License Plate Reader Companies Lose Case Seeking To Have Anti-ALPR Law Declared Unconstitutional

from the will-just-have-to-make-do-with-the-millions-of-records-already-acquired dept

Last summer, automatic license plate reader manufacturer Vigilant Systems took the state of Arkansas to court over its legislative ban on the private collection of license plate data. It argued -- along with Digital Recognition Networks -- that the new law encroached on its First Amendment rights.

Its argument was this: photography of public objects is protected by the First Amendment. A license plate is a public object and, when photographed from a public street, is no different than any random person with a camera snapping license plate photos. Because an individual taking a smaller set of photos would fall under these protections, an ALPR company should similarly be covered. A violation that does not occur in individual cases does not suddenly arise when the amount of photos "taken" (along with location data) is in the millions.

Vigilant pursued a similar lawsuit against Utah and succeeded in gutting the state's anti-ALPR legislation. It was hoping to do the same here, but the state of Arkansas held firm, fighting the companies all the way up to the Eighth Circuit Court of Appeals, which has found in favor of the state.

The lower court had granted the state its motion to dismiss, finding that the defendants were immune from litigation under the Eleventh Amendment, and more importantly, that Vigilant, et al lacked standing to pursue a claim against the state. DRN and Vigilant appealed.

Digital Recognition argues that the district court erred by dismissing its complaint based on the Eleventh Amendment and state sovereign immunity. The state officials make a two-fold response: The Eleventh Amendment bars the suit, because the officials do not have sufficient connection to enforcement of the Reader System Act, and there is no Article III case or controversy, because Digital Recognition lacks standing to sue.

The Appeals Court sides with the previous decision. While it recognizes there may be a chance that Digital Recognition can achieve standing, it won't be against these particular defendants.

We may assume that Digital Recognition satisfies the injury-in-fact element of standing, because it has alleged that but for the Act, it would resume collecting and disseminating license-plate data in Arkansas. This conduct is “arguably affected with a constitutional interest,” Babbitt v. United Farm Workers Nat’l Union, 442 U.S. 289, 298 (1979), because the “creation and dissemination of information are speech within the meaning of the First Amendment.”

[...]

Digital Recognition nonetheless lacks standing to sue the governor and attorney general because the injury of which Digital Recognition complains is not “fairly traceable” to either official. Article III requires “a causal connection” between the injury and the defendant’s conduct; the injury may not be a result of “the independent action of some third party not before the court.”

Because the two defendants -- the governor and attorney general -- are not directly involved in enforcing the law, any injury resulting from the law can only be traced back to plaintiffs bringing civil litigation against the alleged violators. The attorney general may defend the lawfulness of the anti-ALPR law, but the office does not itself bring actions against a violating entity. So, as the law is written, the parties named here cannot be held responsible for violating the two companies' First Amendment rights.

The plate reader companies also tried a few obliquely-angled attacks on the law, neither of which found their mark.

Digital Recognition requests a permanent injunction, phrasing this request as one for an “injunction[] enjoining Defendants from applying or enforcing the Act’s provisions,” and an “injunction against the application or enforcement of the Act.". But as the district court observed, an injunction prohibiting the attorney general from intervening in a private damages action to defend the Act’s constitutionality would not redress Digital Recognition’s injury… Private litigants who assert violations of the Reader System Act may defend the constitutionality of the Act, and they will not be constrained by any injunction that could be issued against the state officials in this action. A district court has no authority to enjoin the statute; an injunction would run only against the defendants in the case.

[...]

Digital Recognition suggests that even if an injunction against the officials would not redress its injury, the district court could declare the Act unconstitutional, and the relief accorded by a declaratory judgment would satisfy Article III. A declaration, the companies argue, would substantially diminish the risk that the Act would be enforced: private parties would be less likely to sue, the attorney general would not intervene to defend the Act, and a declaratory judgment would “create precedent that binds federal and state judges in Arkansas.” This argument, however, “overlooks the principle that it must be the effect of the court’s judgment on the defendant that redresses the plaintiff’s injury, whether directly or indirectly.” A declaration that the Reader System Act is unconstitutional would not redress Digital Recognition’s injury by virtue of its effect on the defendant officials. Private litigants with rights to enforce the Act would not be the subject of any relief in this action, and any judgment would not oblige private litigants to refrain from proceeding under the Act.

In the end, the law stands and the officials named as defendants are immune from litigation. The companies can still challenge the legality of the law, but they'll have to take a different approach. For the time being, plate information will still be collected in Arkansas, but only by government entities. Private collections -- usually obtained by towing companies and sold to repo firms, auto dealers and insurers -- are still off limits.

