Fighting High-Tech Government Surveillance

Through a year-long public records investigation, we uncovered records including flight logs and actual aerial surveillance footage that show California Highway Patrol (CHP) spying on protesters for racial justice in more than 25 cities up and down the state. CHP recorded hours of video footage of peaceful protests and people calling for justice.

For decades, the ACLU of Northern California has fought back against discriminatory and dangerous state surveillance in San Francisco. Read a chronicle of the movement. An amici curiae brief in our case Williams vs. SF includes a retrospective of police surveillance of residents and activists in San Francisco.

For too long, police have secretly purchased the latest surveillance technologies from profit-hungry tech companies, tightening their grip communities at the expense of civil rights and public safety. In 2014, we launched a model local surveillance ordinance and a statewide surveillance campaign.

The surveillance ordinance equips local activists with new tools to expose and organize against police surveillance. Working with coalition partners, we have passed surveillance ordinance legislation in California communities, including Santa Clara County, Oakland, Palo Alto, Berkeley, Davis, BART, and San Francisco. In 2016, ACLU National expanded the California surveillance ordinance campaign into the nationwide campaign known as Community Control Over Police Surveillance (CCOPS). As of November 2021, 23 cities and counties across the United States have adopted surveillance laws and the Harvard Kennedy School of Government recognized it as a top technology and public purpose project in the world for 2021.

In 2020, we released a toolkit in conjunction with Oakland Privacy summarizing many of the lessons we have learned about how to effectively fight against local surveillance and pass robust surveillance ordinances. This toolkit is designed for anyone who wants to start their own local campaign to fight back against government surveillance and features model legislation, template letters, requests, and other useful documents.

Using records obtained via public records requests, we revealed that Amazon was selling face recognition software to police departments across the United States. In 2018 and 2019, the a coalition of over 85 racial justice, faith, and civil, human, and immigrants’ rights groups sent letters to Microsoft, Amazon, and Google demanding the companies commit not to sell face surveillance technology to the government. We also delivered more than 500,000 petitions to Amazon and supported shareholder actions pushing the company to stop selling face recognition to law enforcement. In 2020, Amazon announced a moratorium on the sales of face recognition technology to law enforcement, which the company extended indefinitely in 2021. We also advocated to Facebook for more than a decade about the lack of privacy protections for Facebook photos and the dangers of face recognition. In 2021, Facebook finally announced plans to shut down its face-recognition system and delete the faceprints of more than 1 billion people citing “societal concern.”

Following the groundbreaking work by Joy Buolamwini and Timnit Gibru that revealed the widespread racial bias and accuracy problems plaguing face recognition systems, we built our own test of Amazon’s Rekognition face recognition technology, using it to scan the images of members of Congress and the California legislature. In both cases, Amazon’s facial recognition system incorrectly and falsely matched lawmakers with mugshot images, sparking critical legislative debate and the subsequent introduction of a moratorium bill in Congress and passage of numerous state laws including California AB 1215.

We organized and led the coalition effort to pass San Francisco’s historic ban on the government acquisition and use of facial recognition surveillance technology, the first law of its kind. That victory helped spark a nationwide local movement against government face surveillance -- as part of ACLU-led campaigns, more than 20 cities and counties have passed bans on facial recognition. The ACLU and partners have called on Congress and President Biden to support the moratorium on the federal government’s use of the technology.

Our statewide public records investigation uncovered the widespread use of social media surveillance software by police agencies in California.

We followed-up on a tip from a local community member in Fresno and learned that police in Fresno and in many other communities were using invasive social media surveillance software. The vendors of these surveillance products marketed their software as a way to track Black Lives Matter, target union activists, and assign “threat” levels to individuals based on opaque algorithms and potentially inaccurate information.

Our investigation also revealed these surveillance vendors had obtained privileged access to user information on Facebook, Twitter, and Instagram. Working together with Media Justice and Color of Change, we successfully advocated for the social media networks to cut ties with the social media surveillance companies and for Facebook and Twitter to adopt new worldwide rules to better protect billions of people around the world from government surveillance.

