How one mayor struggles with balancing privacy and surveillance

Who are you and what is your position?

My name is Libby Schaaf. I am the mayor of my hometown, Oakland, California. I just took office this January. I am very passionate about my city. I’m passionate about civil rights, civil liberties and technology. I’m passionate about all these things, and I really want to use technology responsibly, for good, and I can use everyone’s help in figuring out the way to do that.

Are there principles that guide you when you think about these [privacy and surveillance] issues? You’re in the big chair in the city now. Are there things that when you have law enforcement agencies that come to you and say: "Look, Mayor, we need your permission to do this, or we need these tools to be able to do our jobs." How do you balance those things?

It’s really frustrating. On one hand we have an obligation to use tools that can save lives, can create safety, can prevent harm. And yet at the same time we have an obligation to respect and protect the privacy of the people who live here. And we are not doing a good job of reconciling those two needs. And it’s been frustrating because we really need the brilliant people in this city to help us. Help us not just say "hell no,” to every form of technology that potentially could violate your privacy, but to help answer us the question: How, when, where and why? Because I think we have an obligation to figure out how to responsibly use these tools, and we have not done that.

Does that apply to all of these types of surveillance tools? LPRs? Stingrays, that you mentioned earlier? Does that framework, does that thinking apply to each of those in the same way?

The framework in saying that we need to do better than we’re doing now applies to all of them. Obviously, the appropriate controls are going to be on a case-by-case basis and a tool-by-tool basis. And I’m confident that there are tools that I don’t know about. Technology is changing every day and government, unfortunately, moves just at a snail’s pace. We need not only to kind of change our policies to create protections, but we need to change the process that we have for adopting policies because our process doesn’t move quickly enough to keep up with technological advances.

I try to get information from different sources to create a full picture, not just of the use and policies that we currently have in place, but also of these unintended consequences. And again I’m very thankful to people like [American Civil Liberties Union attorney] Linda Lye who have really helped me understand the full ramifications because what might seem like a simple use scenario when it’s described by officers doesn't always fully capture all the different ways that this information can be fully used.

Last summer, I read Dave Eggers’ book The Circle, and it scared the shit out of me. So that is another part of my underlying concerns as I tread into the perilous waters of balancing taking advantage of technology with protecting privacy.

Does it surprise you when I show you something like this, that the OPD retains this type of information on me? Somebody who has never even had a traffic stop in the City of Oakland. Does that surprise you that this data is kept for this long?

It doesn’t surprise me because I’ve been aware of it since you started publishing your articles. But I can tell you how frustrated I’ve been. Because I have tried to start the process of revising our policies because again, these are well-intended uses of technology with a department that—it’s not in their purview to think about these things, it is in my purview. But it is a very frustrating policy-making atmosphere here with so many competing demands on our time and energy so that process has been frustrating.

I just found an e-mail chain that I started on March 25.

This year?

This year. Because now I’m mayor so that puts me in a different position to say: why haven’t we adopted a policy that limits the retention of data that is not needed for investigations? And there is a long and amusing chain of responses to my inquiry.

I think a lot of people, myself included, would really like to see the city implement that and use the power of your office as a way to further that goal. I think that it would be really interesting if Oakland could come out and say: “Ok, we’ve thought about this, and we’ve talked to our colleagues at the OPD, and we’ve decided that the limits should be…” I think you can make arguments that the limits should be 30 days or 15 days or 60 days or whatever it is, but I think that some limit would be better than no limit, which is what there seems to be right now.

I agree. When I started this inquiry, I was told that we have to complete an inventory of all policies in all departments for us to move forward.

Who told you that?

The City Clerk. So, that was one of the things that has slowed this process down. But that's part of kind of changing the culture in government. Honestly our City Clerk is very forward-thinking. She really is a partner with me in terms of shaking things up a bit in the City of Oakland, particularly around transparency and the use of technology to engage people to make sure that people have access to our information. I mean, I’m sure you know that I sponsored Oakland’s Open Data policy and I’ve been a champion of using technology to make our processes more transparent and to make more data like this available to the public to help us solve our problems, because we can’t do it alone. We need help. And we do need pressure from the outside not just to change our policies but to change our process for policy adoption because that in and of itself is a barrier.

I completely agree with that and I’m glad to hear that your administration is taking that into consideration.

Having previously only requested information about myself—when I went and requested the entire LPR dataset, I was pleasantly surprised that the city came back with the entire dataset. You might know that the Elecronic Frontier Foundation in San Francisco and the ACLU unsuccessfully sued the [Los Angeles Police Department] and the LA County Sheriff’s to get just one week worth of LPR data in Los Angeles. They lost at the Superior Court level and then also at the appellate level and they’re considering whether they’re going to appeal to the California Supreme Court. So as far as I know this is one of or maybe the largest LPR dataset that's been released in California.

You probably know if you read my story, I was also able to accurately guess where Councilmember Kalb lives in North Oakland based solely on looking up his plate in the database. So other people have gone through, using the same public records process that I went through and have asked the city to release it to them. Basically saying: you released it to this one guy, you should release it to us too. And as far as I know, the city has not re-released it to anyone else besides me. And I’m curious if you were aware of that or if there is some other process that those people should go through?

I’m not aware of that and that surprises me. Because under RecordTrac, not only do we create a publicly-accessible website that shows what data requests have been made by anybody in the public but usually when we respond to that request, we—

Make the files public.

Yeah.

That surprises me. We need to figure out a better way of managing public data. It used to be that public data should be made public because there wasn’t that much harm that could come of it. Now that we are collecting so much data, and it can be manipulated and analyzed so easily through technology, we have to have a much bigger conservation about the public nature of data.

[Editor's note: After Ars' interview concluded, Michael Hunt, a member of Schaaf's staff, said that the city would be releasing the entire dataset in short order.]

I agree with you and I look forward to having and continuing that conversation with you and your administration.

One very last thing before we wrap up, and I do appreciate your limited time, you talked earlier about stingrays. This is another surveillance device that I’ve been writing a lot about. And you mentioned, and I would be curious to understand that officially: is it OPD’s policy to always use warrants?

My reporting has shown, as others have around the country, that that is not always the case. In many instances, law enforcement goes to court with a different type of court order, what’s known as a pen register application, which is a lower standard. It does not require probable cause, it requires relevancy of a criminal investigation.

And often times, in that application, almost always, in fact, the application does not mention a stingray, it does not mention what it does, it does not mention how it’s being used and that it’s collecting data on innocent people that happen to be in the vicinity of the target.

So I’m curious, and I can confirm this with the OPD, but do you happen to know if that’s the policy of the OPD?

I apologize that I don’t know the legal distinctions between the different court-ordered permissions for utilizing a tool like this. What I do know is that it is with the permission of the court, that there’s a written document, that they have to make the case for the need for using this particular instrument because there is an actual reason. And so I do know that they have to jump through that hoop. They can’t just willy-nilly just go down the street, using a stingray.

So that, again, it is something that is on my radar—pun fully intended. It’s on my radar screen because it’s another area that is fraught with peril. It is another area that we really need to address and I’m asking people like you to help us. We have many demands on our time and our bandwidth. I have to cut this interview short because I’m going to a funeral. That is the hard reality.

There are so many brilliant minds, particularly here in the Bay Area that are interested in this issue and again, I hope that people are going to help us not just say no, but help us say how, when, why and where. Because we do have an obligation to use technology for good and I think that we can do that responsibly if we adopt the right policies and the right framework for making those policies rapidly.