Filed Under: alpr, arkansas, first amendment, license plate reader, privacy
Companies: vigilant systems

City Of Boston Left License Plate Data Unprotected And Unencrypted

from the the-city-invites-you-to-perform-vanity-searches-on-its-ALPR-servers dept

If you want a rough estimate on how much respect law enforcement agencies (and the contractors they hire) have for your personal information, all you have to do is take a look at how well they protect the vast amount of data they slurp up.

Investigative reporter Kenneth Lipp has been digging up documents and data left unguarded by government contractors for several months now. While researching the use of ALPRs (Automatic License Plate Readers) in Boston, Lipp came across a publicly-accessible database of plate scans and motor vehicle records. The problem is: it wasn't supposed to be publicly-accessible.

Prior to two weeks ago, when this reporter alerted authorities that they had exposed critical data, anyone online was able to freely access a City of Boston automated license plate reader (ALPR) system and to download dozens of sensitive files, including hundreds of thousands of motor vehicle records dating back to 2012. If someone saw your shiny car and wanted to rob your equally nice house, for example, they could use your parking permit number to obtain your address. All they had to do was find the server’s URL.

This data wasn't being housed by Boston law enforcement. Instead, it was in the hands of its contractor, Genetec, which owns the popular ALPR brand, AutoVu. As Lipp points out, the city of Boston's first ALPR deployments were no big secret. The camera system was mounted on the roofs of Transportation Department vans along with sodium lights. The surveillance was no secret, but the data collected certainly was -- which was why it was left in the hands of a private corporation.

ALPRs were eventually noticed by watchdogs, and in 2004 spurred a public records request, which was denied by the BTD [Boston Transportation Department] on the grounds that the database was privately owned and “on loan” from AutoVu.

Ten years later, the city is still putting its faith (and its un-FOIA-able records) in Genetec. Not that Genetec deserves it. When Lipp pointed out its unguarded portal, it denied any responsibility for its carelessness.

Reached by email for this story, the company’s Vice President of Marketing and Product Management Andrew Elvish wrote that the server in question was a “location used by a customer to transfer data to be used in a parking or law enforcement patrol car, equipped with a Genetec system.” The data, Elvish added, was “not gathered by a Genetec AutoVu ALPR system … [which is] automatically encrypted.”

Lipp investigated further and found that the server was actually run by a Xerox subsidiary. Two hours after being notified of the security hole, the company closed it.

This would normally be the end of the story. But it goes on from there. What was uncovered during Lipp's foray into a supposedly secured and encrypted server points to further dishonesty, going beyond Genetec's disowning of a database it has (or had) direct access to.

As the ACLU's Kade Crockford points out, autogenerated notifications found on the server point to Boston law enforcement continuing to utilize a program it had previously told the public it would be abandoning.

I was surprised to discover these records because in 2013, in the wake of local reporter Shawn Musgrave's expose on privacy and civil liberties problems with the department’s license plate reader program, the Boston Police told the public that it was scrapping the program altogether. The Xerox records suggest scrapping isn’t at all what occurred. Indeed, the automated emails from BTD’s license plate reader program to the Boston Police, left on the Xerox server for anyone to download at will, appear to have started at around the same time the cops told the public they’d stopped using license plate readers. That's to say, instead of scrapping the program as the police told the public they would, BPD appears to have bootstrapped their license plate reader program from BTD data.

The government may claim license plate data has no expectation of privacy (unless you ask for it…) but people hardly expect their records to be exposed to the public at large. And they certainly don't expect them to be accessible from the web and stored in plaintext. Even if the public is willing to accept the portrayal of plate/location data as nothing more than the digital equivalent of human eyeballs on public streets, it will be far less likely to forgive the government's apparent disinterest in ensuring these records received even a minimal level of protection.

Filed Under: alpr, boston, license plate data, license plates, privacy, security
Companies: autovu, genetec

City of San Jose Looking To Attach Automatic License Plate Readers To Garbage Trucks

from the proxy-police dept

Because automatic license plate readers just aren't efficient enough -- what with their ability to capture hundreds, if not thousands, of plate scans per hour -- San Jose's city government is looking to deputize other businesses and their vehicles in its quest to achieve 100% coverage of the city.

Mayor Sam Liccardo and Councilmen Johnny Khamis and Raul Peralez proposed that the city consider strapping license plate readers to the front of garbage trucks, allowing them to record the plates of every car along their routes. The data would be fed directly to the Police Department from the privately operated trash trucks, prompting an officer to respond to stolen vehicles or cars involved with serious crime.

"We can cover every street at least once a week and possibly deter thieves from coming into our city," Khamis said. A committee chaired by Liccardo that sets the council's agenda voted Wednesday to continue exploring the idea.

