that’s more than 26 license plate reads each year for each Novato resident. With an additional 12.7 million license plate reads per year, that would increase to more than 249 license plate reader each year per Novato resident. According to the Novato Police Department policy for ALPRs, the data collected is stored for a minimum of one year.

The 2012 Novato Police Annual Report states that the department received a $20,000 Homeland Security grant for mobile ALPRs to “identify, track and report wanted terrorist suspects and locate other wanted suspects identified by the Department of Justice.” ALPRs were installed on five police vehicles in 2012 and by 2014, an additional police vehicle had ALPRs installed. A mobile ALPR trailer funded by a $36,583.75 grant from the California State Homeland Security Grant Program was added in 2014.

Documents:

Apr 232020
 

On April 21, 2020, the San Leandro City Council was scheduled to consider installing 10 surveillance cameras in areas recommended by the police department. However, the agenda item came the day after San Leandro police shot and killed Steve Taylor at a local Walmart. Publicity surrounding the shooting, including cell phone video from a bystander, led to outrage that may have caused city staff to pull the item off of the agenda.

There are already 12 surveillance cameras installed around the city that were originally used for traffic monitoring, but were converted to surveillance cameras and have been used since at least 2012.

CameraIntersectionMonitoring Streets
1Bancroft / Estudillo AvenueBancroft Ave (north leg)
2Marina / Merced StreetMarina Blvd (east leg)
3Hesperian / Halcyon StreetHesperian Blvd (south leg)
4Hesperian / SpringlakeHesperian Blvd (north leg)
5Marina / Teagarden StreetMarina Blvd (west leg)
6Washington / SpringlakeWashington Ave (south leg)
7E. 14th / Hesperian BlvdE. 14th St (north leg)
8E. 14th / San Leandro BlvdE. 14th St (north leg)
9E. 14th / Davis Street (SR 185-112)Davis St (west leg)
10Davis / Orchard AvenueDavis St (west leg)
11Davis / Polvorosa OverpassDavis St (east leg)
12Davis / San Leandro BlvdSan Leandro (south leg)

The $103,000 cost comes at a time when city revenues from sales taxes and other sources are declining drastically. Cal Matters recently reported, “City hall leaders now face an unsavory menu of service cuts, furloughs and staff reductions.”

For the past 30 years, the crime rate in San Leandro, as in much of the country, has been on a steady decline. This decrease in crime reported by the San Leandro Police Department to the FBI can be seen in the graph below.

On September 3, 2013, the San Leandro Police Chief proposed installing surveillance cameras at the city border with Oakland, citing a reduction in crime observed in Pittsburg after the surveillance cameras were installed. However, analysis of crime data from 2005 to 2010 in San Leandro and Pittsburg showed that crime decreased more in San Leandro, even though it had no surveillance cameras.

The proposed surveillance cameras were previously approved at the Facilities and Technology Committee meeting on March 4, 2020, by Councilmembers Corina Lopez and Deborah Cox. The presentation by the San Leandro Police focused on where crime occurred in the past three years as the basis for the proposed surveillance camera locations. No evidence was provided about the effectiveness of surveillance cameras, but some vague anecdotes were offered about crimes that were solved with the help of existing cameras. Mayor Pauline Cutter was absent from the meeting.

Documents:

Mar 302020
 

The Vallejo Police Department cited ferry terrorism as part of its $30,000 grant application for license plate readers, calling the ferry “a viable threat for a terrorist act.”

According to the grant application, the “Grant Funds will be utilized to establish an ALPR [Automated License Plate Reader] camera system for eastbound and westbound traffic lanes approaching the Ferry Terminal, Ferry Terminal Parking Structure and waterfront.”

Two 3M ALPRs on Glen Cove Road in VallejoThe Vallejo Police Department already has a network of license plate readers in locations around the city. Two of Vallejo’s ALPRs can be found on a pole on the west side of Glen Cove Road, at the Vallejo city line just south of Interstate 780. Two ALPRs are located in front of 4325 Sonoma Boulevard and two ALPRs are located on southbound Fairgrounds Drive at Gateway Drive. The six stationary ALPRs were installed in 2015, along with ALPRs on five police vehicles.

According to information provided to the California State Auditor, 102 of the police department’s 150 employees have access to license plate reader data. The Vallejo Police Department’s ALPRs send the collected images and data to the Northern California Regional Intelligence Center (NCRIC), which retains them for one year and makes it available to dozens of other agencies. In the six months from July 2019 to December 2019, Vallejo sent more than 5 million images collected from its ALPRs to NCRIC.

Vallejo Detective Lieutenant Fabian Rodriguez was listed as the applicant for the grant for the project, which was expected to begin on November 1, 2020 and completed by May 1, 2021.

