Private Companies Continue To Amass Millions Of License Plate Photos, Hold Onto The Data Forever

from the your-plate/location-data-isn't-yours dept

Mon, Mar 16th 2015 3:41pm — Tim Cushing

Vigilant Solutions' automatic license plate readers are everywhere, even places where you wouldn't expect them. Like, mounted on private companies' vehicles. This isn't new. BetaBoston investigated the private ALPR growth industry early last year. Unfortunately, there's been very little good news to report since then. In fact, there still isn't.

Vigilant's ALPR database currently houses more than 2 billion plate scans, with nearly 100 million more being added every day by law enforcement agencies and repo companies. It actually has two databases. One can be plugged into by law enforcement. The other, housed by Vigilant-owned Digital Recognition Network, can be accessed by certain members of the public: car dealers, insurance companies, private detectives… basically anyone willing to pay access fees and who can offer a suitable justification for digging through a multi-billion plate database.

But when confronted with the possible privacy issues this massive database creates, the company is swift to point out the obvious: license plates on vehicles are, in fact, public. But this justification for the creation of the database fails to carry over to those requesting information about what's in the database. Public records requests have routinely been denied by law enforcement, who claim releasing publicly-obtained, by definition public, license plate photos is somehow a privacy violation.

Todd Hodnett, founder of Digital Recognition Network (corporate "child" of ALPR manufacturer Vigilant Solutions), says privacy concerns should be addressed by anyone but the company making the ALPR equipment and the one housing billions of plate photos accessible by non-government entities.

Hodnett… added that state and federal laws protect the privacy of motorists' information. State lawmakers, he said, could instead focus on restricting public access to the records and requiring state government oversight and more transparency.

He also points out the hypocrisy of the current situation:

"For the state on one hand to require that you place a license plate with six or eight alphanumeric characters on your vehicle and then on the other hand come back and say that is private - well it doesn't make any sense," he said. "It is not private. Otherwise, how could they require you or mandate you to expose it?"

It's a good point, but one Hodnett ultimately doesn't care about. At present, plates are considered "public" -- which allows his company to do what it does with no legal ramifications. And when the massive database of plate and location info is threatened, DRN's parent company (Vigilant) is prone to filing lawsuits claiming its license plate photography is protected speech.

It also goes to great lengths to portray any limitation of its plate readers as a threat to public safety.

Brian Shockley — vice president of marketing at Vigilant — plans to warn legislators that Massachusetts risks getting left behind in the use of a new tool that helps fight crime.

“I fear that the proposed legislation would essentially create a safe haven in the Commonwealth for certain types of criminals, it would reduce the safety of our officers, and it could ultimately result in lives lost,” Shockley is scheduled to say in testimony prepared for the hearing before the Joint Transportation Committee.

This may sound reasonable, but Shockley's claim doesn't stand up to scrutiny. As it stands now, ALPRs seem nearly as likely to return false positives as generate useful leads.

Until there's any serious pushback, Vigilant is free to arm both cops and citizens with plate scanners and sell access to both. And until someone starts seriously considering the fact that a plate/location database containing billions of records unrelated to criminal activity might be a bit of a privacy issue (in terms of long-term tracking of people's movements), Vigilant has no reason to alter even the most questionable of its practices. After all, it's not as if law enforcement agencies and their private customers (through DRN) have any problem with limitless collection and retention.

Fulton County Police Dept. Corporal Kay Lester:

"Per our understanding, the data that we contribute stays on the database indefinitely," Lester said in an email. "We can change the time frame if we choose, but since the data is only accessible to (law enforcement agencies), we currently have elected not to do so."

This is the standard m.o. for most law enforcement agencies in the country. As McClatchy reports, only 10 states have implemented laws governing collection and retention of license plate photos. There's even less oversight of Vigilant's "private" collection -- the database accessible by corporate customers. Until laws are passed governing the private side of Vigilant's collection activities, the company is free to hold onto everything forever.

Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.

Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.

While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.

–The Techdirt Team

Filed Under: alpr, data retention, license plate photos, privacy

25 Comments

If you liked this post, you may also be interested in...

Reader Comments

Subscribe: RSS

View by: Time | Thread

AntiFish03 (profile), 16 Mar 2015 @ 4:49pm

I posted a quick thought about this on twitter and thought I should come here and say a little more.

1) I agree that taking a photo of a license plate should not be wrong and that as a publicly visible thing I have no expectation of privacy.

2) License plate readers are a great tool for Law Enforcement purposes... While driving down the road they don't need to be trying to type in a license plate of a vehicle near them. (Something that officers do a lot... The number of Felony warrants on vehicles is amazing)

3) I also believe that the issue is not really with photographing the plate. It is in creating a database of those images with location data, frequency etc that is the root of the issue, and where the privacy violations occur. To combat this privacy issue I think that there should be legislation that should allow the database to tally the number of plate hits but no additional information about the plate. And that way the ALPR systems are doing their original job of making the officer safer in his job and making as small of a privacy issue as possible.