San Jose won't be the first city to use non-police vehicles to do its plate scanning. As was covered here earlier this year, Hampton, Virginia has mounted an ALPR to a "city van" and uses the data collected to chase down the city's tax evaders -- a term that includes anyone who owes $5 or more to the city. Another town doesn't even use a city vehicle. Isle of Wight completely outsources its plate scanning efforts, putting it solely in the hands of a private company with its own plate scanners.

While it's true that a vehicle parked on a public street (or one that can be viewed from a public street) has no expectation of privacy, the amount of data gathered still raises privacy-related concerns. It's one thing to view a vehicle on a public street with a set of human eyes. It's quite another when this set of "eyes" compiles thousands of plate-location records and stores them for weeks or months. Once that happens, it's no longer just random cars on random streets. It's long-term tracking.

At this point, the plan is still in its proposal stage. City officials say at least one sanitation company is already on board with the proposed program.

Khamis said Wednesday's action is only the first step in a long process. The proposal calls for city officials to explore the "feasibility, legality and civil liberties implications" of garbage-truck mounted license plate readers. Questions the council members asked the city to consider include the process of transferring license data from the private garbage trucks to the police, whether they would be subjected to the same or different policies governing police car license readers and whether other cities have taken similar measures and how they worked.

Beyond the civil liberties implications, the city needs to examine the reality of what it's doing: using public funds to purchase law enforcement equipment to place on private vehicles. And it needs to ask itself whether the people providing these funds -- taxpayers -- are on board with the use of private companies as an extension of law enforcement. It also needs to examine its motives thoroughly. Just because there's no expectation of privacy doesn't necessarily mean government bodies should strive for 100% exploitation of these areas.

Filed Under: alpr, garbage trucks, license plates, privacy, san jose

Feds Hand Out Funds To Be Used For 'Traffic Safety;' Local Agencies Buy License Plate Readers Instead

from the protective-non-custody dept

The National Highway Transportation Safety Association (NHTSA) is supposed to be focused on one thing: safety. For crying out loud, it's right in the middle of its cumbersome name. But the federal funding it hands out to state and local governments is being used for surveillance devices with no discernible "safety" purpose: automatic license plate readers.

The NHTSA is funding license plate readers for highway safety purposes only, but it’s far from clear how law enforcement agencies are interpreting this and whether they are using the funding to buy license plate readers for non-safety uses. The NHTSA should not be funding police technology for surveillance purposes and it should not let law enforcement apply for funding to decrease traffic fatalities and then turn around and use those funds to track people not suspected of any crime.

This is how things are supposed to run versus how things actually run. This funding dodge is pretty much indiscernible from law enforcement agencies obtaining DHS/DoD grants for Stingrays and Bearcats to combat "terrorism," and then using the equipment to do banal, routine policework, like tracking down drug dealers.

So, in the name of "safety," local agencies are asking for federal funding, and then using the subsidization to deploy new surveillance tech. Standard operating procedure. And the companies manufacturing this equipment clearly recognize these exploitable funding opportunities and target prospective purchasers accordingly.

Private license plate reader manufacturers have further facilitated NHTSA granting funds for license plate reader systems by connecting state and local law enforcement agencies with the funding streams. In one 2012 email exchange, an employee of an ALPR maker advises the Florida Department of Highway Safety and Motor Vehicles that “NHTSA funding is available for traffic safety” and provides contact information. Indeed, the company has a whole page of its website devoted to connecting law enforcement agencies with sources of funding.

In essence, the companies are telling agencies this equipment is pretty much free. And it is, as long as you don't think too hard about the original source of the funding: taxpayers. Exploiting this federal funding allows agencies to claim safety is a priority while not actually moving towards that goal. Instead, they get the location tracking technology they want and allow the public to pick up the tab. Then this equipment is turned around and pointed at the same people paying for it, sometimes literally as a tool of tax collection.

And it looks as if this broken, abused system will only get worse. The ACLU reports the NHTSA is soliciting bids for a study into the use of license plate readers to improve driver safety. That this obviously arrives well after NHTSA funds have been used to purchase plate readers is already problematic. Beyond that, any conclusions drawn from the report will simply provide law enforcement agencies with handy citations to use when requesting funding for equipment they have no interest in using for "public safety" reasons.

Filed Under: alpr, license plate readers, traffic safety

Virginia Governor Signs Warrant Requirement For Police Drone Use; Balks At Seven-Day Limit On ALPR Data Retention

from the aww...-and-he-was-doing-so-good-on-the-civil-liberties-front dept

Good news/bad news from the state of Virginia. Governor Terry McAuliffe had two bills land on his desk, both passed with overwhelming support, that would have assured additional privacy protections for the state's citizens. Unfortunately, he only signed one of them.

The one with his signature on it institutes a warrant requirement for law enforcement drone usage. McAuliffe originally sent this one back with a suggested "fixes" that would have rendered the proposed warrant requirement completely meaningless.

