Loading...
HomeMy WebLinkAbout6.i. Body Worn Camera Biennial Audit 1 EXECUTIVE SUMMARY City Council Regular Meeting: April 18, 2023 AGENDA ITEM: Body Worn Camera Biennial Audit AGENDA SECTION: Consent PREPARED BY: Mikael Dahlstrom, Chief of Police AGENDA NO. 6.i. ATTACHMENTS: 2023 BWC Audit Report APPROVED BY: LJM RECOMMENDED ACTION: Informational update BACKGROUND Minnesota Statute 13.825, Subd. 9, requires law enforcement agencies to arrange for an independent, biennial audit to ensure compliance of Minnesota Statutes 13.825 and 626.8473 which determine how data are classified, used, destroyed, shared and accessed. The results of the audit are public and per statute, must be provided to the “governing body with jurisdiction over the budget of the law enforcement agency, to the Legislative Commission on Data Practices and Personal Data Privacy, and to the chairs and ranking minority members of the committees of the house of representatives and the senate with jurisdiction over data practices and public safety issues no later than 60 days following completion of the audit”. The 2023 BWC Audit Report was completed by Lynn Lembcke of Lynn Lembcke Consulting and is attached for the Council’s review. Only one discrepancy was noted in the section pertaining to Retention of Data where certain categories of BWC data had a retention period of less than 90 days as required by statute. This discrepancy has since been corrected to comply with the statute requirement of 90 days. RECOMMENDATION The 2023 Body Worn Camera Audit Report is attached for the Council review and information. INDEPENDENT AUDIT REPORT Chief Mikael Dahlstrom Rosemount Police Department 2875 145th St. W. Rosemount, MN 55068 Dear Chief Dahlstrom: An independent audit of the Rosemount Police Department’s Portable Recording System (body- worn cameras (BWCs)) was conducted on March 3, 2023. The objective of the audit was to verify Rosemount Police Department’s compliance with Minnesota Statutes §§13.825 and 626.8473. Data elements the audit includes: Minnesota Statute §13.825 • Data Classification • Retention of Data • Access by Data Subjects • Inventory of Portable Recording System Technology • Use of Agency-Issued Portable Recording Systems • Authorization to Access Data • Sharing Among Agencies Minnesota Statute §626.8473 • Public Comment • Body-worn Camera Policy The Rosemount Police Department is located in Dakota County, Minnesota and employs thirty (30) peace officers. The Rosemount Police Department utilizes Axon body-worn cameras and Evidence.com cloud-based evidence management storage. The audit covers the period February 12, 2021, through February 28, 2023. Audit Requirement: Data Classification Determine if the data collected by BWCs are appropriately classified. Rosemount Police Department BWC data is presumptively private. All data collected during the audit period is classified as private or nonpublic data. The Rosemount Police Department had no incidents of the discharge of a firearm by a peace officer, use of force that resulted in substantial bodily harm, requests from data subjects for the data to be made accessible to the public, or court orders directing the agency to release the BWC data to the public. No discrepancies noted. Audit Requirement: Retention of Data Determine if the data collected by BWCs are appropriately retained and destroyed in accordance with statutes. The Rosemount Police Department utilizes the General Records Retention Schedule for Minnesota Cities and agency specified retention periods in Evidence.com. At the conclusion of a BWC recording, officers assign meta data, including an Evidence.com category, to the recording. Each Evidence.com category has an associated retention period. Upon reaching its retention date, evidence is systematically deleted. Deletion of the data is captured in the audit trail. A report was produced from Evidence.com for all BWC data collected during the audit period. Randomly selected records from the Evidence Created Report were reviewed, and the date and time the data was created was verified against the deletion date. Each of the records were deleted or maintained in accordance with the record retention, however retention periods on three categories, Camera Check, False Gunshot Activation, and Squad Check were set to less than the ninety (90) days required by statute. Randomly selected records from the Evidence Created Report were verified against audit trail reports, and each record was deleted or maintained in accordance with the record retention. The Rosemount Police Department had received no requests from data subjects to retain BWC data beyond the applicable retention period. The Records Supervisor monitors BWC data for proper categorization to ensure BWC data are appropriately retained and destroyed. Discrepancy noted. Audit Requirement: Access by Data Subjects Determine if individuals who are the subject of collected data have access to the data, and if the data subject requests a copy of the data, other individuals who do not consent to its release are redacted. BWC data is available to data subjects and access may be requested by submission of a Rosemount Police Department Request for Data Form. During the audit period, the Rosemount Police Department had received no requests to view BWC video but did receive requests for copies of BWC video from data subjects. Data subjects who had not consented to release of the data were redacted. A copy of the redacted video is stored in Evidence.com along with the original copy. The data request is documented in Evidence.com notes and audit trail, and the data request form is retained in the case file. No discrepancies noted. Audit Requirement: Inventory of Portable Recording System Technology Determine the total number of recording devices owned and maintained by the agency; a daily record of the total number of recording devices actually deployed and used by officers, the policies and procedures for use of portable recording systems by required by section 626.8473; and the total amount of recorded audio and video collected by the portable recording system and maintained by the agency, the agency’s retention schedule for the data, the agency’s procedures for destruction of the data, and that the data are available to the public. Rosemount Police Department’s BWC inventory consists of thirty-four (34) devices. An inventory report produced from Evidence.com detailed the total number of recording devices owned and maintained by the agency. The inventory included the device model, serial number, device name, the officer assigned to the device, date of last upload, device status, error status, firmware version, and warranty date. The Rosemount Police Department BWC policy governs the use of portable recording systems by peace officers while in the performance of their duties. The Department’s BWC policy requires officers to conduct a function test of their BWC at the beginning of each shift and to report any failure to his/her supervisor. Peace officers were trained on the use of the portable recording system during