Portland police are secretly planning to use a risky AI tool they are explicitly prohibited from using.
Records show members of Portland Police Bureau, Bureau of Technology Services and other city tech staff held at least eight meetings between May and September dedicated to using the Microsoft Copilot generative AI system, despite serious security and inaccuracy risks posed by the software that they themselves acknowledge.
Revelations of the closed-door meetings planning for controversial use of AI by police carry added weight right now as PPB accepts comments from the public through the end of October regarding its policy for trials of new tech.
Portland city staff, elected officials, contractors and authorized third parties are allowed to use Microsoft Copilot — an AI system inside tools many people use at work or school, like Microsoft’s document software Word and its number-crunching Excel spreadsheet software. But when the city of Portland approved use of the generative AI assistant in April, it emphasized that only employees outside of the Police Bureau could use it.
Police plan to use it anyway.
Unredacted records of several meetings obtained through a public records request detail discussions among PPB, BTS and other city tech staff with titles such as “Planning Microsoft CoPilot Chat at the Police.” Records from a “PPB Copilot Implementation Funding” meeting held in late August show participants determined “Copilot at Police is feasible” and planned to “pilot, test and validate” police use of the AI system. Records show more than 1,000 users inside PPB could eventually use the tool if implemented.
“PPB is seeking to understand whether Copilot can provide efficiencies at the Police Bureau,” wrote Mike Benner, a PPB public information manager, in an email to Street Roots, adding the Copilot initiative was in a discovery phase. “This is of particular interest as we face staffing shortages and steady or increased workloads.”
Meeting records from one of the group’s last meetings in August show PPB, BTS and city tech staff plan for full deployment of Copilot after gauging the success of a possible official PPB “pilot” or trial of the chatbot. Participants also discussed potential funding sources for the would-be deployment, noting “BTS plans on funding the first full year.”
Efficiency promises and legal headaches
Microsoft promotes its Copilot AI chatbot to law enforcement around the world as a way to automate investigation tasks such as summarizing witness testimony and even providing steps for arrests. But use of Copilot by police already caused serious legal problems. When police officers in the UK recently used the same AI chatbot, it led to rejection of a court sentence involving a violent crime as well as a government-issued allegation of inappropriate use of Copilot during criminal investigations.
“Our priority is to ensure we’ve done our due diligence in understanding the potential impacts to our community and employees before deciding whether this initiative should move forward,” Benner said.
Part of that due diligence involves assessing and possibly fortifying PPB data security, or what it calls its “security posture,” according to Janet Storm from Portland Public Records Center.
Meeting records also show participants discussed employing the city’s existing Copilot use guidance and policy as a starting point for possible future PPB-specific guidance. However, Benner said there is no separate PPB-specific Copilot policy development effort currently underway.
Meanwhile, Portland City Council may have been left out of the process thus far. According to the city clerk’s office, there have been no specific City Council meeting agenda items this year addressing a possible change to the policy that currently excludes police from use of Microsoft Copilot. The city’s existing AI rule allows for the city administrator to inspect use of AI systems and require bureaus to alter or stop use of AI systems.
Researchers and law enforcement organizations themselves have found discriminatory impacts of AI use for police case report writing, analysis and crime prediction for at least a decade. And, while approved use of AI by policymakers and non-police government employees in Portland is only just emerging, researchers for years have studied how algorithmic and AI systems replace and redistribute human discretion in ways that affect government transparency and accountability.
Police and tech staff acknowledged AI risks and audit fails
PPB and technology staff acknowledged serious risks of Copilot use by police since their very first May meeting. Their concerns hinge on the risk of exposing a particular category of regulated data: sensitive criminal justice data or CJI.
CJI can include criminal history data, biographical information, and biometric data such as fingerprints and facial or iris recognition data, and more. It is subject to oversight by state and federal authorities, and the Oregon State Police audits the city’s CJI systems every three years. Records show meeting participants recognized use of Copilot could put the city at risk of “Failing a CJIS [Criminal Justice Information Services] Audit,” “Exposing CJIS to AI” or allowing “certain documents/content into the wild.” The meeting records state “all users at Police have access to CJI.” Meeting participants also acknowledged Copilot could provide police users with outdated information depending on how the software is configured.