Rather than require a warrant for all law enforcement use of drones, the governor's amendments only require warrants for “active criminal investigations,” leaving the door open for persistent, untargeted drone surveillance. Rather than ban the use of evidence collected without a warrant by drones, the governor's amendments created a procedural loophole where otherwise forbidden evidence could be introduced under a different set of legal standards.

To their credits, the legislators who had passed the bill without massive loopholes refused to fold in the governor's suggested amendments. The second time it hit his desk, McAuliffe signed it. This passage can be added to the state's privacy "wins" column, which also includes a warrant requirement for Stingray use.

The bad news is that McAuliffe rejected a bill that would have placed a seven-day retention limit on data gathered by automatic license plate readers. McAuliffe argued -- correctly -- that this limit was significantly lower than any policy currently in place in Virginia. (And, most likely, anywhere in the nation.) Unfortunately, he used ALPR/law enforcement talking points to do so.

Many localities in Virginia retain this data for 60 days to two years. Seven days is a substantial reduction. Additionally, law enforcement agencies demonstrate that crimes are often not reported until several weeks later. Under this bill, essential data would not be available at the time of those reports. This is particularly concerning when considering implications for the National Capitol Region, where cross-state collaboration and information-sharing are essential to responding to potential criminal or terrorist activity occurring near Virginia’s borders.

Oh, "terrorism," you rascally, constantly useful justification! Where will you pop up next? (Probably not in areas actually loaded with terrorists, I would guess.)

Unlike drones and Stingrays, ALPRs weren't originally crafted for use by military personnel in war zones. But here we see the invocation of terrorism as a justification for passively scanning thousands-to-millions of license plates every day. Sure, any vehicle traveling in public areas can be observed, but multi-point collections of plate/location data gives anyone with access a very clear picture of someone's daily life. While we would expect people currently under investigation to be closely watched by police (and/or "tailed" by proxy by ALPR data), we don't expect everyone to be subject to the same level of scrutiny simply because the technology has liberated law enforcement officers from performing in-person surveillance.

The destruction of non-hit data within a short time frame shouldn't be a concern, no matter how much crime/terrorism is afoot in the Virginia area. The amount of plate/location data that can be hauled in by ALPRs is astounding. And the "cross-state collaborations" and "information-sharing" the governor points to only adds to the massive haul. If a potential suspect's information falls into the seven-day memory hole, there's a good chance it will return to the database within a matter of days.

As for the stated concern about the lag between criminal activity and its reporting? Well, what did officers do before they had historical ALPR data to rely on? Surely those investigative methods still exist. ALPRs may have made the job easier, but they didn't destroy previously-existent investigative techniques upon deployment.

On top of this, there's the fact that if McAuliffe doesn't pass this law with the limitation intact, state ALPR usage will continue to violate ANOTHER law.

[M]cAuliffe fails to mention [that] law enforcement agencies are already breaking Virginia’s Data Act by storing ALPR data, as the Virginia Attorney General determined in a 2013 legal opinion [PDF].

If he decides to pass the bill with the limit in place, his state may also enjoy a more favorable outcome to the ALPR-related lawsuit filed against it.

Five days after McAuliffe signed the bills, the [ACLU of Virginia] filed a lawsuit [PDF] against the Fairfax County Police Department, which, despite the Attorney General’s guidance, has been storing ALPR data for up to a year and sharing that data with other law enforcement agencies in the region.

And then there's the fact that ALPRs have been abused by state police and no one in Virginia law enforcement seems to know whether the systems are actually helping apprehend more criminals.

McAuliffe has already sided with his constituents' privacy on two previous bills. There's a lot of ground for compromise between the seven days the bill asks for and the "up to a year" time limit law enforcement agencies already enjoy. That this bill also landed on his desk with overwhelming legislative support is a pretty good indication that Virginians would like the retention needle pushed closer to one week. Hopefully, he'll make the right call and continue to allow his state to lead the nation in privacy protections.

Filed Under: alpr, drones, license plate readers, privacy, surveillance, terry mcauliffe, virginia

Philly PD Declares All Drivers To Be 'Under Investigation' While Denying Request For License Plate Reader Data

from the the-REAL-wretched-hive-of-scum-and-villainy dept

We've all heard nasty things about the citizens of the apparently ironically-named "City of Brotherly Love." They'll boo Santa Claus. They throw batteries at opposing baseball players... and their own. And that's just the sports fans.

More bad news has just arrived on the "We're all not that terrible" PR front: according to Philly's police department, each and every car owner whose vehicle's license plate has had the misfortune of being scanned by the PD's license plate readers is some sort of criminal. Charges TBD.

The City of Philadelphia does not want you to know in which neighborhoods the Philadelphia Police Department (PPD) is focusing their use of powerful automatic license plate readers (ALPR), nor do they want disclosed the effectiveness (or lack thereof) of this technology, as they continue to fight a Declaration public records request filed in January with MuckRock News.