implementation. Newly hired officers are trained as part of their field training program. Officers working on randomly selected dates, and randomly selected calls for service, were verified against the Evidence Created Report and confirmed that BWCs are being deployed and officers are wearing and activating their BWCs. A comparison between the total number of BWC videos created per quarter and total calls for shows a consistent collection of BWC data. Evidence.com queries and the Evidence Created Report detail the total amount of BWC data created, stored/maintained, and deleted. The Rosemount Police Department utilizes the General Records Retention Schedule for Minnesota Cities and agency specified retention periods in Evidence.com. BWC video is fully deleted from Evidence.com upon reaching its scheduled deletion date. Meta data and audit trails are maintained in Evidence.com after deletion of BWC audio and video. BWC data is available upon request, and access may be requested by submission of a Rosemount Police Department Request for Data Form. No discrepancies noted. Audit Requirement: Use of Agency-Issued Portable Recording Systems Determine if peace officers are only allowed to use portable recording systems issued and maintained by the officer’s agency. The Rosemount Police Department’s BWC policy states that officers may use only department issued BWCs in the performance of official duties for the agency or when otherwise performing authorized law enforcement services as an employee of the department. No discrepancies noted. Audit Requirement: Authorization to Access Data Determine if the agency complies with sections 13.05, Subd. 5, and 13.055 in the operation of portable recording systems and in maintaining portable recording system data. Supervisors conduct weekly reviews of BWC data to ensure BWCs are being used in compliance with policy. Nonpublic BWC data is only available to persons whose work assignment reasonably requires access to the data. User access to BWC data is managed by the assignment of roles and permissions in Evidence.com. Permissions are based on staff work assignments. Roles and Permissions are administered by the Records Supervisor. Access to Evidence.com is password protected and requires dual authentication. The agency’s BWC Policy governs access to BWC data. Agency personnel may access BWC data only when there is a business need for doing so. Agency personnel are prohibited from accessing BWC data for non-business reasons and from sharing the data for non-law- enforcement-related purposes. User access to data is captured in the audit trail. The BWC policy states that unauthorized access to or disclosure of BWC data may constitute misconduct and subject individuals to disciplinary action and criminal penalties pursuant to Minn. Stat. § 13.09 When BWC data is deleted from Evidence.com, its contents cannot be determined. The Rosemount Police Department has had no security breaches. A BCA CJIS Security audit was conducted in June of 2021. No discrepancies noted. Audit Requirement: Sharing Among Agencies Determine if nonpublic BWC data is shared with other law enforcement agencies, government entities, or federal agencies. The Rosemount Police Department’s BWC policy allows for the sharing of data with other law enforcement agencies for legitimate law enforcement purposes only and for the sharing of data with prosecutors, courts and other criminal justice entities as provided by law. Law enforcement agencies seeking access to BWC data submit a written request. Sharing of data is captured in the audit trail. The Evidence.com Sharing Audit Report provides documentation of shared data. No discrepancies noted. Audit Requirement: Biennial Audit Determine if the agency maintains records showing the date and time the portable recording system data were collected, the applicable classification of the data, how the data are used, and whether data are destroyed as required. Evidence.com and the Evidence Created Report document the date and time portable recording system data were collected and deleted. All BWC data collected during the audit period is classified as private or nonpublic data. The Evidence.com audit trail documents how the data are used. The audit trail is maintained in Evidence.com after deletion of video. The Evidence.com audit trail documents each and every action taken from the creation of the recording to its deletion, as well as access to the audit trail after BWC has been deleted. No discrepancies noted. Audit Requirement: Portable Recording System Vendor Determine if portable recording system data stored in the cloud, is stored in accordance with security requirements of the United States Federal Bureau of Investigation Criminal Justice Information Services Division Security Policy 5.4 or its successor version. An Axon CJIS Compliance White paper outlines the specific security policies and practices for Evidence.com and how they are compliant with the CJIS Security Policy. Axon has signed the CJIS Security Addendum in all states and has performed statewide CJIS-related vendor requirements in Minnesota. Axon has incorporated the CJIS Security Addendum by reference into the Axon Master Services and Purchase Agreement. Axon maintains signed CJIS Security Addendum certification pages for Axon personnel. Authorized Axon personnel are required to complete Level 4 CJIS Security Training upon assignment and biennially thereafter. Axon appears on the BCA Vendor Screening Program list of approved and screened vendors and is vetted in accordance with the security requirements of the United States Federal Bureau of Investigation Criminal Justice Information Services Division Security Policy. No discrepancies noted. Audit Requirement: Public Comment Determine if the law enforcement agency provided an opportunity for public comment before it purchased or implemented a portable recording system and if the governing body with jurisdiction over the budget of the law enforcement agency provided an opportunity for public comment at a regularly scheduled meeting. The Rosemount Police Department solicited for public comment on the City’s website. The Rosemount City Council held a public hearing at their December 17, 2019, meeting. The BWC program was implemented February 12, 2021. No discrepancies noted. Audit Requirement: Body-worn Camera Policy Determine if a written policy governing the use of portable recording systems has been established and is enforced. The Rosemount Police Department has established and enforces a BWC policy. The policy was compared to the requirements of Minn. Stat. § 626.8473. The agency’s policy includes all minimum requirements of Minn. Stat. § 626.8473, Subd. 3. The BWC policy is posted on the agency’s website. No discrepancies noted. This report was prepared exclusively for the City of Rosemount and Rosemount Police Department by Lynn Lembcke Consulting. The findings in this report are impartial and based on information and documentation provided and examined. Dated: April 3, 2023 Lynn Lembcke Consulting ______________________________ Lynn Lembcke