Patent Description:
Documents <CIT> and <CIT> both disclose methods for redacting data.

In the accompanying figures similar or the same reference numerals may be repeated to indicate corresponding or analogous elements. These figures, together with the detailed description, below are incorporated in and form part of the specification and serve to further illustrate various embodiments of concepts that include the claimed invention, and to explain various principles and advantages of those embodiments.

For example, the dimensions of some of the elements in the figures may be exaggerated relative to other elements to help improve understanding of embodiments of the present disclosure.

The apparatus and method components have been represented where appropriate by conventional symbols in the drawings, showing only those specific details that are pertinent to understanding the embodiments of the present disclosure so as not to obscure the disclosure with details that will be readily apparent to those of ordinary skill in the art having the benefit of the description herein.

As described above, redaction may be performed to obscure or remove sensitive data contained in data records. Data records maintained by one or more organizations may be contextually related to each other, for example, when the data records are captured in relation to a same event, incident, or situation. In these cases, when any sensitive data is redacted from one record, it is necessary to identify and redact other contextually-related data records containing same or similar data. As an example, assume that a public-safety incident is captured via different recording sources (e.g., a body-worn camera, a surveillance camera, or an audio recorder). In this example, data records obtained from different recording sources may contain similar data. For instance, it is possible that a person witnessing a public-safety incident may be captured in data records obtained through multiple data recording sources. In order to protect the identity of the person who witnessed the incident, a public-safety agency may decide to redact characteristics (e.g., face) of the person in an image or a video, for example, captured by a body-worn camera of a responding officer. For example, when the face of the person captured in one data record is redacted, it is also necessary for the agency to identify other data records (e.g., data records captured by other recording sources) that may be contextually-related (e.g., when records are linked to the same incident) to a previously redacted record and further redact the face of the person as well as other visually and non-visually identifiable information (e.g., person's voice, name, address, phone number, social security number etc.,) related to the person irrespective of the format (i.e., image, video, audio, or text) in which the data was recorded. While humans could attempt to manually process each data record to identify portions of the data record that contain the person's identifiable information, it would not be scalable for humans to process hundreds and thousands of data records (that may be maintained corresponding to a single incident) to first identify data records that are contextually related to each other and to further consistently redact the person's identifiable information that may or may not be recorded in the same data format as other records. Manual redaction is also prone to errors when the person's identifiable information is not identified and consistently redacted across all contextually-related data records. As an example, when a person's face is redacted from an image or a video obtained in relation to a particular incident, it is also important to redact portions of an audio containing the person's speech to ensure that the person's identity cannot be deduced from the speech content or voice pattern. Moreover, a user redacting sensitive data on data records obtained from recording sources associated with one agency may not be aware that the same sensitive data was recorded by recording sources associated with a different agency (or a different group within the same agency). The inconsistent redaction or non-redaction of data across data records maintained by multiple agencies may lead to inadvertent disclosure of sensitive data (e.g., person's personal identifiable information) to unintended persons. Accordingly, there is a need for an improved device and process for automatically redacting records of different data types based on a contextual correlation with one or more previously redacted records.

One embodiment provides a method of redacting records based on a contextual correlation with a previously redacted record. The method comprises: obtaining, at an electronic computing device, redaction metadata associated with a redacted record, the redaction metadata identifying a segment within an unredacted record to which redaction was applied to generate the redacted record; processing, at the electronic computing device, the identified segment of the unredacted record to detect that a person or an object captured within the identified segment of the unredacted record was redacted in the redacted record; processing, at the electronic computing device, the identified segment of the unredacted record to detect characteristics of the person or the object; obtaining, at the electronic computing device, at least one context attribute specifying a context in which the redacted person or the redacted object was captured within the identified segment of the unredacted record: identifying, at the electronic computing device, at least one other unredacted record that is associated with the unredacted record; determining, at the electronic computing device, that characteristics of a person or an object captured within at least one other segment of the at least one other unredacted record match with the characteristics of the person or the object captured within the identified segment of the unredacted record; obtaining, at the electronic computing device, at least one other context attribute specifying a context in which the person or the object was captured within the at least one other segment of the at least one other unredacted record; determining, at the electronic computing device, a contextual correlation value based on a correlation between the at least one context attribute and the at least one other context attribute; and when the contextual correlation value exceeds a correlation threshold, generating at least one other redacted record by redacting the person or the object captured within the at least one other segment of the at least one other unredacted record.

Another embodiment provides an electronic computing device. The electronic computing device includes a communications interface and an electronic processor communicatively coupled to the communications interface. The electronic processor is configured to: obtain redaction metadata associated with a redacted record, the redaction metadata identifying a segment within an unredacted record to which redaction was applied to generate the redacted record; process the identified segment of the unredacted record to detect that a person or an object captured within the identified segment of the unredacted record was redacted in the redacted record; process the identified segment of the unredacted record to detect characteristics of the person or the object; obtain at least one context attribute specifying a context in which the redacted person or the redacted object was captured within the identified segment of the unredacted record: identify at least one other unredacted record that is associated with the unredacted record; determine that characteristics of a person or an object captured within at least one other segment of the at least one other unredacted record match with the characteristics of the person or the object captured within the identified segment of the unredacted record; obtain at least one other context attribute specifying a context in which the person or the object was captured within the at least one other segment of the at least one other unredacted record; determine a contextual correlation value based on a correlation between the at least one context attribute and the at least one other context attribute; and generate at least one other redacted record by redacting the person or the object captured within the at least one other segment of the at least one other unredacted record when the contextual correlation value exceeds a correlation threshold.

Each of the above-mentioned embodiments will be discussed in more detail below, starting with example system and device architectures of the system in which the embodiments may be practiced, followed by an illustration of processing blocks for achieving an improved technical method, device, and system for redacting records based on a contextual correlation with a previously redacted record. Example embodiments are herein described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to example embodiments. The methods and processes set forth herein need not, in some embodiments, be performed in the exact sequence as shown and likewise various blocks may be performed in parallel rather than in sequence. Accordingly, the elements of methods and processes are referred to herein as "blocks" rather than "steps.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the function/act specified in the flowchart and/or block diagram block or blocks.

The computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational blocks to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide blocks for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks. It is contemplated that any part of any aspect or embodiment discussed in this specification can be implemented or combined with any part of any other aspect or embodiment discussed in this specification.

Further advantages and features consistent with this disclosure will be set forth in the following detailed description, with reference to the figures.

Referring now to the drawings, and in particular <FIG>, a system <NUM> is shown including an electronic computing device <NUM> configured to provide a redaction service corresponding to data records maintained by one or more agencies in one or more records databases <NUM>. An agency is an organizational entity that may store, retrieve, and/or process various types of data records stored in the records database <NUM> related to the organization's goals, activities, resources, and the like. In some embodiments, an agency may represent a private enterprise organization such as press, media, utilities, retail, healthcare, manufacturing, oil/gas, electric, private security, or other business. In other embodiments, an agency may represent a public organization such as a public-safety agency (e.g., police, fire, emergency medical service), governmental entity (e.g., court, city administration), and the like. The one or more records databases <NUM> may be implemented using any type of storage device, storage server, storage area network, redundant array of independent discs, cloud storage device, or any type of local or network-accessible data storage device configured to store data records for access by computing devices. In some embodiments, the one or more records databases <NUM> are commercial cloud-based storage devices. In some embodiments, the one or more records databases <NUM> are housed on suitable on-premise database servers or edge computing devices that may be owned and/or operated by one or more of public-safety or private agencies. The one or more records databases <NUM> may be maintained by third parties as well. The data records may be stored at the one or more records databases <NUM> in any suitable format or data type, for example, video, image, audio, text, or combination thereof. The records database <NUM> can include additional or fewer records and/or different types of records than illustrated in the example of <FIG>. In accordance with some embodiments, the electronic computing device <NUM> obtains permission to access and process all or subset of data records maintained in one or more records databases <NUM> and owned by one or more agencies prior to providing a redaction service to the one or more agencies.