City officials argue in their response that every metro driver is under investigation, in an effort to exempt so-called criminal investigatory records from release under PA’s Right-to-Know Act:

Moreover, records “relating to or resulting in a criminal investigation” are exempt from disclosure under the Act, in particular “[i]nvestigative materials, notes, correspondence, videos and reports.” 65 P.S. § 67.708(b)(16)(ii). Such individual license plate readings and accompanying information are investigative materials that relate to individual criminal investigations, and, as your request indicates, these investigations may result in vehicle stops, arrests, or other police actions. Therefore, the individual license plate reading data is exempt from disclosure under the Act.

Investigative reporter Dustin Slaughter and The Philly Declaration have been battling the city for access to two weeks of raw ALPR output and, after multiple appeals, have been told every scan is exempt because every scan is part of a criminal investigation. This bizarre claim echoes the Los Angeles Police Department's public records request-thwarting declaration: all scans are, and always will be, tied to investigations.

The Declaration is seeking this data to see if deployment patterns signal any sort of bias or prejudicial treatment. What it has managed to pry free from law enforcement are the following facts: At least 10 ALPRs are in steady use. Non-hit data is retained for a year. Data actually related to investigations is held indefinitely. (Which would mean -- if the PD's stated logic holds -- that all scans are held indefinitely...)

The PD did hand over some summary data "pertaining to the time period requested," but it must have grabbed the wrong figures or misread Dustin Slaughter's request. He asked for data for a two-week period (Jan. 1-14, 2015). These are the numbers the PD handed over.

Number of Tags Read: 22,810,687
Terror Watch Reads: 77
Stolen Autos Recovered: 420
Stolen Plates Recovered: 23
Felony Arrests Made: 19
Misdemeanor Arrests Made: 9
Total Read Hours ALPR Fleet: 81,197

While it's theoretically possible 22 million plates could be scanned in two weeks, there's no way the Philly PD racked up 81,197 read hours during that time period, even if distributed across multiple vehicles. If this is a two-week period summary, the PD would need 241 units running 24 hours a day to hit the quoted "read hours."

But even if these numbers are a lifetime summary of the the ALPR program, they're still pretty impressive… at least in terms of scanning efficiency.

The department launched its ALPR program in or around 2011, according to Newsworks’ reporter Tom MacDonald.

This means the department is raking in around 7 million scans per year. On the other hand, if 22 million scans have only generated 19 felony arrests, you have to start wondering about the return-on-investment -- something that doesn't exactly back up Commissioner Charles Ramsey's claim that the ALPRs are "highly effective crime fighting tools." While it's nice to see the department is recovering around 140 stolen vehicles every year, it's a bit more disheartening to hear that it's only led to 28 total arrests -- especially when it considers every single one of these 22 million scans to be part of criminal investigations.

Filed Under: alpr, investigations, license plate readers, license plates, philadelphia, philadelphia pd, philadelphia police, privacy

DHS Takes Another Stab At License Plate Database, But This Time With More Privacy Protections And Transparency

from the it-can-be-taught dept

About a year ago, the DHS -- seemingly completely oblivious to the fact that domestic surveillance programs were being collectively frowned upon in the wake of the Snowden leaks -- began soliciting quotes on a nationwide license plate reader database. Within a week, DHS head Jeh Johnson had shut down the plan, claiming the rogue solicitation had somehow escaped into the wild without a proper official approval and had nothing to do with the backlash it had generated upon discovery.

Not that the disappearance of this solicitation changed anything. The DHS (and ICE) already have access to the many ALPR databases maintained by a variety of private companies. All this would have done was provide the DHS with estimates on subscription fees and perhaps some help on developing a DHS/ICE-specific front end for access.

Nearly a year past the mini-debacle and the DHS is back in the license plate database business. This solicitation, however, is far more specific than last year's botched attempt. (via The Hill)

Immigration and Customs Enforcement (ICE) intends to issue a solicitation to obtain query-based access to a commercially available License Plate Reader (LPR) database.

ICE seems far more interested than usual in alleviating any concerns that this will be yet another domestic surveillance program.

ICE is neither seeking to build nor contribute to a national public or private LPR database. ICE will use LPR information obtained in response to queries of the commercial database to further its immigration enforcement missions. ICE law enforcement personnel will query the LPR database using known license plate numbers associated with the aliens who are immigration enforcement priorities, based on investigative leads, to determine where and when the vehicle has travelled within a specified period of time. The results of the queries can assist in identifying the location of aliens who are immigration enforcement priorities, to include aliens with certain criminal convictions, absconders, illegal re-entrants and those that pose a public safety or national security risk.

