ShieldPST.ai · Technology Reference Library

Police Technology Legal & Governance Map

A practical crosswalk connecting 18 public-safety technologies with the constitutional, privacy, evidentiary, artificial-intelligence, retention, procurement, information-sharing, and governance issues agencies should evaluate before deployment and throughout the technology lifecycle.

18 Technologies Mapped

8 Cross-Cutting Domains

1 Governance Framework

View the Map Technology Explainers Police Technology Case Law Center

Why this map exists

Public-safety technologies rarely present only one legal or policy issue. An ALPR system may implicate location privacy, retention, information sharing, evidentiary integrity, procurement, and potentially Fourth Amendment concerns depending on how the system is deployed and searched.

Facial recognition raises different questions involving identification, accuracy, human review, demographic performance, First Amendment activity, discovery, watchlists, vendor validation, and downstream police action. An AI report-writing system presents still another combination.

This map allows agencies to look horizontally across technologies and identify the issues that deserve attention before the system becomes routine operational infrastructure.

This is a risk map—not a legal conclusion.

A designation of Core does not mean that a particular constitutional rule automatically applies in every deployment.

It means the issue is sufficiently central that an agency should affirmatively address it through legal review, policy, validation, procurement, training, oversight, or another governance control.

How to Read the Map

Core

A central legal or governance issue for this technology. Agencies should expect to address it expressly.

Significant

Frequently important, but the degree of concern depends materially on configuration, deployment, use, or jurisdiction.

Contextual

Can become important in particular implementations, investigations, integrations, or operational circumstances.

Important The map identifies issues requiring analysis. It does not mean that every technology marked under the Fourth Amendment constitutes a search, that every First Amendment designation establishes a constitutional violation, or that every technology is subject to the same statutory regime. Deployment details and controlling jurisdictional law matter.

Eight Cross-Cutting Domains

1 Fourth Amendment

Searches, seizures, warrants, particularity, homes, location history, aggregation, and investigative access.

2 First Amendment

Speech, association, religion, journalism, protest, political activity, and protected expression.

3 Privacy & Civil Rights

Sensitive information, bias, discrimination, proportionality, innocent persons, and government aggregation.

4 Evidence & Discovery

Source evidence, authentication, machine output, alternative results, provenance, disclosure, and testimony.

5 AI & Algorithmic Risk

Accuracy, hallucination, classification, automation bias, explainability, validation, and human review.

6 Retention & Access

How long data persists, who may search it, secondary use, audit logs, deletion, and historical reconstruction.

7 Procurement & Vendors

Contracts, performance claims, source data, model changes, ownership, cybersecurity, audit rights, and termination.

8 Intelligence & Sharing

Dissemination, criminal-intelligence systems, interagency access, regional networks, private partners, purpose limitation, and downstream use.

The Technology Legal & Governance Map

Scroll horizontally to review all eight domains. Click any technology name to open its full ShieldPST.ai explainer.

Technology	Fourth Amendment	First Amendment	Privacy & Civil Rights	Evidence & Discovery	AI & Algorithmic Risk	Retention & Access	Procurement & Vendors	Intelligence & Sharing
Automatic License Plate Readers	Core	Significant	Core	Core	Contextual	Core	Core	Core
AI-Assisted Police Reports	Contextual	Contextual	Significant	Core	Core	Core	Core	Significant
Geofence Warrants	Core	Significant	Core	Core	Contextual	Significant	Significant	Significant
Pole Cameras	Core	Significant	Core	Core	Contextual	Core	Significant	Significant
Cell-Site Simulators	Core	Contextual	Core	Core	Contextual	Significant	Core	Significant
Body-Worn Camera Analytics	Significant	Significant	Core	Core	Core	Core	Core	Significant
Social Media & OSINT	Significant	Core	Core	Core	Significant	Core	Significant	Core
Reverse Keyword Warrants	Core	Core	Core	Core	Contextual	Significant	Significant	Significant
Gunshot Detection Technology	Contextual	Contextual	Significant	Core	Core	Significant	Core	Significant
Real-Time Crime Centers	Core	Core	Core	Core	Core	Core	Core	Core
Facial Recognition Technology	Significant	Core	Core	Core	Core	Core	Core	Core
Predictive Policing & Algorithmic Crime Forecasting	Significant	Core	Core	Significant	Core	Core	Core	Core
Drones & Drone as First Responder	Core	Significant	Core	Core	Significant	Core	Core	Significant
CSLI & Tower Dumps	Core	Contextual	Core	Core	Contextual	Core	Significant	Significant
Smartphones & Mobile Device Forensics	Core	Contextual	Core	Core	Significant	Core	Core	Significant
Cloud Data & Provider Records	Core	Significant	Core	Core	Contextual	Core	Significant	Significant
Commercial Data Brokers & Location Intelligence	Core	Core	Core	Significant	Core	Core	Core	Core
Video Analytics & Automated Video Search	Core	Core	Core	Core	Core	Core	Core	Core

The classifications are issue-spotting judgments for governance purposes, not determinations that a specific law automatically applies. Configuration, duration, data source, search method, jurisdiction, integration, operational purpose, and downstream government action can materially change the legal analysis.

