Standard v1.0
The Verified Unsurveilled standard
What a municipality has to demonstrate, what evidence resolves each question, and what has to happen before anyone gets a badge.
Status of this document. Version 1.0 is published as a working research rubric. It has not yet been through legal review, and Unsurveilled will not treat it as a mature certification program until it has. No municipality has been designated under it. 5 have been assessed against it.
The core qualification principle
The standard is deliberately not “no cameras” or “no surveillance technology of any kind.” That test would improperly sweep in legitimate tools — body-worn cameras, building security systems, traffic sensors that do not identify people, and targeted technology used under lawful investigative authority.
The distinction the standard actually draws is this:
Targeted investigation of people, evidence, or events connected to suspected wrongdoing through lawful process is legitimate. Persistent or indiscriminate identification and tracking of the general public is what this standard measures — and what a qualifying community has declined to build.
Two consequences follow. First, the standard is vendor-neutral: ending a contract with one company while retaining equivalent capability from another changes nothing. Second, it is capability-based: a policy that names a product has an expiry date, while one that governs what may be collected, retained, shared, and searched survives the next procurement.
The 12 criteria
A community must demonstrate all of the following, or functionally equivalent protections.
- 01
No persistent mass ALPR program
The municipality does not operate a persistent automated license plate reader program that routinely records ordinary traffic and builds a searchable history of people’s movements.
Evidence examined Municipal code, procurement records, department policy, technology inventory, council minutes.
- 02
No vendor workaround
The municipality has not simply replaced one platform with another providing substantially equivalent dragnet capability.
Evidence examined Procurement records across all vendors, not only the one that attracted public attention.
- 03
No routine access to another agency’s dragnet
The municipality does not evade the standard by routinely querying regional, private, vendor, or neighbouring ALPR databases as a substitute for operating its own network.
Evidence examined Mutual-aid agreements, regional fusion or task-force participation, vendor account access, department policy.
- 04
Targeted investigative exception only under defined lawful authority
Short-term or case-specific use is tied to individualized legal justification, a warrant or court order where required, or a tightly defined exigent circumstance documented by policy.
Evidence examined Written department policy, authorization logs, ordinance text.
- 05
No persistent facial recognition or biometric identification of the public
No persistent facial-recognition or biometric identification system aimed at the general public.
Evidence examined Municipal code, department policy, technology inventory, procurement records.
- 06
No purchase of sensitive historical location data from data brokers
The municipality does not purchase sensitive historical location data to circumvent warrant or court-order requirements.
Evidence examined Procurement records, purchase orders, department policy.
- 07
Democratic control of new surveillance technology
New systems capable of identifying, tracking, or profiling the public require advance public notice, an impact and use policy, and approval by the elected legislative body or an equivalently accountable process.
Evidence examined Surveillance-technology ordinance, council approval records.
- 08
Public surveillance technology inventory
The municipality publishes what surveillance technologies it uses and for what purpose.
Evidence examined Published inventory, currency of the most recent version.
- 09
Retention and deletion limits
Personally identifying surveillance data is minimized and deleted on defined schedules unless legitimately tied to a specific investigation or legal obligation.
Evidence examined Written retention schedule, department policy, contract terms.
- 10
Sharing controls
Sensitive data is not casually pooled, sold, or made broadly searchable by outside agencies; sharing rules and legal standards are public.
Evidence examined Sharing configuration, data-sharing agreements, published policy.
- 11
Annual transparency reporting
The municipality publishes meaningful annual reports covering use, sharing, complaints, audits, policy violations, costs, and material changes.
Evidence examined Published reports and whether they are current and substantive.
- 12
Function-over-brand protection
Policies apply to capabilities rather than vendor names, so future technology cannot bypass the spirit of the standard by changing product labels.
Evidence examined Ordinance and policy text — how the scope clause is written.
Status definitions
These are not tiers, and they are not a rating. Bronze/silver/gold gamification would make the designation easier to earn and less worth having. There is one designation, and everything else describes where an assessment stands.
- Verified
- Every criterion met with cited evidence, review complete, re-review scheduled. Entitled to display the badge.
- Candidate
- Publicly identified as a promising research target. NOT an endorsement and NOT a partial award. No badge may be displayed.
- Under review
- An active assessment, usually waiting on a specific document or a pending policy decision.
- Suspended
- Previously verified; contradictory evidence or a policy change has put the designation in question pending review.
- Formerly verified
- Designation withdrawn. The record and the reason remain public.
- Does not currently qualify
- Assessed against the standard and found not to meet it. The reasons are published.
The audit workflow
No municipality is publicly labelled Verified until every step is complete.
- Inspect current municipal code and resolutions.
- Search procurement and contract records for ALPR and equivalent vendors — all vendors, not one.
- Inspect police policies and technology inventories.
- Inspect annual surveillance reports where required.
- Query Atlas of Surveillance and other external datasets as leads, not as proof.
- Check neighbouring and regional database access and mutual-aid sharing.
- Search council agendas and minutes for recent or pending changes.
- Submit targeted public-records requests for unresolved criteria.
- Send the municipality a factual pre-publication verification summary and invite corrections and evidence.
- Publish the completed rubric and the receipts.
- Schedule a re-review date.
Renewal, suspension, and withdrawal
Verification is renewable, never permanent. Every designated jurisdiction displays its current status, original verification date, most recent review date, next review due date, the version of the standard applied, the public evidence for each criterion, unresolved questions, and a change log.
Verified Unsurveilled status reflects documented municipal policy and practices as of the verification date. Status may be suspended or withdrawn if qualifying policies change or contradictory evidence is discovered.
Anyone may submit contrary evidence. Challenges create a review record. Evidence is evaluated before publication rather than posted as a public accusation.
Relationship to Warrant Required
These are distinct and should not be conflated:
- Warrant Required is a policy campaign about the legal standard for access to sensitive surveillance data, especially historical networked ALPR data.
- Verified Unsurveilled is a broader community designation reflecting an overall privacy posture and the rejection of persistent mass tracking.
A municipality can adopt a warrant requirement and still fail this standard, if it operates a large persistent dragnet network. The warrant requirement constrains access to the archive. The standard asks whether the archive should exist.