Rather than build new databases and grant open access to ICE agents, the agency is only looking to search known plate numbers. While this end will remain targeted, it doesn't do anything limit the collection efforts. Vigilant -- the largest ALPR provider -- claims to be adding more nearly 100 million plate/location records every month. The only thing "limited" about this plan is DHS's access. And even that may not be as limited as the previous paragraph implies.

ICE will also use LPR information obtained from the commercial database to further its criminal law enforcement mission, which includes investigations related to national security, illegal arms exports, financial crimes, commercial fraud, human trafficking, narcotics smuggling, child pornography, and immigration fraud.

So, it's not just immigration and customs enforcement. It's pretty much everything the ICE thinks it should have an active part in.

To its credit, it has at least compiled a Privacy Impact Assessment ahead of its ALPR database plans, rather than allow this to trail implementation by months or years. But within this assessment are hints that ICE's access won't be quite as limited as its earlier statement implies. For one, ICE already operates its own LPR cameras, so it won't solely be making use of preexisting data. It also has no controls in place to limit access when working with outside law enforcement agencies and using their access to LPR databases.

There are indications that the DHS and ICE are attempting to keep this access from being exploited or abused. The assessment notes that agents will be informed (and reminded) that a license plate "hit' cannot be the "sole basis" for law enforcement action. But the limits it's imposing on itself are still a bit too flexible. Plate info will only be allowed to be accessed for a "limited" amount of time, but that "limited" time frame is partly tied to the statute of limitations for the underlying crime. In most cases, the assessment notes, ICE agents will be able to access five years of historical plate/location data -- which it notes is approximately the average amount of time a person owns a particular vehicle.

The assessment also notes that the "Alert List" must be frequently updated to remove plates tied to closed investigations or when a person [but a license plate isn't a person?] is no longer a suspect. While some agents will be more proactive than others, the assessment only suggests an update be performed "at least annually."

The better news is that the DHS and ICE are making moves towards greater transparency, as well as demanding the winning vendor provide "robust audit trails" on any agency database use. Of course, a "robust audit trail" is only as good as the consequences for misuse, and the government in general has never been big on meaningful enforcement of its internal policies. Unfortunately, that's really the only thing preventing this targeted access from becoming the "unwarranted surveillance" the agency's Privacy Impact Assessment claims it's trying to avoid.

That being said, getting out ahead of the program with an impact assessment is almost unheard of in the law enforcement/intelligence field, so the DHS deserves some credit for realizing its past effort in this area was badly mishandled.

Filed Under: alpr, database, dhs, homeland security, license plates, privacy

Virginia Towns Using Federally-Funded License Plate Readers To Collect Local Taxes

from the thanks-for-the-exploitable-tech,-US-citizens! dept

Two things remain certain in life: death... and law enforcement agencies using license plate readers obtained with Homeland Security grants for purposes not even remotely related to securing the homeland.

Here's how Newport News, Virginia's police department obtained its automatic license plate readers:

Grant money from a terrorism prevention program of the U.S. Department of Homeland Security through the Virginia Department of Emergency Management provided the funding for automatic license plate readers for several Hampton Roads agencies, including Newport News, Suffolk, Norfolk, Williamsburg, James City County, York-Poquoson and Isle of Wight, said Laura Southard, public outreach coordinator for the state's emergency management department.

Hampton Roads law enforcement departments received $869,000 in 2009, $357,000 in 2010 and $143,000 in 2011 for license plate readers, Southard said.

And here's what it's doing with them:

Delinquent taxpayers in Newport News could have their vehicles impounded if new cameras snap a photo of their license plates around town.

In an attempt to claim the nearly $4 million in delinquent personal property taxes owed, the city will soon begin using license plate scanners to find vehicles on which more than $200 in personal property taxes are owed.

The cameras will be mounted to the backs of six sheriff's department cruisers to automatically read license plate numbers. Those numbers will be cross-searched with a database updated daily of all the license plates in the city with more than $200 in personal property taxes owed, Treasurer Marty Eubank said.

The terms "terrorism" and "drug enforcement" were likely thrown around during the application process, but the end result is the city viewing law enforcement technology as just another revenue generator. A "hit" from the ALPR will result in the vehicle being towed within three days if the delinquent taxes aren't paid off or a payment plan set up.

While the city has every right to pursue delinquent taxes, it has no business re-purposing federally-purchased law enforcement technology to do so. Citizens concerned about ALPR databases housing millions of non-hit records have always been assured that this technology will be used to fight the baddest of the bad: drug dealers, terrorists, auto thieves, kidnappers, etc. But now it's being used to collect back taxes -- hardly the sort of thing Homeland Security funds should be used for.

Things get even more petty a little down the road in Hampton, Virginia. While Newport News' enforcement efforts don't kick in unless more than $200 is owed, Hampton is all about the Lincolns.

