Another Click2Gov data breach hits Indio, California
October 15, 2018
The online bill payment software used by hundreds of local governments continues to be a frequent source of cybersecurity incidents.
San Francisco area locals who showed up to a public meeting said they were "outraged" and "disgusted" at 12 proposals for new security upgrades on their train system.
Colin Wood is the managing editor of StateScoop. Before that, he was a staff writer for Government Technology magazine. Before that, he taught Engl...
"Opportunistic" was the repeated accusation leveled at the board of the San Francisco area's public-transit system at a public meeting Thursday to determine whether a suite of security proposals totaling more than $28 million should move forward.
The board of directors for Bay Area Rapid Transit, who accelerated work after three homicides last month, concluded more than four hours of discussion by giving the board approval to continue planning the two largest proposals of 12 brought forward by BART General Manager Grace Crunican. They shelved several other proposals, waiting until more public input can be gathered from districts outside of the region's urban core.
"This is a watershed moment for BART. The region is watching. The region depends on BART — hundreds of thousands of riders a day," said Jim Wunderman, CEO of the Bay Area Council, a public policy interest group.
In addition to deciding on next steps for the 12 proposals, the board also approved a motion by Director Nick Josefowitz that Crunican develop a more "holistic" and "coordinated" plan for addressing BART's uptick in violence that asks for input from a broader group of community groups and municipal policymakers, an idea that aligned with public complaints that Crunican's proposals did not address root causes of violence, such as access to mental health treatment. Crunican said she was "committed" to Josefowitz's idea.
Among the two proposals acted on is one for a $15 million project to expand BART's existing video camera system already in stations, parking lots and garages, and convert some 1,500 analog cameras to digital. The upgrade is expected to take four and a half years. The board also approved continued planning for a $5.2 million project to install new emergency call boxes. The board's approvals give Crunican's office the authority to develop more detailed plans, including procurement details, which will require further action by the board before they are implemented.
One local who identified herself as "P.F." said, "I am disgusted by the opportunistic leap for increased state surveillance in the wake of Nia Wilson's murder," referencing the recent fatal stabbing of an 18-year-old African American woman.
Board members voted 7-2 in favor of convening a special evening meeting in a suburban area within the next thirty days to gather input from a different crowd. The motion came following comments from Director Joel Keller, who said the dozens of civil liberties advocates, activists and members of the public who spoke against the GM's proposals at the meeting who cited privacy and discrimination concerns represent "only half the story."
"The people who contact me want a different approach from what apparently a majority of the board and what people have been saying all morning," Keller said. "They want to feel safer. They are scared on our trains. If we don't take more concrete steps to provide immediate safety for our riders, they are going to think we're incompetent and we're morons."
Director Debora Allen agreed with Keller.
"The people who contact me say 'I stopped riding BART today' and the numbers prove that," Allen said. "We have numbers that show our ridership is declining, but the people who spoke here today do not represent the people of my district either."
BART's general manager did not need board permission to carry out five of her proposals, including administrative actions like implementing emergency staffing, which has already begun, launching an increased public education campaign, and heightening promotion of an app called "BART Watch" that allows riders to report suspicious behavior.
The special meeting, the location and exact date of which have not yet been set, will determine the outcome of five remaining proposals that include one of the most contentious — the possible expansion and enhancement of an existing software system that BART security personnel use to manage the transportation network's cameras. Called BART's physical security information management system, or PSIM, the system is described by BART's assistant chief information officer, Travis Engstrom, as a "rules engine" that allows the authority to organize and understand its cameras so administrators can "locate areas of interest and we can integrate them with other fixed alarms, sensors and software."
"When we pull up a camera feed from one of our stations in the dispatch center, we have to know where that camera is physically in the system so we can send resources to that location," Engstrom said. "Many of our cameras look down concrete hallways, they look along tunnels, and they look down fence lines and at staircases, and many of these areas look exactly the same when addressing them through a surveillance system."
Expansion and enhancement of BART's PSIM would cost $1.3 million as currently proposed and extend video analytics capabilities to 2,000 of BART's almost 5,000 existing cameras. Analytics capabilities would also be added the analog camera locations as they are upgraded.
Don Fog, a member of Oakland Privacy, said, "I don't want to be treated like a suspect. Surveilling me, scanning my face, sharing my data or any related data to me and my lifestyle is Orwellian."
Crunican countered the public's opposition to her proposals by pointing out that "the police department is able to regularly make arrests because of clear camera images and passenger alertness."