Will the above solution ever occur? I highly doubt it and if it did I guarantee that the private companies providing the ALPR services would fight tooth and nail to keep the status quo.
[ link to this | view in thread ]
Anonymous Coward, 16 Mar 2015 @ 4:57pm

Protected speech / public activity vs privacy
I will likely come off as an apologist for the data collecting company, but consider this:

If the same company collected the same photos, but did not scan them to identify license places, would we have a leg to stand on about what they do with them, or how long they keep them?

What about someone who sets up their Android phone long term in a park, and connected the phone to a facial recognition scanner? Or a business who applied the same technology for their door monitoring camera?

... or who cooperated with other individuals who did the same?

I don't much care for the privacy implications either, but the free speech argument isn't small.
[ link to this | view in thread ]
Billy, 16 Mar 2015 @ 4:57pm

Numbers don't add up
I read your article with interest but your numbers don't add up. In the second paragraph you reference they have two billion plates with 100 more being added every day. They have only been collecting for 20 days?

This makes me skeptical of the accuracy with the rest of the article.

I personally don't have a problem with law enforcement having access to this type of database. The DMV already has my license plate information. What do I care if cops do? Do you have any examples of where police have abused this database? I'd be interested in knowing this.
[ link to this | view in thread ]
Anonymous Coward, 16 Mar 2015 @ 4:58pm

A license plate is not a person, at least last time I checked it wasn't. Makes you wonder about the legality of red light cameras issuing tickest also. What goes around comes around, I believe the folks at Vigilante will become all to aware of that in the near future.
[ link to this | view in thread ]
That One Guy (profile), 16 Mar 2015 @ 5:03pm

The best way to kill a bad idea is to apply it equally
It would take someone with a crazy amount of courage, hefty war-chest for the inevitable lawsuits and 'unofficial' harassment, and lawyers on speed dial, but I imagine such businesses would be a lot less acceptable to the police and government agencies if there was one specifically advertised as focused on police and/or politicians.

Want to know where a cop goes on his off-duty hours? Just sign up to the service, and you can track him or her as much as you wish via the collection of plate data.

Curious as to where your local mayor or council member spends his relaxation time? Just plug in their name and the database will return all results that match, allowing you to track their movements as much as you care to.

Exact same result, that of a service that allows you to track the movement of a person, and all without so much as a slip of paper being presented for a judge to sign, but targeting those that defend such tracking as 'harmless' and 'public' to give them a taste of what it's like being under the microscope for once.

Of course those signed up with the service would be required to sign a (non-legally binding) 'promise' that they wouldn't use, or even look at the data without a 'really good reason', to be determined at their discretion. You know, the same excuse that makes all the data collection by the police and/or private companies magically 'not a problem'.

The resulting lawsuits(and there would be lawsuits) for 'privacy violations' and 'endangering officer safety' would be interesting for one of two reasons. Either the service would be ruled illegal due to privacy violations, and the ruling could then be turned around and used to go after the current plate tracking companies/services, or it would be ruled illegal and we'd get to watch the judge in charge pretend to be contortionist as they tried to explain why this plate tracking service was illegal, while another, identical in every way that counts, service wasn't.
[ link to this | view in thread ]
That One Guy (profile), 16 Mar 2015 @ 5:15pm

Re: Numbers don't add up
Question: Would you object if, as a requirement for acquiring or renewing your driver's license, you were told that you had to allow the installation of a tracking device in your vehicle, one that would allow police to know, with no warrant needed, where you have been and at what times, allowing them, and anyone else who has access to that data, to easily track your movements and construct a record of them?

If you would not, well, not much I can say there I suppose, you clearly don't value your privacy as much as a lot of people.

If you would, why, as that's pretty much exactly what these systems allow, given sufficient cameras(and given how eager police and the companies pushing them are for them, 'enough' is just a matter of time). No-warrant-needed tracking of everyone on the road, with little more than empty promises that the data won't be misused or acquired by others who would misuse it.
[ link to this | view in thread ]
Personanongrata, 16 Mar 2015 @ 5:16pm

Cui Bono
Private Companies Continue To Amass Millions Of License Plate Photos, Hold Onto The Data Forever

Are these truly private companies or are they shell-corporations acting as fronts for the state?
[ link to this | view in thread ]
Anonymous Coward, 16 Mar 2015 @ 6:32pm

Re:
Red light cameras have been tossed in several jurisdictions for precisely that reason: You can't punish a person if you don't know they were the one responsible for the violation alleged.
[ link to this | view in thread ]
Anonymous Coward, 16 Mar 2015 @ 6:34pm

Re: Cui Bono
Considering how the vast majority of their customers are the state, that's a very good point. What facts and circumstances distinguish between them?
[ link to this | view in thread ]
Bobster, 16 Mar 2015 @ 7:20pm

If your in public, you can't expect much privacy. That's a simple fact. Hence the meaning of the word public.
[ link to this | view in thread ]
Ned Ludd, 16 Mar 2015 @ 8:31pm

Copyright to the Rescue!
So the answer is to copyright the contents of every plate.