Hampton has one camera mounted to a city minivan, not a police vehicle, which is driven around town every week day, said Dave Ellis, field compliance supervisor in the Hampton Treasurer's Office. When field investigators find a vehicle with a license plate for which more than $5 in property taxes is owed, they first place a warning sticker on the vehicle telling the owner to make contact with the city. If there is no response from the owner after about a week, the investigators go back and remove the license plates or put on a wheel lock, Ellis said.

Hampton's tax-collecting ALPRs were first deployed in 2008. It's left unclear how the usually "law enforcement-only" technology ended up in the city's hands, but most likely a Memorandum of Understanding allowed the transfer of the plate readers. To date, $1.4 million in federal funds have been dispersed to pay for law enforcement's ALPRs -- and now some of them are being used to track down $5 property tax deadbeats.

Isle of Wight doesn't even bother doing its own tax collection efforts. According to the article, this is outsourced to a private company with its own plate readers, meaning there's next to zero accountability. Turning a city job private keeps records related to tax collection efforts a little further away from curious constituents and their Freedom of Information requests.

Not that the Hampton Roads law enforcement network is too concerned about overstepping its bounds or potentially violating constitutional rights. As was covered here late last year, these same law enforcement agencies have built their own phone record database -- filled with data obtained from subpoenas, warrants and court orders -- which is shared between the multiple agencies with no apparent oversight.

Once you get past the re-purposing of federal funds for local tax collection, you arrive at the question of cost effectiveness. Hampton sends its city vehicle out every weekday to troll for plates. On top of the paycheck handed out to the driver(s), there's fuel and vehicle wear-and-tear costs to be considered, along with whatever's being paid to maintain the technology and its database. And yet, it seems satisfied to have collected $60,000 in unpaid taxes last year -- seemingly "break even" at best.

The bottom line is this: if you want to use ALPRs to catch delinquent taxpayers, then be upfront about this and use local funds to purchase the equipment. Don't simply use the technology because it's there. Using federally-funded plate readers is basically asking the rest of the US to fund your local tax collection efforts. And just like when law enforcement deploys these readers, there should be explicit, public information about how the data is collected, retained and destroyed. Sure, law enforcement agencies have been less than open about these factors, but at least they have the (poor) excuse that there are means and methods to protect. The cities doing this don't have anything to protect -- at least nothing that would (supposedly) threaten public safety if it were made known.

Filed Under: alpr, license plate readers, privacy, taxes, terrorism, virginia

Private Companies Continue To Amass Millions Of License Plate Photos, Hold Onto The Data Forever

from the your-plate/location-data-isn't-yours dept

Vigilant Solutions' automatic license plate readers are everywhere, even places where you wouldn't expect them. Like, mounted on private companies' vehicles. This isn't new. BetaBoston investigated the private ALPR growth industry early last year. Unfortunately, there's been very little good news to report since then. In fact, there still isn't.

Vigilant's ALPR database currently houses more than 2 billion plate scans, with nearly 100 million more being added every day by law enforcement agencies and repo companies. It actually has two databases. One can be plugged into by law enforcement. The other, housed by Vigilant-owned Digital Recognition Network, can be accessed by certain members of the public: car dealers, insurance companies, private detectives… basically anyone willing to pay access fees and who can offer a suitable justification for digging through a multi-billion plate database.

But when confronted with the possible privacy issues this massive database creates, the company is swift to point out the obvious: license plates on vehicles are, in fact, public. But this justification for the creation of the database fails to carry over to those requesting information about what's in the database. Public records requests have routinely been denied by law enforcement, who claim releasing publicly-obtained, by definition public, license plate photos is somehow a privacy violation.

Todd Hodnett, founder of Digital Recognition Network (corporate "child" of ALPR manufacturer Vigilant Solutions), says privacy concerns should be addressed by anyone but the company making the ALPR equipment and the one housing billions of plate photos accessible by non-government entities.

Hodnett… added that state and federal laws protect the privacy of motorists' information. State lawmakers, he said, could instead focus on restricting public access to the records and requiring state government oversight and more transparency.

He also points out the hypocrisy of the current situation:

"For the state on one hand to require that you place a license plate with six or eight alphanumeric characters on your vehicle and then on the other hand come back and say that is private - well it doesn't make any sense," he said. "It is not private. Otherwise, how could they require you or mandate you to expose it?"

It's a good point, but one Hodnett ultimately doesn't care about. At present, plates are considered "public" -- which allows his company to do what it does with no legal ramifications. And when the massive database of plate and location info is threatened, DRN's parent company (Vigilant) is prone to filing lawsuits claiming its license plate photography is protected speech.

It also goes to great lengths to portray any limitation of its plate readers as a threat to public safety.

