Virginia Supreme Court Says License Plate Readers Collect Personal Data; Suggests Use Violates State Law

from the but-then-again,-no-one-expects-cops-to-have-much-legal-knowledge... dept

A resident of Virginia, with the ACLU's help, has won at least a partial victory against the mass collection of license plate/location info by automatic license plate readers (ALPRs). The question of whether or not mass collections of this data violated state privacy law has been answered, which may mean significant changes to the way state law enforcement deploys them.

Virginia's history of ALPR use is questionable, to say the least. Some towns in the state obtained ALPRs by claiming a need to swiftly capture the worst of the worst criminals, but decided to put them to use locating people behind on their property taxes. In 2013, state police were discovered to be using ALPRs to troll parking lots at political rallies, giving law enforcement a convenient way to connect drivers to their political leanings. Many of these devices were deployed without public comment or oversight. And law enforcement agencies drew a blank when asked for documentation of the devices' crime-fighting effectiveness.

This passive collection violated the state's "Government Data Collection and Dissemination Act," which forbids collection of personal information without a "clearly established need" to do so. The law prevents codification of abusive practices by requiring agencies looking to harvest personal information to seek approval first, rather than ask for forgiveness later.

This law -- and law enforcement's apparent inability to follow it -- prompted this lawsuit.

In 2013, the (conservative) former Virginia attorney general Ken Cuccinelli issued a strong official advisory opinion stating that under the law, “active” use of an ALPR to identify vehicles that were already involved in wrongdoing was permissible, but that “passive” use of the devices to sweep up raw location data about Virginia residents was not permissible. Nevertheless, in 2014 Harrison Neal, a Virginia resident, found that the Fairfax County Police Department was doing just that, and asked the ACLU of Virginia to file suit challenging the practice on his behalf.

The PD argued nothing "personal" was collected by its ALPRs. It claimed that it represented a vehicle only -- one that could be driven by any number of different drivers. While this is true, most vehicles are driven by one driver a large percentage of the time.

There are 268 million registered vehicles in the United States, but only 221 million licensed drivers, which strongly supports the common sense observation that most vehicles, most of the time, are driven by the same person, or at most a handful of family members.

This rolling database of license plate/location records provides a pretty good depiction of the main driver's life. All plate shots collected by the Fairfax PD are retained for 364 days, allowing officers to track people by proxy for an entire year.

The claim license plates can't be linked to people is disingenuous, at best. Even if the ALPR database is siloed (and it seemingly isn't), police also have access to vehicle registration records which link license plates to vehicle owners. Combine this with other law enforcement databases (biometric, criminal, etc.) and a license plate is as good as an entire person, even if there's a small chance someone else was driving during a few of the passive photoshoots.

The state's supreme court overturns [PDF] the lower court's finding that license plate photos aren't "personal info." The judges here note that would likely be true if all the devices captured were photos of license plates.

The images of the vehicle, its license plate, and the vehicle’s immediate surroundings, along with the GPS location, time, and date when the image was captured “afford a basis for inferring personal characteristics, such as . . . things done by or to” the individual who owns the vehicle, as well as a basis for inferring the presence of the individual who owns the vehicle in a certain location at a certain time. Code § 2.2-3801. The conclusion that the picture and associated data is “personal information” is consistent with the legislature’s intent to remedy the potential mischief posed by “the extensive collection, maintenance, use and dissemination of personal information” and the potential for misuse of such information.

But it's not a complete victory… yet. The court was unable to determine how ALPR software handled license plate data. The case has been remanded to the lower court to perform some fact-finding on law enforcement ALPR data use. If ALPR data is siloed off completely, it may technically be legal under the privacy law. If the police can easily link plate numbers to vehicle owners via registration databases (and from there to other law enforcement collections), the devices violate the law.

If such a means exists, then the Police Department’s “passive use” of ALPRs is not exempt from the operation of the Data Act under the law enforcement exception of Code § 2.2- 3802(7), because the Police Department collected and retained personal information without any suspicion of criminal activity at any level of abstraction, and thus created an information system that does not “deal with investigations and intelligence gathering related to criminal activity.”

This final paragraph also suggests it may not matter if the ALPR data isn't linked to other law enforcement databases. As noted earlier in the decision, a wealth information is collected with every plate photo, which would still be in violation of the law, even if cops have to access a different database to link plates to people. If so, ALPRs may be put on ice until their collection method is modified. At present, non-hit photos are kept along with everything else for 364 days. To comply with the law, the PD is probably going to have to immediately discard non-hit photos, since only those matching law enforcement hotlists will fulfill the requirement that collections like this be used only for "needs clearly established in advance."

Filed Under: 4th amendment, alpr, license plate readers, privacy, virginia

License Plate Reader Company Says Public Records Requests For ALPR Documents Are Just Clickbait

from the price-of-freedom-is-eternal-Vigilant-open-letters dept

It turns out the most oppressed demographic in this country is the one with power, guns, unions, extra rights, and plenty of civil immunity. Law enforcement agencies around the country currently besieged by public records requests are having their fears assuaged and brows unfurrowed by the nation's largest provider of automatic license plate reader technology.