In accordance with embodiments, the records database <NUM> stores unredacted records <NUM> (e.g., unredacted records <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM>. <NUM>-N), redacted records <NUM> (e.g., redacted records <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM>. <NUM>-N), and redaction metadata <NUM> (e.g., redaction metadata <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM>. Although the unredacted records <NUM>, redacted records <NUM>, and redaction metadata <NUM> are illustrated as stored in a single records database <NUM> in <FIG>, the unredacted records <NUM>, redacted records <NUM>, and redaction metadata <NUM> may be stored in separate databases. The unredacted records <NUM> stored in the records database <NUM> include original data (i.e., in unredacted form) recorded by recording sources <NUM> (e.g., recording sources <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM>. In some embodiments, the unredacted records <NUM> may represent images, videos, audios, or text captured in relation to a particular incident. As used herein, the term "incident" may refer to an event, occurrence, or situation that an agency has been tasked to resolve (e.g., a traffic accident, public disturbance, medical emergency, fire, broken water meter or power line, etc.). The unredacted records <NUM> stored at the records database <NUM> include records that are of different record types. In the example shown in <FIG>, the unredacted record <NUM>-<NUM> represents an image or a video recorded by a recording source <NUM>-<NUM> (e.g., a body-worn camera), the unredacted record <NUM>-<NUM> represents an audio (e.g., talk group conversations) recorded through a recording source <NUM>-<NUM> (e.g., a land mobile radio), and the unredacted record <NUM>-<NUM> represents text data (e.g., an incident report) submitted through a recording source <NUM>-<NUM> (e.g., a communication device operated by a public-safety officer). Similarly, the unredacted record <NUM>-N represents an image or a video recorded by a recording source <NUM>-N (e.g., a surveillance camera). Although the unredacted records <NUM> are shown in <FIG> as recorded by different recording sources <NUM>, embodiments described herein can be implemented in a similar manner to redact groups of unredacted records <NUM> that may be captured by the same recording source <NUM>. In accordance with some embodiments, the unredacted records <NUM> illustrated in <FIG> may be associated with a single agency or multiple agencies. For example, the recording sources <NUM>-<NUM>, <NUM>-<NUM>, and <NUM>-<NUM> may be associated with a first agency (e.g., police department) and the recording source <NUM>-N may be associated with a second agency (e.g., city administration). In this case, the recording sources <NUM>-<NUM>, <NUM>-<NUM>, and <NUM>-<NUM> may be configured by the first agency to record and upload the respective unredacted records <NUM>-<NUM>, <NUM>-<NUM>, and <NUM>-<NUM> to the records database <NUM> that may be accessible by users affiliated with the first agency. Similarly, the recording source <NUM>-N may be configured by the second agency to record and upload the unredacted record <NUM>-N to a different records database <NUM> that may be accessible by users affiliated with the second agency. In one embodiment, the electronic computing device <NUM> may obtain permission to access data records respectively associated with the first and second agencies and to provide redaction services corresponding to the data records associated with the first and second agencies. In accordance with some embodiments, the unredacted records <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM>. <NUM>-N are stored in separate databases each operated by a different private or public agency.

The redacted records <NUM> are generated based on applying redaction <NUM> (e.g., redaction <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM>. <NUM>-N) to the corresponding unredacted records <NUM>. In accordance with some embodiments, the redaction <NUM> may be applied (e.g., by the electronic computing device <NUM>) automatically or in response to a user input indicating a selection of a particular object (e.g., vehicle license plate, person's face) or a particular segment (e.g., frame number, time frame, pixel coordinates, specific image or an area within an image, line number or a region within the text, etc.,) and a corresponding type of redaction (e.g., blurring, removing etc.,) to be applied to the particular object or segment. As an example, redaction <NUM>-<NUM> is applied to the unredacted record <NUM>-<NUM> to generate a redacted record <NUM>-<NUM> in which, for instance, a segment of an image showing a person's face is redacted (e.g., blurred). In one embodiment, the redaction <NUM>-<NUM> may involve application of a redaction filter (e.g., blur filter) to pixel values within an area of pixels (e.g., an area containing a selected object) associated with an image to be redacted. The application of a redaction filter may modify optical characteristics (e.g., reduction of optical intensity) of one or more pixel values to which the filter is applied. The modification of the optical characteristics of the pixel values may make the area (e.g., an area showing the person's face) within a particular image more coherent and less distinct, resulting in a redacted image. Alternatively, the redaction <NUM>-<NUM> may also involve removing certain pixel values within an image or certain frames within an image containing data (e.g., face of a person) that is to be redacted.

In accordance with some embodiments, a redaction metadata <NUM> is generated each time a redacted record <NUM> is generated from an unredacted record <NUM>. The redaction metadata <NUM> associated with a redacted record <NUM> identifies one or more segments (e.g., frame number, pixel coordinates, etc.,) within an unredacted record <NUM> to which redaction <NUM> was applied to generate the redacted record <NUM>. As an example, a redaction metadata <NUM>-<NUM> identifies a particular segment within the unredacted record <NUM>-<NUM> to which the redaction <NUM>-<NUM> was applied to generate the redacted record <NUM>-<NUM>. In this example, the particular segment may refer to pixel coordinates identifying a region (e.g., a region within an image) where an unredacted face of a person appears within the unredacted record <NUM>-<NUM>. Depending on the type of redaction <NUM>-<NUM> applied to the unredacted record <NUM>-<NUM>, the corresponding region (i.e., region containing the face of a person) is blurred, removed, or masked to generate the corresponding redacted record <NUM>-<NUM>.

In accordance with some embodiments, the electronic computing device <NUM> is configured to automatically redact other unredacted records <NUM> (e.g., unredacted records <NUM>-<NUM>, <NUM>-<NUM>. <NUM>-N) based on a contextual correlation with a previously redacted record <NUM> (e.g., a redacted record <NUM>-<NUM> previously generated from redacting an unredacted record <NUM>-<NUM>). In these embodiments, the electronic computing device <NUM> uses the redaction metadata <NUM> of a previously redacted record <NUM> to determine a context in which a person or object was redacted from an unredacted record <NUM> corresponding to the previously redacted record <NUM>. The electronic computing device <NUM> further redacts other unredacted records <NUM> when the same redacted person or object is captured within other unredacted records under a same or similar context. As an example, the electronic computing device <NUM> uses the redaction metadata <NUM>-<NUM> associated with a previously redacted record <NUM>-<NUM> to identify a segment (e.g., frame number of a video) within the unredacted record <NUM>-<NUM> to which redaction <NUM>-<NUM> was applied to generate the redacted record <NUM>-<NUM>. The electronic computing device <NUM> then processes the identified segment within the unredacted record <NUM>-<NUM> to detect a context in which a person or object captured within the identified segment of the unredacted record <NUM>-<NUM> was redacted in the redacted record <NUM>-<NUM>. The electronic computing device <NUM> then redacts other unredacted records <NUM>-<NUM>, <NUM>-<NUM>,. <NUM>-N when information related to the same person or object is visually or non-visually captured within the unredacted records <NUM>-<NUM>, <NUM>-<NUM>,. <NUM>-N under a same or similar context.

In the example shown in <FIG>, the electronic computing device <NUM> may apply redaction <NUM>-<NUM> to the unredacted record <NUM>-<NUM> to generate a redacted record <NUM>-<NUM> in which, for instance, a segment of audio data containing a speech of the person (i.e., a person whose face was redacted in the previously redacted record <NUM>-<NUM>) is redacted. The redaction <NUM>-<NUM> may involve muting or removing portions of the audio data in which the person's speech (or other identifiable information about the person such as name, address, phone, vehicle license plate number etc., are detected. The redaction <NUM>-<NUM> may also involve changing a person's voice (e.g., by adding distortions, changing tone or pitch, etc.,) to protect the identity of the person. The electronic computing device <NUM> also generates a redaction record <NUM>-<NUM> identifying one or more audio segments within the corresponding unredacted record <NUM>-<NUM> to which the redaction <NUM>-<NUM> was applied to generate the redaction record <NUM>-<NUM>. As further shown in <FIG>, the electronic computing device <NUM> may apply redaction <NUM>-<NUM> to unredacted record <NUM>-<NUM> to generate a redacted record <NUM>-<NUM> in which, for instance, a portion of incident report containing a person's personal identifiable information (e.g., name, address, phone number, personal characteristics, vehicle license plate number, etc.,) is redacted. The redaction <NUM>-<NUM> may involve obscuring or removing portions of the incident report in which the person's personal identifiable information appears. The electronic computing device <NUM> also generates a redaction record <NUM>-<NUM> identifying one or more segments within the corresponding unredacted record <NUM>-<NUM> to which the redaction <NUM>-<NUM> was applied to generate the redaction record <NUM>-<NUM>.

