We started hearing back from the implementers at the last meeting; OPD, PEC, Auditor, and the ER director talked. Now the committee has to decide what to do about what they said. See you at 6:00pm, Thursday, 12 March 2015, at Oakland City Hall.
Joe DeVries from the City Administrator’s office and Brian Hofer of the Ad Hoc Advisory DAC Privacy and Data Retention Committee briefed Oakland’s Public Ethics Commission Monday night and took questions. This is my recap of the PEC’s concerns and my answers where I have them.
The Commissioners raised four issues.
Not really. Let’s do some simple math.
- Fewer employees to get in trouble. The PEC addresses complaints generated by the behavior of the 4000+ City employees. Fewer than five, likely only two or three, will be involved in using the DAC software. That’s 0.1% of the existing workload.
- Few hours of activity. As originally scoped, the DAC would be staffed all day and night year round. Plans changed, funding was cut and now it will be an on-demand service. Oakland Police knew of 98 protests in 2014 and activated the Emergency Operations Center (where the DAC lives) for 14 of them, about 15% of the time. So let’s say they turn on the DAC for a two-hour look-see 85 times a year and for two shifts 15 times. That’s 410 hours of use a year, or 4.7% of the originally planned 8760 hours/year.
- Small geography being watched. Oakland has 806 miles of streets. There fewer than 4 miles of street bordering the Port of Oakland. And it’s not a pedestrian hot spot. So the exposure to people who might have privacy, speech, or assembly concerns is vanishingly small. Less than 0.5% of the DAC’s original beat.
0.1% * 4.7% * 0.5% * 33% is a vanishingly small impact. The DAC’s use and application would have to change radically for enough people to be affected by the DAC to create a material risk to the PEC’s whistleblower pipeline.
New expertise needed. Privacy competence is not required now. PEC staff must master the laws, regulations, and practices for each area where they administer justice. This requires time and training. How could the PEC rapidly become sufficiently knowledgeable and skilled to do a good job without extra headcount and specialized experts?
Assuming even one privacy matter comes before the PEC, this is a fair concern.
Uneven justice for whistleblowers. The new policy calls for three different organizations provide privacy oversight, whistleblower investigations, and public ombudsman services. Today, the PEC and Auditor have different protocols and standards for administering whistleblower investigations. For instance the Auditor’s investigations may be public and optional while the PEC’s investigations are private and mandatory. Their abilities to order operational changes or to punish are different. Could we see different outcomes for the same issue depending on who the whistleblower calls?
Good question. The Policy doesn’t address this. Suggestions?
Duplication of effort. Do we really want to build the oversight, ombudsman, and whistleblower capacity three times?
It’s their duty. Government abuse of the federal and state constitutions or of the City’s charter is within scope for the PEC, City Auditor, and the new privacy committee/commission.
Variety works. City staff and the public perceive real differences between the PEC, Auditor, and the privacy group. The Auditor’s office is known for public crackdowns on waste and poor management. The PEC is known for adeptly resolving conflicts of interest and employee relations investigations. And the privacy group may be known for a focus on civil liberties. Each brand will appeal to different employees in different situations. So they are more likely, as a whole, to report abuse to someone.
Those are my answers and explanations so far. And they’re rough and incomplete, perhaps outright wrong. Are there better answers? Better questions? Or better ways of framing the problems? Chime in.
See you at 6pm tonight at City Hall, room 4 (second floor). Focus: implementation feedback from those who’ll have to make the policy work. Where-the-rubber-meets-the-road talk.
- DAC Advisory Committee Meeting Agenda 022615
- DAC Privacy and Data Retention Policy 020515 (what we proposed)
- Final DAC Council Report 012815 (explaining what we proposed)
From Joe DeVries:
I am pleased to announce that we will have several guests to discuss certain components of the draft Policy and the additional recommendations that the Advisory Committee is recommending to the City Council. The guests include our Newly Elected City Auditor Brenda Roberts, the Executive Director of our Public Ethics Commission, Whitney Barazoto, and the City’s Employee Relations Manager, Renee Mayne. Also available will be our EOC Acting Manager, Deputy Chief David Downing from OPD, and other city support staff to further discuss issues raised about the Policy.
Agenda (UPDATED WITH A FEW NOTES LATER THAT NIGHT)
- 6:00pm: Call to Order, determination of Quorum
- 6:05pm: Recap of discussion and action taken by the City Council Public Safety Committee on February 10th.
- Public Comment Period with Website Presence
- Concerns around Staffing of DAC and Auditing Procedures
- Return on April 14th, 2015
- 6:15: Discussion with City Auditor Brenda Roberts regarding the Auditor’s role in the Policy
ROUGH NOTES IN MY WORDS: The City Auditor’s office is independent, so can’t be compelled what to audit or when to perform them. The Auditor will prioritize auditing what goes on at the DAC against everything else the City does, weighing the cost, time, and impact of the systems and services being audited. So, if the Council wants regularly scheduled audits to confirm that the system is being well supervised and remains aligned with the Policy’s privacy protection and liability avoidance purposes, then the City should hire an outside auditor.
The City Auditor operates a whistleblower hotline. All calls receive at least a preliminary investigation.
- 6:40: Discussion with the Public Ethics Commission regarding their role in the Policy (Executive Director, Whitney Barazoto)
ROUGH NOTES: A few concerns about the scale of DAC-related whistleblower activity the PEC might face without additional headcount.
The next PEC meeting (Monday, 2 March, 6:30pm Hearing Room 1) will include a presentation and Q&A with DeVries and Hofer about the Policy. From Monday’s agenda… (pdf)
- 7:00: Discussion with the City’s Employee Relations Manager (Renee Mayne) regarding the impact of the proposed penalties for violations of the Policy.
ROUGH NOTES: “Employees shall follow laws with punishments up to and including termination” is common boilerplate. “Just cause” is the standard for discipline; its seven elements: fair, reasonable, known, consistent, investigation, fair investigation (and one more). employees have a property right and a due process right in their jobs.
For any change to employee penalties, unions and their bargaining units must agree to be bound by those new terms of employment. Failing that, an issue goes to arbitration. Although the City is entering collective bargaining talks, the Policy’s new terms will not be part of the negotiation.
- 7:30: Discussion with Deputy Chief Downing (OPD) and Cathey Eide (EOC), and Ahsan Baig (ITD) regarding functional concerns about the Policy and/or external recommendations to the Policy.
NOTES: Wants covering peaceful marches and protests to be an “acceptable use.” Same for planned “special events” like marathons and Presidential visits.
- 7:50: Next Steps/Adjournment.
We’re responding to comments and recommended edits from the City Attorney’s office on Thursday, 8 January 2015.
From there, our recommendations and those of the City Attorney will go the Public Safety Committee. They will make their own edits, incorporate some or all of the CA’s edits, and listen to public comment and perhaps incorporate more changes from them. They’ll send a their flavor of the policy on to the full City Council.
So this Thursday may be the last meeting of the committee.
Action: If you want anything changed or explained, I need them before Sunday 4 January at noon (pwolff at gmail or @evanwolf) so I can get them to Joe in time for official distribution on Monday before Thursday’s meeting (public notice rules).
Action: Please point out the most confusing parts.
Action: Please point out any factual errors.
Thanks. – Phil
Where boring meets important. 😉 How should we balance the City’s needs for surveillance during a crisis vs Oaklanders’ year-round constitutional rights as we craft Oakland’s Domain Awareness Center’s privacy and data retention policy? P.S. We meet 2nd and 4th Thursdays.