No city council ever voted to build a comprehensive surveillance network. What they voted for, across two decades, was a traffic monitoring pilot, a transit safety upgrade, a parking enforcement contract, a set of cameras at a difficult junction, and a grant-funded deployment in a business district.
Each decision was defensible on its own terms. The aggregate was never on any agenda.
Integration is the actual event
For most of their history these systems could not talk to each other. Different vendors, different formats, different retention rules, different departments with different lawyers. That incompatibility functioned as a privacy control — an accidental one, but an effective one.
The last few years have removed it. Unified video management platforms exist specifically to ingest heterogeneous feeds and present them as one searchable surface. The pitch to a city is efficiency and cost, and both are real.
The side effect is that a capability nobody approved comes into existence the moment the integration is switched on: the ability to follow a person across a city, retrospectively, from a single search box.
Retention is where the policy actually lives
Public debate focuses on cameras. The consequential variable is how long the footage lasts.
Seventy-two hours of retention supports incident response — something happened, someone reviews the relevant window. Ninety days supports pattern analysis, which is a categorically different power: where does this person go, when, and with whom.
Retention periods are typically set in procurement documents rather than by legislation, which means the most important privacy parameter in the system is decided by whoever is drafting the contract, usually without a public reading.
The questions worth asking locally
If you want to understand what your own city has built, four questions get you most of the way:
How long is footage kept, and who sets that number? If the answer lives in a vendor contract, it can change without notice.
Which feeds are joined? Separate systems are a meaningful protection. Ask specifically whether transit, traffic, and municipal cameras share a search interface.
What is logged when someone searches? A system that records who queried what, and why, behaves very differently from one that does not. This is the single highest-leverage control available.
Who else can request access? Mutual aid agreements and data-sharing arrangements routinely extend reach far beyond the authority that installed the cameras.
Not an argument against cameras
There are genuine uses. Junctions get safer. Some investigations are resolved. Reasonable people support parts of this.
The argument is about the difference between deciding to build a capability and arriving at one. Almost every city is in the second category, and the fix is not removal. It is writing down what the system is allowed to do, publishing it, and logging every time someone uses it.
That is unexciting governance work. It is also the only thing that turns an accumulation into a decision.
