This review identified 1 item recommended for first review, alongside 1 additional item noted for context.
Every item in this report is a statistical pattern presented for human review, together with an explanation of how the same pattern could arise from entirely routine police work. Nothing in this report is a finding of misconduct by any person.
Personnel in this public version are identified by stable pseudonyms (Subject A, Subject B, and so on). The corresponding identifiers are held in the sealed version of this report, which carries the same verification hash.
This review covered the search audit export provided by the agency (sample-log.csv). 378 records were readable and reviewed; 0 rows could not be read and are listed in the working papers.
Rules applied in this review:
Every account that searched during the period, highest to lowest, with the department median marked. 10 accounts in total, median 38.5 searches, highest 52. Accounts are unlabelled in the public version. A single tall bar is not a finding on its own, because assignment differences routinely explain high volume. The rule compares against this median, and this exhibit lets you check it.
Searches by hour of day across the whole period, combining every account. This is the department’s working pattern, and it is the shape the working-hours rule is built from. That rule looks at each user against their own window rather than this one, and it stands down when the surrounding activity explains what it sees.
What this tool cannot see. License plate identifiers are converted to one-way codes the moment your export reaches us, so the review can recognize that the same vehicle was queried twice without ever holding the plate itself. We review only the hashed data, and the export is deleted once your reports are delivered.
Observed. Subject A ran 7 searches outside their usual hours, with nothing in the surrounding activity to explain them. Searches falling outside a person's own established pattern, with nothing around them tying them to a shared incident, warrant a routine question. Hours involved: 02:00, 03:00, 04:00. Of these, 7 had no case number.
Possible innocent explanation. Overtime, a shift swap, court preparation, a call-out, or a period of working a case alone all produce this. Check the duty roster for the dates involved before drawing any conclusion.
Recommended follow-up. What duty, call-out, or approved overtime placed these searches outside the user's usual hours?
Records involved: 7
Observed. Subject B searched the same vehicle 9 times over 56 days, and 8 of those searches had no case number attached. Repeated queries against a single vehicle spread across weeks, with no case number tying them to an investigation, is the pattern most commonly associated with personal use of the system. This warrants asking the officer what investigation these searches belonged to.
Possible innocent explanation. A long-running investigation, a repeat offender the officer encounters often, or an ongoing neighborhood complaint can all produce this pattern legitimately. Case numbers are also commonly left blank through simple habit rather than intent.
Recommended follow-up. What investigation did these queries belong to, and can a case number be attached retroactively?
Records involved: 9
Each rule below is deterministic arithmetic over the records provided: the same export, reviewed again with the same settings, produces the same findings. No artificial intelligence or statistical model is involved in detection.
Counts how many times each user queried the same vehicle key across the period, and whether those queries carried a case number. Vehicle identifiers are one-way hashed, so the report can say “the same vehicle” without knowing which vehicle.
Compares each user's total searches to the department median for the period. Users far above the median are listed for context, not accusation; assignment differences routinely explain high volume.
Splits the period in half and compares each user's activity between halves, and a sharp increase is noted so a reviewer can ask what changed.
Builds each user's own typical working window from their record, then notes searches well outside it, unless the surrounding activity explains them, since a genuine incident leaves context around it.
Checks each search's stated reason and offense code against the purposes the agency's policy permits, and checks whether the written reason and the selected code agree. Department-wide patterns are reported once, as configuration items, rather than once per officer.
Looks for dense clusters of searches by one user in a short window, unless the surrounding activity explains the cluster.
Compares each outside agency's use of this agency's cameras to its peers, and notes concentration on a small number of vehicles.
Looks at each outside account's queries of this agency's cameras and notes accounts that devote most of their searches to a handful of specific vehicles, since routine outside use touches many different plates once.
Compares each search's shared-network count to the roster's typical value and notes users who repeatedly search far beyond it. Wide scope is legitimate for statewide alerts; the flag asks which case required the reach.
Reports users whose searches chronically lack a case number, and reports a department-wide rate.
WilWell Technologies is independent of the agency reviewed and of any license plate reader vendor. WilWell holds no interest in the outcome of this review and had no role in creating the records reviewed. This review was engaged and paid for by the agency, in the same manner as an independent financial audit; the engagement does not extend to the content of findings.
The verification hash on the cover page is computed from the findings themselves. Any change to the findings produces a different hash. The sealed and public versions of this audit carry the same hash, confirming they reflect the identical underlying review. To verify, re-run the audit on the same export with the same settings and compare hashes.
Prepared by: Your Firm Name Here