In accordance with embodiments, the electronic computing device <NUM> is implemented as a standalone electronic device or alternatively integrated into one or more computing devices (e.g., computing devices operated by one or more agencies) operating within the system <NUM>. The electronic computing device <NUM> and the recording sources <NUM> communicate with the records database <NUM> via one or more communication networks <NUM>. The communication network <NUM> includes wireless and wired connections. For example, the communication network <NUM> may be implemented using a wide area network, such as the Internet, a local area network, such as a Wi-Fi network, and personal area or near-field networks, for example a Bluetooth™ network. Portions of the communications network <NUM> may include a Long Term Evolution (LTE) network, a Global System for Mobile Communications (or Groupe Special Mobile (GSM)) network, a Code Division Multiple Access (CDMA) network, an Evolution-Data Optimized (EV-DO) network, an Enhanced Data Rates for GSM Evolution (EDGE) network, a <NUM> network, a <NUM> network, a <NUM> network, and combinations or derivatives thereof.

<FIG> is an example functional block diagram of an electronic computing device <NUM> operating within the system <NUM> in accordance with some embodiments. The electronic computing device <NUM> may be embodied in computing devices not illustrated in <FIG>, and/or may be a distributed computing device across two or more of the foregoing (or multiple of a same type of one of the foregoing) and linked via a wired and/or wireless communication link(s). In one embodiment, one or more functions of the electronic computing device <NUM> may be executed at one or more other computing devices (e.g., recording sources <NUM>, servers hosting the one or more records databases <NUM>, etc.,) operating within the system <NUM>. While <FIG> represents an electronic computing device <NUM> described above with respect to <FIG>, depending on the type of the computing device, the electronic computing device <NUM> may include fewer or additional components in configurations different from that illustrated in <FIG>.

As shown in <FIG>, the electronic computing device <NUM> includes a communications interface <NUM> coupled to a common data and address bus <NUM> of a processing unit <NUM>. The communications interface <NUM> sends and receives data to and from other devices (e.g., records database <NUM>) in the system <NUM>. The communications interface <NUM> may include one or more wired and/or wireless input/output (I/O) interfaces <NUM> that are configurable to communicate with other devices in the system <NUM>. For example, the communications interface <NUM> may include one or more wireless transceivers <NUM>, such as a digital mobile radio (DMR) transceiver, a project <NUM> (P25) transceiver, a Bluetooth transceiver, a Wi-Fi transceiver perhaps operating in accordance with an IEEE <NUM> standard (for example, <NUM>. 11a, <NUM>1b, <NUM>), an long term evolution (LTE) transceiver, a WiMAX transceiver perhaps operating in accordance with an IEEE <NUM> standard, and/or another similar type of wireless transceiver configurable to communicate via a wireless radio network. The communications interface <NUM> may additionally or alternatively include one or more wireline transceivers <NUM>, such as an Ethernet transceiver, a universal serial bus (USB) transceiver, or similar transceiver configurable to communicate via a twisted pair wire, a coaxial cable, a fiber-optic link, or a similar physical connection to a wireline network. The transceiver <NUM> is also coupled to a combined modulator/demodulator <NUM>.

The processing unit <NUM> may include an encoder/decoder <NUM> with a code Read Only Memory (ROM) <NUM> coupled to the common data and address bus <NUM> for storing data for initializing system components. The processing unit <NUM> may further include an electronic processor <NUM> (for example, a microprocessor, a logic circuit, an application-specific integrated circuit, a field-programmable gate array, or another electronic device) coupled, by the common data and address bus <NUM>, to a Random Access Memory (RAM) <NUM> and a static memory <NUM>. The electronic processor <NUM> may generate electrical signals and may communicate electrical signals through the communications interface <NUM>, such as for receipt by the records database <NUM>.

Static memory <NUM> may store operating code <NUM> for the electronic processor <NUM> that, when executed, performs one or more of the blocks set forth in <FIG> and the accompanying text(s). The static memory <NUM> may comprise, for example, a hard-disk drive (HDD), an optical disk drive such as a compact disk (CD) drive or digital versatile disk (DVD) drive, a solid state drive (SSD), a tape drive, a flash memory drive, or a tape drive, and the like. In accordance with embodiments, the static memory <NUM> may further store information required for the electronic computing device <NUM> to provide redaction services corresponding to data records maintained by one or more agencies in one or more records databases <NUM>. For example, the electronic computing device <NUM> may download one or more data records from the one or more records databases <NUM> and further temporarily store the data records at the static memory <NUM> during execution of the process <NUM> set forth in <FIG>. In accordance with embodiments, the electronic computing device <NUM> employs one or more analytics engines (e.g., a video analytics engine, audio analytics engine, natural language processing engine etc.,) to process data records and to detect identifiable information related to persons or objects that may need to be redacted from unredacted records <NUM> based on redaction <NUM> applied to a previously redacted record <NUM>. In one embodiment, the executable code corresponding to the one or more analytics engines may be stored at the static memory <NUM>. In another embodiment, the analytics engines may reside in a computing device other than the electronic computing device <NUM>. In this case, the electronic computing device <NUM> may request a computing device hosting the analytics engines to analyze the data records and provide analytics data corresponding to persons or objects captured within the data records to the electronic computing device <NUM>.

Turning now to <FIG>, a flowchart diagram illustrates a process <NUM> for redacting records based on a contextual relation with a previously redacted record. While a particular order of processing steps, message receptions, and/or message transmissions is indicated in <FIG> as an example, timing and ordering of such steps, receptions, and transmissions may vary where appropriate without negating the purpose and advantages of the examples set forth in detail throughout the remainder of this disclosure. An electronic computing device <NUM> shown in <FIG> and/or <FIG>, and embodied as a singular computing device or distributed computing device may execute process <NUM> via an electronic processor <NUM>. In accordance with some embodiments, the process <NUM> is executed by an electronic computing device <NUM> employed by or associated with one or more agencies requesting a redaction service corresponding to data records maintained by the agencies in one or more records databases <NUM>.

The electronic computing device <NUM> may execute the process <NUM> at power-on, at some predetermined periodic time period thereafter, in response to a trigger raised locally at the computing device <NUM> via an internal process or via an input interface or in response to a trigger from an external device to which the electronic computing device <NUM> is communicably coupled, among other possibilities. As an example, the electronic computing device <NUM> is programmed to execute the process <NUM> when a request to provide a redaction service is received from a user affiliated with an agency.

The process <NUM> of <FIG> need not be performed in the exact sequence as shown and likewise various blocks may be performed in different order or alternatively in parallel rather than in sequence. The process <NUM> may be implemented on variations of the system <NUM> of <FIG> as well.

At block <NUM>, the electronic computing device begins to execute the process <NUM> by obtaining redaction metadata (e.g., redaction metadata <NUM>-<NUM>) associated with a redacted record (e.g., a redacted record <NUM>-<NUM>). In one embodiment, the electronic computing device <NUM> is programmed to begin execution of the process <NUM> each time a redacted record <NUM> (e.g., redacted record <NUM>-<NUM>, also referred to as "a previously redacted record") is generated based on applying redaction (e.g., redaction <NUM>-<NUM>) to the unredacted record <NUM> (e.g., unredacted record <NUM>-<NUM>). In one embodiment, the electronic computing device <NUM> is programmed to begin execution of the process <NUM> in response to detecting that a redacted record has been generated based on applying a manual redaction <NUM> to an unredacted record <NUM>. In other words, in this embodiment, the electronic computing device <NUM> begins to execute the process <NUM> whenever a redacted record is generated based on user inputs indicating which particular one or more segments of an unredacted record <NUM> should be redacted or which particular one or more of persons or objects (visually, audibly, or textually captured within the unredacted record <NUM>) should be redacted. In accordance with some embodiments, the electronic computing device <NUM> may be programmed to automatically obtain redaction metadata <NUM> associated with a redacted record <NUM> whenever an unredacted record <NUM> stored at the records database <NUM> has been redacted to generate the redacted record <NUM>.