Earlier this year, the EFF and public records clearinghouse MuckRock joined forces to file approximately 1,000 public records requests with agencies partnering with Vigilant. Apparently this influx of up to one additional records request per agency has pushed law enforcement to its limits. Vigilant Solutions has stepped up to let law enforcement officers know it has their back during this ongoing national nightmare. (h/t Dave Maass, Camille Fassett)

Dear Vigilant Solutions Customer,

We know you are experiencing an onslaught of Freedom of Information Act (FOIA) and Public Records Act (PRA) requests from the Electronic Frontier Foundation (EFF) and MuckRock regarding your use of our license plate reader (LPR) technology. We write this letter to let you know, quite simply, we support you and are here for you.

Just to be clear, this "onslaught" is composed of one request per law enforcement agency. There's no point in doubling up on requests since that would just waste time and resources. There may be some inadvertent double filings, but that would only mean some agencies have seen more than one request for Vigilant documents. In no case are any agencies being targeted with mass duplicated requests. So, this "onslaught" might be cumulative in total, but it basically comes down to a 1/1 ratio of requests/agencies.

From there, Vigilant's letter [PDF] devolves into talking points about the great law enforcement work being done with its passive collection systems. It highlights a handful of nonspecific success stories -- stories it claims the EFF and MuckRock ignore -- as justification for 24/7 gathering of license plate/location data. Again, this poor attempt to slam both entities as anti-law enforcement fails. No one disputes ALPRs help catch criminals. The problem is they're often put into place with zero public comment, zero discussion by public officials, zero guidelines for data gathering and retention, and with an eye on law enforcement efficiency above everything else.

The letter tries to mock EFF as being noble fools for pointing out how many agencies have access to Vigilant plate data.

The EFF has noted that California agencies are sharing with the U.S. Forest Service, universities on the East Coast, and airports in Tennessee. EFF is apparently unaware that criminals travel across state lines. Perhaps these writers have not read the countless stories about crimes committed on college campuses, at airports and even in National Parks.

This willfully ignores the reason the EFF points out the long list of agencies with access to data. It's not that the EFF doesn't know suspected criminals move around the country or that criminal acts can occur anywhere. It's that hundreds of agencies are dipping into this data without clear, concise guidance on what they can access and how they can use it. For some agencies not tasked with law enforcement, it's unclear why they're even able to pull data from a database supposedly created for law enforcement use only.

But the most ridiculous part of the letter is its ending, in which Vigilant claims the EFF and MuckRock are doing this for the clicks.

The real impetus behind this campaign is so EFF and MuckRock can capitalize on the most well-known emotional trigger for fundraising: Fear. Their aim is to paint a false picture of sharing LPR data by leading their readers to believe it is reckless, unrestricted and used to track individuals. In short, they are attempting to scare individuals into hitting one of the countless "Contribute" and "Donate" buttons on their website.

Wow. Way to stick it to a couple of nonprofits, Vigilant. The "doing it for money/eyeballs/ad revenue/etc." argument is a full-throated admission you can't find anything legitimate to complain about. Vigilant sure seems defensive for an entity that believes it's nothing but a net gain for public safety. This letter is hilarious -- an admission Vigilant can be put on the defensive by a steady trickle of public records requests from around the nation.

It's also kind of hypocritical. Vigilant has brought lawsuits against states claiming their anti-ALPR laws violated the company's First Amendment right to collect license plate photographs en masse. Now, it's reaching out to law enforcement agencies to let them know Vigilant will be there for them while citizens exercise their First Amendment rights by requesting a much smaller quantity of public records. This open letter of Vigilant's is terrible optics. Either it shows Vigilant can be put on the defensive by people seeking information about its products, or it believes law enforcement officers are feeling threatened by the incremental increase in FOIA paperwork. Either way, it's a terrible look and a terrible response.

Filed Under: alpr, foia, law enforcement, license plate readers, police departments, public records, transparency
Companies: eff, muckrock, vigilant solutions

ICE Finally Gets The Nationwide License Plate Database It's Spent Years Asking For

from the papers-please,-says-ICE-to-all-vehicles-in-the-nation dept

ICE is finally getting that nationwide license plate reader database it's been lusting after for several years. The DHS announced plans for a nationwide database in 2014, but decided to rein that idea in after a bit of backlash. The post-Snowden political climate made many domestic mass surveillance plans untenable, if not completely unpalatable.

Times have changed. The new team in the White House doesn't care how much domestic surveillance it engages in as long as it might aid in rooting out foreign immigrants. The first move was the DHS's updated Privacy Impact Assessment on license plate readers -- delivered late last year -- which came to the conclusion that any privacy violations were minimal compared to the national security net benefits.

The last step has been finalized, as Russell Brandom reports for The Verge.

