A d v i s o r y G r o u p

OHLEGAdvisoryGroupRecommendations OHLEGAdvisoryGroupMembers EvelynLundbergStratton,Vorys,Sater,Seymour,andPeaseLLP,formerOhio SupremeCourtJustice YvetteMcGeeBrown,JonesDay,formerOhioSupremeCourtJustice ShelbyCountyCommonPleasCourtJudgeJamesStevenson PickawayCountyJuvenileCourtJudgeJanLong UnionCountyProsecutorDavidPhillips LorainCountySheriffPhilStammitti AdministrativeCounseltotheOhioPublicDefenderDanJones GroveCityChiefofPoliceSteveRobinette MontgomeryCountyCoronerDr.KentHarshbarger TheOHLEGAdvisoryGroupisgratefultothefollowinginvitedguestswho appearedbeforeit: DeputyTimWinebrenner,MadisonCountySheriffsOffice DetectiveErikGilleland,DublinPoliceDepartment ProbationOfficerKimberlyChandler,FranklinCounty DetectiveBrianLowe,LancasterPoliceDepartment ProfessorDennisHirsch,CapitalUniversityLawSchool OHLEGTrainingCoordinatorTerryStaderman OHLEGTrainingCoordinatorJillSmall ChiefOperatingOfficerKimberlyMurnieks,OhioAttorneyGeneralsOffice
1

Introduction Technologyplaysanintegralpartinourdailylives,includingworkdoneeveryday bylawenforcementtokeepourcitizenssafe.WhenOhiolawenforcement personneltakeadvantageoftheefficienciesandspeedthattechnologyoffers, thedataneededtohelpsolvecrimescanbesearchedandsortedquickly. Forthepasttenyears,OhiohasoperatedtheOhioLawEnforcementGateway,or OHLEG,auniqueplatformallowinglawenforcementtoaccessandsearch databases.NodatabasesarecreatedthroughOHLEG.Rather,OHLEGprovides accesstoexistingdatabases.Nootherstateorthefederalgovernmenthasa systemquitelikeit. AnewadditiontoOHLEGisfacialrecognitiontechnology.Itisabiometric technologythatmeasurespointsonapersonsfacethatareuniquemuchlike individualfingerprintsareunique.LiketechnologiesthatrelyonDNAor fingerprints,facialrecognitiontechnologyisatoolthathelpslawenforcement identifypeople.Aswemoveforwardwithaddingnewtechnologysuchasfacial recognition,itisimportanttoexaminethesecurityandtechnologybehindOHLEG toensurethesystemisservingasatoolforcriminaljusticepractitionersandnot beingusedimproperly. AttorneyGeneralMikeDeWinecreatedtheOHLEGAdvisoryGrouptoexamine notonlyfacialrecognition,buttheentireOHLEGsystem. Itwasourpleasuretoserveascochairsofthisadvisorygroup,andwebelieve thattherecommendationscontainedinthisreportwillbehelpfultothefuture operationofOHLEGandthecitizensofOhio. Sincerely, YvetteMcGeeBrown EvelynLundbergStratton
2

General TheOHLEGAdvisoryGroupreviewedOHLEGpoliciesandprocedureswitha criticaleye.Thegroupspurposewastoofferrecommendationsthatwould protecttheintegrityofOHLEGandprovideconfidencetothepublicthatsafe guardsareinplacetoprotectthedatathatisaccessiblebycriminaljustice personnel.Tothatend,itisimportantthattherebeinplaceabody,orbodies, whosefunctionitwillbetocontinuallyreviewOHLEGpoliciesandproceduresas thesystemevolves.ToensurethatOHLEGcontinuestooperateinapublicly accountablemanner,thefollowingrecommendationsaremade. Recommendations (1)OHLEGSteeringCommittee:TheauthorityprovidedunderOhioRevisedCode Section109.57(C)(4)shouldbeexercisedandanOHLEGsteeringcommittee shouldbeestablished.Pursuanttothatsection,thecommitteeshouldbe comprisedofcriminaljusticeagencies...thatuse[OHLEG].Thecommittee shouldbetaskedwiththereview,monitoring,training,andupdatingofthe OHLEGandfacialrecognitionpolicies,toincludeongoingreviewofthe implementationoftheserecommendations.Inaddition,thecommitteeshould reviewriskassessmentstothesystemandcontinuetodevelopnewantihacking andsecuritypoliciesasnewthreatsbecomeknown. (2)AdvisoryGrouptotheOHLEGSteeringCommittee:Anadvisorygroup consistingofprofessionalsfromabroadrangeofagencieswithaninterestin OHLEGactivitiesshouldbeestablished.Theadvisorygroupshouldserveasa soundingboardfortheOHLEGSteeringCommitteeandtheAttorneyGeneralas newpoliciesaredeveloped.Theadvisorygroupshouldmeetatleasttwiceayear orasneeded(seecomment1onpage9ofthisreportforanadditionalremark regardingthisrecommendation). (3)OHLEGRecordsRetention:ThelengthoftimeOHLEGsearchinformation needstoberetainedshouldbeassessedandarecordsretentionpolicyforsuch recordsshouldbeestablished.
3