In one embodiment, the redaction metadata <NUM> identifies a segment (or in some cases, multiple segments) within an unredacted record <NUM> to which redaction <NUM> was applied to generate the previously redacted record <NUM>. The term "segment" may indicate one or more of a particular frame number or time frame within a video or audio; pixel coordinates or a particular area or a boundary within an image; a line number, a paragraph number, or a particular area within a text document; or any other data identifying which portions of the data record have been redacted. In one embodiment, the redaction metadata <NUM> may optionally include information indicating a rule, policy, or a reason under which an identified segment (or a person or object) within the unredacted record <NUM> has been redacted to generate the redaction record. As an example, an agency may have a policy of redacting, from certain unredacted records <NUM>, personal identifiable information related to persons (e.g., bystanders) when such information does not have any evidentiary value with respect to a public-safety incident. As another example, an agency may have a policy of redacting, from certain unredacted records <NUM>, personal identifiable information related to persons participating in a witness protection program. As a further example, an agency may have a policy of redacting, from certain unredacted records <NUM>, personal identifiable information related to officers who have been authorized to participate in an under-cover or covert public-safety operation. In these examples, the redaction metadata <NUM> may include information identifying a particular redaction policy or rule as well as information indicating (but not including any personal identifiable information) that a person (or any object associated with the person) has been redacted from the unredacted record <NUM> in accordance with the agency's policy. The redaction metadata <NUM> may also include information indicating non-personal identifiable information, for example, number of persons or objects or characteristics of such persons or objects that have been redacted within one or more of the identified segments of the previously redacted record <NUM>.

At block <NUM>, the electronic computing device <NUM> processes the identified segment (or in some cases multiple identified segments) of the unredacted record <NUM> using one or more analytics engines to detect that a person or an object captured within the identified segment of the unredacted record <NUM> was redacted in the redacted record <NUM>. The analytics engines employed by the electronic computing device <NUM> may include one or more of person, object, or text classifiers, where each classifier may be particularly trained to detect an instance of a person or an object captured (e.g., visually, audibly, or textually captured) within the identified segment of the unredacted record <NUM>. As an example, when the unredacted record <NUM> is an image record, the electronic computing device <NUM> may process the identified segment (e.g., pixel coordinates identified in the redaction metadata <NUM>) using an image analytics engine to detect that a person (e.g., person's face) or an object (e.g., vehicles license plate) captured within the identified segment of the unredacted record <NUM> (e.g., unredacted record <NUM>-<NUM>) was redacted in the previously redacted record <NUM> (e.g., redacted record <NUM>-<NUM>). As another example, when the unredacted record <NUM> is a text-based incident report, the electronic computing device <NUM> may process the identified segment (e.g., a line number, a page number, a document number, a file name, etc.,) using an analytics engine (e.g., natural language processing engine) to detect that information (e.g., captured in textual form) related to a person (e.g., a person's personal identifiable information such as name, address, phone number, social security number, etc.,) or an object (e.g., license plate number in a vehicle) captured within the identified segment of the unredacted record <NUM> was redacted in the previously redacted record <NUM>.

At block <NUM>, the electronic computing device <NUM> further processes the identified segment (or in some cases, multiple identified segments) of the unredacted record <NUM> using one or more analytics engines to detect specific characteristics of the person or the object captured within the identified segment of the unredacted record <NUM> and further redacted in the previously redacted record <NUM>. In accordance with embodiments, the analytics engines employed by the electronic computing device may be trained to detect characteristics of an object (e.g., vehicle, watch, cloth, backpack, shoe, wall, furniture, flower, flower pot, animal, blood splatter, etc.,) or parts of an object (e.g., individual parts of a broken table such as table leg and table surface). The characteristics of an object include, but not limited to, object type, object shape, object pattern, text within the object, and association of an object to persons (e.g., a vehicle may be associated with a person when the vehicle is determined to have been operated and/or owned by the person) or other objects. In some embodiments, the analytics engines may include a recognition engine to recognize characteristics of persons or objects appearing in data records, where one or more of the characteristics can be used to determine an identity of a person. The characteristics may represent any data visually, audibly, or textually captured in or deduced from data records (e.g., images, videos, audios, text, etc.,) that can be used to uniquely identify or verify an identity of a person. The characteristics of a person may include, but not limited to, face, fingerprint, eye (iris and retina), gesture, gait characteristic, and body marks such as birthmarks, moles, body piercings, tattoos, scars, and the like. In some embodiments, the electronic computing device <NUM> employs a natural language processing engine to semantically process, for example, text-based data records and detect identifiable information (e.g., person's name, address, telephone, social security number, vehicle license plate number, etc.,) related to the person or object detected within the identified segment of the unredacted record <NUM>.

At block <NUM>, the electronic computing device <NUM> obtains at least one context attribute specifying a context in which the person or object (i.e., person or object redacted in the previously redacted record <NUM>) was captured within the identified segment or segments of the unredacted record <NUM>. The context attribute identifies one or more of: a geographical location at which the person or the object was captured in the unredacted record <NUM>; a time at which the person or the object was captured in the unredacted record <NUM>, an action performed by or in relation to the person or the object captured in the unredacted record <NUM>, an interaction between the person or the object with another person or object captured in the unredacted record <NUM>, an identity of the person or a type of the object captured in the unredacted record <NUM>, a statement made in relation to the person or object captured in the unredacted record <NUM>, and any other information that may describe the context in which the person or the object was captured in the unredacted record <NUM> corresponding to the previously redacted record <NUM>. In accordance with some embodiments, the electronic computing device <NUM> may obtain the context attribute from analytics data extracted by the analytics engines from processing the identified segment within the unredacted record <NUM>. The electronic computing device <NUM> may also obtain the context attribute from metadata associated with the unredacted record <NUM>.

At block <NUM>, the electronic computing device <NUM> identifies at least one other unredacted record (e.g., unredacted records <NUM>-<NUM>, <NUM>-<NUM>. <NUM>-N) associated with the unredacted record (e.g., unredacted record <NUM>-<NUM>). In accordance with some embodiments, the electronic computing device <NUM> has permission to access all or a subset of unredacted records <NUM> maintained by one or more agencies at one or more records databases <NUM>. The electronic computing device <NUM> searches the data records stored at the one or more records databases <NUM> to identify other unredacted records <NUM> that are associated with the unredacted record <NUM> which was previously redacted. In accordance with some embodiments, the electronic computing device <NUM> determines that the unredacted record <NUM> (i.e., corresponding to a previously redacted record) is associated with the at least one other unredacted record <NUM> when the unredacted record <NUM> and the at least one other unredacted record <NUM> are linked to one or more of: a same incident identifier, a same location, a same timestamp, or recording sources <NUM> assigned to a same communication group. As an example, the electronic computing device <NUM> may determine that the unredacted record <NUM>-<NUM> is associated with other unredacted records <NUM>-<NUM>, <NUM>-<NUM>,. <NUM>-N when the unredacted record <NUM>-<NUM> and other unredacted records <NUM>-<NUM>, <NUM>-<NUM>,. <NUM>-N were captured corresponding to a same incident (e.g., a vehicle collision incident). As another example, the electronic computing device <NUM> may determine that the unredacted record <NUM>-<NUM> is associated with other unredacted records <NUM>-<NUM>, <NUM>-<NUM>,. <NUM>-N when the unredacted record <NUM>-<NUM> and other unredacted records <NUM>-<NUM>, <NUM>-<NUM>,. <NUM>-N were captured during the same period of time. As another example, the electronic computing device <NUM> may determine that the unredacted record <NUM>-<NUM> is associated with other unredacted records <NUM>-<NUM>, <NUM>-<NUM>,. <NUM>-N when the unredacted record <NUM>-<NUM> and other unredacted records <NUM>-<NUM>, <NUM>-<NUM>,. <NUM>-N were captured by recording sources <NUM> that were deployed at the same location or when the recording sources <NUM> were assigned to the same communication group (e.g., a talk group). For instance, unredacted records <NUM>-<NUM>, <NUM>-<NUM>, and <NUM>-<NUM> each may represent an image or a video respectively captured by body-worn cameras operated by officers responding to the same incident and further assigned to the same communication group. In accordance with some embodiments, two unredacted records <NUM> may be associated with each other even when the unredacted records <NUM> are maintained at different records databases <NUM> and/or maintained by different agencies. As an example, assume that the unredacted record <NUM>-<NUM> (e.g., audio record) is captured by a recording source <NUM>-<NUM> (e.g., a land mobile radio) operated by a first agency (e.g., police department) and the unredacted record <NUM>-N (e.g., video record) is captured by a recording source <NUM>-N (e.g., surveillance camera) operated by a second agency (e.g., city administration). In this example, even though the unredacted records <NUM>-<NUM>, <NUM>-N are captured by recording sources <NUM>-<NUM>, <NUM>-N, respectively, associated with different agencies and further maintained at different records databases <NUM>, the electronic computing device <NUM> may still determine that the unredacted records <NUM>-<NUM>, <NUM>-N are associated with each other, for example, when the unredacted records <NUM>-<NUM>, <NUM>-N are linked to a same incident (e.g., determined based on time, location, or incident identifier).