Brian Shockley — vice president of marketing at Vigilant — plans to warn legislators that Massachusetts risks getting left behind in the use of a new tool that helps fight crime.

“I fear that the proposed legislation would essentially create a safe haven in the Commonwealth for certain types of criminals, it would reduce the safety of our officers, and it could ultimately result in lives lost,” Shockley is scheduled to say in testimony prepared for the hearing before the Joint Transportation Committee.

This may sound reasonable, but Shockley's claim doesn't stand up to scrutiny. As it stands now, ALPRs seem nearly as likely to return false positives as generate useful leads.

Until there's any serious pushback, Vigilant is free to arm both cops and citizens with plate scanners and sell access to both. And until someone starts seriously considering the fact that a plate/location database containing billions of records unrelated to criminal activity might be a bit of a privacy issue (in terms of long-term tracking of people's movements), Vigilant has no reason to alter even the most questionable of its practices. After all, it's not as if law enforcement agencies and their private customers (through DRN) have any problem with limitless collection and retention.

Fulton County Police Dept. Corporal Kay Lester:

"Per our understanding, the data that we contribute stays on the database indefinitely," Lester said in an email. "We can change the time frame if we choose, but since the data is only accessible to (law enforcement agencies), we currently have elected not to do so."

This is the standard m.o. for most law enforcement agencies in the country. As McClatchy reports, only 10 states have implemented laws governing collection and retention of license plate photos. There's even less oversight of Vigilant's "private" collection -- the database accessible by corporate customers. Until laws are passed governing the private side of Vigilant's collection activities, the company is free to hold onto everything forever.

Filed Under: alpr, data retention, license plate photos, privacy

Automatic License Plate Readers Also Gathering Millions Of Facial Photos Daily

from the THE-DATABASE-IS-MADE-OF-PEOPLE! dept

Every day in the US, millions of license plate photos are scanned and stored in various third-party databases, accessible by hundreds of law enforcement agencies, including those at the federal level. Privacy concerns have been raised by groups like the EFF and ACLU, but these have been brushed off with two assertions:

1. Driving in public is, by definition, not a private activity.

2. The license plate/location data only identifies a vehicle, not a person.

The first point can't really be argued. Your expectation of privacy pretty much ends when you start traveling on public streets. But the massive number of plate photos scanned and stored still creates privacy concerns. Most of the photos stored in law enforcement databases have nothing to do with ongoing investigations, and long-term storage of irrelevant plate/location data allows law enforcement to "track" anyone it wants to. Further concerns arise when agencies troll events like political rallies to add plates to their databases. It may not be a privacy violation, but it does raise questions about surveillance of First Amendment-protected activities.

As for the second argument -- just cars, not people -- that one's apparently completely bogus.

In addition to tracking license plates, the federal government has been taking and sharing photos of drivers and passengers inside the cars, documents obtained by the American Civil Liberties Union show.

License plate readers (LPRs) are designed to provide “the requester” with images of license plate vehicle numbers, in addition to “photos of visible vehicle occupants,” one of the newly released documents reads.

Another document obtained by the ACLU reveals the cameras have the ability to “store up to 10 photos per vehicle transaction including 4 occupant photos.”

The reality of the situation doesn't mesh with law enforcement's statements. And with ALPR manufacturers like Vigilant Solutions hoping to add facial recognition technology to their products, law enforcement agencies will soon have access to millions of individuals' photos, a large majority of which aren't currently under investigation.

The DEA's database alone holds at least 343 million LPR photos. Other law enforcement agencies are adding millions of shots to these shared databases daily. While the expectation of privacy is lowered in public settings, the millions of photos amassed turn these databases into long-term tracking devices. Surveillance of this scope used to be limited by personnel availability. Now, it's as easy as leaving camera running for the entire shift -- day after day after day. This low-effort process builds easy-to-use "maps" of citizens' movements -- where they work, where they live, which businesses they frequent, where they spend their "off" hours, which doctors they use, etc. And it's all at the fingertips of federal, state and local law enforcement agencies.

No law enforcement agencies are willing to talk about the implications of storing millions of "non-hit" photos. Los Angeles law enforcement officials went so far as to claim all captured photos were "relevant" to investigations. What little has been uncovered has been the results of tenacious FOIA requesters or open records lawsuits. The efforts being made to keep this information out of the public eye has very little to do with "protecting law enforcement methods" and everything to do with minimizing the amount of scrutiny or criticism these agencies face.

With the steady improvement of facial recognition technology, law enforcement agencies will soon know not only where your vehicle's been, but who was in it. The push back against this technology isn't so much about preventing its use, but preventing its abuse. Storing records unrelated to criminal activity for years is nothing more than stockpiling of data for its own sake -- nearly completely divorced from the actual business of enforcing laws.

Filed Under: alpr, database, faces, license plates, photographs, privacy