Access Testimonyfrominvitedguestsmadeclearthatnotallcriminaljustice professionalsrequirethesameaccesstothevariousapplicationsofferedthrough OHLEG.However,individualjobresponsibilitiesvarywidelyfromcountyto county,evenwhenjobtitlesareidentical.LimitingOHLEGaccesstoonlythose applicationsnecessarytoperformonesjobdutieswillmitigatetheriskofOHLEG misuse. Ofparticularimportanceisthedistinctionbetweenlawenforcementandnonlaw enforcementagencies.Criminaljusticeprofessionalswhoworkinalaw enforcementagency(i.e.,policeofficersandsheriffsdeputies)requireagreater degreeofOHLEGaccessthanthosewhoworkfornonlawenforcementagencies (i.e.,courtemployees).Forpurposesoftheserecommendations,"law enforcementagency"meansapolicedepartment,theofficeofasheriff,thestate highwaypatrol,acountyprosecutingattorney,orafederal,state,orlocal governmentalbodythatenforcescriminallawsandhasemployeeswhohavea statutorypowerofarrest.SeeOhioRev.Code109.573(A)(8). Recommendations (1)GeneralOHLEGAccess:ThecurrentprojecttotailorOHLEGaccessas determinedbythechiefexecutiveofficerofanorganizationshouldcontinue. OHLEGusersshouldonlyaccesstheinformationtheyneedfortheirjob responsibilities.Thisincludesaccesstoinformationgainedthroughfacial recognitionsearches.Guidelinesandproceduresforimmediatelyremovingaccess andforreportingtoOHLEGwhenanindividualuseristerminated,retires,or otherwisebecomesineligibletoaccessOHLEGhavebeendevelopedandshould beimplementedassoonaspossible. (2)FacialRecognition:AlthoughthegeneralOHLEGaccessrecommendation aboveissufficientforlawenforcementagencies,nonlawenforcementagencies requirestricteraccesstothistechnology.Nonlawenforcementagenciesshould nothaveaccesstoOHLEGfacialrecognitiontechnologywithouttheexpress writtenpermissionoftheSuperintendentoftheBureauofCriminalInvestigation (BCI).
4

(3)JuvenileRecords:AccesstojuvenilerecordsshouldbereferredtotheOHLEG steeringcommittee,whichshouldproceedinconsultationwiththeOhio AssociationofJuvenileCourtJudgesandtheOhioAttorneyGeneralsTaskForce onCriminalJusticeandMentalIllness. (4)OutofStateAccess:Awrittenpolicygoverningaccessbyoutofstate agenciesshouldbedeveloped.SuchapolicyshouldrequireoutofstateOHLEG applicantstoexpresslyconsenttopersonaljurisdictioninMadisonCounty,Ohio. Whenpossible,reciprocalaccesstotheotherjurisdictionsdatabaseshouldbe requested. NodirectaccesstoOHLEGshouldbegrantedtooutofstate,nonlaw enforcementagencies,withouttheexpress,writtenauthorizationofthe SuperintendentofBCI.(ItshouldbenotedthatOHLEGaccesshasnotbeen providedtoanyoutofstate,nonlawenforcementagenciestodate.) (5)ResearchAccess:Awrittenpolicyforentitieswishingtoconductresearch involvingOHLEGshouldbeestablished.Allapplicantsseekingaccesstorecords forresearchpurposesshouldbesubjecttothesametrainingandmisusewarnings asotherOHLEGusers. Training TrainingisanessentialtooltoensurethatusersofOHLEGgainanappreciationfor OHLEGsvalueandunderstandtheresponsibilityassociatedwithitsuseaswellas theconsequencesforitsmisuse.Thedevelopmentofastandardizedtraining programisparamounttoOHLEGreachingitsfullpotentialinapubliclyacceptable manner. Recommendations (1)MandatoryTraining:Amandatory,standardizedtrainingprogramthatisalso gearedtotheaudienceshouldprovidetrainingandprotocols.Suchtrainingcould beofferedonlineprovidedthatcompletioncanbeverified.Trainingshould include:(1)penaltiesformisusewithreallifeexamplesofprosecutionstostress
5