At block <NUM>, the electronic computing device <NUM> determines that characteristics of a person or an object captured within at least one other segment of the at least one other unredacted record (e.g., unredacted records <NUM>-<NUM>, <NUM>-<NUM>. <NUM>-N) match with the characteristics of the person or the object captured within the identified segment of the unredacted record (e.g., unredacted record <NUM>-<NUM>). In accordance with embodiments, the electronic computing device <NUM>-<NUM> processes each of the other unredacted records <NUM>-<NUM>, <NUM>-<NUM>,. <NUM>-N using one or more analytics engine to extract analytics data including characteristics of one or more persons or objects captured from within one or more segments of the other unredacted records <NUM>-<NUM>, <NUM>-<NUM>,. In accordance with embodiments, the electronic computing device <NUM> compares the characteristics (determined at block <NUM>) of the person or the object detected within the identified segment of the unredacted record <NUM>-<NUM> with characteristics of one or more persons or objects captured within one or more segments of the other unredacted records <NUM>-<NUM>, <NUM>-<NUM>,. <NUM>-N to determine if the same person or object (i.e., person or object redacted in the previously redacted record <NUM>) is also captured in other unredacted records <NUM>-<NUM>, <NUM>-<NUM>,. As an example, the electronic computing device <NUM> may determine that the face of a person captured in the unredacted record <NUM>-<NUM> (e.g., image record) and further redacted in the previously redacted record <NUM>-<NUM> visually matches the face of a person captured within a video of the unredacted record <NUM>-N. As another example, the electronic computing device <NUM> may determine that a license plate number of a vehicle captured in an image included in the unredacted record <NUM>-<NUM> and further redacted in the previously redacted record <NUM>-<NUM> matches with a license plate number of a vehicle captured in a text record included in the unredacted record <NUM>-N. As yet another example, assume that the electronic computing device <NUM> determines (at block <NUM>) that a person captured in a video of the unredacted record <NUM>-<NUM> was wearing a blue shirt with a red cap. Also, assume that the electronic computing device <NUM> determines that the unredacted record <NUM>-<NUM> contains an audio communication (e.g., captured via the recording source <NUM>-<NUM> such as a land mobile radio) indicating that a person of interest is wearing a blue shirt with a red cap. In this example, the electronic computing device <NUM> may determine that the characteristics (i.e., blue shirt with a red cap) of a person captured in the unredacted record <NUM>-<NUM> corresponding to the previously redacted record <NUM>-<NUM> match with the characteristics (i.e., blue shirt with a red cap) of a person audibly captured in the unredacted record <NUM>-<NUM>.

At block <NUM>, the electronic computing device <NUM> obtains at least one other context attribute specifying a context in which the person or the object was captured within the at least other segment (determined at block <NUM>) of the at least one other unredacted record (e.g., unredacted records <NUM>-<NUM>, <NUM>-<NUM>. As an example, assume that the electronic computing device <NUM> has determined (at block <NUM>) that the characteristics (e.g., face, gait characteristic, body marks etc.,) of a person captured within an unredacted record <NUM>-<NUM> (i.e., corresponding to the previously redacted record <NUM>-<NUM>) match with one or more characteristics of a person audibly captured within a particular segment of an unredacted record <NUM>-<NUM> (e.g., audio record). In this case, the electronic computing device <NUM> determines a context attribute specifying a context in which the person or the object (with matching characteristics) was audibly captured within one or more segments of the unredacted record <NUM>-<NUM>. The context attribute identifies one or more of: a geographical location at which the person or the object was captured in the unredacted record <NUM>-<NUM>; a time at which the person or the object was captured in the unredacted record <NUM>-<NUM>, an action performed by or in relation to the person or the object captured in the unredacted record <NUM>-<NUM>, an interaction between the person or the object with another person or object captured in the unredacted record <NUM>-<NUM>, an identity of the person or type of the object captured in the unredacted record <NUM>-<NUM>, a statement made in relation to the person or object captured in the unredacted record <NUM>-<NUM>, and any other information that may describe the context in which the person or the object was captured in the unredacted record <NUM>-<NUM>. In accordance with some embodiments, the electronic computing device <NUM> may obtain the context attribute from analytics data extracted by the analytics engines from processing one or more segments of the unredacted record <NUM>-<NUM>. Additionally, or alternatively, the electronic computing device <NUM> may also obtain the context attribute from metadata associated with the unredacted record <NUM>-<NUM>.

At block <NUM>, the electronic computing device <NUM> determines a contextual correlation value based on a correlation between the at least one context attribute (i.e., context attribute determined at block <NUM>) and the at least one other context attribute (i.e., context attribute determined at block <NUM>). As an example, when the context attribute represents a geographical location, the electronic computing device <NUM> may compare a geographical location at which a person or object (i.e., person or object redacted in a previously redacted record <NUM>-<NUM>) was captured in an unredacted record <NUM>-<NUM> with a geographical location at which a person or object with matching characteristics was captured in another unredacted record <NUM>-N. When the geographical locations match or are within a predefined distance, the electronic computing device <NUM> may assign a contextual correlation value representing a correlation between the two context attributes. The contextual correlation value may be expressed in terms of percentages, correlation levels, numerical values, among other possibilities. In this example, the electronic computing device <NUM> may assign a contextual correlation value of '<NUM>%' when the geographical location associated with the redacted person or object captured in the unredacted record <NUM>-<NUM> matches with the geographical location associated with the person captured in the other unredacted record <NUM>-N. In one embodiment, the electronic computing device <NUM> may assign a contextual correlation value based on the correlation between a plurality of context attributes (i.e., multiple context attributes obtained at block <NUM> corresponding to the redacted person or object captured within the unredacted record <NUM>-<NUM>) and a corresponding plurality of context attributes (i.e., multiple context attributes obtained at block <NUM> corresponding to the person or object captured within the unredacted record <NUM>-N). As an example, suppose the electronic computing device <NUM> computes a contextual correlation value based on a correlation between context attributes including a first context attribute indicating a geographical location at which a person was captured, a second context attribute indicating a time at which the person was captured, and a third context attribute indicating an interaction (or non-interaction) between the person with another person or another object such as a vehicle. In this case, the electronic computing device <NUM> may correlate the geographical locations at which the same person was respectively captured in the unredacted records <NUM>-<NUM>, <NUM>-N to compute a first contextual correlation value. The electronic computing device <NUM> may further correlate the time at which the same person was respectively captured in the unredacted records <NUM>-<NUM>, <NUM>-N to compute a second contextual correlation value. The electronic computing device <NUM> may further determine whether the unredacted records <NUM>-<NUM>, <NUM>-N have both captured the same person interacting with the same object to compute a third contextual correlation value. The electronic computing device <NUM> then determines an aggregated contextual correlation value as a function (e.g., sum function, average function, etc.,) of the first, second, and third contextual correlation values. In one embodiment, the electronic computing device <NUM> may apply different weights to correlation values resulting from correlations between different types of context attributes. As an example, the electronic computing device <NUM> may apply a higher weight to a context attribute indicating a person's interaction with another person or object, but lower weight to context attributes indicating the geographical location and time. In accordance with some embodiments, if there are multiple persons or objects that were redacted in the identified segment of the previously redacted record <NUM> (e.g., redacted record <NUM>-<NUM>), the electronic computing device <NUM> determines a separate contextual correlation value corresponding to each different redacted person or object.

