By Dave Maass / Electronic Frontier Foundation

In the TV series Person of Interest, two government artificial intelligence programs—one gone rogue—can access virtually every surveillance camera across New York City, including privately operated ones in places like parking garages, hotels, and apartment complexes. The creators of the show try to stay one step ahead of modern technology. So the question is: do cities really create a network of interconnected private and public security cameras?

Yes, they do. If you’re going to San Diego Comic-Con (and the Person of Interest team is), you’ll want to pull on your Batman mask or slather on the Sith paint if you’re passing any of the marked locations on this new map. You might very be under surveillance as part of the San Diego Police Department’s “Operation Secure San Diego.”

Operation Secure San Diego—ostensibly intended so first responders could get a view of a crime as it’s happening—encourages private businesses to allow the cops to access their surveillance video cameras. It also gives officers sitting in their squad cars the power to tap directly into live feeds. The first to share its streams was Hotel Indigo, a hotel popular with the Comic-Con set in San Diego’s Gaslamp district.

Whether you’re a resident or tourist, Operation Secure San Diego might make you a little nervous. SDPD wants to reassure you. As they write in a “news flash”:

We are very cognizant of the impact this may have on privacy issues and the public’s perception of being on video. The SDPD can assure you that we have procedures in place that allow the viewing only when summoned to the Hotel Indigo (or any additional partner) for a service call.

That might be comforting… if it were actually true.

San Diego technologist Jeff Hammett got curious and filed a public records act for those procedures. He did not get them, because now, according to SDPD, these procedures don’t exist. Here’s what SDPD told Hammett:

There are no responsive documents for your request to any copies of procedures regarding viewing these camera feeds. Operation Secure San Diego is still in the development stages. There are no procedures at this time.

In 2010, Hotel Indigo’s manager assured reporters that police could only access the hotel’s four lobby cameras when called to the scene and that police would be limited to watching the feeds live, no recording. Four years later, a written police policy does not exist and, without a policy, there can be no way of identifying violations of it.

Nevertheless, Hammett was able to obtain the list of 40 locations that are already in Operation Secure San Diego’s network, most of which are government property, such as trolley stops and police substations. Several, however, are on private property, including the cameras at Hotel Indigo and Prudential Realty, just blocks away from the San Diego Convention Center.

San Diego has a legitimate interest in public safety, including during massive events like San Diego Comic-Con, but it hasn’t been shown that this interest warrants a system of interconnected surveillance cameras or police access to private video feeds—especially in a city like San Diego that brags about “hav[ing] such a low crime rate.” Even if this were shown, SDPD needs to do a better job of defining the limits of this program.

Who can access the feeds and under what circumstances? What kind of paper trail is created when they access a feed? San Diego has been playing with facial recognition systems; are these being applied to the feeds? How long after a reported incident can SDPD continue monitoring the cameras? Does a police officer have the technological access to turn on a camera by himself, at any time, or only during a crisis or with authorization from higher up? Have the feeds been tested for security vulnerabilities?

Then there’s the big question: can some vigilante, crime-predicting artificial intelligence program built by the sinister guy from Lost tap into it through a backdoor?

So many questions and so few answers. SDPD claimed it couldn’t hand over any of the agreements with private businesses because these would reveal security practices, even though formal protocols don’t actually exist.

Maybe SDPD will be watching you, maybe they won’t. One thing we can say is that we hope to see you at Comic-Con. EFF will be at Alaska Robotics’ exhibition hall booth (#1134) 2 – 3 p.m. on Friday, Saturday, and Sunday.

Irony Update: Ten minutes after this post went live, the San Diego Police Department tweeted:”SDPD welcomes Comic Con visitors to town. We look forward to seeing a lot of superheroes.”