The Tiburon Police Department's capture of my car's plates.
Sept 28 2012 http://arstechnica.com
The Tiburon Police Department's capture of my car's plates.
TIBURON, CALIFORNIA—Tiburon, a small but wealthy town just northeast of the Golden Gate Bridge, has an unusual distinction: it was one of the first towns in the country to mount automated license plate readers (LPRs) at its city borders—the only two roads going in and out of town. Effectively, that means the cops are keeping an eye on every car coming and going.
A contentious plan? Not in Tiburon, where the city council approved the cameras unanimously back in November 2009.
The scanners can read 60 license plates per second, then match observed plates against a "hot list" of wanted vehicles, stolen cars, or criminal suspects. LPRs have increasingly become a mainstay of law enforcement nationwide; many agencies tout them as a highly effective "force multiplier" for catching bad guys, most notably burglars, car thieves, child molesters, kidnappers, terrorists, and—potentially—undocumented immigrants.
Today, tens of thousands of LPRs are being used by law enforcement agencies all over the country—practically every week, local media around the country report on some LPR expansion. But the system's unchecked and largely unmonitored use raises significant privacy concerns. License plates, dates, times, and locations of all cars seen are kept in law enforcement databases for months or even years at a time. In the worst case, the New York State Police keeps all of its LPR data indefinitely. No universal standard governs how long data can or should be retained.
Not surprisingly, the expanded use of LPRs has drawn the ire of privacy watchdogs. In late July 2012, the American Civil Liberties Union and its affiliates sent requests to local police departments and state agencies across 38 states to request information on how LPRs are used.
As I headed into the picturesque town last month for a meeting with local police, I kept a lookout for the LPRs. Tiburon Boulevard, along the city's southern coastal edge, is a lovely stretch of road overlooking a small bay that feeds into the San Francisco Bay. On summer days, cyclists and runners take to a trail along the water's edge. And It was there that I spotted the cameras, mounted on a traffic island just west of the intersection with Blackfield Drive.
Cameras point in each direction of traffic, each one trained on two lanes. The LPRs, with their sleek cylindrical design, look similar to a surveillance camera or a speed camera. They provide no indication of what they do, nor would you know by looking that have become the newest object of contention in the long-running war between "security" and "privacy." But as I drove into town to interview Captain David Hutton and Chief Michael Cronin of the Tiburon Police Department, the cameras did their silent work: my plate was scanned, parsed, and logged in the name of security.
I met Capt. Hutton in a police conference room; Chief Cronin, recovering at home after surgery, joined us by phone. First, the officers made the case that LPRs really do provide more security to towns like Tiburon. After we hung up with Chief Cronin, Capt. Hutton obligingly showed me the database entries for my own arrival.
The entire LPR setup, including the six new cameras, cost $130,000. Funding came in part from the Marin County Sheriff's Department and the adjacent City of Belvedere; as a result, those other entities also get access to the Tiburon camera data.
The cameras run constantly, looking for hot listed plates. When they spot one, the system sends automated alerts directly to officers' in-car and in-office computers and to the Marin County Sheriff's communications desk (which does dispatching for Tiburon). The alerts provide a photo of the car in question, the date, the time, and which specific camera spotted the car.
Cronin explained that in a town like Tiburon, where the biggest criminal concern is property crime, knowing who is coming and going at odd hours has been very helpful to the squad. The chief added that, prior to deploying the cameras, crime was still relatively low—only about 100 to 120 thefts per year, he said. Since the cameras have been in place, that figure has dropped by "around a third," he said.
However, the system is not without flaws. It tends to yield numerous false positives because the hot list data received from the California Department of Motor Vehicles takes a long time to be updated—and because the system cannot distinguish out-of-state plates. This creates a problem if, for instance, California plate ABC123 has been reported as stolen and is on the hotlist, and then someone drives through Tiburon with Oregon plate ABC123. (Other LPR systems can distinguish the plates from different states.)
Hutton showed me an example of a unique California vanity plate that the department gets a hit on every day, because that same plate from a different state was reported stolen. The Tiburon authorities pulled over the local resident once, his story checked out, but his plate turns up again every time he enters or leaves the city.
