From the Public Safety edition of November 9, 2026
Alabama state audit of the Department of Corrections finds at least 100 employees can access plate reader data with no specific-use policy, and records access obstructed
Alabama Department of Public Examiners (ADEPA) and Alabama Department of Corrections; reported by 1819 News · Corrections / automated license plate readers and contract oversight · Alabama, United States
- Publisher
- 1819 News
- Original publication
- 1819 News, Nov. 7, 2026 (Caleb Taylor)
- Source retrieved
- 2026-11-10
- Event date
- 2026-11-06
What happened
1819 News reports that ADEPA released a 367-page audit of the Alabama Department of Corrections central office and Kilby Correctional Facility. On license plate readers installed around prisons for contraband interdiction, auditors say at least 100 employees can access collected data, ADOC could not articulate a procedure for when access is appropriate, full access was granted without management knowing, and audit privileges went to all users. ADEPA recommends role-based access, monitoring and a documented need for each access. The audit also cites distributed, inconsistent contract monitoring, including a vendor contract involving an employee’s family member, and difficulty obtaining records that required a subpoena. The Commissioner disputes the audit’s scope and cautions that samples and a survey of under 5 percent of Kilby inmates are not representative.
Why it matters
A rare government audit of surveillance technology in a corrections setting. It shows access management and contract monitoring gaps that agencies can check before a similar review.
Evidence and measured results
Secondary news account of an audit with quoted findings; agency response disputes scope and sampling; underlying report not opened.
Limitations and uncertainty
Findings quoted from the audit via a news article; ADOC contests parts of the audit; plate reader finding is one section of a broad review; one state.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-10; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- A corrections agency cannot show who may use surveillance data, why, or who monitors the vendor contracts.
- Stakeholders
- Commissioner or director
- General counsel
- Chief information officer
- Contracts office
- Legislative oversight staff
- Discovery questions
- How many staff can access plate reader data and why?
- Who holds audit privileges?
- Who monitors each vendor contract and how are conflicts checked?
- Value hypothesis
- An access and contract review can close the specific gaps auditors flag; cost savings are not claimed.
- Potential engagement
- Three to four week surveillance data access and contract monitoring review for one agency.
- Unsupported claims
- That ADOC staff misused data
- That the audit conclusions are uncontested
- That findings generalize to other states
Pre-sales engineering
Role takeaway
- Fit
- Access control and logging review for plate reader and similar systems; not an accuracy evaluation.
- Architecture and integration
- Tie system roles to job function and require a documented need entry per query.
- Prerequisites
- User and role export
- Query log access
- Current administrative rule on plate readers
- Constraints
- Vendor platform limits on roles
- Audit disputed by agency
- Facility-specific needs vary
- Security
- Least privilege, separate audit privileges and monitor query volume for abuse.
- Proof of value
- Percent of users with documented job need
- Complete query log with stated need for sampled period
Delivery
Role takeaway
- Work
- Run a permission and contract review and deliver a revised access rule and monitoring register.
- Dependencies
- Legal division cooperation
- Vendor role configuration support
- HR input on job functions
- Ownership
- Agency CIO with general counsel and an independent audit owner.
- Skills and adoption
- Train managers on audit duties and users on documenting need.
- Governance checkpoints
- Rule revision approval
- Quarterly access recertification
- Response to oversight body
- Acceptance criteria
- Access limited to roles with job need
- Need documented per query
- Each contract has a named monitor and conflict check
- Risks
- Dispute with auditors slows changes
- Role redesign disrupts operations
- Records access friction repeats
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Plate reader systems need role-based access and per-query logging rather than broad default access, and audit privileges separated from users.
Governance
Who approves, reviews and stays accountable for outcomes?
Written procedures should state when plate reader data may be accessed, require a documented need each time, and assign contract monitoring to accountable owners with conflict checks.
Security and privacy
What data, permissions and controls need testing?
Broad employee access and audit privileges given to all users weaken the ability to detect misuse of location data.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Staff access should follow job duties; the audit notes restricted employee access for auditors and heavy reliance on a legal division gatekeeper, which strains oversight capacity.
Procurement
What should contracts, pricing and exit terms secure?
The audit says contract monitoring is spread across employees, with conflict-of-interest and spending ceiling gaps; contracts need a named monitor and conflict checks.
Operating model
Which teams own the service once it runs?
Responsibility for plate reader rules and audit functions should sit with management separate from users, rather than being shared by default.
Publication history
- 2026-11-09Public Safety · Issue 643 resources
Stable resource ID: alabama-adoc-adepa-audit-alpr-access-100-employees-1819-news-20261107