At block <NUM>, after determining the contextual correlation value, the electronic computing device <NUM> determines whether the contextual correlation value exceeds a correlation threshold. In accordance with embodiments, the electronic computing device <NUM> is configured to compare the contextual correlation value determined at block <NUM> with the correlation threshold. The correlation threshold may be set in terms of percentages (e.g., <NUM>%, <NUM>%, etc.,), numerical values (e.g., <NUM>, <NUM> etc.,), correlation levels (e.g., level <NUM>, level <NUM>), among other possibilities. The electronic computing device <NUM> may set and/or dynamically adjust the correlation threshold based on one or more of user inputs or system inputs obtained through machine learning algorithms. When the contextual correlation value (e.g., <NUM>%) exceeds the threshold (e.g., <NUM>%), the electronic computing device <NUM> generates at least one other redacted record (e.g., redacted record <NUM>-<NUM>) by redacting the person or the object detected within the at least one other unredacted record (e.g., unredacted record <NUM>-<NUM>). Otherwise, when the contextual correlation value does not exceed the threshold, the electronic computing device <NUM> does not redact the person or the object detected within the at least one other unredacted record (e.g., unredacted record <NUM>-<NUM>). In accordance with some embodiments, if there are multiple persons or objects that were redacted in the identified segment of the previously redacted record <NUM> (e.g., redacted record <NUM>-<NUM>), the electronic computing device <NUM> compares a contextual correlation value determined for each different person or object with the correlation threshold and further redacts each person or object from the at least one other unredacted record (e.g., unredacted record <NUM>-<NUM>) when the contextual correlation exceeds the correlation threshold. If the contextual correlation value determined for any of the persons or objects does not exceed the threshold, then the electronic computing device <NUM> refrains from redacting the particular one of the persons or objects captured in the at least one other unredacted record (e.g., unredacted record <NUM>-<NUM>). In any case, the electronic computing device <NUM> generates a redacted record (e.g., redacted record <NUM>-<NUM>) as long as at least one person or object was redacted from the unredacted record (e.g., unredacted record <NUM>-<NUM>). In addition, the electronic computing device <NUM> also generates a redaction metadata (e.g., redaction metadata <NUM>-<NUM>) identifying the specific segments in which one or more persons or objects were redacted from the unredacted record <NUM> (e.g., unredacted record <NUM>-<NUM>). The redaction metadata <NUM>-<NUM> may also identify a rule, policy, or a reason under which the specific segments within the unredacted record <NUM>-<NUM> have been redacted to generate the redaction record <NUM>-<NUM>. In one embodiment, the redaction metadata <NUM>-<NUM> may include an indicator indicating that the redaction record <NUM>-<NUM> was generated based on a contextual correlation with a previously redacted record <NUM>-<NUM>. In this case, the redaction metadata <NUM>-<NUM> may include a link to the previously redacted record <NUM>-<NUM> or the corresponding unredacted record <NUM>-<NUM>.

In accordance with some embodiments, when the contextual correlation value exceeds the correlation threshold, the electronic computing device <NUM> redacts at least one other unredacted record (e.g., unredacted records <NUM>-<NUM>, <NUM>-<NUM>. <NUM>-N) only after obtaining permission from an authorized user. In this embodiment, the electronic computing device <NUM> transmits, to a communication device of an authorized user (e.g., a user affiliated with an agency that maintains the other unredacted record), a request for approval to redact the person or the object detected within the at least one other segment of the at least one other unredacted record. The electronic computing device <NUM> then redacts the person or the object detected within the at least one other segment of the at least one other unredacted record only when a response indicating an approval to redact the person or the object is received from the communication device of the authorized user.

In accordance with some embodiments, the electronic computing device <NUM> may determine that a first person or object captured within the identified segment of the unredacted record <NUM>-<NUM> (i.e., corresponding to the previously redacted record <NUM>-<NUM>) is related to a second person or object captured within the same identified segment or different segment of the unredacted record <NUM>-<NUM>. In accordance with some embodiments, the electronic computing device <NUM> may determine that the first person or object is related to the second person or object based on analytics data extracted from analyzing the unredacted record <NUM>-<NUM> using one or more analytics engines. In these embodiments, the electronic computing device <NUM> may determine that the first person or object captured in the unredacted record <NUM>-<NUM> is related to the second person or object captured in the unredacted record <NUM>-<NUM> when it is determined that the first person or object captured in the unredacted record <NUM>-<NUM> has interacted with the second person or object captured in the unredacted record <NUM>-<NUM>. As an example, the electronic computing device <NUM> may determine that the first person captured in the unredacted record <NUM>-<NUM> has interacted with the second person captured in the unredacted record <NUM>-<NUM> based on physical proximity or detected conversations between the two persons. As another example, the electronic computing device <NUM> may determine that a person captured in the unredacted record <NUM>-<NUM> has interacted with an object captured in the unredacted record <NUM>-<NUM> based on physical proximity between the person and the object, or one or more actions performed by the person in relation to the object (e.g., a person exiting, entering, or operating a vehicle). As another example, the electronic computing device <NUM> may determine that a first person or object captured in the unredacted record <NUM>-<NUM> is related to the second person or object captured in the unredacted record <NUM>-<NUM> when the electronic computing device <NUM> detects a statement or a display (e.g., gesture) from the second person or object revealing an identity of the person or object captured in the unredacted record <NUM>-<NUM>. As another example, assume that a first person redacted from a previously redacted record <NUM>-<NUM> is also captured in an unredacted record <NUM>-N. Further assume that the first person captured in the unredacted record <NUM>-N is having conversations with a second person captured in the unredacted record <NUM>-N. In this example, the electronic computing device <NUM> may redact the conversations between the two persons as captured in the unredacted record <NUM>-N to generate a redacted record <NUM>-N when the conversations include any statement (e.g., from the second person) revealing the identity (i.e., personal identifiable information) of the person redacted from the previously redacted record <NUM>-<NUM>. In addition, the electronic computing device <NUM> may also redact, for example, the face of the first person as well as the second person captured in the unredacted record <NUM>-N while generating a corresponding redacted record <NUM>-N. In this example, the electronic computing device <NUM> may determine characteristics (e.g., similar to block <NUM>) of the second person captured in the unredacted record <NUM>-N. The electronic computing device <NUM> may further determine (e.g., similar to block <NUM>) that characteristics of the first person captured in the unredacted record <NUM>-<NUM> match with the characteristics of the second person captured in the unredacted record <NUM>-N. The electronic computing device <NUM> then redacts the second person in addition to the first person from the unredacted record <NUM>-N to generate a corresponding redacted record <NUM>-N. In some embodiments, the electronic computing device <NUM> may also redact identifiable information (e.g., person's face, name, phone number, vehicle license plate number etc.,) related to the second person from one or more previously redacted records <NUM> (e.g., redacted record <NUM>-<NUM>) even if the electronic computing device <NUM> determines that the one or more previously redacted records <NUM> did not capture any interaction between the first person and the second person.

In accordance with embodiments, the electronic computing device <NUM> may execute the process <NUM> to redact a particular unredacted record, for example, unredacted record <NUM>-<NUM> in response to a user input requesting access to view and/or playback the unredacted record <NUM>-<NUM>. In these embodiments, in response to a user input requesting to access an unredacted record <NUM>-<NUM>, the electronic computing device <NUM> determines, in accordance with the block <NUM> of the process <NUM> shown in <FIG>, that an unredacted record <NUM>-<NUM> is associated with another unredacted record, for example, unredacted record <NUM>-<NUM> which has been previously redacted to generate a corresponding redacted record <NUM>-<NUM> in accordance with the block <NUM>. The electronic computing device <NUM>-<NUM> then retrieves redaction metadata <NUM>-<NUM> associated with the redacted record <NUM>-<NUM>. In accordance with some embodiments, a single unredacted record <NUM>-<NUM> may be redacted to generate multiple versions of the redacted record <NUM>-<NUM>, where each version can be accessed by users (e.g., press, police, medical, etc.,) with different levels of authorization. Accordingly, in these embodiments, multiple versions of redaction metadata <NUM> may be maintained for multiple versions of the redacted record <NUM>-<NUM>. In any case, in response to user input requesting to access the unredacted record <NUM>-<NUM>, the electronic computing device <NUM> identifies an associated unredacted record <NUM>-<NUM> and further retrieves a version of redaction metadata <NUM>-<NUM> that corresponds to a version of the redacted record <NUM>-<NUM> that is accessible by the user requesting to access the unredacted record <NUM>-<NUM>. The electronic computing device <NUM> then executes the remaining blocks of process <NUM> set forth in <FIG> to generate a redacted record <NUM>-<NUM> corresponding to the unredacted record <NUM>-<NUM> based on redaction <NUM>-<NUM> applied to the unredacted record <NUM>-<NUM>. The redacted record <NUM>-<NUM> can then be accessed and/or played back to the user in real-time in response to the user input received from the user. In some of these embodiments, the electronic computing device <NUM> may not store a copy of the redacted record <NUM>-<NUM> at the records database <NUM>. In another embodiment, the electronic computing device <NUM> may delete any copy of the redacted record <NUM>-<NUM> locally and/or remotely stored, for example, at the records database <NUM>, after the user has viewed and/or played back the redacted record <NUM>-<NUM>.

