Rialto’s video-surveillance edict puts Big Brother in your building

The delicate balance between government surveillance and individual liberties looms ominously over our digitally connected lives. A recent example shows just how easily the government can stretch its power in dangerous ways.

An investigative report revealed that since 2020, the city of Rialto has required commercial and industrial buildings that are newly constructed or remodeled to install exterior video surveillance cameras and to provide the Rialto Police Department with access to live video streams.

This mandate did not come from an enacted city ordinance that generally requires public hearings and a public vote but by using the city’s Planning Commission to order this action before issuing a “certificate of occupancy” in Rialto’s permit process. This is a massive overstep by government authorities and runs afoul of California’s constitutional commitment to privacy. The requirement should be removed and re-examined with significant community input.

Californians take their privacy seriously. Unlike the U.S. Constitution, the California constitution makes privacy an inalienable right. And California has been a leading pioneer in privacy protection, passing the first comprehensive data privacy law in the United States in 2018, the California Consumer Privacy Act (CCPA). And before the ink was dry on the CCPA, over 9 million Californians voted to pass the California Privacy Rights Act (CPRA), which amended and expanded the CCPA’s privacy protections, including establishing the California Privacy Protection Agency to implement and enforce the law.

There is always a tension between privacy and community safety, but to stay true to California’s privacy-driven standard, any government action that claims to increase community safety ought to have actual evidence supporting those actions.

Studies have shown, however, that surveillance cameras don’t deter most types of crime as a stand-alone solution. That hasn’t stopped law enforcement agencies from creating residential and commercial surveillance camera programs to build a surveillance web in communities across the United States.

These programs are different from Rialto in that they are voluntary. In these instances, community members can choose to share access to their surveillance cameras with their local police department. The Rialto Police Department also has a similar volunteer program for residences and businesses that fall outside the scope of the Planning Commission’s requirements.

If a business owner did not want to share their surveillance video footage with law enforcement, however, officers would have to secure a search warrant in order to view the footage. This is the case across the country. But for some Rialto business owners who only wanted to receive their certificate of occupancy, their right to refuse law enforcement access might be gone.

Some might argue that this is OK because there is no reasonable expectation of privacy in a public area. Generally, that would be correct, but U.S. courts have recently grappled with technology’s impact on a person’s reasonable expectation of privacy in public areas, especially when law enforcement surveils and collects data electronically. Indeed, many courts would likely express skepticism of law enforcement’s mandated constant access to video surveillance cameras. Further, forcing a private business to install surveillance cameras and provide access to their live feed is arguably the same as the government physically occupying private property to obtain information, which would be unconstitutional.

Even outside the pervasive shadows of government surveillance, serious data privacy and security concerns should be considered too. Threats like hackers loom constantly, and video surveillance footage must be stored for an extended period. The risk of unauthorized access or leaks of hours of surveillance footage is undeniable.

Even if data security protections are implemented, there are still risks. Law enforcement networks with large security budgets have been breached, which does not bode well for small businesses with constrained budgets. Any leaked footage can be used in combination with other data sources, like social media, and even synced with facial recognition software to cause significant harm to an individual’s privacy. But internal threats exist too. Even with oversight protections, law enforcement personnel can still misuse databases and access live feeds for non-investigative purposes.

Small businesses and cities like Rialto are the perfect soft targets for bad actors because they are likely under-resourced and ill-prepared for a cyber attack. Using technology to improve community safety is good, and the Rialto Police Department has been at the forefront of this. But even the most praiseworthy efforts can cross constitutional boundaries and need to be reined in, as is clearly the case in Rialto.

Steven Ward is resident privacy and security fellow for R Street Institute’s Cybersecurity and Emerging Threats team. He received a JD from the University of California College of the Law, San Francisco, and has 10 years of law enforcement experience. Write to him at sward@rstreet.org.