The Immigration and Customs Enforcement (ICE) agency has officially gained agency-wide access to a nationwide license plate recognition database, according to a contract finalized earlier this month. The system gives the agency access to billions of license plate records and new powers of real-time location tracking, raising significant concerns from civil libertarians.

For those counting tax beans, the good news is this database won't cost much. Billions of license plate records have already been collected (and continue to be collected). All the winning contractor has to do is hook ICE up to the firehose.

The source of the data is not named in the contract, but an ICE representative said the data came from Vigilant Solutions, the leading network for license plate recognition data. “Like most other law enforcement agencies, ICE uses information obtained from license plate readers as one tool in support of its investigations,” spokesperson Dani Bennett said in a statement. “ICE is not seeking to build a license plate reader database, and will not collect nor contribute any data to a national public or private database through this contract.”

Nice use of wiggle words to minimize ICE's new surveillance power. ICE won't "build" a database. Great, but it doesn't need to. Vigilant has been collecting records for years via private companies and partnerships with law enforcement agencies. Around two billion plate/location records are already stored by Vigilant, presumably indefinitely. According to the Verge report, ICE will have access to at least five years of records for historical searches.

But ICE won't be just be diving into Vigilant's plate record archives. ICE will also be able to hand Vigilant "hot lists" for automatic notification any time the nation's many ALPR cameras capture a shot of targeted license plates.

ICE agents can also receive instantaneous email alerts whenever a new record of a particular plate is found — a system known internally as a “hot list.” (The same alerts can also be funneled to the Vigilant’s iOS app.) According to the privacy assessment, as many as 2,500 license plates could be uploaded to the hot list in a single batch, although the assessment does not detail how often new batches can be added.

According to the report, ICE first tried out Vigilant's system in 2012. It hoped to go live in 2014, but the Snowden documents chilled enthusiasm for mass surveillance temporarily. Now, the system is ready to roll, pre-stocked with a couple billion plate records for ICE to peruse as it expands its enforcement activities past the deportation of foreign criminals.

There are few nods to privacy, but they're mostly useless. ICE owns it own ALPR cameras but those won't feed into this database, which means other law enforcement agencies won't have access to ICE-generated plate records. Hot lists aren't forever. They'll expire after a year. And there will be audit trails for ICE agents who use the system, although it remains to be seen how serious ICE is about punishing misuse of this authority.

There's not much that citizens can do to keep their inland plates from becoming part of ICE's border enforcement activity. Most states require visible, legible license plates at all times, even when parked at homes or private businesses. One state, however, is doing something about that. California legislators recently offered up a bill that would provide a little pocket of privacy for citizens and their vehicles.

S.B. 712 would allow drivers to apply a removable cover to their license plates when they are lawfully parked, similar to how drivers are currently allowed to cover their entire vehicles with a tarp to protect their paint jobs from elements. While this would not prevent ALPRs from collecting data from moving vehicles, it would offer privacy for those who want to protect the confidentiality of their destinations.

Unfortunately, this legislation has struggled to find enough support to get it to the governor's desk. As the EFF reports, state senators who have stated support for pushing back against the White House's anti-immigrant policies failed to show support for a bill that would have slowed ICE's acquisition of plate records from their state. The initial vote, however, took place before the Verge broke the story of ICE's partnership with Vigilant Systems. Things could change on January 31's vote, now that new information has come to light.

Filed Under: 4th amendment, alpr, database, ice, law enforcement, license plate readers, lpr, privacy

DHS Expands License Plate Dragnet, Streams Collections To US Law Enforcement Agencies

from the let-the-government-know-your-travel-plans...-as-you-travel! dept

The DHS has provided the public with a Privacy Impact Assessment (PIA) on its use of license plate readers (LPRs). What the document shows is the DHS's hasty abandonment of plans for a national license plate database had little impact on its ability to create a replacement national license plate database. The document deals with border areas primarily, but that shouldn't lead inland drivers to believe they won't be swept up in the collection.

The DHS has multiple partners in its license plate gathering efforts, with the foremost beneficiary being the DEA, as Papers, Please! Reports:

The latest so-called “Privacy Impact Assessment” (PIA) made public by the US Department of Homeland Security, “CBP License Plate Reader Technology“, provides unsurprising but disturbing details about how the US government’s phobias about foreigners and drugs are driving (pun intended) the convergence of border surveillance and dragnet surveillance of the movements of private vehicles within the USA.

The CBP defines the border as anything within 100 miles of the country's physical borders, which also include international airports. Consequently, more than 2/3rds of the nation's population reside in the CBP's so-called "Constitution-free zone." The plate readers discussed in the PIA aren't just the ones drivers and visitors might expect. While the CBP operates many of these at static locations at entry points, other LPRs are mounted on CBP vehicles or hidden in areas the CBP patrols.

The addition of the DEA adds law enforcement to the mix. This means the DHS is intermingling its collection with existing law enforcement databases, allowing it to build an ad hoc national database without having to inform the public or hire a contractor to build one from the ground up.

[T]he DEA has compiled an aggregated database of geotagged and timestamped license plate records purchased from commercial sources, including records of vehicle locations far from what even the DHS considers the “border zone”.

