Rules Committee advances most COIT surveillance‑technology policies, holds others for revision

The Rules Committee on Oct. 3 examined a broad package of surveillance‑technology policies developed with the Committee on Information Technology (COIT), advanced most of them to the full Board of Supervisors with a positive recommendation, and set aside several items for further revision and separate review.

Joanne Johnson, COIT staff, told the committee that the city’s surveillance inventory identifies 171 technologies and that 36 technologies had already received board and mayoral approval. "We work with departments to develop impact reports and surveillance technology policies as defined by §19B of the Administrative Code," she said, describing COIT’s surveillance toolkit, advisory board and multi‑step review process.

The committee focused discussion on several substantive points raised by supervisors and agency staff:

- Classification and privacy: Julia Crucio, COIT privacy analyst, described classification levels used in policies ("1 is public information, and 5 is the most sensitive data") and cited NIST and DataSF as informing the framework.

- Airport tenant security cameras: Chair Aaron Peskin pressed airport staff on whether Rule 7 allows live monitoring. Kiabuka Murad (Airport security services) described the rule as enabling "live review" when incident response or regulatory needs demand it but said the intended policy covers review of historic footage. Peskin noted the policy text lacked an explicit exigency limitation and flagged jurisdictional complexity because San Francisco International Airport involves San Mateo County law enforcement and prosecutorial authorities; airport staff agreed to revise the language.

- Elections recordings and retention: Committee members queried an apparent inconsistency in the Elections policy between a 10‑day automatic deletion and a separate statement that some recordings are stored for a minimum of one year. Elections staff said subscriptions that retained recordings had been canceled and that most feeds are now streaming only; staff agreed to fix the policy language.

- Rec & Park body‑worn cameras: Supervisors pushed back on broad "designee" access and on retention phrasing that used a "minimum of 1 year" rather than a limiting maximum. Kristine Nath (Rec & Park CIO) acknowledged typos and said the policy will clarify the named positions with access and make clear body‑worn cameras are not used for live streaming in ordinary operations.

- Tennis reservation app and privacy: Peskin raised privacy concerns with a third‑party booking app whose terms appear to allow data mining, advertising and policy changes. Rec & Park staff said 80 of the city’s roughly 150 courts are bookable online, 70 remain walk‑up only, and the department plans to roll out a call‑in option; staff committed to review third‑party terms and consider alternative approaches.

- ALPR and taxi cameras: SFMTA described automated license plate readers (ALPRs) mounted on city vehicles. Staff said non‑violation ALPR data are retained 14 days; records tied to a parking citation are retained one year to support later contests, even though a citation record can exist for a longer administrative period.

Public commenter David Pilpelt praised the package and encouraged public engagement in COIT and PSAP meetings, and urged departments to update record‑retention schedules to reflect new record types created by the policies.

Committee action: Chair Peskin proposed—and the panel adopted—targeted amendments removing several policies (including the police third‑party camera policy) from the main file, duplicating the item set, and forwarding the amended original file to the full board with a positive recommendation for hearing on Oct. 18. Mirror amendments to the duplicated file retained certain items (for example, Rec & Park body‑worn cameras, airport tenant security and the tennis reservation policy) for further work; the committee voted to continue that duplicated file to Oct. 17 for additional departmental revisions. All recorded committee votes on the package were unanimous.

The committee asked departments to return with clarified policy language—addressing live monitoring/exigency limits, internal vs. external data sharing (including cross‑county issues at the airport), access descriptions for designees, and corrected retention periods—before final board consideration.