<FIG> shows an example of an unredacted record <NUM>-<NUM> including an image <NUM> captured corresponding to an incident (e.g., a vehicle collision incident) by a recording source <NUM>-<NUM> such as a body-worn camera in accordance with some embodiments. Assume that an operator authorized by a public-safety agency (e.g., police) to redact records views the image <NUM> included in the unredacted record <NUM>-<NUM> and decides to redact the face of a person <NUM> (e.g., a bystander with no evidentiary value) as well as the license plate number of a vehicle <NUM> (e.g., a vehicle determined to have been operated by the person <NUM>) appearing within the image <NUM>. In this case, the operator may provide an input selecting one or more portions (e.g., a segment <NUM> in which the face of the person <NUM> appears and a segment <NUM> in which the license plate number of the vehicle <NUM> appears) of the image <NUM> on which redaction <NUM>-<NUM> (e.g., blurring) is to be applied. Alternatively, the operator can also provide an input selecting one or more segments (e.g., other than the segments <NUM>, <NUM>) within the image that are to remain unredacted. The electronic computing device <NUM> may automatically determine that segments <NUM>, <NUM> are to be redacted based on the input. In any case, in response to the input received from the operator, the electronic computing device <NUM> shown in <FIG> and <FIG> or some other computing device employed by the public-safety agency may automatically redact the data contained in the segments <NUM>, <NUM> selected by the operator. As a result of redaction <NUM>-<NUM> applied to the unredacted record <NUM>-<NUM>, a redacted record <NUM>-<NUM> is generated as shown in <FIG>.

Now referring to <FIG>, a redacted record <NUM>-<NUM> is shown with an image <NUM> in which the segment <NUM> is redacted to mask the face of the person <NUM> and the segment <NUM> is redacted to mask the license plate number of the vehicle <NUM>. In accordance with embodiments, a redaction metadata <NUM>-<NUM> (see <FIG>) is automatically generated to identify the segments <NUM>, <NUM> within the image <NUM> included in the unredacted record <NUM>-<NUM> to which redaction <NUM>-<NUM> was applied to generate the redacted record <NUM>-<NUM>. In accordance with some embodiments, whenever an unredacted record (e.g., unredacted record <NUM>-<NUM>) has been redacted to generate a new redacted record (e.g., redacted record <NUM>-<NUM>), the electronic computing device <NUM> automatically executes the process set forth in <FIG> to redact other unredacted records that are contextually-related to a previously redacted record (e.g., redacted record <NUM>-<NUM>) as further described below with reference to <FIG>.

<FIG> shows an example of an unredacted record <NUM>-N including an image <NUM> captured corresponding to the same incident shown in <FIG> by a recording source <NUM>-N such as a surveillance camera in accordance with some embodiments. In this example, the electronic computing device <NUM> may identify that the unredacted record <NUM>-N is associated with an unredacted record <NUM>-<NUM> (which has been previously redacted to generate a redacted record <NUM>-<NUM> as shown in <FIG>) because both the unredacted records <NUM>-<NUM>, <NUM>-N were captured corresponding to the same incident. In the example shown in <FIG>, the electronic computing device <NUM> may determine that a person <NUM> captured within a segment <NUM> of the image <NUM> included in the unredacted record <NUM>-N has characteristics (e.g., face) matching the characteristics of the person <NUM> captured within the segment <NUM> (identified in redaction metadata <NUM>-<NUM>) of the image <NUM> included in the unredacted record <NUM>-<NUM> shown in <FIG>. The electronic computing device <NUM> may further determine that a vehicle <NUM> captured within a segment <NUM> of the image <NUM> included in the unredacted record <NUM>-N has characteristics (e.g., license plate number) matching the characteristics of the vehicle <NUM> captured within the segment <NUM> (identified in redaction metadata <NUM>-<NUM>) of the image <NUM> included in the unredacted record <NUM>-<NUM> shown in <FIG>. The electronic computing device <NUM> may further determine a contextual correlation value based on a correlation between a context attribute specifying a context (e.g., geographical location, time, person's action or behavior level, person's interaction with other persons or objects) in which the person <NUM> captured in the image <NUM> included in the unredacted record <NUM>-<NUM> was redacted and a context attribute specifying a context in which the person <NUM> was captured in the image <NUM> included in the unredacted record <NUM>-N. When the contextual correlation value exceeds a correlation threshold, the electronic computing device <NUM> automatically applies redaction <NUM>-N (which may be of similar type to redaction <NUM>-<NUM> previously applied to the unredacted record <NUM>-<NUM> to generate the redacted record <NUM>-<NUM>) to the segment <NUM> of the image <NUM> included in the unredacted record <NUM>-N to generate a redacted record <NUM>-N as shown in <FIG>. The electronic computing device <NUM> may similarly determine a contextual correlation value based on a correlation between a context attribute specifying a context (e.g., geographical location, time, action performed in relation to the object, interaction of the object by another person or object) in which the vehicle <NUM> captured in the image <NUM> included in the unredacted record <NUM>-<NUM> was redacted and a context attribute specifying a context in which the vehicle <NUM> was captured in the image <NUM> included in the unredacted record <NUM>-N. When the contextual correlation value exceeds a correlation threshold, the electronic computing device <NUM> automatically applies redaction <NUM>-N (which may be of similar type to redaction <NUM>-<NUM> previously applied to the unredacted record <NUM>-<NUM> to generate the redacted record <NUM>-<NUM>) to the segment <NUM> of the image <NUM> included in the unredacted record <NUM>-N to generate a redacted record <NUM>-N as shown in <FIG>.

In the example shown in <FIG>, a redacted record <NUM>-N is generated with an image <NUM> in which the segment <NUM> is redacted to mask the face of the person <NUM> and the segment <NUM> is redacted to mask the license plate number of the vehicle <NUM>. In accordance with embodiments, a redaction metadata <NUM>-N (see <FIG>) is automatically generated to identify the segments <NUM>, <NUM> within the image <NUM> included in the unredacted record <NUM>-N to which redaction <NUM>-N was applied to generate the redacted record <NUM>-N. In accordance with embodiments, the electronic computing device <NUM> repeats the execution of the process set forth in <FIG> to redact any unredacted record (irrespective of data type or recording sources <NUM>) that is contextually-related to a previously redacted record <NUM>-<NUM>.

<FIG> shows an example of an unredacted record <NUM>-<NUM> including a text-based incident report <NUM> captured from the same incident shown in <FIG> and <FIG> by a recording source <NUM>-<NUM> such as a communication device operated by a public-safety officer. As an example, the public-safety officer might have submitted the incident report <NUM> after responding to a vehicle collision incident at a location of the incident scene. In this example, the electronic computing device <NUM> may identify that the unredacted record <NUM>-<NUM> is associated with an unredacted record <NUM>-<NUM> (which has been previously redacted to generate a redacted record <NUM>-<NUM> shown in <FIG>) because both the unredacted records <NUM>-<NUM>, <NUM>-<NUM> were captured corresponding to the same incident. In the example shown in <FIG>, the electronic computing device <NUM> may determine that information (e.g., name, address etc.,) captured within a segment <NUM> of the incident report included in the unredacted record <NUM>-<NUM> is associated with the person <NUM> captured within the segment <NUM> (identified in redaction metadata <NUM>-<NUM>) of the image <NUM> included in the unredacted record <NUM>-<NUM>. As an example, the electronic computing device <NUM> may process the incident report <NUM> using a natural language processing engine to extract personal identifiable information such as name and address of a person. The electronic computing device <NUM> then verifies whether the characteristics (i.e., identifiable information) captured in textual form in the incident report <NUM> included in the unredacted record <NUM>-<NUM> match with characteristics (e.g., identifiable information retrieved from data records other than the unredacted record <NUM>-<NUM>) of the person <NUM> captured within the image <NUM> of the unredacted record <NUM>-<NUM>. If there is a match in the characteristics, the electronic computing device <NUM> further determines a contextual correlation value based on a correlation between a context attribute specifying a context (e.g., geographical location, time, person's action or behavior level, person's interaction with other person's or objects) in which the person <NUM> captured within the image <NUM> included in the unredacted record <NUM>-<NUM> was redacted and a context attribute specifying a context in which the same person's personal identifiable information was captured in the unredacted record <NUM>-<NUM>. When the contextual correlation value exceeds a correlation threshold, the electronic computing device <NUM> automatically applies redaction <NUM>-<NUM> (e.g., masking the text to indicate that the text has been redacted) to the segment <NUM> of the incident report <NUM> included in the unredacted record <NUM>-<NUM> to generate a redacted record <NUM>-<NUM> as shown in <FIG>.