What the Map Reveals

1. Governance becomes more important as technologies integrate

A stand-alone sensor may present a narrower set of issues than a system that combines multiple technologies. Real-Time Crime Centers and automated video platforms illustrate this effect particularly well because they can integrate cameras, ALPR, drones, databases, analytics, identification systems, and other information.

2. Retention can change the character of a technology

A system designed to generate a momentary alert may become a historical surveillance tool when observations are retained and made searchable for months or years.

3. Machine-generated information creates a second evidence layer

AI summaries, facial-recognition candidates, video classifications, predictive scores, gunshot alerts, BWC transcripts, and commercial-data inferences are not identical to the source evidence from which they were produced.

4. Procurement decisions can become constitutional and evidentiary decisions

Data sources, retention periods, sharing networks, model updates, default settings, audit capabilities, search functionality, and vendor access are often determined during procurement. Those choices can materially affect later legal and operational risk.

5. “Lead” and “legal justification” must remain separate

A technology may generate valuable investigative information without independently establishing the legal standard for a stop, search, arrest, residential entry, or other consequential government action.

Core Governance Principle Do not govern technology only by asking: “Is the system legal?” Also ask: What information does it create? How accurate is it? Who can search it? How long is it retained? What happens when it is combined with other systems? What must be preserved? What must be disclosed? And what prevents a legitimate capability from becoming an uncontrolled surveillance or decision system?

Governance Questions by Legal Domain

Domain	Questions an Agency Should Ask
Fourth Amendment	What government conduct occurs? What information is obtained? Is a home or curtilage involved? Is location history reconstructed? Is surveillance prolonged? Is information aggregated? Is legal process required? Does the warrant describe the technology accurately? What does controlling state law require?
First Amendment	Can the technology identify, track, classify, or develop intelligence concerning protests, religious activity, political organizations, journalists, advocacy groups, unions, or other protected speech or association? What purpose limitations and approvals apply?
Privacy & Civil Rights	What sensitive information is exposed? How many uninvolved people enter the dataset? Are there demographic or geographic performance differences? Can proxy variables create disparate effects? What correction mechanism exists for erroneous information?
Evidence & Discovery	What is the original evidence? What is machine-generated? Can the agency reconstruct the analysis? Are alternative candidates or contrary results preserved? What software version was used? What should prosecutors receive?
AI & Algorithmic Risk	What does the model actually do? What data were used? What are the relevant error rates? Has performance been validated locally? Can humans reject the result? Are model changes documented? Is the output explainable enough for its intended use?
Retention & Access	What is retained? For how long? Does derived metadata survive deletion of source evidence? Who can search historical data? Are searches logged? Can data be reused for unrelated investigations?
Procurement & Vendors	What exactly is being purchased? What capabilities are enabled? Who owns the data? Can the vendor access it? Can vendor updates change capabilities? What independent testing exists? What happens at contract termination?
Intelligence & Sharing	Can records be shared with other agencies? Are private-sector systems connected? Does information enter a criminal-intelligence system? What reliability or reasonable-suspicion requirements apply? Do downstream restrictions travel with the information?

Technology Governance Is a Lifecycle

Governance should begin before the contract is signed and continue until the technology and its data have been retired.

1. Define Need What problem are we solving? What capability is actually necessary?

2. Evaluate Legal review, privacy impact, technical validation, vendor diligence, alternatives, and risk assessment.

3. Procure Contract terms, ownership, retention, audit rights, security, model changes, disclosure, and termination.

4. Deploy Policy, training, permissions, supervisors, validation, documentation, and operating procedures.

5. Monitor Audits, error rates, misuse, legal developments, model changes, complaints, and operational value.

6. Reassess Continue, modify, restrict, suspend, replace, or terminate. Address remaining data.

Twelve Questions for Every Technology

Regardless of the technology, an agency should be able to answer these questions clearly.

1. What problem are we solving?

Identify the operational need before evaluating a particular product.

2. What exactly does the system do?

Describe actual capabilities rather than marketing labels.

3. What data does it collect, create, infer, or access?

Include source data, derived data, metadata, scores, alerts, embeddings, logs, and generated outputs.