CBP and DEA are already able to query and retrieve data from each other’s LPR databases. A DEA agent can also set a “TECS alert” flag in the DHS database for a specific license plate number, the same way they can for a specific passport number, so that they will be notified automatically whenever that plate is spotted by a DHS camera.

Vanishing from these multiple databases is any form of targeting. The DHS plans to pipe its LPR collection to DEA and other law enforcement agencies as a live feed, allowing agencies on the receiving end to browse the collection at will and/or add it to databases they control.

“CBP intends to provide DEA access to CBP LPR information… through a real-time streaming service.” Each agency will have a complete copy of the data collected by the other, so that they can merge and mine it and use it for “pre-crime” profiling.

The Impact Assessment notes privacy will, yes, be "impacted," but that's the way it goes. Many, many US citizens who have never crossed the border will have their license plate/location data added to multiple law enforcement databases. But what option does the DHS have? Not policing the "border?" Not helping the DEA out with the Drug War? From the PIA [PDF]:

Privacy Risk: There is a risk to individual participation in that individuals do not have an opportunity to consent to CBP’s retention and use of their license plate data.

Mitigation: This risk is not mitigated given the purpose of the collection. Many areas of both public and private property have signage that alerts individuals that the area is under surveillance; however, this signage does not consistently include a description of how and with whom such data may be shared. Moreover, the only way to opt out of such surveillance is to avoid the impacted area, which may pose significant hardships and be generally unrealistic.

As Papers, Please! notes, this PIA is a nice addition to the DHS's collection, but it's supposed to be released prior to roll out and the public is supposed to be notified via the Federal Register about additional collections of personally-identifiable info by government agencies. None of this has happened in a timely manner, making these collections illegal until the assessments are in place and notices properly published. The DHS -- along with its component agencies -- routinely ignore statutory requirements but, to date, not a single agency official has been punished for disobeying the law.

As for US citizens, they can expect this Kudzu-like growth of surveillance to continue, especially around airports or borders, even as the country remains only minimally threatened by terrorist activity or illegal entry into the country.

Filed Under: alpr, dea, dhs, homeland security, law enforcement, license plates, lpr, privacy, surveillance

California's Top Court Says Cops Have To Hand Over Automatic Plate Reader Records

from the no-more-hiding-behind-abused-exceptions dept

The EFF and ACLU have achieved a victory in an acronym-heavy public records case. The California Supreme Court has ruled the Los Angeles Police Department (LAPD) and Los Angeles Sheriff's Department (LASD) will have to turn over data acquired by their automatic license plate readers (ALPRs).

Both entities tried to keep these records from the EFF and ACLU by claiming every single one of the millions of plate records were "investigatory records," exempt from disclosure under California's public records law. This apparently included the millions of "non-hit" records never utilized in any LAPD/LASD investigation. With the plate readers collecting 1.5-2 million records per week, they were basically arguing every driver passing by an ALPR was under investigation.

That's not how the state's Supreme Court sees it [PDF]. The "investigatory records" exemption pertains to targeted, ongoing investigations. The public records law cannot be stretched to cover indiscriminate mass surveillance.

Accordingly, we hold that real parties’ process of ALPR scanning does not produce records of investigations, because the scans are not conducted as part of a targeted inquiry into any particular crime or crimes. The scans are conducted with an expectation that the vast majority of the data collected will prove irrelevant for law enforcement purposes. We recognize that it may not always be an easy task to identify the line between traditional “investigation” and the sort of “bulk” collection at issue here. But wherever the line may ultimately fall, it is at least clear that real parties’ ALPR process falls on the bulk collection side of it.

The court also says the fact that the database of records is routinely searched during current investigations does not make everything in it immune from public records requests. If the law were interpreted this way, all it would take to exempt every one of the millions of plate records from disclosure would be the inclusion of a targeted plate in every batch of ALPR records requested.

The law enforcement agencies also claimed any release of the data would harm law enforcement interests, supposedly by giving criminals the info they needed to avoid plate readers. The Supreme Court finds this far less persuasive than the lower court did.

The trial court appears to have placed significant weight on the possibility that a criminal could use ALPR data to identify law enforcement patrol patterns. The court did so based on the declaration of LAPD Sergeant Daniel Gomez. In pertinent part, Sergeant Gomez claimed that an individual requesting ALPR data “could use the data to try and identify patterns of a particular vehicle.” (Italics added.) However, Sergeant Gomez also seemed to cast doubt on the likelihood that an individual could do so successfully, explaining that “[u]nlike law enforcement that uses additional departmental resources to validate captured [A]LPR information, a private person would be basing their assumptions solely on the data created by the [A]LPR system . . . .” Nevertheless, we will assume, as the trial court found, that a person could at least roughly infer patrol patterns from a week’s worth of plate scan data.