When asked specifically by Street Roots why the bureaus held at least eight meetings about using an AI system they know could put Portland’s sensitive data security and information accuracy at risk, BTS responded, “The meetings were to assess the federal and City security requirements and determine whether Microsoft Copilot Chat (Copilot) could meet them before any deployment decision in Portland Police.”
Portland’s SmartCityPDX found use of Copilot by city staff alone poses 48 distinct risks according to its 2025 Privacy Impact Assessment and Risk Analysis of Microsoft Copilot. The assessment found multiple medium- and medium-high level risks, including exposure of private or sensitive information via the chatbot prompt, misleading or inaccurate information, culturally specific biases, over-trust in recommendations made by the software, unwarranted searches on private information related to an individual, and exposure of someone’s financial vulnerabilities.
Portland’s AI Principles include equity along with security, safety and privacy and other values describing how AI systems are purchased, configured, developed, operated, used and maintained by the city.
However, although notes from the PPB Copilot meetings and bureau comments about police use of Copilot for this story focus on concerns related to data security requirements and possibly outdated information in AI outputs, they do not address discriminatory impacts of AI in policing.
Police in the UK are in legal hot water after using Microsoft Copilot. In one recent case, an officer used the tool to generate a statement about a victim in the hopes of inspiring a harsh sentence, prompting the UK Court of Appeal in September to reject the court sentence. Since then, the UK government’s police watchdog The Independent Office for Police Conduct issued a warning about police use of AI and launched an inquiry into alleged inappropriate police use of Copilot “to create policy decisions, assess and manage risk, and to justify decision making.”
How Microsoft sells Copilot to cops around the world
PPB told Street Roots it is exploring use of Copilot for “administrative, research, data analysis, idea generation, and meeting management and collaboration features.” Meeting records also note, “Users will likely use it however they can to provide efficiencies.”
While PPB’s explanation about how it might actually use Copilot is somewhat cloudy, Microsoft marketers have lots of ideas for ways law enforcement can use it, including in investigations that could tap into criminal justice data. A promotional demonstration of Microsoft Copilot walks users through a would-be police investigation using the tool to prepare investigation briefs, automatically summarize witness testimony, and access suspects’ financial documents or criminal records.
In the demo, a fictitious investigator named Carlos prompts Copilot to “Please provide me a task list to assist in the development of a tactical plan to effect arrest on two suspects in several armed robberies.” The AI chatbot responds, “Sure Carlos.” It then spits out a detailed list of tasks including “Conduct surveillance on the suspects’ residence” and “Ensure all necessary warrants and legal documents are obtained.”
When asked whether PPB wants to use Copilot for purposes related to investigations, Benner referred to federal, state or city policies or guidance, noting “If any of these sources dissuade, restrict, or forbid specific uses, PPB will remove these uses from discovery and therefore possible use if PPB moves forward.”
While police could find some value in automating possibly less-risky tasks like press release writing, the introduction of AI into PPB’s workflow is no guarantee of speedy efficiency. A Forbes investigation showed some police found use of AI required additional time to correct errors, and academic researchers have found no time savings in AI-assisted police report-writing.
How non-police city staff already use Copilot
Another reason Portland police and governments around the world want to introduce approved AI tools is to avoid “shadow AI,” or the use of unapproved external AI systems without approval or oversight. “Users are using third party apps now,” the meeting records state; this refers to possible police or government staff use of AI systems made by “third parties” that have no contractual “two-party” city and vendor relationship such as OpenAI’s ChatGPT or Anthropic’s Claude.
Indeed, before Portland announced sanctioned use of Copilot by employees outside of PPB in April, Portland City Councilor Candace Avalos told The Oregonian she used generative AI system ChatGPT to analyze city agency reports and produce talking points.
And now that it’s allowed, Portland city staff are using Copilot. Recent documents from Portland’s Committee on Community Engaged Policing and its Pedestrian Advisory Committee, for instance, mention use of Microsoft Copilot to assist in producing the documents with review from human staff.
