The Wall Street Journal recently reported that the United States government is creating a massive database of records culled from license plate scanners, and making this database available to law enforcement and other agencies.
The WSJ article was specifically about a database created by the Drug Enforcement Administration, but thousands of other agencies and departments collect, store, analyze and maintain databases culled from Automated License Plate Readers (ALPR’s).
Traffic cameras have ALPR’s, and when you drive into the District of Columbia, a collection of more than 97 ALPR’s collect data on every car that enters or leaves. Toll takers use them, parking attendants use them, meter maids use them, and even Repo men use them.
For a fee, you can log into a webpage, enter a license plate number, and find out where that car is – or recently was – based on ALPR data. Police routinely drive down the streets in patrol cars equipped with ALPR’s, scanning and recording the license plates of driving and parked vehicles.
But don’t fear. This data would never be abused. According to the WSJ article, the Department of Justice noted that “It is not new that the DEA uses the license-plate reader program to arrest criminals and stop the flow of drugs in areas of high trafficking intensity.”
The government has argued that ALPRs are perfectly legal, and that people have no expectation of privacy in their license plates displayed in public. Moreover, law enforcement agencies have consistently argued (successfully) that they need no suspicion to “run” someone’s plate – that is, not only to capture the license plate, but to check databases to see if the car is stolen, owned by someone with arrest warrants, owned by someone on a government “watch” list, or properly registered or insured. So in addition to getting license plate data, these ALPRs can also get a host of other “linked” data.
They can also be used for a lot more than law enforcement purposes. Bounty hunters can use them to find people who have failed to appear on bonds. Repo men can use them to find people who are late on car payments, and reposes the cars while they are shopping at the mall.
Websites collect this data and, for a fee, will allow you to see where any car is (or recently was.) Commercial entities can use them to learn the shopping and travel patterns, or link them with credit card or other personal data.
So when you park at the mall, the camera can capture your license plate (access to DMV records was severely curtailed by federal law as a result of a series of stalking cases) and mall cameras can follow you into the store. When you use your credit card or affinity card, the store can link these two and establish a link between the license plate “ASSMAN” and you.
They can also take pictures of your car in the driveway, and get public records of the owner of the house and link that back to you as well. So much for preventing stalking, right?
The National Conference of State Legislatures has collected some of the most recent state laws on the use of ALPR’s. Some restrict the use of ALPR by civilians, some restrict the storage and use by law enforcement agencies, some exempt ALPR data from freedom of information act requests. A few limit law enforcement’s use of the ALPR’s to “legitimate law enforcement purposes.” But in general, it’s the Wild West out there.
Sauce for the Goose
So the reason ALPR’s are fine and dandy is because there is no expectation of privacy in your whereabouts on the public highways and byways. The government (or anyone else) can set up a camera, capture your image, and do whatever they want with it.
Even though the Supreme Court limited the government’s right to install GPS devices on cars without a warrant, that decision was limited to the invasion of property rights inherent in the placing of the device on the car – not on the tracking of a person’s location in public. So outside – no privacy.
Unless you’re a cop. Last week, a host of law enforcement agencies objected vehemently to the web app Waze, a Google acquired company’s GPS software. Waze allows a crowd sourced community to share information in real time about traffic conditions, roadway obstructions, construction, road conditions, hazards or other relevant information.
By tapping an icon, you can tell other Wazers that there’s a stalled vehicle in the left lane of the Cross-Bronx Expressway (it’s been there since 1972), or that there’s a CHP car off the 405 near Santa Monica Boulevard (also been there since 1972). This allows drivers to adjust their behavior (read that, slam on the brakes) accordingly.
That upsets the LAPD and others. Indeed, Los Angeles Police Chief Charlie Beck reportedly wrote to Google executives making it clear that, in his opinion, “It is not always in the public’s best interest to know where police are operating,” and that “There is a criminal element that are able to ply their trade and ply their craft more effectively by knowing where police are.”
Now I can understand how knowing where the cops are can make people less safe. Growing up in New York in the 1960’s and 1970’s we all knew of situations where a guy would breathlessly come up to you in the Subway and ask, “hey, have you seen a cop?”
If you say, “no” he would pull out a knife and demand money. (Yes, this happened to me.) So the correct response to “have you seen a cop” was always, “yeah, there’s one around the corner – let me go get him.”
If the bad guys know where the cops ARE then they will know where the cops AREN’T and therefore plan accordingly. This is also why the states of Florida, Indiana, Kentucky, New York and Minnesota attempt to make it illegal to use a police scanner in a car. I say “attempt to” because now, anyone with a cell phone and an app can listen over the Internet to police radio calls.
Police also say that crowdsourcing their location makes the cops less safe because anyone intent on hurting cops can use an app like Waze to find out where they are. As if the big black and white car with the flashy lights isn’t a bit of a tip off.
So let me see if I have this straight. People (that is civilians) have no right or expectation of privacy in their location, and cops, intelligence agencies, and the local Aarons Rent A Center can capture and store (and analyze and sell) this data at will. But heaven forbid that anyone collects this data about government officials.
A Lost Cause
Even as a privacy advocate, I am seeing this as a lost cause. Not because we can’t (or shouldn’t) have laws restricting the collection, storage or use of location data – including license plate data. We should. It’s just that it won’t work.
With tens of millions of people carrying cameras in their pockets all the time, with dashboard cameras, and wearable technology, it is inevitable that information about license plates and locations will be captured. Every traffic camera does it, albeit in low res right now. As long as we can capture video of vehicles, someone will take that video and plug in an ALPR app into it. It may not be practical now, but soon.
Veteran and accidental security researcher (and planetary astrophysicist) Clifford Stoll was once upset about people driving too fast in his suburban neighborhood. So he set up a one-gigahertz antenna made from empty coffee cans link to a rudimentary radar detector and display to capture the speed of vehicles in the neighborhood, and capture the license plates of the offenders.
Ultimately, as cameras and data proliferate, we need not only fear government surveillance, or corporate surveillance. As Walt Kelly’s Pogo once observed, “we have met the enemy, and he is us.” We have crowd-sourced tyranny. And I doubt that the law will be able to reverse this trend.
But just because we have the ability to collect this data doesn’t mean that we should. And that’s why most of the problem with data collection still remains with corporate and governmental data collection.
Because they are the ones with the incentive to collect and store the data. For every Cliff Stoll with a couple of Horn & Hardart cans strung across a suburban road, there are thousands of cops and passive cameras capturing data about speeders and non-speeders alike. For every webcam capturing traffic conditions on Dixie Highway there are tens of thousands of DOT cameras, broadcasting online and on TV.
At the end of the day, we need to have a real discussion of whether our whereabouts outside are truly public. Should an ex-boyfriend be able to enter his ex-girlfriend’s license plate number (or just her name) and get real-time information about her location?
I mean, just because he is curious. Should an investor be able to see when the CEO of a company she is thinking of investing in is meeting with a competitor or potential takeover target just with a few clicks of a mouse?
The government can’t have it both ways. It can’t use the data willy nilly and then complain about privacy. I’m shocked, shocked to see there’s location capture going on here. And that’s the thing about most data. It’s neither fully public nor fully private. Somewhere in between. Shall we call it, 50 shades of grey?