{"resourceId":"chicago-pd-audits-officer-access-outside-alpr-systems-draft-directive-20261026","versions":[{"version":"external-7e1074b635c01013d50a267e5e746671760fcea29317f5a2ae87507c0e518a3e","resource":{"id":"chicago-pd-audits-officer-access-outside-alpr-systems-draft-directive-20261026","title":"Chicago police audit officers’ use of other agencies’ plate-reader systems, cut access and propose documented-purpose and monthly-audit rules","organization":"Chicago Police Department","sector":"Policing / automated license plate readers","geography":"Chicago, Illinois, United States","publishedAt":"Chicago Sun-Times, Oct. 26, 2026","publicationDate":"2026-10-26","eventDate":"2026-10-26","sourceName":"Chicago Sun-Times","sourceLabel":"CPD probing its potential misuse of outside agencies’ license plate reader systems","sourceUrl":"https://chicago.suntimes.com/news/2026/10/26/flock-cameras-data-police-access-abused-cpd-internal-audit-directive","evidenceClass":"independent-reporting","outcomeClass":"cautionary","topics":["data-security","governance-procurement","operating-model"],"finding":"The Chicago Police Department is auditing whether officers abused access to other law enforcement agencies’ license plate reader systems. It has immediately limited access to outside systems to members whose position and job duties require it, and each of its five bureaus must designate someone to oversee ALPR use, including outside systems. Proposed changes in a draft directive open for public comment through Nov. 12 include non-transferable logins, a documented legitimate law enforcement purpose for every query, monthly search audits, central processing of access requests by the Office of Public Safety Administration, and penalties from loss of access to referral for prosecution. The department did not say what triggered the audit. The article notes felony charges against officers in several Illinois and Wisconsin agencies for Flock misuse and a Will County Board vote on an ALPR ban set for Nov. 12.","sledRelevance":"A large department that does not own Flock still relies on other agencies’ networks, so its controls must cover borrowed access, not just its own cameras.","evidence":"Opened the Sun-Times article and read it in full.","architectureImplications":"Access to outside ALPR networks is per-user; the directive would make credentials non-transferable and require a purpose field on every query.","governanceImplications":"Bureau-level ALPR overseers, monthly audits, central access approval and a graduated penalty scale; draft directive under public comment until Nov. 12.","securityPrivacyImplications":"Shared logins and undocumented queries are the specific weaknesses targeted; misuse cases elsewhere led to felony charges.","caveats":"The department did not explain what prompted the audit or when it will finish; no count of suspected misuse is given. Proposed rules may change after comment. Earlier coverage of CPD’s outside Flock searches (Oct. 7) is archived separately.","streamIds":["public-safety"],"roles":{"sales":"Sales framing: Chicago is tightening officers’ access to other agencies’ plate-reader networks, so the buyer problem is proving every query had a purpose and a named user. Departments that borrow access to neighbours’ systems are the audience. A bounded engagement could be an access and audit design for outside ALPR queries. This article cannot support claims about how much misuse occurred; the department gave no figures.","engineering":"Engineering framing: the controls depend on per-user credentials, a mandatory purpose field and monthly audit exports, across systems the department does not own. Pre-sales should ask whether each outside network can enforce purpose entry and provide user-level logs to Chicago. A proof of value could reconcile one month of outside queries against case numbers, recognising that a purpose field alone does not prove a legitimate purpose.","delivery":"Delivery framing: work includes access recertification, naming bureau overseers, writing the audit procedure and training officers on the directive. The operational owner is the Office of Public Safety Administration with bureau designees. Dependencies include the final directive after Nov. 12 comment. Acceptance criteria are proposals: no shared credentials, purpose recorded on every query, monthly audits completed on time. Risks include outside systems lacking audit features and investigators resisting reduced access."},"roleDetails":{"sales":{"customerProblem":"Large departments need to show that officers’ searches of other agencies’ plate-reader data were authorized and purposeful.","stakeholders":["Police superintendent and bureau chiefs","Office of Public Safety Administration","Inspector general and oversight board","Partner agencies that own the cameras"],"discoveryQuestions":["How many staff have access to outside ALPR systems today?","Can each outside system require a purpose and export user-level logs?","Who reviews audit exceptions?"],"valueHypothesis":"Documented-purpose and audit controls could reduce misuse risk and liability.","potentialEngagement":"Access recertification and audit design for outside ALPR queries in one bureau.","unsupportedClaims":["Any estimate of misuse volume","That the draft directive will be adopted unchanged","That purpose fields prove legitimacy"]},"engineering":{"fit":"Departments relying on other agencies’ networked ALPR systems without owning cameras.","architectureIntegration":"Controls span multiple external platforms; audits require log exports from each.","prerequisites":["Inventory of outside system accounts","Log export access","Case-number linkage"],"constraints":["Draft directive under comment to Nov. 12","External systems controlled by other agencies","No published audit findings"],"security":"Non-transferable credentials, MFA and query purpose logging.","proofOfValue":["Proposed: reconcile one month of queries to case numbers","Proposed: confirm no account is used from multiple users"]},"delivery":{"work":"Recertify access, appoint overseers, set monthly audit routine, train officers.","dependencies":["Final directive","Partner agency cooperation","Audit staffing"],"ownership":"Office of Public Safety Administration with bureau ALPR designees","skillsAdoption":"Officers trained on purpose documentation and penalties.","governanceCheckpoints":["Directive adoption after comment","First monthly audit","Annual access recertification"],"acceptanceCriteria":["Proposed: zero shared credentials","Proposed: purpose recorded on 100% of queries"],"risks":["External systems lack audit features","Investigator workarounds","Audit backlog"]}},"retrievedAt":"2026-10-27T02:51:56Z","enrichedAt":"2026-10-27T02:56:37Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Access is cut back to roles that need it, which may slow investigators who previously ran their own queries.","procurementImplications":"Limited relevance; the controls concern access to other agencies’ systems rather than a purchase.","operatingModelImplications":"Moves access approval to the Office of Public Safety Administration and adds an overseer in each bureau.","sourceVerification":{"openedUrl":"https://chicago.suntimes.com/news/2026/10/26/flock-cameras-data-police-access-abused-cpd-internal-audit-directive","referenceExcerpt":"monthly audits of searches would be conducted","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}