The city extended its authorization to use Microsoft Office 365 software in April 2024 for three years at an annual cost of $4 million. The set of applications such as PowerPoint for presentations and Outlook for email and calendar scheduling now can include Copilot AI functions. The city has used Microsoft Office 365 since 2012.
Non-police city employees in Portland are allowed to use Copilot Chat for tasks including drafting early versions of documents or messages, summarizing materials, brainstorming or outlining ideas, or explaining general concepts. However, Portland’s AI administrative rule, established in March, prohibits use of Copilot or other AI systems to automate decisions affecting people’s health, safety, rights, or financial well-being “without an appropriate level of human review.” Those include decisions affecting someone’s employment or specific law enforcement actions.
Portland calls on Oregon’s criminal data security cop
“We’d like Nick Harris’ thoughts on this.”
That statement reflects just one of at least five times the name of Oregon’s top enforcer of CJI security Nicholas C. Harris is invoked in PPB’s Copilot planning meeting records. Indeed, the records show participants were particularly focused on evaluation of data security compliance requirements necessary for police to use Copilot, including in relation to the appropriate tier of Microsoft security services necessary to protect Criminal Justice Information.
Harris oversees Oregon’s CJI-related technical security requirements and audits, which follow policy set forth by the state and FBI’s Criminal Justice Information Services Division. Records from the initial May convening of PPB, BTS and city tech staff note Harris “suggested very limited Use” of Copilot or AI by police.
Oregon’s statewide guidance prohibits any AI system from interacting with CJI, according to Oregon State Police Deputy Public Information Officer Jolene Kelley.
“AI systems must not interface with CJIS environments, and no CJI data may be included in AI prompts, outputs, training datasets, or operational workflows,” Kelley told Street Roots.
Meeting records show participants have concerns about possible interception of sensitive data by other systems if police use Copilot. They questioned multiple times whether they could control or stop data from flowing into systems including Microsoft’s Bing search engine. Meeting notes state “MS documentation is vague about what is being sent to Bing” and note the company had not specified what data leaves the city’s Microsoft 365 environment.
Alison Perkins, the public information officer representing BTS, told Street Roots that Microsoft and the city “have discussed the controls required to govern criminal justice information” and “Microsoft has provided documentation describing how Copilot processes web search queries and handles associated data.”
The bureau said it continues to evaluate the information provided by Microsoft in the context of CJIS requirements, city policy, and BTS technical controls, and that deployment of Copilot for police “remains contingent on meeting applicable City and CJIS requirements.”
Microsoft declined to comment for this story. The company says that Copilot prompts, responses and generated content stay inside a customer’s U.S. government cloud environment and Copilot applies the security and compliance controls customers have set up in their own data environments.
Both BTS and PPB told Street Roots they would adhere to state and federal policies related to AI and Copilot in police environments and in relation to CJI. Perkins also added, “There are potential cases for PPB that would not involve any CJIS data.”
Microsoft’s data security practices were heavily criticized in 2024 by one of its largest and oldest public sector customers, the U.S. government. In its independent review of a 2023 Microsoft Exchange Online intrusion, the U.S. Department of Homeland Security’s Cyber Safety Review Board wrote, “Unfortunately, throughout this review, the Board identified a series of operational and strategic decisions that collectively point to a corporate culture in Microsoft that deprioritized both enterprise security investments and rigorous risk management.”
In response to the DHS report, Microsoft said it would “double down” on core security principles.
Public can comment on police tech trials til Oct. 31
Despite dedicating at least eight closed-door meetings to the initiative, existing PPB policy for new trials of tech never applied because the efforts were not part of an official “pilot,” even though meeting participants mentioned “Pilot Prep” of the AI tool throughout those discussions.
Right now, through October 31, the public can submit comments regarding PPB’s Equipment Authorization Directive — its policy for trials of new tech. The current directive gives PPB itself the responsibility to review and approve new tech pilot programs. And while a tech trial may trigger a Privacy Impact Assessment, the policy does not reference Portland’s new independent City Data and Privacy Office. That office oversees governance and management of data used by city bureaus, including in relation to tech trials that implicate sensitive data, surveillance technologies, AI systems, large language models and other automated decision systems.