Virginia Governor Signs Warrant Requirement For Police Drone Use; Balks At Seven-Day Limit On ALPR Data Retention

from the aww...-and-he-was-doing-so-good-on-the-civil-liberties-front dept

Good news/bad news from the state of Virginia. Governor Terry McAuliffe had two bills land on his desk, both passed with overwhelming support, that would have assured additional privacy protections for the state's citizens. Unfortunately, he only signed one of them.

The one with his signature on it institutes a warrant requirement for law enforcement drone usage. McAuliffe originally sent this one back with a suggested "fixes" that would have rendered the proposed warrant requirement completely meaningless.

Rather than require a warrant for all law enforcement use of drones, the governor's amendments only require warrants for “active criminal investigations,” leaving the door open for persistent, untargeted drone surveillance. Rather than ban the use of evidence collected without a warrant by drones, the governor's amendments created a procedural loophole where otherwise forbidden evidence could be introduced under a different set of legal standards.

To their credits, the legislators who had passed the bill without massive loopholes refused to fold in the governor's suggested amendments. The second time it hit his desk, McAuliffe signed it. This passage can be added to the state's privacy "wins" column, which also includes a warrant requirement for Stingray use.

The bad news is that McAuliffe rejected a bill that would have placed a seven-day retention limit on data gathered by automatic license plate readers. McAuliffe argued -- correctly -- that this limit was significantly lower than any policy currently in place in Virginia. (And, most likely, anywhere in the nation.) Unfortunately, he used ALPR/law enforcement talking points to do so.

Many localities in Virginia retain this data for 60 days to two years. Seven days is a substantial reduction. Additionally, law enforcement agencies demonstrate that crimes are often not reported until several weeks later. Under this bill, essential data would not be available at the time of those reports. This is particularly concerning when considering implications for the National Capitol Region, where cross-state collaboration and information-sharing are essential to responding to potential criminal or terrorist activity occurring near Virginia’s borders.

Oh, "terrorism," you rascally, constantly useful justification! Where will you pop up next? (Probably not in areas actually loaded with terrorists, I would guess.)

Unlike drones and Stingrays, ALPRs weren't originally crafted for use by military personnel in war zones. But here we see the invocation of terrorism as a justification for passively scanning thousands-to-millions of license plates every day. Sure, any vehicle traveling in public areas can be observed, but multi-point collections of plate/location data gives anyone with access a very clear picture of someone's daily life. While we would expect people currently under investigation to be closely watched by police (and/or "tailed" by proxy by ALPR data), we don't expect everyone to be subject to the same level of scrutiny simply because the technology has liberated law enforcement officers from performing in-person surveillance.

The destruction of non-hit data within a short time frame shouldn't be a concern, no matter how much crime/terrorism is afoot in the Virginia area. The amount of plate/location data that can be hauled in by ALPRs is astounding. And the "cross-state collaborations" and "information-sharing" the governor points to only adds to the massive haul. If a potential suspect's information falls into the seven-day memory hole, there's a good chance it will return to the database within a matter of days.

As for the stated concern about the lag between criminal activity and its reporting? Well, what did officers do before they had historical ALPR data to rely on? Surely those investigative methods still exist. ALPRs may have made the job easier, but they didn't destroy previously-existent investigative techniques upon deployment.

On top of this, there's the fact that if McAuliffe doesn't pass this law with the limitation intact, state ALPR usage will continue to violate ANOTHER law.

[M]cAuliffe fails to mention [that] law enforcement agencies are already breaking Virginia’s Data Act by storing ALPR data, as the Virginia Attorney General determined in a 2013 legal opinion [PDF].

If he decides to pass the bill with the limit in place, his state may also enjoy a more favorable outcome to the ALPR-related lawsuit filed against it.

Five days after McAuliffe signed the bills, the [ACLU of Virginia] filed a lawsuit [PDF] against the Fairfax County Police Department, which, despite the Attorney General’s guidance, has been storing ALPR data for up to a year and sharing that data with other law enforcement agencies in the region.

And then there's the fact that ALPRs have been abused by state police and no one in Virginia law enforcement seems to know whether the systems are actually helping apprehend more criminals.

McAuliffe has already sided with his constituents' privacy on two previous bills. There's a lot of ground for compromise between the seven days the bill asks for and the "up to a year" time limit law enforcement agencies already enjoy. That this bill also landed on his desk with overwhelming legislative support is a pretty good indication that Virginians would like the retention needle pushed closer to one week. Hopefully, he'll make the right call and continue to allow his state to lead the nation in privacy protections.

Filed Under: alpr, drones, license plate readers, privacy, surveillance, terry mcauliffe, virginia