In addition, the cameras miss some plates. When I saw the LPR system, for instance, I slowed down to get a better look. By the time I reached Blackfield Drive, I knew I had to turn around to get closer, so I made a U-turn and pulled over in the shoulder directly across from the cameras. I parked my car, and walked over to the island to snap a few pictures with my phone. I got back in my car, drove ahead 20 feet or so while still on the shoulder, and then moved over to the left turn lane, making a second U-turn to head back toward the police station. When I asked Capt. Hutton to see my own log entry, the camera had only recorded my inbound entries. Pulling over to the shoulder apparently put me out of range of the camera—a pretty easily exploitable weakness. I'd "hacked" the Tiburon Police LPRs without even trying.
Even when the cameras do score a "hit" against the hot list, few are linked to major crimes. "The vast majority of the hits that we get are not wanted cars, they're lost or stolen plates," said Cronin.
And he recognizes the system's easy susceptibility to abuse. "We could put our boss's plates in the system and every time she leaves town we could go get her golf clubs," he joked.
To prevent problems, only Cronin and Hutton can add plates to the hot list. Each time a plate is run for historical data by either an officer or requested by an outside agency, the requester has to inform the chief by e-mail. Requests are tallied in an annual report for the town council.
LPR systems are doing big business at the moment. The country's largest such company, Federal Signal Corporation (FSC), which sells LPRs under its PIPS brand name, says it has sold 20,000 mobile systems across North America and another 15,000 fixed devices across the United States and the United Kingdom.
"We work with the 25 largest cities in the United States, over 100 cities in the US and over 200 in North America, including the Royal Canadian Mounted Police and in Mexico," said Tim O'Leary, a company vice president, in an interview with Ars. "We think the market is growing at 8 to 10 percent, adjusted growth rate, annually."
In its SEC filing earlier this year, FSC said its sales of LPRs were up by $2.1 million in 2010 alone. One of its primary competitors, Elsag North America, says it has worked with 1,200 agencies nationwide, while declining to state how many LPRs it has sold.
The New York Police Department began using LPR devices made by Elsag in 2006. As of 2011, the NYPD told the New York Times that it maintains 108 stationary LPRs and 130 mobile devices (Elsag's "Mobile Plate Hunter".)
The Times also wrote that in 2005, the year before LPRs were introduced, New York City had nearly 18,000 reports of stolen cars, a figure that fell to just over 10,000—a drop of over 40 percent—in the next six years. The NYPD attributes the benefits of LPR technology to being "directly responsible" for recovering over 3,600 stolen cars and for issuing summons to nearly 35,000 unregistered vehicles.
New York isn't alone in its love of LPRs. Washington, DC, with its 250 cameras, has more than one LPR per square mile, likely the highest concentration in the country.
In September 2011, the FBI reported that its Criminal Justice Information Services Advisory Policy Board (CJIS APB) had approved the use of LPRs years earlier through a pilot project conducted by the Ohio State Highway Patrol. That pilot has since expanded to "46 states, the District of Columbia, 33 local agencies, and one federal agency," which have "formal agreements with the FBI to receive the [National Crime Information Center] information for the purpose of using LPRs."
The FBI also added that a survey of its pilot partners "reported a total of 1,102 stolen vehicles recovered with a value of more than $6.5 million, as well as contraband recovered that included stolen license plates, stolen property, vehicles, drugs, weapons, larceny proceeds, suspended registrations, credit cards, and a police badge. Also as a result of the LPR technology, participating agencies located 818 subjects listed in the Wanted Persons File and 19 listed in the Missing Persons File. Another 2,611 persons were apprehended."
The recent uptick in LPR deployments is likely due to a combination of price drops—each camera can cost between $8,000 and $20,000 now—and increased federal grants for the tech. Various agencies, in particular the Department of Homeland Security, the Drug Enforcement Agency, and Customs and Border Protection have issued many millions of dollars in federal grants to state and local law enforcement to buy the hardware. (Both FSC and Elsag provide prominent links on their websites to help cops apply for these grants, too.)
Police know the technology can irritate the public. A 2010 presentation (PDF) on the topic noted "community concerns" that included:
But cops argue that the benefits are significant. Sid Heal, a recently retired commander who evaluated technology during his decades-long tenure at the Los Angeles County Sheriff's Department, and is now a law enforcement consultant, said he's been working with LPRs since 2005.
"It was one of the few technologies that did everything that they said it did as well as they said it did," he told Ars. "It staggered the imagination."
That's exactly what LPR vendors love to hear. Law enforcement officials also tout the ability of LPRs to not only scan plates that are actively under investigation, but the ability to go back in time, scanning those months- or years-old databases for evidence that a particular car was at a certain location at a given time.
