Seattle's policy against sharing surveillance data with federal immigration enforcement may not protect residents captured on the city's 62 police cameras. The reason: the footage flows through a private vendor that Seattle cannot control.

Cybersecurity engineer Noah Williams, a member of the Community Not Cameras coalition and the Transit Riders Union, laid out that argument on KIRO Newsradio's "The John Curley Show" on Sunday, Aug. 23. Williams said he was able to open the same web application used by SPD's Real-Time Crime Center on his own browser in an unauthenticated state, expanding what security professionals call the system's "attack surface."

"Anyone who goes after Axon and decides to hack them, or coerces them through commercial pressures, subpoenas, can readily obtain access to that data and pull footage from our cameras without our knowledge," Williams said on the program.

The RTCC web application operates on a public-facing website that does not require a VPN, according to Williams, making it easier for hackers to probe for vulnerabilities. Williams toured the RTCC on Aug. 17 with five other coalition members and SPD staff; the unauthenticated-access finding came from his own browser, separate from the tour.

SPD's contract does include language requiring Axon to notify the department if it receives a warrant or subpoena for SPD data, and to retain legal counsel to object, according to PubliCola. But the contract contains a carve-out: Axon need not notify SPD if "prohibited by law." Williams argued federal agencies could use that exception to prevent notification entirely.

As an alternative, Williams pointed to King County Metro bus cameras. Thanks to contract demands by ATU Local 587, Metro buses store footage on local DVRs aboard the bus, disconnected from the internet and inaccessible remotely.

Public Safety Committee Chair Bob Kettle, who represents District 7, stated in a Feb. 24 written response that if a federal subpoena for CCTV data occurs, the City Council ordinance requires the system to shut down for 60 days. Kettle said at the time there had been no subpoenas for Seattle's data. As of Aug. 23, neither Kettle nor SPD had publicly responded to Williams' specific technical claims.

Mayor Katie Wilson has paused any camera expansion pending an NYU Policing Project audit expected by the end of September. A separate University of Pennsylvania evaluation, overseen by the city's Office of Inspector General for Public Safety, is also due in September. Williams said the NYU report should, at minimum, address where encryption keys are stored and who controls them.

The 62 cameras currently operating in downtown, Chinatown-International District and the North Aurora corridor feed the RTCC, which SPD activated in May 2025 as a two-year research project. SPD's policy limits local storage to five days; footage moves to evidential storage only if needed for an investigation. Williams said any replacement system should store data exclusively on servers Seattle owns and manages.