GARI

Mr. Maass,

Your request for public records has been received and is being processed. Please allow up to 30 days for the records to be gathered and reviewed. Thank you.

Cynthia Forbes, Legal Counsel

Indiana State Police

317-234-4217

December 7, 2015
Indiana State Police

Dear Custodian of Records/Public Records Coordinator,

I am collaborating with the Electronic Frontier Foundation, a public interest group, and the media organization MuckRock, to survey how law enforcement agencies deploy mobile biometric technologies.

Pursuant to Indiana Access to Public Records Act, I request the following records pertaining to the Gang Graffiti/ Tattoo Automatic Recognition and Interpretation (GARI) system:

1) Purchasing and procurement documents, including but not limited to: purchase orders, RFPs, responses to RFPs, invoices and contracts

2) Policy, procedural, and training documents, including but not limited to: use policies, standard operating procedures, training materials, presentations, privacy assessments, data retention policies, and other guidelines

3) Programming documents, including but not limited to: funding opportunity announcements, grant applications and grantor status/progress reports, reports to legislative bodies, annual reports

4) Audit documents, including but not limited to: audits of the system, misuse reports, and reports to oversight bodies

In your response, I would appreciate that you individually address each of the above categories of documents individually.

In addition to the above classes of documents, I am also seeking the following information:

- The total number of individuals whose biometric data has been collected over the last three years,
- The total number of [biometric data points] contained in the agency's database
- The retention period for biometric data
- The number of mobile biometrics devices purchased and in use
- The total number of authorized users of the mobile biometrics devices
- Which external agencies and entities have access to biometric data in the database and under what conditions,
- Whether biometric data is combined with biographic data such as name and address in the database, and
- The process by which data is entered into the database

These documents will be published online and inform the public dialog over police technology. Because of the great public interest in these issues, I ask that you waive any fees. If your agency is unable to do so, please contact me with an estimate of the costs.

Sincerely,

Dave Maass
Investigative Researcher
Electronic Frontier Foundation

References:
http://www.in.gov/iifc/2418.htm
http://www.lawofficer.com/articles/print/volume-10/issue-4/features/new-smartphone-app-interprets.html
https://www.dhs.gov/sites/default/files/publications/Enhancing%20Community%20Safety-Gang%20Graffiti%20Automatic%20Recognition%20and%20Interpretation%20System-GARI-Jan2014_2.pdf
http://wishtv.com/2014/08/21/phone-app-that-tracks-gang-graffiti-under-used-impd-says/

Filed via MuckRock.com<http://muckrock.com/>
E-mail (Preferred): requests@muckrock.com<mailto:requests@muckrock.com>

For mailed responses, please address (see note):
MuckRock
DEPT MR 22773
PO Box 55819?
Boston, MA 02205-5819

PLEASE NOTE: This request is not filed by a MuckRock staff member, but is being sent through MuckRock by the above in order to better track, share, and manage public records requests. Also note that improperly addressed (i.e., with the requester's name rather than "MuckRock News" and the department number) requests might be returned as undeliverable.

Mr. Maas,

This in response to your request from public records from ISP regarding the GARI system wherein you requested the following:

1) Purchasing and procurement documents, including but not limited to: purchase orders, RFPs, responses to RFPs, invoices and contracts Please find attached Purdue-ISP MOA. This is the only document ISP possess responsive to this request.

2) Policy, procedural, and training documents, including but not limited to: use policies, standard operating procedures, training materials, presentations, privacy assessments, data retention policies, and other guidelines. Please find attached the user agreement for GARI, CGAP, Probation Presentation 2015, flyers and factsheets regarding GARI.

3) Programming documents, including but not limited to: funding opportunity announcements, grant applications and grantor status/progress reports, reports to legislative bodies, annual reports. ISP is not in possession of any of these documents as the program was developed and funded by Purdue University VACCINE program.

4) Audit documents, including but not limited to: audits of the system, misuse reports, and reports to oversight bodies. ISP currently has no records responsive.

In your response, I would appreciate that you individually address each of the above categories of documents individually.

In addition to the above classes of documents, I am also seeking the following information:

- The total number of individuals whose biometric data has been collected over the last three years, There are a total of 1,855 tattoos in GARI, but from an unknown number of individuals.
- The total number of [biometric data points] contained in the agency's database. GARI collects only images of tattoos.
- The number of mobile biometrics devices purchased and in use No devices have been purchased for use of GARI
- The total number of authorized users of the mobile biometrics devices Currently there are 156 users
- Which external agencies and entities have access to biometric data in the database and under what conditions, Please see attached list of agencies using GARI
- Whether biometric data is combined with biographic data such as name and address in the database, No.
- The process by which data is entered into the database Users of the GARI app can submit photos that are reviewed and either approved or disapproved for submission into the database.
Thank you.

Cynthia Forbes, Legal Counsel
Indiana State Police - Legal Office
Indiana Intelligence Fusion Center
Telephone: 317-234-4217
Fax: 317-234-7638