They can also be used to create "geo-fences" around specific hotspots like schools, which can each get a GPS-defined ring of protection. Whenever a vehicle belonging to a known sexual offender enters the ring, the system trips an alert; so long as the offender stays outside the various rings, the system lets him pass without incident.
George Mason University, which runs a major LPR portal for law enforcement, conducted a study of local Virginia residents and noted that reactions to LPR use are "complex."
"For example, most citizens supported their local police using LPR to check to see if passing vehicles were stolen or to monitor high-risk targets of terrorism," the researchers noted. "However, of all applications for LPR that citizens were asked about, they were least likely to support police checking for parking violations with LPR or using data collected to recreate travel patterns of those involved in low-level infractions. Furthermore, the majority of respondents considered the data collected by LPR systems to be private, and that policies and protections should be in place for the use of this data."
One LPR case that is often cited on the East Coast is the 2007 murder of five people in Fishkill, New York. Local police were able to access the LPR records of a state trooper who happened to be nearby. That data showed the suspect's car was in the vicinity of the killing when it happened, which dismantled his alibi.
"They were able to coordinate GPS positions and time, and place that car in front of the house shortly before the alarm was raised with the local fire department," said Pete Kontos, a New York State Police senior investigator, to the Hudson Valley's Journal News in 2009. "It was a substantial piece of evidence used in the trial."
But, as with Tiburon, most results are more mundane. The New York State Police 2010 Annual Report found that over 57,000 plates were read by the Auto-Theft Unit using its LPRs that year. The result: 200 suspended or revoked registrations... and a grand total of three stolen vehicles.
Given the results, critics question just how long such data needs to be retained.
The DEA recently increased its deployment across the Southwestern border, though Utah legislators expressed skepticism about the DEA wanting to deploy LPRs along stretches of state highway.
"I want to give law enforcement all the tools to catch the bad guys, but I don't want to yield to [a] Big Brother state," Utah State Senator Todd Weiler, a Republican, told Ars. "There has to be a happy medium, but part of the happy medium is showing how long you need to store the data."
That data retention issue is a particularly thorny one—the New York State Police is one of the few public law enforcement agencies in the country that has no limit on how long its 104 LPRs can retain data. Some agencies, like the Tiburon Police Department, retain data for only 30 days, while others, including the Washington State Police and the California Highway Patrol, go up to 60 days. Some go as high as one year, as is the case with the Tennessee Highway Patrol and the Maryland State Police.
"Virtually all the crimes that we're going to get that are going to be dangerous are going to be reported in the first day," Heal said. "The only things that wouldn't be are those that are discovered later. Burglary, if someone's on vacation—probably a couple weeks. At some point in time it needs to be kept long enough to have value but not long enough to be intrusive."
Nate Maloney, a vice president of Elsag North America, another major vendor of LPRs, told Ars that his company does not provide a rule of thumb as to how long the data should be retained.
"We say the technology will allow you immediate interdiction, or there's an investigation property, which allows you to go back into your read," he said. "But if you're not saving any data, that function will not exist. You're eliminating half of the tool."
While state and local law enforcement agencies can easily tap into state and federal databases to check against "hot" cars, private companies also create and host their own license plate databases. They do the same things that the cops do—drive around with LPRs, logging when and where plates were seen—then sell access to law enforcement agencies.
Oversight of such privately held data is even more lax than publicly held data. Following a pilot project in conjunction with the San Jose Police Department, a now-defunct Southern California company called Plate Scan still retains about four years' worth of license plate data. All of those logs could be sold or licensed to whoever wants to buy them.
"At this point it would be morally irresponsible to stop it, as people would die."
"There's no law against it that I know of," said John Dalinsky, the company's president, in an interview with SanJose.com. "There are really no guidelines for the data in the United States." Dalinsky is currently liquidating company assets, so buyers would be welcome. Dalinsky did not respond to our request for comment.
These days, all eyes point to Vigilant Video, a Livermore, California-based company that touts itself as the "LPR endgame." The company, which declined to be interviewed for this story other than through written answers to e-mailed questions, operates what it calls the National Vehicle Location Service—a private database that uses data that it collects, along with data submitted by public entities. The NVLS is likely the largest single LPR database in the country, with over 550 million entries.
