by Jennifer Lynch and Peter Bibring
Law
enforcement agencies are increasingly using sophisticated cameras,
called "automated license plate readers," or ALPRs, to scan and record
the license plates of millions of cars across the country. These
cameras, mounted on top of patrol cars and on city streets, can scan up
to 1,800 license plate per minute, day or night, allowing one squad car
to record more than 14,000 plates during the course of a single shift.
Automated License Plate Recording System
Photographing
a single license plate one time on a public city street may not seem
problematic, but when the data are put into a database, combined with
other scans of that same plate on other city streets, and stored
forever, it can become very revealing. Information about your location
over time can show not only where you live and work, but your political
and religious beliefs, your social and sexual habits, your visits to the
doctor, and your associations with others. And according to recent
research reported in
Nature, it's possible to identify 95% of
individuals with as few as four randomly selected geospatial data points
(location plus time), making location data the ultimate biometric
identifiers.
To better gauge the real threat to privacy posed by
ALPRs, the Electronic Frontier Foundation and the ACLU of Southern
California asked the LAPD and LA Sheriff's Department for information on
their systems, including their policies on retaining and sharing
information and all the license plate data each department collected
over the course of a single week in 2012.
After both agencies
refused to release most of the records we asked for, we sued. We hope to
get access to these data, both to show just how many data the agencies
are collecting and to show how revealing they can be.
Automated
license plate readers are often touted as an easy way to find stolen
cars -- the system checks a scanned plate against a database of stolen
or wanted cars and can instantly identify a hit, allowing officers to
set up a sting to recover the car and catch the thief.
But even
when there's no match in the database and no reason to think a car is
stolen or involved in a crime, police keep the data.According to the
LA Weekly,
the LAPD and LASD together already have collected more than 160 million
"data points" (license plates plus time, date, and exact location) in
the greater LA area -- that's more than 20 hits for each of the more
than 7 million vehicles registered in LA County. That's a ton of data,
but it's not all -- law enforcement officers also have access to private
databases containing hundreds of millions of plates and their
coordinates collected by "repo" men.
Law enforcement
agencies claim that ALPR systems are no different from an officer
recording license plate, time and location information by hand. They
also argue the data don't warrant any privacy protections because we
drive our cars around in public. However, as five justices of the
Supreme Court recognized last year in U.S. v. Jones, a case
involving GPS tracking, the ease of data collection and the low cost of
data storage make technological surveillance solutions such as GPS or
ALPR very different from techniques used in the past.
Police are
open about their desire to record the movements of every car in case it
might one day prove valuable. In 2008, LAPD police Chief Charlie Beck
(then the agency's chief of detectives) told GovTech magazine
that ALPRs have "unlimited potential" as an investigative tool. "It's
always going to be great for the black-and-white to be driving down the
street and find stolen cars rolling around... But the real value comes
from the long-term investigative uses of being able to track vehicles --
where they've been and what they've been doing -- and tie that to
crimes that have occurred or that will occur." But amassing data on the
movements of law-abiding residents poses a real threat to privacy, while
the benefit to public safety is speculative, at best.
In light
of privacy concerns, states including Maine, New Jersey, and Virginia
have limited the use of ALPRs, and New Hampshire has banned them
outright. Even the International Association of Chiefs of Police has
issued a report recognizing that "recording driving habits" could raise
First Amendment concerns because cameras could record "vehicles parked
at addiction-counseling meetings, doctors' offices, health clinics, or
even staging areas for political protests."
But even if ALPRs are
permitted, there are still common-sense limits that can allow the
public safety benefits of ALPRs while preventing the wholesale tracking
of every resident's movements. Police can, and should, treat location
information from ALPRs like other sensitive information -- they should
retain it no longer than necessary to determine if it might be relevant
to a crime, and should get a warrant to keep it any longer. They should
limit who can access it and who they can share it with. And they should
put oversight in place to ensure these limits are followed.
Unfortunately,
efforts to impose reasonable limits on ALPR tracking in California have
failed so far. Last year, legislation that would have limited private
and law enforcement retention of ALPR data to 60 days -- a limit
currently in effect for the California Highway Patrol -- and restricted
sharing between law enforcement and private companies failed after
vigorous opposition from law enforcement. In California, law enforcement
agencies remain free to set their own policies on the use and retention
of ALPR data, or to have no policy at all.
Some have asked why
we would seek public disclosure of the actual license plate data
collected by the police -- location-based data that we think is private.
But we asked specifically for a narrow slice of data -- just a week's
worth -- to demonstrate how invasive the technology is. Having the data
will allow us to see how frequently some plates have been scanned; where
and when, specifically, the cops are scanning plates; and just how many
plates can be collected in a large metropolitan area over the course of
a single week. Actual data will reveal whether ALPRs are deployed
primarily in particular areas of Los Angeles and whether some
communities might, therefore, be much more heavily tracked than others.
If these data are too private to give a week's worth to the public to
help inform us how the technology is being used, then isn't it too
private to let the police amass years' worth of data without a warrant?
After
the Boston Marathon bombings, many have argued that the government
should take advantage of surveillance technology to collect more data,
rather than less. But we should not so readily give up the very freedoms
that terrorists seek to destroy. We should recognize just how revealing
ALPR data are and not be afraid to push our police and legislators for
sensible limits to protect our basic right to privacy.
{Editor Note:
Automated License Plate Recorders are merely the precursor ro CCTV
which is already in use in many U.S. cities. However, a recent
Australian court decision casts doubt as to their real purpose which
doesn't appear to be crime. "A local resident opposed to the introduction of CCTV cameras succesfully
proved that public surveillance carried out by his city council not
only broke Australia’s privacy laws, but also did nothing to prevent
crime – the supposed reason for its installation."}
Daniel
Solove, author of Nothing to Hide: The False Tradeoff Between Privacy
and Security, believes these arguments, and many like them, are flawed.
They are based on mistaken views about what it means to protect privacy
and the costs and benefits of doing so.
Terrorist attacks, while
horrific, claim far fewer lives each year than suicide in the U.S.
Nearly 30,000 Americans take their own lives each year. According to The
Guardian, 3,467 American lives have been lost in terrorist attacks
since 1970; 3,003 of those were in 2001. A version of this article was
originally posted here.