4. What legal authority permits each use?

Consider federal and state constitutional law, statutes, court orders, consent, contracts, and other authority.

5. How accurate and reliable is it?

Identify the relevant error measures and validate performance under real operational conditions.

6. What decisions may rely on the output?

Distinguish investigative leads from information sufficient to support consequential government action.

7. What human review is required?

Define who reviews output, what source evidence must be examined, and when an automated result may be rejected.

8. Who may access the system?

Define authorized users, permissions, case-purpose requirements, supervisors, audits, and misuse controls.

9. How long is information retained?

Address original evidence, derived metadata, queries, alerts, audit logs, and unrelated-person data.

10. What must be preserved and disclosed?

Coordinate evidentiary preservation and discovery before the technology generates a contested prosecution.

11. What does the vendor control?

Understand data access, subcontractors, model updates, cybersecurity, AI training, audit rights, and termination obligations.

12. When will we reassess the system?

Establish periodic review based on legal changes, performance, misuse, costs, technology changes, community impact, and operational value.

Criminal Intelligence Systems & 28 C.F.R. Part 23

Some technologies generate information that may eventually enter a criminal-intelligence system. Examples can include RTCC information, social-network analysis, commercial intelligence, surveillance records, association data, and information shared through multijurisdictional systems.

Applicability Matters 28 C.F.R. Part 23 does not automatically regulate every police database. Its standards apply to covered criminal-intelligence systems operating through qualifying federal support. Where applicable, the regulation includes important requirements concerning collection, reasonable suspicion, dissemination, security, review, and system operation.

Even where Part 23 is not formally applicable, agencies may find concepts such as purpose limitation, information reliability, access controls, dissemination controls, and periodic review useful when designing broader intelligence-governance systems.

AI Governance Across the Map

AI is no longer confined to products marketed as “artificial intelligence.” Computer vision, facial recognition, automated transcription, predictive systems, classification, anomaly detection, natural-language search, report generation, and commercial identity-resolution tools can all contain algorithmic components.

AI Governance Principle Govern the function, not merely the vendor's label. If a system classifies, predicts, identifies, summarizes, generates, scores, recommends, or automatically detects, the agency should understand how that function is validated, what errors occur, what human review exists, and what consequences can follow from the output.

AI Governance Question	Why It Matters
What is the intended use?	A model appropriate for triage may not be appropriate for identification or consequential decision-making.
What is the source data?	Training and operational data can contain errors, historical bias, missing information, or proxies.
How is performance measured?	Accuracy should be defined using metrics relevant to the actual task rather than one generalized percentage.
What happens when the model is wrong?	Risk depends on the consequence attached to the output.
Can a human meaningfully review the result?	Human involvement is valuable only when the reviewer can understand, test, and reject automated output.
Can the model change?	Vendor updates can alter performance after procurement and may require revalidation.
Is the output preserved?	Investigations and litigation may require reconstruction of what the system produced at a particular time.
Is use auditable?	Agencies should know who used the system, why, what was entered, and what was returned.

Use the Map with the ShieldPST.ai Reference Library

Selected Legal & Governance Foundations

Carpenter v. United States, 585 U.S. 296 (2018)
Supreme Court decision addressing extended historical cell-site location information and the relationship between digital location information, privacy, and the third-party doctrine.
Read Supreme Court opinion

NIST Artificial Intelligence Risk Management Framework
Voluntary framework addressing governance and management of risks associated with artificial-intelligence systems, including validity and reliability, transparency, explainability, privacy, accountability, security, and fairness.
Review NIST AI RMF

U.S. Department of Justice — Artificial Intelligence and Criminal Justice
DOJ report examining criminal-justice uses of AI and related issues involving governance, privacy, civil rights, accuracy, transparency, and oversight.
Review DOJ report

28 C.F.R. Part 23 — Criminal Intelligence Systems Operating Policies
Federal regulatory standards applicable to covered criminal-intelligence systems operating through qualifying federal support, including rules concerning collection, reasonable suspicion, dissemination, access, and review.
Review current regulation

The Governance Question

Technology governance should not begin after a controversy, suppression motion, discovery dispute, audit finding, public-records request, or vendor failure.

It should begin when an agency first asks whether a technology should be acquired.

Bottom Line Before deploying any public-safety technology, an agency should be able to explain: what the system does; what data it uses; what it creates; what legal authority supports its use; how accurate it is; how humans verify its output; who may access it; how long information remains available; what must be preserved and disclosed; how vendors are controlled; how information may be shared; and when the system will be independently reassessed.

If those questions cannot be answered, the agency does not yet fully understand the technology it is governing.

Explore the Technologies Explore the Case Law