"Currently we have about 22,000 US law enforcement investigators using the system (at no cost to them)," wrote Pierre Leroy, the chairman of the company's board, in an e-mail sent to Ars. "Each month we add roughly 1,000 more, although the rate is growing due to our efforts to market the system."
As a result of this rapid expansion of private monitoring, the company recently won a $25,000 contract with Immigration and Customs Enforcement to provide a database that would help locate "fugitive aliens." In a letter (PDF) recently published on a federal contracting website, the government wrote that NVLS was the "only product capable of producing the data in the marketplace."
"At this point it would be morally irresponsible to stop it, as people would die," Leroy added in the e-mail to Ars. "There has never been any abuse reported or known to us (in more than seven years) wherein data was accessed to perform some illegitimate activity. However, we do have tens of thousands of examples of the public safety benefit to law enforcement without the expense of one single taxpayer dollar."
Private LPR tracking shows up in all sorts of places. All cars that drive onto the campus of Brigham Young University in Provo, Utah have their plates scanned. My own hometown of Santa Monica, California, uses the technology to scan plates in parking garages so that shoppers can locate lost cars at a local shopping mall. Arden Fair Mall in Sacramento also uses LPRs in conjunction with local police to scan for stolen cars.
In February 2012, Joe Simitian, a California state senator, proposed (PDF) a bill that would have put a damper on Vigilant Video's business model by requiring it to delete LPR data after 60 days, by blocking such companies from selling or handing over data to a non-law enforcement agency, and by requiring police to get a warrant if they wanted access to this private data.
"Do we really want to live in a culture where the law-abiding movements of everyday citizens are tracked and accumulated in perpetuity?" Simitian told Ars. "The thing that I think is not widely understood in the digital age is that there's a difference in degree which ends up being a difference in kind. The fact that you might be spotted [by the police] in a parking lot, that's very different from a half billion records for a company that accumulates 40 percent of the vehicles in the country in a year. The ability to collect and maintain data in vast numbers electronically and the ability for that information to move anywhere is just not just a quantitative difference, it's a qualitative difference."
That bill died on the legislative floor. Simitian, who will be term-limited out of the state senate later this year, decided not to pursue it further. But the fights over LPR are just getting started.
For now, the use of license plate readers has been upheld in numerous criminal cases around the country. In 2006, for instance, Gina L. Bianchi, the deputy commissioner and counsel at the New York State Division of Criminal Justice Services wrote in a memo (PDF) to all local law enforcement agencies across the state that there "does not appear to be any legal impediment to the use of a license plate reader by law enforcement."
"A license plate reader merely accomplishes, more efficiently, the same task that a police officer may accomplish by reading a license plate and manually entering the number into a database," she added. "Therefore, it is reasonable to assume that a court would not hold that the use of a license plate reader would constitute a search. However, at this time there is no decisional case law from any court concerning the use of a license plate reader."
In 2011, a federal appeals court even upheld the case of a San Francisco police officer who stopped a woman after her license plate was mistakenly read by an LPR. She was ordered to pull her vehicle over, subsequently ordered from the car at gunpoint, ordered to her knees, and handcuffed. After it was determined that her car was the wrong one, she filed a lawsuit against the city and the SFPD, a suit that was dismissed on the grounds that there was a reasonable suspicion to stop her and that the officer used reasonable force.
But other judges are more skeptical about the technology—and about the proper role of license plate lookups by cops. Karen Nelson Moore of the United States Court of Appeals for the Sixth Circuit in Cleveland has raised some questions in a few federal cases about the constitutionality of license plate searches, and LPRs in particular, as recently as June 2012 (PDF). Moore's best known questioning of license plate data searches came in her dissenting opinion of a 2005 appellate case known as United States v. Ellison.
The case dates back to December 31, 2003, when Officer Mark Keeley of the Farmington (Michigan) Police spotted a white van idling in a fire lane near a shopping center. Rather than issue a citation for being illegally parked in a No Parking zone, Keeley parked his own patrol car to observe the van. Keeley ran the van's plate number through his patrol car's Law Enforcement Information Network (LEIN) computer and found the car's registrant, Curtis Ellison, had an outstanding warrant against him.
After radioing for backup, and after noticing that another person got into the van, Keeley approached the vehicle. The second passenger identified himself as Ellison. After placing Ellison under arrest as part of the outstanding warrant, Keeley frisked him, finding two firearms. Ellison was subsequently indicted for being a felon in possession of a firearm.