The problem with this aspect of the trial court’s analysis is that, even assuming patrol patterns can be inferred from ALPR data, there is little reason to believe that this possibility points meaningfully toward “a clear overbalance on the side of confidentiality” with respect to all the records sought. (Michaelis, supra, 38 Cal.4th at p. 1071.) For one thing, fixed ALPR scanners are just that—fixed— so concerns about patrol patterns are inapplicable to the data they collect. For another, the record does not appear to indicate that knowledge of where law enforcement officers were during a particular week is a reliable guide to where they will be at some precise moment in the future. The trial court did not find, for example, that real parties conduct law enforcement in the same way that they might operate a bus service—moving from point to point at particular times on particular days, never deviating to attend to other business or emergencies. We are not aware of substantial evidence that would have supported such a finding.

The court, however, does find one thing to be concerned with, and it's an issue the LAPD/LASD generally doesn't take into consideration until they're being asked to hand over bulk collection records: privacy.

Although we acknowledge that revealing raw ALPR data would be helpful in determining the extent to which ALPR technology threatens privacy, the act of revealing the data would itself jeopardize the privacy of everyone associated with a scanned plate. Given that real parties each conduct more than one million scans per week, this threat to privacy is significant. We therefore conclude that the public interest in preventing such disclosure “clearly outweighs the public interest served by disclosure of” these records.

This means the ACLU and EFF will end up with the data they seek, but in anonymized form. It's unclear at this point how this will be anonymized, or if the data, in its abstracted form, will show anything interesting. And there's still more discussion to be had on remand before the ACLU/EFF can actually take possession of the one week of ALPR data they requested. But it's still a significant precedent -- one that narrows the scope of an often-abused public records exemption.

Filed Under: alpr, automatic license plate reader, california, california supreme court, la, lapd, lasd, license plate readers, public records, transparency
Companies: aclu, eff

Terrorist-Fighting License Plate Readers Just Mobile Revenue Generators Cruising Poor Neighborhoods

from the gotta-spend-(public)-money-to-take-money-(from-the-public) dept

We know what automatic license plate readers are good for: collecting massive amounts (billions of records) of plate/location data housed by private companies and accessed by law enforcement for indefinite periods of time. What we don't know is how effective ALPRs are at fighting/investigating crime.

George Joseph at Citylab has done some digging into the effectiveness of license plate readers and hasn't found much that justifies the expense, much less the constant compilation of plate info.

Last month, the Bay Area’s UASI released ALPR data from the Central Marin Police Authority showing that only .02% of the nearly 4 million license plates tracked over October of 2015 through April of this year resulted in matches to any police “hot list” databases. The data indicate that zero “known or suspected terrorists” have been tracked using ALPRs, and that only a handful of other matches related to other hot-list criteria.

Why the mention of "terrorists?" Well, like most other high-tech law enforcement gear, the funding and deployment of these tools relies heavily on a narrative that never pans out: the neverending War on Terror. UASI stands for "Urban Areas Security Initiative" -- a DHS grant program meant to better equip law enforcement for handling terrorism/terrorists. To secure grants to pay for ALPRs, Stingrays, 1033 program supplies, etc., all law enforcement has to do is insert "because terrorism" somewhere in the requisition form. Existential angst -- and every government agency's natural desire to stay well-funded -- takes care of the rest.

But in reality, ALPRs aren't catching terrorists. They're not even catching dangerous criminals. Use of ALPRs has increased dramatically over the past decade, but there's not much to show for it other than millions upon millions of "non-hit" snapshots. Instead of bringing down terrorists, drug traffickers, auto theft rings, and kidnappers, ALPRs are being used to troll low-income neighborhoods. (Oakland, CA: Picture/data by Dave Maass, Jeremy Gillula, and EFF.)

Law enforcement officials continue to claim ALPRs are being used to target "major criminal activities." Maybe so, but there's been a troubling push by municipalities and private companies to turn plate readers into roaming revenue generators.

As the Electronic Frontier Foundation found, several municipalities in Texas... have sparked controversy for allowing police to team up with private-sector companies to work like mobile debt collectors.

In places like Guadalupe County, the City of Orange, and the City of Kyle, Vigilant, a for-profit technology firm, gives police free license-plate readers and creates its own “hot list” for police, using police records on individuals with outstanding court fines. In exchange, police with license-plate readers identify drivers with outstanding fines during their patrols, offering them a trip to jail or the option to pay the original court fee (plus a 25 percent markup, all of which goes to Vigilant).

This budget/profit-driven approach leads directly to ALPRs spending a disproportionate amount of time roaming low-income neighborhoods where unpaid fines and fees are often more prevalent. What's touted as a high-tech solution to serious criminal activity is being used to collect on unpaid parking tickets and unregistered vehicles. DHS anti-terrorism dollars are being converted into city budget enhancers. The "hot lists" used to direct law enforcement activity are routing officers away from dangerous criminal activity and turning them into glorified meter maids and revenue agents. Who needs to worry about terrorists when low-level scofflaws with unpaid parking tickets are more likely to generate income on the spot?