In 2023, we saw that social-media surveillance companies were marketing themselves as having privileged access to information from Meta (formerly Facebook) and X (formerly Twitter). Joining with the Brennan Center for Justice, we called for an investigation by the FTC to determine whether the companies were keeping their promises.

We have been a leader in partnering with shareholders to force companies to admit and address how they are facilitating government surveillance. We collaborated with shareholders in filing shareholder proposals with Verizon and AT&T, successfully forcing both Verizon and AT&T to issue their first “transparency reports” detailing government demands for customer information. In 2019, we stood in support of a shareholder proposal urging Amazon to prohibit the sale of Rekognition, its face surveillance technology, and have also stood in support of subsequent shareholder efforts at Amazon and Microsoft and other companies.

We helped spark a national and international conversation about the privacy and security dangers of radio frequency identification (RFID) technology and stop it from being used in government identification documents including Real ID licenses.

We worked with EFF to lead the effort to support parents in Sutter, California who made international news in successfully pushing back on the use of RFID technology on their schoolchildren, we supported the ability of security researchers to talk about the dangers of RFID technology, and passed landmark California privacy laws on RFID technology. You can read more about the RFID Privacy Campaign in the article Rights Chipped Away: RFID and Identification Documents.

We developed the Demand Your dotRights campaign to help people understand and connect the dots between the vast amounts of personal information collected by tech companies and how outdated state and federal privacy law allows the government to reach in and access this sensitive information for government surveillance.

Through this campaign, people have powered privacy change across many sectors, including the passage of landmark California privacy laws including the California Electronic Communications Privacy Act (CalECPA), the Reader Privacy Act, and the introduction of the California Right to Know Act.

Fact sheets are available to learn more and connect the dots about how Big Tech collects, shares, and uses personal information – and take action to demand bold, new privacy protections that make technology work for the people, not against us. You can also read white papers exploring the privacy threats of metadata, cloud computing, and location services.

We filed a letter supporting the Electronic Frontier Foundation’s request to the California Supreme Court to review a Court of Appeals decision that inappropriately limited public access to the facts and evidence underlying the governments’ use of cell-site simulators. Cell-site simulators (also known as Stingrays) pose real harms to people in California. Our letter highlights the structural role transparency plays fueling the organizing, activism, and legislation around surveillance technology that has put real protections in place, including CalECPA, ordinances around the country, and bans on face surveillance. Finally, we emphasized  that the affidavits must be available to the public because police lie. Allowing complete sealing of those affidavits deprives the public of the opportunity to test the veracity of law-enforcement claims and bring some measure of accountability when those claims are untrue.

Along with our partners Electronic Frontier Foundation and ACLU National, we filed an amicus brief in the Ninth Circuit Court of Appeals outlining the importance to the public of access to legal arguments and opinions relating to the government’s surveillance efforts.

We filed suit on behalf of community activists against Marin County Sheriff Robert Doyle for his practice of illegally sharing millions of local drivers’ license plate numbers and location data with hundreds of federal and out-of-state agencies, including Immigration and Customs Enforcement and Customs and Border Patrol. Since at least 2014, the Marin County Sheriff’s Office has shared and transferred the sensitive location information of its residents and people who travel through its boundaries with these agencies—a practice that violates two California laws, endangers the safety and privacy of local immigrant communities, and facilitates.

Along with our partners the Immigrant Defense Project, Just Futures Law, and Mijente, we filed FOIA requests seeking records of the Department of Homeland Security, Immigration and Customs Enforcement, and Customs and Border Protection's use of Clearview AI's face surveillance system. When none of the agencies responded substantively to our FOIA requests we sued.

We sued the San Francisco Police Department for violating the City’s surveillance technology ordinance by obtaining and using a live link to a vast network of surveillance cameras aimed at San Francisco’s streets and racial justice protesters.

We filed suit against the City of LA and Department of Transportation (LADOT) asserting violations of the Fourth Amendment and the California Electronic Communications Privacy Act (CalECPA), and seeking an injunction to end all prospective collection, storage, or maintenance of precise location data acquired through the Mobility Data Specification (MDS), a software tool that uses GPS data to automatically track the precise movement of every scooter rider in the city.

