Twelve Breakpoints
A governance framework designed to stop one uncertain camera or database event from authorizing historical tracking or a high-risk stop.
Perfect sensors are impossible. High-stakes systems therefore need independent checks, uncertainty disclosure, limited privileges, auditable actions, and fail-safe defaults.
The controls below address different stages. Short retention cannot prevent a dangerous real-time stop. Officer verification cannot prevent a historical movement dossier. Audit logs cannot prevent misuse unless independent institutions inspect them and can impose consequences.
Independent verification
No stop, search, pursuit, or detention based solely on an ALPR alert; verify full plate, issuing state, vehicle make/model, and hot-list currency.
Why: Breaks the sensor-to-force escalation chain
Public reference →High-risk-stop threshold
Treat an alert as an investigative lead rather than probable cause absent corroborating facts.
Why: Reduces automation-bias commission errors
Public reference →Source-data integrity
Require originating agencies to preserve full identifiers, validate unusual plate formats, and promptly remove recovered vehicles.
Why: Prevents local entry defects from becoming national alerts
Public reference →Short retention
Delete non-hit observations on a short statutory schedule unless tied to a documented investigation.
Why: Limits retrospective movement dossiers
Public reference →Warrant for historical search
Require probable-cause warrants for historical movement searches and pattern-of-life analysis.
Why: Applies mosaic privacy principles to network scale
Public reference →Purpose limitation
Enumerate permissible serious-crime and emergency purposes; prohibit immigration, reproductive-health, protest, religion, and generalized identity searches.
Why: Constrains function creep and interstate conflict
Public reference →Network sharing control
Default to no national sharing; require named bilateral agreements, legal review, and recurring reauthorization.
Why: Prevents indirect access that defeats local law and public commitments
Public reference →Tamper-evident audit
Log query, user, case number, purpose, scope, results viewed, export, and downstream action; prevent users from editing reasons after the fact.
Why: Makes misuse investigations possible without treating vague logs as self-policing
Public reference →Independent audit
Publish quarterly aggregate use and error reports; sample queries and resulting stops; investigate outliers and complaints.
Why: Tests actual practice rather than policy text
Public reference →Meaningful remedy
Provide notice, correction, complaint, preservation, exclusion, civil remedy, and discipline pathways.
Why: Converts policy violations into enforceable accountability
Public reference →Procurement transparency
Publicly disclose contracts, camera counts, locations at safe granularity, retention, sharing relationships, training, efficacy claims, and renewals before purchase.
Why: Allows democratic review before infrastructure becomes sunk cost
Public reference →Effectiveness evaluation
Pre-register outcomes and compare against a matched or randomized baseline rather than counting raw alerts or anecdotes.
Why: Separates investigative utility from causal crime-reduction claims
Public reference →Minimum viable chain of corroboration
Before an ALPR alert justifies a stop, an officer should be able to answer:
- Does the complete plate match, including state and plate type?
- Does the vehicle's make, model, color, and body type match?
- Is the hot-list record current, and did the originating agency preserve the full identifier?
- Does the interface disclose omitted characters, confidence, and multiple candidates?
- Is there independent evidence supporting the level of force contemplated?
If the answer is unavailable, uncertainty should slow escalation—not disappear behind a red alert banner.