This is what's being done with millions of records controlled by private companies and governed by a patchwork collection of inadequate minimization and data destruction policies. Rather than make cities safer, they're only serving to make cities slightly richer. And in doing so, ALPRs are making policing -- especially the sort that actually serves the community -- a dusty relic of a bygone era.

Filed Under: alpr, law enforcement, license plates, privacy, revenue generation

Philly Cops Tried To Disguise An SUV With License Plate Readers As A Google Maps Vehicle

from the can't-spell-'stupid'-with-an-Alphabet dept

Here's the sort of fun stuff law enforcement gets up to when it thinks no one's paying attention. It all started with Matt Blaze tweeting out a photo of a rather suspicious-looking Google Maps vehicle.

WTF? Pennsylvania State Police license plate reader SUV camouflaged as Google Street View vehicle. pic.twitter.com/0z4yo2rVoR

— matt blaze (@mattblaze) May 11, 2016

As anyone can clearly see, a crappy decal was slapped on the window of a huge SUV, presumably in an attempt to disguise the true purpose of the cameras mounted up front, which are high-powered automatic license plate readers.

Blaze also spotted a Pennsylvania State Police parking placard on the dash.

The Pennsylvania State Police quickly denied the vehicle belonged to it. But it did, at least, (sort of) confirm the cameras were license plate readers.

Matt, this is not a PSP vehicle. If this is LPR technology, other agencies and companies might make use of it.

Philadelphia resident/investigative reporter Dustin Slaughter tracked down the vehicle and shot photos of the parking placard, along with the other side of the vehicle, confirming the bogus Google Maps window stickers were on both sides of the vehicle.

The city's fleet manager denied the vehicle belonged to the State Police. However, he did not clarify which agency the faux Google vehicle belonged to.

“All city vehicles such as police, fire, streets etc.…are registered to the city. Quasi [public] agencies like PPA, Housing Authority, PGW and School District are registered to their respective agencies,” fleet manager Christopher Cocci wrote in an email to Motherboard after reviewing photos of the vehicle.

Google also denied any involvement.

“We can confirm that this is not a Google Maps car, and that we are currently looking into the matter,” Google spokesperson Susan Cadrecha wrote.

Google tends to use vehicles with lower profiles, better gas mileage, and very distinctive branding/camera setups.


A few hours later, another Philadelphia law enforcement agency stepped forward to take credit for the deceptive vehicle.

The Philadelphia Police Department admitted today that a mysterious unmarked license plate surveillance truck disguised as a Google Maps vehicle, which Motherboard first reported on this morning, is its own.

In an emailed statement, a department spokesperson confirmed:

“We have been informed that this unmarked vehicle belongs to the police department; however, the placing of any particular decal on the vehicle was not approved through any chain of command. With that being said, once this was brought to our attention, it was ordered that the decals be removed immediately.”

The spokesperson also claimed that an inquiry is forthcoming.

Well, we have a WHO. What we don't have is a WHY. Of what possible use was this crappy, little fakeout? Anyone stupid enough to believe a hulking SUV with a city parking permit was a Google Maps vehicle is also too stupid to know what the cameras mounted on it are actually used for. For everyone else above that level, the easiest conclusion to draw is that the Philly police are stupid enough to think this would work. If so, they've shorted the wrong set of collective IQ.

A more benign explanation is also possible, though. It could have just been a poorly thought out attempt at a joke. Who sports more cameras and hoovers up more photos than Google's mapping vehicles? This may have just been a few cops poking fun at themselves, co-opting Big Data's look for their Big Brother plate scanning: the Google Maps of law enforcement, making sure no obscure side road goes "unmapped."

Filed Under: alpr, disguise, google maps, matt blaze, philadelphia, philadelpia police

Cops Getting Free License Plate Readers In Exchange For 25% Of The 'Take' And All The Driver Data Vigilant Can Slurp

from the an-equitable-partnership dept

What happens when you lower the barriers to entry? More participants join the market. It works everywhere, even when the market is "law enforcement" and the "customers" are everyone else.

Vigilant Solutions, one of the country’s largest brokers of vehicle surveillance technology, is offering a hell of a deal to law enforcement agencies in Texas: a whole suite of automated license plate reader (ALPR) equipment and access to the company’s massive databases and analytical tools—and it won’t cost the agency a dime.

[...]

Vigilant is leveraging H.B. 121, a new Texas law passed in 2015 that allows officers to install credit and debit card readers in their patrol vehicles to take payment on the spot for unpaid court fines, also known as capias warrants. When the law passed, Texas legislators argued that not only would it help local government with their budgets, it would also benefit the public and police.

Well, we can see how this will benefit law enforcement and others on the government food chain, but it's unclear how this will benefit the public. The bill's sponsor said the law would "relieve the burden" of having their vehicles impounded or being jailed for unpaid fines. But beyond those vague perks, the benefits seem to flow mostly in one direction.