Though facial recognition is not being proposed, Director Josefowitz said recently he wants to explore the technology, and several members of the public at the meeting said they don't trust the transportation authority to safeguard their personal data in any event.
Victoria Fierce, of East Bay for Everyone, a local nonprofit, warned the board that data collection is akin to stockpiling nuclear waste.
"Data you're collecting about people has a really similar property about it," Fierce said. "Agencies, contracts, systems — they come and go. But information about people retains its power over them as long as it exists, sometimes outliving the people, sometimes outliving the children of those people."
Several who spoke, including Mike Chase, a representative for the Northern California branch of the American Civil Liberties Union, also asked how the transportation authority could ensure that data and video collected wouldn't fall into the hands of other entities, liked federal immigration authorities.
"The answer is not a rushed surveillance proposal … that poses a unique threat to people of color, immigrants and activists," Chase said.
The current process for considering these technologies ignores the spirit of the privacy draft proposal that has been underway the last two years, he said.
Camille Ochoa of the Electronic Frontier Foundation said none of the technology being proposed has been examined closely enough to be approved yet.
"Nia Wilson's murder was horrifying and the board was right to consider security measures," Ochoa said. "No tragedy, however, should justify eroding the rights of riders."
A plan for everyone
The authority's process for managing the proposals repeatedly came under scrutiny during the meeting by both members of the public and Director Rebecca Saltzman who called it "the strangest" set of proposals she had seen during her time on the board. Saltzman asked how she could responsibly make a decision on a proposal without knowing its potential impact or having more than the brief descriptions she was given, which do not delineate clear funding sources.
Brian Hofer, a member of Oakland Privacy, and chair of Oakland's privacy commission, asked for several of the projects, including the camera upgrade proposal that was passed shortly after, to be postponed until further analysis could be performed.
"You don't know what's coming later," Hofer said. "There's nothing in front of you. Is [U.S. Immigration and Customs Enforcement] going to get access to your data? You can't answer that — there's no use-policy. What data will you be collecting? How invasive is it? You don't know — we're not talking about it. You don't greenlight $30 million in taxpayer funds based on two paragraphs of text."
The most common complaint from the public was that the board was exploiting the recent deaths to push forward policy for which it had previously struggled to find approval.
"I'm totally opposed to board's exploitation of the stabbing murder of Nia Wilson by increasing surveillance of all BART riders," said Jackie Barshak of the Democratic Socialists of America. "There's no consideration of my personal privacy rights! You know, I do have civil rights."
While Crunican stayed in the middle of the road on most debates, on the issue of privacy she took a firm stance.
"I don't believe there's an expectation of privacy on the trains and the platforms and the stations," Crunican said. "We are not taking any individual data, so the concern for storage or use by outside agencies should be lessened."
Despite hours of conflict and confusion, Director Josefowitz was able to find consensus among board members at the end of the meeting by suggesting that Crunican should develop a more holistic plan.
Josefowitz found support the general manager herself and from Director Bevan Dufty who said, "Why don't we ask people what we should be doing rather than always trying to bake the cake and present it?"
BART administrators also admitted throughout the meeting that as a transportation authority, its ability to manage sprawling social issues like homelessness, poverty and mental health are sometimes beyond the reach of its core competencies and limited resources.
Several members of the public brought up issues of racial or class discrimination linked to the proposals, such as one proposal that would instate stricter prohibitions against aggressive panhandling. Josefowitz, who rallied for "a safe and vibrant BART system," suggested approaching young men who dance on the train for money and trying to somehow integrate that dancing into a municipal arts program.
Alexander Post, another DSA member, critiqued the proposals as not addressing root causes of violence.
"There are no proposals for mental health specialists in stations," Post said. "There are no proposals for social housing to be built on BART property. There are no proposals for working with local jails to consider the late-night releases of vulnerable people miles away from stations that are closed."
Catherine Huchting, a local woman, said she wanted to see further analysis of how BART police interact with mentally ill passengers.
"I think the biggest problem we have," Huchting said, "is the mentally ill people who are living on the trains need help and there just doesn't seem to be anything here in your proposal that would deal with that."
Update on August 11, 2018: A previous version of this story incorrectly attributed a quote spoken by Director Debora Allen to Director Joel Keller. This has been corrected.
Update on August 13, 2018: This story was updated to clarify the outcome of the meeting and provide the correct spelling of Brian Hofer's name.