ACLU Presents Its Findings On License Plate Scanners, Most Of Which Is Bad News

from the more-haystacks,-fewer-needles dept

The ACLU has just released a report on the widespread use of license plate scanners by law enforcement agencies across the US. Culled from nearly 600 FOIA requests (and 26,000 pages of documents), the report shows that not only are license plate scanners widely deployed, but few police departments place any substantial restrictions on how they can be used.

The approach in Pittsburg, Calif., is typical: a police policy document there says that license plate readers can be used for "any routine patrol operation or criminal investigation," adding, "reasonable suspicion or probable cause is not required." While many police departments do prohibit police officers from using license plate readers for personal uses such as tracking friends, these are the only restrictions. As New York's Scarsdale Police Department put it in one document, the use of license plate readers "is only limited by the officer's imagination."

This "deploy first, restrict later" approach seems to be the default when it comes to new law enforcement technology. As we've noted before, law enforcement agencies (both local and federal) have been utilizing drones for investigative and surveillance purposes, most without establishing ground rules or taking into consideration possible privacy issues.

The other issue is a lack of standardized rules controlling the collection, usage and retention of license plate data. The Minnesota State Patrol deletes all records after 48 hours, but it's the exception. Most other agencies hold onto all data for anywhere from 90 days to 5 years. Responses from three agencies in Texas specified no end date, so until otherwise indicated, it's presumed to be indefinite.

Why are these agencies holding on to this data for so long? And why so much of it? The information the ACLU received indicates that license plate "hits" make for a very small percentage of records retained.

For example, in Maryland, for every million plates read, only 47 (0.005 percent) were potentially associated with a stolen car or a person wanted for a serious crime. [Other examples: Burbank, IL - 0.3%, Rhinebeck, NY - 0.01%, High Point, NC - 0.08%.] Yet, the documents show that many police departments are storing – for long periods of time – huge numbers of records on scanned plates that do not return hits. For example, police in Jersey City, N.J., recorded 2.1 million plate reads last year. As of August 2012, Grapevine, Texas, had 2 million plate reads stored and Milpitas, Calif., had 4.7 million.

This is a concern for many reasons. First, storing millions of records on plates unrelated to criminal activity opens the door for potential abuse, as would any database of its size. One snapshot isn't a problem, but multiple photos over an extended period of time turn plate scanners into tracking tools.

What can location data reveal about people? Trips to places of worship, political protests, or gun ranges can be powerful indicators of people’s beliefs. Is it really the government’s business how often you go to the drug store or liquor store, what doctors you visit, and the identities of your friends? I’m sure all of us can remember something from our past that could embarrass us. If the government comes to suspect you of something in 2020, should it have access to databases stretching back years that could dig up facts about you that previously went unnoticed?

Not only does this give law enforcement a pretty good indication of your habits, it also opens the door to misinterpretation. Someone traveling back and forth frequently from high crime areas might be assumed to be somehow involved with the criminal activity there. That's just one example, but amassing non-specific data encourages investigators to begin "connecting dots" and inferring suspicious behavior where there is none. Finding patterns is something the brain does well, even if not encouraged. But not every pattern is truly a pattern, nor does every perceived pattern indicate something of significance. (See also: numerology.)

Of additional concern is the fact that some of this retained data isn't in law enforcement hands at all.

License plate readers are used not only by police but also by private companies, which themselves make their data available to police with little or no oversight or privacy protections. One of these private databases, run by a company called Vigilant Solutions, holds over 800 million license plate location records and is used by over 2,200 law enforcement agencies, including the U.S. Department of Homeland Security.

The ACLU is calling for law enforcement agencies to adopt certain basic policies to ensure proper protection of license plate data, as well as recommending the retention period of non-suspect data be measured in days, rather than weeks or years.

License plate readers may be used by law enforcement agencies only to investigate hits and in other circumstances in which law enforcement agents reasonably believe that the plate data are relevant to an ongoing criminal investigation.

The government must not store data about innocent people for any lengthy period. Unless plate data has been flagged, retention periods should be measured in days or weeks, not months and certainly not years.

People should be able to find out if plate data of vehicles registered to them are contained in a law enforcement agency’s database.

Law enforcement agencies should not share license plate reader data with third parties that do not follow proper retention and access principles. They should also be transparent regarding with whom they share license plate reader data.

Any entity that uses license plate readers should be required to report its usage publicly on at least an annual basis.

What the ACLU is asking for isn't overly-restrictive. In fact, what's listed here seems to be a bare minimum, common sense approach to data collection and retention, one that law enforcement agencies should have had in place before deploying the plate scanners. There's nothing about this that unduly binds law enforcement's hands in utilizing these scanners for their intended purpose. All these policies would do is trim down the likelihood of abuse and prevent agencies from collecting data simply to be collecting data.

Filed Under: aclu, license plate scanners, license plates, privacy, surveillance