Then put the plates under a license that permits photographing and hand-writing the plate contents, but does not permit storing the plate or any derivative (like a hash) in a database.

Might have some problems due to the low amount of creative content in a license plate. But congress can certainly add any weirdo rules to title 17 that it feels like, it wouldn't be the first time.
[ link to this | view in thread ]
Ned Ludd, 16 Mar 2015 @ 8:34pm

Re:
If displaying the license plate was an option, you'd have a point. But because license plates are legally required and obscuring one is actually illegal, not so much.

The laws about license plates were written before databases even existed. Times have changed. The laws need to change to keep up with the times.
[ link to this | view in thread ]
Anonymous Coward, 16 Mar 2015 @ 9:03pm

Re: Protected speech / public activity vs privacy
Please tell me how a database is "speech". Especially when it's getting data from *automatic* readers, not from some guy just taking pictures.
[ link to this | view in thread ]
Anonymous Coward, 16 Mar 2015 @ 10:48pm

Runaway governments with entitled authority..........sooooo many things been done that need to be abolished and then done right or stayed abholished, things like asking for public fucking consent for one, and ongoing discussion on just exactly what can and cant be done.......NONE of this has been done, and yet i seem to hear every other day how our respective governments have these extra authority/power that was'nt there 15 years ago, find out that not only has it been arrogantly implemented without so much as a "by your leave", turns out that its been out a while already.
[ link to this | view in thread ]
Anonymous Coward, 17 Mar 2015 @ 12:08am

Unintended consequences. I don't think the public agreed to submit their location and plate number (even if inaccurate) so some private company can make a few billion off that free "public" information. It's a 2 way street. If he wants to sell the information, he needs to buy the information. The word "parasite" comes to mind.

par·a·site/ˈperəˌsīt/
noun
an organism that lives in or on another organism (its host) and benefits by deriving nutrients at the host's expense.
[ link to this | view in thread ]
Violynne (profile), 17 Mar 2015 @ 3:18am

This article assumes the ALPR created this database.

That's false.

LE has had a similar database for decades. ALPRs just make their task easier.

It wouldn't surprise me in the least bit if the databases were merged, which certainly accounts for the high number of stored images.
[ link to this | view in thread ]
Yes, I know I'm commentng anonymously, 17 Mar 2015 @ 4:57am

Expect the police to stop with license plate scanning. They can simply query private databases for information while having plausible deniablility for FOIA-requests. (win-win for the police, loss-loss for the public.)

And Yes, they will probably set up private companies for this.
[ link to this | view in thread ]
Anonymous Coward, 17 Mar 2015 @ 6:47am

Possible ways to stop this
(1) Repeal the requirement that the plates be machine-readable at all times. This will happen only if some other equally invasive tracking technique becomes available.

(2) Ban collecting the data. If it is collected without trespassing, such a ban will be hard to defend in court. Courts are reluctant to ban non-disruptive recording (except when it comes to cops performing their jobs, of course). Also, if such a ban were allowed to stand, it would be precedent for banning other forms of public photography / recording.

(3) Ban collating the data. Courts generally don't like laws which say that having N of something is allowed, but having N+1 is disallowed, so how do you prevent collating a large database while allowing a small one? If you disallow the small one, on what grounds?

(4) Ban selling the data to anyone. This is hard to defend if the data was legally acquired and its release poses no immediate public safety hazard.

(5) Ban the state from buying the data. This one is relatively easy to justify in court, since it is a "power of the purse" issue. It would substantially discourage private databases if the state cannot buy from them. However, it is also easy to lobby against, and might require getting a legislator to attach such a ban to every appropriations bill, every year. Also, expect at least temporary workarounds where the companies sell some other service to the state, and happen to toss in ALPR access as a freebie.

(6) Ban the state from contributing to the database. This will not prevent its growth, but could slow it down, since the company could not make use of police ALPRs.