theseriousnessoftheconsequences;and(2)guidelinesforreportingand prosecutinginfractions.Necessarystepstotakeafterdiscoveringmisuseshould beprovided. (2)OngoingUserTraining:PeriodictrainingmodulesthatwouldrequireOHLEG userstoacknowledgereceiptoftrainingupdatesshouldbeimplemented.These trainingmodules,discussedbyBCI,seektoensurecompliancewithandremind usersoftheregulationsfortheuseofOHLEG.Whereappropriate,trainingshould beconductedthrougheOPOTA. (3)SimulatedTrainingPlatform:Atrainingplatformshouldbeestablishedto permituserstopracticesearcheswithoutaccessingofficialrecords. MonitoringOHLEGUse ProactivemonitoringofOHLEGuseisperhapsthemosteffectivemeasureof whetherthesystemisbeingproperlyimplementedforitsintendedcriminal justicepurpose.Whileitisunderstoodthatchiefexecutiveofficersmaynot engageindailyhandsonOHLEGactivity,theyarethepartyresponsiblefor ensuringthattheiragencymeetsthecriminaljusticerequirementssetforthby theAttorneyGeneralsOffice.Delegationofauthorityinordertoimplement OHLEGpoliciesonalocallevelwillnotabsolveCEOsofthisresponsibility. Recommendations (1)GeneralOHLEGAudits:DedicatedOHLEGstaffshouldperformrandomaudits onaregularbasistobesurethereiscompliancewithbothOhiolawandOHLEG policies.Thecurrentprojecttoeasilygenerateacomprehensivelistofallusers thatidentifieseachuserbynameandagencyshouldcontinue. (2)LocalMonitoring:Onepersonshouldbeinchargeofandresponsiblefor monitoringanagencysusage.Thecurrentplantoprovideaclearpolicy regardingdutiesofagencychiefexecutiveofficersshouldcontinue.AgencyCEOs
6

shouldbechargedwithmonitoringwhohasaccess,levelsofaccess,whohas completedtraining,andaccounttermination. (3)ModelOHLEGPolicy:AmodelOHLEGusepolicyforlocalagenciesshouldbe developedandmadeavailabletoallOHLEGuseragencies.Guidelinesfor reportingandprosecutinginfractionsshouldbedeveloped.Necessarystepsto takeafterdiscoveringmisuseshouldbeprovided. PublicEducation PubliceducationaboutinformationfoundinOHLEGcanincreasetheaccuracyof thoserecordswhileimprovingpublicperceptionofthesystem.Forinstance, oftentimesthemostefficientmannerinwhichtoreviewcriminalrecordsfor accuracyistopermitthesubjectofthoserecordsaccess.Inordertoeffectuate thissolution,thepublicmustbemadeawareoftheprocedurethroughwhich individualcriminalhistoriescanbeobtained.If,afterobtainingacopyofhisor hercriminalhistory,anindividualdiscovershisorheridentitywasusedinan unauthorizedmanner,directionastohowtocorrectresultingerrorsinthat criminalhistoryisnecessary. Recommendations (1)MentalHealthRecordsEducation:Lawenforcementshouldbeapprisedofthe availabilityofmentalhealthinformationundertheSuzanneHopperAct. (2)FacialRecognition:Thepublicshouldbeinformedastohowfacialrecognition searchescanbenefitthem.Facialrecognitionsearchesmitigatetheabilityof otherstostealtheiridentitybyimmediatelymatchingafacewithdata.Itcan clearaninnocentpersonwhensomeoneelsehastheirstolendriver'slicenseor otheridentification.
7

(3)ComputerizedCriminalHistories:Thefactthatanyonecanaccesshisorher owncriminalhistorypursuanttoOhioAdministrativeCode109:5101,shouldbe publicizedontheOhioAttorneyGeneralswebsite.TheOhioAttorneyGeneral shouldworkwiththeOhioPublicDefenderandotherswhorepresentthe indigenttoensuretheyareawaretheycanaccesstheirclientscriminalhistories (seecomment2onpage9ofthisreportforanadditionalremarkregardingthis recommendation). (4)CorrectionofErrors:Thepublicshouldbeinformedofhowtocorrecterrors foundinrecordssuchascriminalhistoriesanddriverslicenseinformation. AlthoughrecordsobtainedthroughOHLEGmustbecorrectedbythesourceof thoserecords,thisinformationshouldberelayedtothepublic.
8

CommentsfromIndividualOHLEGAdvisoryGroupMembers 1. ChiefRobinettewouldremovethisrecommendationandbroadenthe descriptionoftheOHLEGSteeringCommittee.Amoreefficientapproach wouldbetoexpresslyauthorizetheOHLEGSteeringCommitteeto,fromtime totime,taketestimonyfrominterestedpartiesonOHLEGpracticesanduse. 2. TheOhioPublicDefendersOfficewouldaugmentthisrecommendationtoadd thatanyOhiocitizenshouldbeabletoaccessandreviewhisorherown criminalhistoryrecordthroughasecureinternetportalusinghisorhersocial securitynumber,inamannersimilartoobtainingaconsumercredithistory checkunderfederalconsumerprotectionlaws,viathewebsite www.AnnualCreditReport.com.Andaswiththecreditreportmodel,once annuallyanyOhiocitizenshouldbeallowedtoaccesshisorherowncriminal historyrecordatnocost.ThisprocesswouldallowOhiocitizenstoreportany errorsoridentitytheftconcernstoBCIand/orthecourtsystem,andthus wouldcontributetothevalidityofthedatabase,ascontemplatedby recommendation(4),above.