In the example shown in <FIG>, a redacted record <NUM>-<NUM> is generated with a redacted incident report <NUM> in which the segment <NUM> is redacted to mask the person's personal identifiable information. In accordance with embodiments, a redaction metadata <NUM>-<NUM> (see <FIG>) is automatically generated to identify the segment <NUM> within the incident report <NUM> included in the unredacted record <NUM>-<NUM> to which redaction <NUM>-<NUM> was applied to generate the redacted record <NUM>-<NUM>. In accordance with embodiments, in the examples shown in <FIG>, and <FIG>, the electronic computing device <NUM> may redact the unredacted records <NUM>-N, <NUM>-<NUM> to generate the corresponding redacted records <NUM>-N, <NUM>-<NUM> only after receiving an approval from an authorized user. In one embodiment, the electronic computing device <NUM> may automatically delete an unredacted record <NUM> or mark an unredacted record <NUM> for deletion whenever an unredacted record <NUM> has been redacted to generate a corresponding redacted record <NUM>.

In accordance with some embodiments, the electronic computing device <NUM> may execute a process to unredact a person (or object) previously redacted in one or more redacted records <NUM> in response to a request from an authorized user. As an example, assume that the electronic computing device <NUM> has automatically redacted information (i.e., person's <NUM> face within the image <NUM> shown in <FIG> and person's <NUM> name and address included within the incident report <NUM> shown in <FIG>) relating to the person <NUM> to generate redacted records <NUM>-<NUM>, <NUM>-N based on a redaction of the face of the person <NUM> in a previously redacted record <NUM>-<NUM>. In this example, assume that the electronic computing device <NUM> has received an authorized request (e.g., in response to a court order authorizing unredaction of data) to unredact identifiable information related to the same person <NUM>. In response to this request, the electronic computing device <NUM> automatically processes the previously redacted records (e.g., redacted records <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-N) to unredact identifiable information (e.g., person's <NUM> face shown within the images <NUM>, <NUM> and person's <NUM> name and address included within the incident report <NUM>) related to the person <NUM>.

While embodiments of the present disclosure are described with examples relating to images captured corresponding to public-safety related incident scenes, embodiments of the present disclosure can be also readily adapted for non-public safety environments including press, media, utilities, retail, healthcare, manufacturing, oil/gas, electric, private security, and other business environments where there may be a need to automatically redact different types of data records captured in such environments based on a contextual correlation with one or more previously redacted records.

As should be apparent from this detailed description, the operations and functions of the computing devices described herein are sufficiently complex as to require their implementation on a computer system, and cannot be performed, as a practical matter, in the human mind. Electronic computing devices such as set forth herein are understood as requiring and providing speed and accuracy and complexity management that are not obtainable by human mental steps, in addition to the inherently digital nature of such operations (e.g., a human mind cannot interface directly with RAM or other digital storage, cannot transmit or receive electronic messages, electronically encoded video, electronically encoded audio, etc., among other features and functions set forth herein).

However, one of ordinary skill in the art appreciates that various modifications and changes can be made without departing from the scope of the claims below. Accordingly, the specification and figures are to be regarded in an illustrative rather than a restrictive sense, and all such modifications are intended to be included within the scope of the appended claims.

Moreover, in this document, relational terms such as first and second, top and bottom, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. The terms "comprises," "comprising," "has", "having," "includes", "including," "contains", "containing" or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises, has, includes, contains a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element preceded by "comprises. a", "includes. a", "contains. a" does not, without more constraints, preclude the existence of additional identical elements in the process, method, article, or apparatus that comprises, has, includes, contains the element. The terms "a" and "an" are defined as one or more unless explicitly stated otherwise herein. The terms "substantially", "essentially", "approximately", "about" or any other version thereof, are defined as being close to as understood by one of ordinary skill in the art, and in one non-limiting embodiment the term is defined to be within <NUM>%, in another embodiment within <NUM>%, in another embodiment within <NUM>% and in another embodiment within <NUM>%. The term "one of", without a more limiting modifier such as "only one of", and when applied herein to two or more subsequently defined options such as "one of A and B" should be construed to mean an existence of any one of the options in the list alone (e.g., A alone or B alone) or any combination of two or more of the options in the list (e.g., A and B together).

A device or structure that is "configured" in a certain way is configured in at least that way, but may also be configured in ways that are not listed.

The terms "coupled", "coupling" or "connected" as used herein can have several different meanings depending on the context in which these terms are used. For example, the terms coupled, coupling, or connected can have a mechanical or electrical connotation. For example, as used herein, the terms coupled, coupling, or connected can indicate that two elements or devices are directly connected to one another or connected to one another through an intermediate elements or devices via an electrical element, electrical signal or a mechanical element depending on the particular context.

Moreover, an embodiment can be implemented as a computer-readable storage medium having computer readable code stored thereon for programming a computer (e.g., comprising a processor) to perform a method as described and claimed herein. Any suitable computer-usable or computer readable medium may be utilized. Examples of such computer-readable storage mediums include, but are not limited to, a hard disk, a CD-ROM, an optical storage device, a magnetic storage device, a ROM (Read Only Memory), a PROM (Programmable Read Only Memory), an EPROM (Erasable Programmable Read Only Memory), an EEPROM (Electrically Erasable Programmable Read Only Memory) and a Flash memory. In the context of this document, a computer-usable or computer-readable medium may be any medium that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device.

Further, it is expected that one of ordinary skill, notwithstanding possibly significant effort and many design choices motivated by, for example, available time, current technology, and economic considerations, when guided by the concepts and principles disclosed herein will be readily capable of generating such software instructions and programs and ICs with minimal experimentation. For example, computer program code for carrying out operations of various example embodiments may be written in an object oriented programming language such as Java, Smalltalk, C++, Python, or the like. However, the computer program code for carrying out operations of various example embodiments may also be written in conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on a computer, partly on the computer, as a stand-alone software package, partly on the computer and partly on a remote computer or server or entirely on the remote computer or server. In the latter scenario, the remote computer or server may be connected to the computer through a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider).

Claim 1:
A method (<NUM>) of redacting records based on a contextual correlation with a previously redacted record (<NUM>), the method comprising:
obtaining (<NUM>), at an electronic computing device (<NUM>), redaction metadata (<NUM>) associated with a redacted record (<NUM>), the redaction metadata (<NUM>) identifying a segment within an unredacted record (<NUM>) to which redaction (<NUM>) was applied to generate the redacted record (<NUM>);
processing (<NUM>), at the electronic computing device (<NUM>), the identified segment of the unredacted record (<NUM>) to detect that a person or an object captured within the identified segment of the unredacted (<NUM>) record was redacted in the redacted record (<NUM>);
processing (<NUM>), at the electronic computing device (<NUM>), the identified segment of the unredacted record (<NUM>) to detect characteristics of the person or the object;
obtaining (<NUM>), at the electronic computing device (<NUM>), at least one context attribute specifying a context in which the redacted person or the redacted object was captured within the identified segment of the unredacted record (<NUM>):
identifying (<NUM>), at the electronic computing device (<NUM>), at least one other unredacted record that is associated with the unredacted record (<NUM>);
determining (<NUM>), at the electronic computing device (<NUM>), that characteristics of a person or an object captured within at least one other segment of the at least one other unredacted record (<NUM>) match with the characteristics of the person or the object captured within the identified segment of the unredacted record (<NUM>);
obtaining (<NUM>), at the electronic computing device (<NUM>), at least one other context attribute specifying a context in which the person or the object was captured within the at least one other segment of the at least one other unredacted record (<NUM>);
determining (<NUM>), at the electronic computing device (<NUM>), a contextual correlation value based on a correlation between the at least one context attribute and the at least one other context attribute; and
when the contextual correlation value exceeds a correlation threshold, generating (<NUM>) at least one other redacted record (<NUM>) by redacting the person or the object captured within the at least one other segment of the at least one other unredacted record (<NUM>).