The EFF quotes legal blogger Scott Henson of Grits for Breakfast, who speculated the combination of license plate readers and credit card readers would push cops towards chasing down unpaid fines rather than enforcing traffic laws or performing more routine patrol duties. If so -- and it appears to be the case -- this is exactly the outcome Vigilant was expecting. It didn't hand out its tech for free. There may be no price tag on the plate readers at the point of purchase, but that's only because Vigilant has points on the back end.

The “warrant redemption” program works like this. The agency gets no-cost license plate readers as well as free access to LEARN-NVLS, the ALPR data system Vigilant says contains more than 2.8-billion plate scans and is growing by more than 70 million scans a month. This also includes a wide variety of analytical and predictive software tools.

The government agency in turn gives Vigilant access to information about all its outstanding court fees, which the company then turns into a hot list to feed into the free ALPR systems. As police cars patrol the city, they ping on license plates associated with the fees. The officer then pulls the driver over and offers them a devil’s bargain: go to jail, or pay the original fine with an extra 25% processing fee tacked on, all of which goes to Vigilant.

To make this relationship even more explicit, officers who issue tickets to parked vehicles rather than drivers leave a note instructing them to visit Vigilant's website to pay the fine. On top of the 25% fee, Vigilant also gets to collect massive amounts of sweet, sweet driver data, which it can then sell to other law enforcement agencies (database access licenses) and private firms (insurance companies, repo men, etc.). And, if the locals seem understaffed, Vigilant is more than happy to pick up the slack.

In early December 2015, Vigilant issued a press release bragging that Guadalupe County had used the systems to collect on more than 4,500 warrants between April and December 2015. In January 2016, the City of Kyle signed an identical deal with Vigilant. Soon after, Guadalupe County upgraded the contract to allow Vigilant to dispatch its own contractors to collect on capias warrants.

As the EFF points out, this freemium service benefits Vigilant and law enforcement, but does very little for the general public… including protect them from Vigilant's inability to perform its job competently.

During the second week of December, as part of its Warrant Redemption Program, Vigilant Solutions sent several warrant notices – on behalf of our law enforcement partners – in error to citizens across the state of Texas. A technical error caused us to send warrant notices to the wrong recipients.

These types of mistakes are not acceptable and we deeply apologize to those who received the warrant correspondence in error and to our law enforcement customers.

Apologies are nice, if of limited utility, but…

[T]he company has not disclosed the extent of the error, how many people were affected, how much money was collected that shouldn’t have been, and what it’s doing to inform and make it up to the people affected.

As has been discussed here before, turning law enforcement agencies into revenue-focused entities is a bad idea. Case in point: asset forfeiture. Further case in point: speed trap towns. Improper incentives lead to improper behavior. Agencies may like the idea of a "free" license plate reader, but the price still has to be paid by someone -- and that "someone" is going to be the general public.

As priorities shift towards ensuring ongoing use of the "free" ALPRs, other criminal activity is likely to receive less law enforcement attention. Unpaid fines and fees are in law enforcement's wheelhouse, but should never become its raison d'etre. Once it does, the whole community suffers. Anything that could be implemented to lower crime rates would also serve to lower revenue, making it far less likely to be implemented. Fewer infractions mean fewer opportunities to collect court fees. And while the legislators pushing the new law Vigilant is leveraging talked a good game about sending fewer people to overcrowded jails, the governments overseeing these agencies still have budgets to meet and law enforcement to lean on to ensure this happens. Actually achieving the bill's stated aims would mean a steady reduction in court fees, which would lead to the loss of "free" plate readers. And no one wants that, at least not on the government side of things.

Filed Under: alpr, business models, law enforcement, license plate readers, license plates, police, texas, ticketing
Companies: vigilant solutions

L.A. Politician Proposes Bold Plan To Wreck Homes, Destroy Lives And Abuse License Plate Reader Technology

from the conversely,-the-government-is-able-to-fuck-you-free-of-charge dept

Nick Selby says an LA councilwoman has just proposed "the worst use of license plate data in history." He's not lying.

Automatic license plate readers gather tons of plate/location data, which can then be used for law enforcement purposes (when not being sold to, or by, private entities to insurance companies, repossession firms, etc.). The plate/location data may help recover stolen vehicles or track mobile criminals, but they also create massive databases of people's movements. This can create a chilling effect on motorists, as someone said to Selby at a surveillance-focused conference.

“The issue is the potentially chilling effect that this technology has on freedom of association and freedom of transportation.”

Cue chilling effect.

That’s literally the phrase that leapt into my mind when I read the monumentally over-reaching idea posed by Nury Martinez, a 6th district Los Angeles city councilwoman, to access a database of license plates captured in certain places around the city, translate these license plates to obtain the name and address of each owner, and send to that owner a letter explaining that the vehicle was seen in, “an area known for prostitution.”

This should create some additional household friction in the Los Angeles area. There's nothing like a letter from the city informing a vehicle owner that their car was spotted in an area known for prostitution, with the underlying assumption that the only reason a vehicle would be in these areas is because the driver was looking to exchange money for sexual favors.

Martinez says the non-guilty have nothing to worry about, because she's an idiot.