We have been involved in several cases to help defend and promote CalECPA privacy rights.

People v. Meza

In 2023 we filed an amicus letter in support of a petition for review to the California Supreme Court, asking the Court to correct serious constitutional and statutory defects in an overbroad reverse-location search warrant. Geofence warrants are a surveillance technique that law enforcement uses to comb through millions of people’s location history records in order to identify people near a geographic area during a period of time. In this case, the warrant likely swept in a large number of people going about their daily lives with no connection to the crime under investigation. Our brief argued that the Court of Appeal misinterpreted the CalECPA by reading core protections in the law out of existence. We also argued that the court wrongly concluded that the good-faith exception to the exclusionary rule under the Fourth Amendment applied, with reasoning that would allow law enforcement using novel surveillance technology to violate people’s rights with impunity.

In re Search Warrant for All Records Associated with Google Account Scottarcla@gmail.com

In 2019 the Los Angeles County Sheriff’s Department sought and was granted a warrant giving them access to the entirety of a person’s Google Account. Accessing an entire Google account allows the government to comb through essentially every private, sensitive, intimate, or personal detail of a person’s life: every username, all account activity, every password, every text message, every email, every physical location (no matter the source), every calendar entry, every personal contact, every document, every piece of financial information, every photograph, every mobile app, every search, every call, and every purchase. In 2020 we filed an amicus brief in this case in support of petitioner's motion to quash a search warrant granted in violation of CalECPA. The court granted the motion and ordered the Los Angeles County Sheriff’s Department to destroy all information wrongfully obtained with the warrant.

Klugman v. The Superior Court of Monterey County

In 2018 when the Sixth District Court of Appeal denied the defense’s writ seeking suppression in this case, we filed a letter brief in support of review by the California Supreme Court. The Court granted the petition and directed the court of appeal to issue an opinion addressing whether CalECPA suppression motions must be filed within 60 days of arraignment. We filed an amicus brief supporting CalECPA’s unequivocal suppression remedy, and another in 2019 arguing that all violations of CalECPA must result in suppression. Later in 2019 we filed second letter brief supporting petitioner’s request for review to the California Supreme Court and requesting that the court of appeal’s decision be de-published. The Supreme Court ordered the court of appeal opinion at issue de-published.

We sued the federal government under the Freedom of Information Act (FOIA) for information on its social media surveillance activities, including practices to monitor immigrants and visa applicants under former President Trump’s “extreme vetting” initiative.

We filed a FOIA case with the ACLU National Security Project seeking to obtain 31-page Department of Justice memorandum for federal prosecutors that describes the national security surveillance notice policy related to criminal and foreign-intelligence wiretaps.

We have represented multiple travelers whose digital devices were searched at the border and ports of entry by federal agents. The ACLU Speech, Privacy, and Technology project, along with the Electronic Frontier Foundation, are currently litigating a case in federal court on behalf of diverse travelers challenging the constitutionality of the governments warrantless digital border searches.

In November 2018 in partnership with the ACLU Speech, Privacy, and Technology Project and Electronic Frontier Foundation, we filed a motion to unseal a secret judicial ruling that reportedly prevented the Department of Justice from securing a court order to force Facebook to wiretap encrypted voice conversations on Facebook Messenger.

We submitted an amicus brief and helped argue the case to the California Supreme Court, urging the court to protect the rights of youth probationers by limiting the ability of government agents to conduct searches of their digital devices. The Court issued an important opinion in August 2019 that limits the use of these search conditions and better protects the rights of young people who are pulled into the criminal justice system.

We submitted an amicus brief in this case urging the California Supreme Court to declare that the California Public Records Act (CPRA), applies to and requires disclosure of records about the government’s business created on personal devices. On March 2, 2017, the Court released a unanimous decision holding that when a city employee uses a personal account to communicate about the public’s business, those writings may be subject to the CPRA.

We sued the Department of Justice under the FOIA law seeking information about the federal government’s use of location tracking technology to monitor and surveil suspects. In January 2018, the Ninth Circuit issued an important ruling in our favor and resulting in the release of important documents.