The district court, however, found that the van was not illegally parked, and therefore, the defendant's counsel argued, the officer lacked probable cause to run Ellison's plate. After holding a hearing, the district court made a factual finding that the van was not parked illegally, and thus the officer did not have probable cause to run the LEIN check.
The government appealed—not on the facts, but on the law, arguing that the police did not actually need probable cause to run the plate. They won. The appellate court agreed "that a motorist has no reasonable expectation of privacy in the information contained on his license plate under the Fourth Amendment."
Judge Moore dissented, arguing that while the information printed on a license plate is obviously not private, it's what can be done with that information that matters. "This approach misses the crux of the issue before the court: even if there is no privacy interest in the license-plate number per se, can the police, without any measure of heightened suspicion or other constraint on their discretion, conduct a search using the license-plate number to access information about the vehicle and its operator that may not otherwise be public or accessible by the police without heightened suspicion?" she wrote. The majority's approach "pays short shrift to the crucial issue of how the license-plate information is used."
With LPRs able to run thousands of plates a day against a hot list, this underlying issue becomes increasingly important—and judges like Moore aren't going to let LPRs run unrestricted without resistance.
Moore brought up her concerns again in a more recent June 2012 case that involved LPRs. In that case, United States v. Lurry, Moore sided with the majority but voiced a point of her own (PDF) about the original traffic stop that produced the case. In Lurry, much as in Ellison, a car was pulled over by the Memphis Police Department after an officer's LPR indicated an outstanding warrant for the vehicle's owner.
However, the data was bad; it turned out that the registered address of the woman who owned the car matched the address on a warrant for one Landreo Lurry, which is why the LPR triggered an alert to local law enforcement. But the woman who owned the car was not Lurry, and the man actually driving the car at the time of the stop was also not Lurry.
"Just because a black male with a warrant at one point lived at an address where a female's vehicle is now registered is no reason to think that the present driver of the female's vehicle, who happens to be a black male, is likely that same individual," Moore argued. "This case offers yet another example of why automatic license-plate readers warrant further attention under the Fourth Amendment."
Such scrutiny has arrived from the courts on other automated tracking and surveillance tech, most notably GPS trackers, which the FBI had installed for years on cars without always obtaining warrants. In January 2012, in the Jones v. United States case, the Supreme Court unanimously ruled that law enforcement does not have the authority to warrantlessly track individuals. As LPR deployments expand in scope and number of locations, they can build up less granular but still detailed databases of who has driven where, and when.
"The Fourth Amendment criterion [for searches] is, of course, reasonableness," wrote Stephen Henderson, a law professor at the University of Oklahoma, in an e-mail sent to Ars. "Although the Supreme Court has consistently recognized a need for administrable Fourth Amendment rules, ultimately it is not at all surprising that a designedly ambiguous standard of reasonableness would not always have bright lines. And such is the case, appropriately understood, for LPR. There are undoubtedly instances in which there would be no Fourth Amendment restraint on usage, but one could also imagine such a large number of fixed readers that a system would track vehicle location almost as effectively as the GPS device in United States v. Jones, in which case there should be Fourth Amendment restraint."
Lee Tien, a senior staff attorney at the Electronic Frontier Foundation, says that automated tracking tools are changing our thinking about surveillance. "[LPR technology] forces us to really confront how many of the privacy norms that we form were implicitly dependent [on the fact] that the government couldn't afford to engage in mass, routine surveillance of the entire population," he told me.
Tien pointed out that it can be politically difficult for lawmakers to argue against new tools for law enforcement, and it's often hard for the public to fully grasp the privacy implications of such technology. The kneejerk reaction is to say that most people have nothing to hide, so new tech shouldn't be a concern.
"You don't know how that data is being used," Tien said. "You think that you are not affected, but you have no idea whether you're being affected. As we found after the Patriot Act, with more discrete and insular communities like Muslims in the United States, there's a whole lot of secret lists that were floating around, suspicion was being placed on people, which had effects on them, but they didn't know about it." (Earlier this year, the Associated Press reported that in some cases, the NYPD used LPRs to routinely scan all the plates parked within the vicinity of mosques as part of terror-related investigations.)
Tien believes that the weight of the argument should not fall on those who object to being surveilled, but on the authorities who want to collect the data.
"The question isn't why shouldn't they have it, but why should they have it in the first place?" he said. "We have a failure to understand the dangers of having a complete history of people."