# ALPR incident audit checklist

Use this with the Flockwatch field guide at https://flockwatch.hermanity.dev/audit-guide/. It is research guidance, not legal advice. Preserve originals, follow local law and counsel, and redact personal data before publication.

## Immediate preservation

- [ ] Start a timezone-labeled incident timeline.
- [ ] Preserve original photos, video, audio, messages, receipts, citations, court papers, tow/property records, and location history.
- [ ] Record agency, location, unit numbers, names, exact words, and each police action.
- [ ] Ask counsel whether a preservation notice or discovery request is needed.
- [ ] Keep an untouched original set; analyze copies.

## Stop and encounter record

- [ ] CAD/event history and dispatch audio
- [ ] Incident/offense report and supplements
- [ ] Body-worn and dash-camera video
- [ ] Citation, arrest, search, tow, property, force, K-9, and supervisor records as applicable
- [ ] Final disposition, dismissal, release, correction, or complaint record

## ALPR system record

- [ ] Original scene image and cropped plate image
- [ ] OCR output, displayed plate string, candidate list, and confidence if retained
- [ ] Camera ID, camera location, timestamp, timezone, and system clock source
- [ ] Alert creation, transmission, receipt, acknowledgment, and disposition
- [ ] Exact match logic: full, partial, wildcard, normalized, or vehicle-attribute assisted

## Hot-list provenance

- [ ] Source agency and source system
- [ ] Record/case identifier and reason code
- [ ] Entry, update, synchronization, expiration, removal, and correction times
- [ ] Plate state plus vehicle make/model/color/VIN fields used for confirmation
- [ ] Evidence that correction propagated to downstream systems

## Search and access logs

- [ ] User and agency/network identity
- [ ] Query time, purpose, case number, query type, and result count
- [ ] Export/download history and downstream sharing
- [ ] Sharing agreements and network defaults in force on the incident date
- [ ] Deidentified/redacted production requested when raw plate disclosure would invade privacy

## Policy, training, contract, and controls

- [ ] Incident-date verification and alert-response policy
- [ ] Retention, deletion, audit, access-control, and complaint policy
- [ ] User training and authorization records
- [ ] Vendor contract, amendments, data-processing terms, and support records
- [ ] Security/audit reports, complaints, corrective actions, and aggregate disposition reports

## Chain of custody

- [ ] Source URL, agency, custodian, request number, and retrieval date recorded
- [ ] Original filename and byte count recorded
- [ ] SHA-256 hash recorded where practical
- [ ] Every transformation or redaction logged
- [ ] Conflicting timestamps/versions retained as separate records—not overwritten

## Privacy-safe working copy

- [ ] Plate numbers and plate images redacted
- [ ] Home addresses and precise routine travel history removed
- [ ] Faces and unrelated people's identities protected
- [ ] Credentials, tokens, internal links, and access details removed
- [ ] Originals access-controlled; public packet built from redacted copies

## Evidence grade and closeout

- [ ] Every load-bearing claim assigned grade A, B, C, or D
- [ ] Contradictions and missing records listed explicitly
- [ ] Alert, hot-list record, officer verification, police action, and correction kept as separate events
- [ ] No prevalence claim inferred from one or several documented incidents
- [ ] No claim about proprietary vendor accuracy inferred from this audit
- [ ] Legal/privacy review completed before publication