I strongly dislike the existence of a database that can recount a citizen's movements across a long period of time, but I must reluctantly agree with the position quoted in the article. There is no good way to prevent them from creating the database, and not even a particularly good way of preventing its abuse once it is created.
[ link to this | view in thread ]
Michael, 17 Mar 2015 @ 6:49am

Re:
License plates are totally out-dated and could relatively easily be replaced with solutions that would both be able to be more accurately identified by law enforcement and be difficult or impossible for identification by a third party.

If any state was serious about privacy relating to license plates, they would stop using them in lieu of a more secure system.
[ link to this | view in thread ]
Anonymous Coward, 17 Mar 2015 @ 7:04am

Re: Re: Replacing license plates not that simple
License plates are totally out-dated and could relatively easily be replaced with solutions that would both be able to be more accurately identified by law enforcement and be difficult or impossible for identification by a third party.
Private parties generally have no good cause for long term identification of plates, but for short term uses, as witnesses to a crime or alleged crime, they do. Suppose your neighbour's house gets robbed and you happened to have noticed an unusual vehicle around the neighbourhood recently. Or suppose you witness a hit&run, but manage to record the plate (whether by taking a cell phone photo or just writing it down). In both cases, the victim and the police have an interest in you being able to convey to the police the identity of the offending vehicle. License plates serve that purpose quite well, because they provide a short, unique, and easily recorded identifier. Any replacement will need to provide a way for no-tech witnesses to capture the identifier. The only way I can see to do this would be with a plate that periodically changes its text (where the police can look up what car had the given text at the relevant time). Do you have a better suggestion?

What did you have in mind that satisfies all of:
(1) No-tech witnesses can record it well enough that police can identify it later
(2) Neither high-tech private companies nor high-tech government agencies can record it well enough to produce a long-term tracking database on a large scale
(3) Sufficient tamper-evidence that would-be criminals cannot spend hours/days/weeks with it disabled, and nobody notices
[ link to this | view in thread ]
John Fenderson (profile), 17 Mar 2015 @ 7:46am

Re: Re: Re: Replacing license plates not that simple
The issue isn't whether or not there's value in having license plates. The issue is whether or not that value is greater than the cost in terms of ubiquitous surveillance. I've changed positions on this, personally. I originally thought, like you, that the upside to publicly visible license plates tipped the scales in that direction.

I no longer think so. I think it would be better to lose the benefits you cite if the cost of having them is to be included in these databases.
[ link to this | view in thread ]
John Fenderson (profile), 17 Mar 2015 @ 7:52am

Re: Numbers don't add up
"The DMV already has my license plate information. What do I care if cops do?"

So you're OK with the government being able to track you everywhere you have driven? We aren't talking about a simple database that says that a given plate is registered by a given person. We're talking about databases that record where you've been over time.

"Do you have any examples of where police have abused this database?"

Not yet, but rest assured that will happen eventually, once someone working for the police or ALPR companies blows the whistle.

But we don't need actual evidence of misuse to legitimately object to any of this.
[ link to this | view in thread ]
Anon, 17 Mar 2015 @ 8:24am

Equal Access?
If the data exists, how long before divorce lawyers, people fighting wrongful dismissal ("what time did you get to work?") etc. also have access?

I like the idea of full access - as mentioned, find out where your mayor spends his time. Find out what time your city councillors or member of state legislature gets to work, leaves work; where they go... Who spent 5 hours in the bar then drove home?
[ link to this | view in thread ]
DogBreath, 17 Mar 2015 @ 9:31am

Re: Numbers don't add up
Do you have any examples of where police have abused this database?

Yes:

Perhaps the best known incident involving the abuse of an ANPR database in North America is the case of Edmonton Sun reporter Kerry Diotte in 2004. Diotte wrote an article critical of Edmonton police use of traffic cameras for revenue enhancement, and in retaliation was added to an ANPR database of "high-risk drivers" in an attempt to monitor his habits and create an opportunity to arrest him. The police chief and several officers were fired as a result, and The Office of the Privacy Commissioner of Canada expressed public concern over the "growing police use of technology to spy on motorists."
[ link to this | view in thread ]
GEMont (profile), 19 Mar 2015 @ 10:29am

Re: Equal Access?
Sweet!

Methinks you have just given the 1% the perfect incentive to insure that any legislation pertaining to access of the license plate archive data, will include strong wording about how the public MUST NOT EVER have access to the data and how any citizen utilizing any data from the archives must be summarily executed, or incarcerated indefinitely in an undisclosed location and tortured daily.

Goodness me, how absolutely publically enlightening it would be for everyone to know precisely where every single member of the government, the judiciary, law enforcement and the military spends their spare time.... why.... it would be downright... transparent!

As it stands now however, such a VIP-only data base will be an absolute gold mine for terrorists and other criminals who wish to know the precise daily routines of their civilian and VIP targets and victims-2B.

Ah.... progress. :)

---
[ link to this | view in thread ]