Councilwoman Martinez feels that prostitution is not a “victimless” crime, and that by discouraging johns, the incidence of the crime can be reduced. Martinez told CBS Los Angeles, “If you aren’t soliciting, you have no reason to worry about finding one of these letters in your mailbox. But if you are, these letters will discourage you from returning. Soliciting for sex in our neighborhoods is not OK.”

There are plenty of legitimate reasons for someone to be in an area law enforcement has determined is "known for solicitation." Many drivers live or work in areas "known for prostitution." Many other drivers may have to drive through areas "known for prostitution" to shop, go to work, or just get to the nearest freeway entrance ramp. So, there are plenty of reasons to "worry" about being falsely labelled as a john by the city. And it won't be the city that has to deal with the fallout. It will be the families that are destroyed by Martinez's horrifically misguided proposal.

Even if innocent drivers toss the letters before they do any damage to their personal relationships, each letter generated from this abuse of technology meant to aid police in locating stolen vehicles and/or dangerous criminals will create a public record that can be requested and published by nearly anyone. So, even if a person throws the letter in the garbage after receiving it, someone else could make this information public -- threatening personal relationships, damaging reputations and possibly costing people their jobs. And all because their vehicle happened to be in an arbitrarily "wrong place" at the wrong time.

Selby reports the city council is currently working with the district attorney to see how -- or if -- this can be implemented. Hopefully, someone more aware of the legal ramifications of this proposal will shut it down before it does any damage.

Filed Under: alpr, letters, license plate readers, los angeles, nury martinez, prostitution

EFF Discovers More Leaky ALPR Cameras Accessible Via The Web

from the more-cameras,-less-security dept

Not only are automatic license plate readers (ALPRs) in use all over the nation, but the companies behind them are less interested in securing their systems than selling their systems.

Earlier this year, EFF learned that more than a hundred ALPR cameras were exposed online, often with totally open Web pages accessible by anyone with a browser. In five cases, we were able to track the cameras to their sources: St. Tammany Parish Sheriff’s Office, Jefferson Parish Sheriff’s Office, and the Kenner Police in Louisiana; Hialeah Police Department in Florida; and the University of Southern California’s public safety department. These cases are very similar, but unrelated to, major vulnerabilities in Boston’s ALPR network uncovered in September by DigBoston and the Boston Institute for Nonprofit Journalism.

The earlier investigative work mentioned by the EFF has been spearheaded by Kenneth Lipp, who has exposed several insecure camera systems run by private contractors but deployed by government agencies. Lipp has also uncovered unsecured law enforcement CCTV systems in other major cities, including New York's Domain Awareness System, where feeds could be easily accessed via the internet.

The systems the EFF accessed are sold and maintained by PIPS Technology. The EFF was able to access several stationary ALPR cameras and view live captures of plate data.





The company, now owned by 3M, offered this statement when notified of the security hole.

We cannot comment on issues PIPS may have had prior to the acquisition, but I can tell you any issues with our products are taken very seriously and directly addressed with the customer.

We stand behind the security features of our cameras. 3M’s ALPR cameras have inherent security measures, which must be enabled, such as password protection for the serial, Telnet and web interfaces. These security features are clearly explained in our packaging.

Except, of course, the EFF's discoveries came after 3M's acquisition of PIPS. While the holes the EFF uncovered have been closed, 3M (and other companies) have pretty much declared unsecured ALPR cameras to be Not Their Fault. Over the years, researchers and activists (like Dan Tentler) have received a variety of deflections from ALPR companies.

3M spokeswoman Jacqueline Berry noted that Autoplate's systems feature robust security protocols, including password protection and encryption. They just have to be used.

"We're very confident in the security of our systems," she said.

That would mean something if the companies simply sold the software and hardware. But the companies also have direct access to client connections and should be able to check for unprotected sources. But they don't and when confronted, they blame the end user. When Kenneth Lipp went public with his discoveries, he received this answer from Genetec, which ran the systems he was able to access.

On the ALPR front, Genetec shirks all responsibility for the aforementioned open portal, even though a remote desktop client terminal, which was also left exposed, shows they had direct access. Reached by email for this story, the company’s Vice President of Marketing and Product Management Andrew Elvish wrote that the server in question was a “location used by a customer to transfer data to be used in a parking or law enforcement patrol car, equipped with a Genetec system.” The data, Elvish added, was “not gathered by a Genetec AutoVu ALPR system … [which is] automatically encrypted.”

As far as the contractors are concerned, the problem is law enforcement agencies who are deploying the cameras and systems without implementing built-in security features. And while the agencies involved quickly closed the security holes, it doesn't change the fact that these systems went live while they were still unsecured. This could be chalked up to carelessness, but it could also be another indication of how little most agencies (and the companies who sell to them) care about the millions of people who aren't cops/government contractors. In their minds, the important thing is that the systems went live and started contributing to vast plate/location databases. Properly securing systems is still an afterthought.

Filed Under: alpr, license plate readers, security
Companies: 3m, eff, pips