The regional benefit was described as:

ALPR Cameras to Strengthen Information Sharing and Collaboration of data from Vallejo Ferry Terminal. The Ferry Terminal provides daily commuter transportation from Solano County to San Francisco, with commuters from Napa utilizing the ferry for daily transportation to the Bay Area.

The terrorism nexus was described as:

With thousands of commuters utilizing the Vallejo Ferry system each day to travel to San Francisco, the Ferry is a viable threat for a terrorist act. Installing an ALPR camera system in the area of the Ferry Terminal will assist with identifying potentially wanted terrorist suspect vehicles.

On March 12, 2020, the Bay Area UASI Approval Authority approved a $30,000 grant to the Vallejo Police Department for its “Vallejo PD ALPR” project. When we requested a copy of the grant application, the Vallejo Police Department responded that it has “no responsive documents.” The grant application was disclosed pursuant to a public records request to the Bay Area UASI.

Documents:

Mar 212020
 

On the consent agenda for the March 24, 2020, Vallejo City Council meeting is $766,018 to purchase a KeyW cell site simulator.Vallejo Police Department logo

If approved, Vallejo Police would become the fourth local Bay Area law enforcement agency with this device, after the San Francisco Police Department, San Jose Police Department, and the Alameda County District Attorney (which shares its device with the Oakland Police Department and Fremont Police Department). These other agencies own cell site simulators manufactured by Harris Corporation.

The agenda item includes implementation of a usage and privacy policy, but no policy was provided as part of the background material because the policy will be created at the direction of the Chief of Police, and not by the City Council. California’s Electronic Communications Privacy Act, which went into effect on January 1, 2016, requires that a search warrant be obtained before using a cell site simulator.

Policies in the City of Oakland and Alameda County require annual reporting on the usage of their shared cell site simulator. In 2017, the cell site simulator was used three times, in 2018, it was used four times, and it was used once in 2019. Without public input and city council oversight, Vallejo’s policy is unlikely to require any annual reporting.

A cell site simulator pretends to be a cell phone tower, to which cell phones connect in order to initiate a phone call. Once a cell phone connects to the cell site simulator, the cell phone’s IMSI number can be obtained and used to track the location of the cell phone.

According to the staff report, the cell site simulator will be used by the Crime Reduction Team, which is “tasked with the tracking and apprehension of serious violent offenders, covert surveillance during criminal investigations, human trafficking, and other plain clothes investigative operations…” The desire to obtain a cell site simulator appears to be motivated by an unnamed agency assisting Vallejo by using its own cell site simulator. “In November of 2019, an outside agency used a cellular site simulator for the Vallejo Police Department on several occasions.”

The staff report fails to note that cell site simulators can disrupt “the target cellular device (e.g., cell phone) and other cellular devices in the area might experience a temporary disruption of service from the service provider,” according to guidance from the US Department of Justice. In other words, it could interfere with normal operation of other cellular phones and devices near the cell site simulator, including emergency calls.

The staff report claims that “The equipment does not retain data and is not capable of intercepting and listening to calls, text messages, dialed numbers or any other such content.” However, other cell site simulators are able to eavesdrop on calls and messages and are limited only by the installed software, not the hardware’s capabilities.

The $766,018 price includes the following:

  • $415,000 for the base station
  • $1,400 for two Shark Fin antennas
  • $40,000 for five-day on-site training
  • $60,000 for additional two-year warranty
  • $120,000 for standard vehicle integration (a 2020 Chevrolet Suburban)
  • $32,000 for a Trachea 2 device, a stand alone direction finding system
  • $15,000 for two Jugular 4 devices, a handheld direction finding system
  • $17,760 for two Jugular 4 field kits

The vehicle containing the cell-site simulator (a 2020 Suburban) will drive around to track a cell phone to a building or similar area. Then the handheld Jugular 4 or Trachea 2 devices can be used to track a cell phone to a specific apartment of room. Although little is known about these devices, an earlier version of the Jugular was detailed in a document obtained the Intercept. The Jugular 2 was capable of tracking GSM, CDMA, and UMTS cellular signals. The Jugular 4 and Trachea 2 are likely capable of tracking 4G cellular signals.

The Vallejo City Council meeting takes place on March 24, 2020, at 7pm via teleconference. Since there is no physical access for the public to the meeting, members of the public who wish to comment on the item are required to register to use Open Town Hall at http://www.opentownhall.com/8413.

Documents:

UPDATE: On March 24, 2020, the Vallejo City Council unanimously approved the cell site simulator purchase without discussing potential privacy issues or interruption of cell phone service. Oakland Privacy and the EFF have urged that the cell site simulator purchase be nullified because the Vallejo City Council failed to comply with California state law that requires approval of a privacy and usage policy by the local governing body.