Along with a wide coalition of civil rights organizations we successfully opposed AB 642, which would have endorsed and expanded police use of facial recognition technology (FRT). AB 642 would have provided legislative authorization for unprecedented mass surveillance systems in communities, exacerbating racial profiling and eroding the civil rights and safety of Californians. The bill explicitly allowed for “real time” surveillance of entire areas, exposing entire populations and marginalized communities to tracking and targeting. The bill also condoned the creation of large biometric databases that would be vulnerable to demands from ICE and other agencies, posing a significant threat to Californians.

Along with a wide coalition of civil rights organizations we successfully opposed AB 2261 that would have enabled the expanded government and corporate use of facial recognition and legitimized new dangerous forms of surveillance use that technology. The bill would have allowed companies to use face scans to deny people jobs, financial services, health care, and even basic necessities. It did not provide workers with recourse if their employers use face recognition to scan, identify, or track them in the workplace. The bill also permitted companies to sell face recognition technology to law enforcement even when they know their tech to be flawed and racially biased.

We sponsored AB 1215 and we successfully spearheaded the passage of this law imposing a three-year ban on California law enforcement using face and other biometric surveillance technology in connection with officer-worn or carried cameras. Body cameras were promised as a way to hold police accountable, not as surveillance systems to be used against the public. AB 1215 recognizes that face-scanning body cameras would be a dangerous, radical expansion of police powers at a time when our top priority should be creating new approaches to public safety that work for all of us.

We sponsored and spearheaded the passage of the California Electronic Communications Privacy Act (CalECPA), CalECPA requires that any California government entity obtain a warrant to demand electronic communications information from a service provider or search any electronic device. CalECPA protects all electronic information, including emails, text messages, location information and metadata. And has robust enforcement mechanisms, including a suppression remedy. Our team continues working to ensure the law is followed and effectively enforced in the courts

We sponsored the Reader Privacy Act of 2011 (SB 602) and we successfully spearheaded the passage of this law to bring reader privacy laws into the digital age. The law requires the government and civil litigants demonstrate a compelling interest in obtaining reader records and show that the information contained in those records cannot be obtained by less intrusive means. The Act also creates greater transparency about how often reading records are disclosed, requiring providers of digital book services to record each request for reader records, and to publish an annual report detailing the total number of requests received.

We spearheaded the passage of SB 31, the first bill in the country to safeguard against the privacy and security threats of Radio Frequency Identification (RFID) technology.

This Toolkit describes the methods and strategies you can use to uncover local surveillance programs, organize and build political power around issues of surveillance, and effectively push for policy and legal reforms. The accompanying Appendix contains dozens of sample documents, letters, and other materials you can customize for your own surveillance reform campaign.

This guide provides a step-by-step framework to approach surveillance proposals, properly evaluate their true costs, and develop policies that provide transparency, oversight, and accountability. The guide concludes with model language for policymakers to adopt to make sure the right process is used every time a surveillance proposal is considered.

This report draws from real life case studies, discusses the civil rights threats of “smart” cities, and is designed to help planners, public officials, and community members assess the promises and drawbacks of city projects and products.

In the modern world, the fact that information is not labeled as “content” — whether it’s GPS coordinates or an IP address — does not mean it is non-sensitive or capable of revealing sensitive details about our lives. This report examines how outdated laws and new technologies combine to put personal privacy at risk.

This report walks communities through the questions that need to be asked and answered when any surveillance technology is being considered.

Information that goes into the cloud doesn't necessarily stay there. This report examines the privacy concerns that arise from the use of cloud computing services and the privacy protections for consumers of these services.

Location based services can collect information about not only where we go, but who we know, what we do, and who we are. This report discusses privacy threats for location-based services.

This report assesses the early stages of government-funded video surveillance cameras and video surveillance in California and includes findings from a public records survey. The report looks at the threat posed by public video surveillance to privacy and other civil liberties, how law enforcement seeks to justify video surveillance programs and their real effectiveness, and policy recommendations.