License plate scanners are recording the whereabouts of your car. Who can access this information? Probably anyone.
The Seattle Police Department's acquisition of airborne surveillance drones last year caused an uproar. Yet largely without protest, the SPD, like other urban police departments across the country, has deployed another surveillance technology to amass a vast amount of information that can reveal who is travelling where in the city, regardless of whether or not they are suspected of a crime.
The technology is automatic license plate recognition (ALPR), which uses cameras linked to computers to scan license plates by the thousands, check them against "offender" databases and log their location, date and time. Some police departments keep that information indefinitely; Seattle says it retains the information for 90 days.
As of last week, the SPD had 1,716,908 license plate scans in its systems, according to a department spokesperson. The department uses a fleet of 12 vehicles, both in patrol and parking enforcement operations, which routinely scan and record license plates all over the city. The purchase of ALPR equipment for the SPD was funded, at least in part, by $132,268 in federal government Justice Assistance Grants, according to the department.
The department uses the data to find stolen vehicles, to "e-chalk" cars and write overtime parking tickets, and in the city's relatively new "scofflaw" program that locks a boot on cars whose owners have four or more unpaid parking tickets. The department also uses the data for other purposes, according to spokesman Sean Whitcomb, "If there is an investigative need for it, we use it."
The number of vehicles identified by the police as suspect through ALPR systems is small in comparison to the giant amounts of information the systems ingest and record about ordinary people who have done nothing wrong. It is the lack of legal controls and potential for abuse of that data that has raised concern among privacy and civil liberty advocates.
Vehicle registration data (the name and address of the person who owns a vehicle) is deemed private by Washington state law, but the license plate numbers themselves and their geographic locations are public information, which means that anyone could request the data from the police department through a public disclosure request. After all, you can walk down the street and collect license plate numbers in public. It is the technological change of scanning them by the thousands and amassing longitudinal databases that amounts to a new kind of surveillance via "big data."
As part of an ongoing investigation of the topic, Crosscut News aims to find out how extensive ALPR is, how easy it is to get that data in Seattle and how much it can reveal. Crosscut has made a public disclosure request to the SPD to obtain the department's entire database, all 1.7 million license plate "reads." We aim to see what type of information is collected, in what quantities and how frequently a typical vehicle's location is recorded when travelling throughout the city. The SPD has said that it will respond to our request by February 13th.
Our request was modeled after similar requests the ACLU has made in 38 states. The ACLU of Washington made such a request in 2010 and received data that included license plate numbers according to Doug Klunder, spokesperson for the Washington State chapter, who added that "it was extensive" but they have no plans to make it public.
What kind of information might the data reveal? More than you might expect. An investigation by the StarTribune in Minneapolis used ALPR data to show the whereabouts of Minneapolis Mayor R. T. Rybak's city-owned car. An investigation by a Los Angeles paper showed how data is collected and aggregated by federal agencies, some of whom funded the acquisition of such equipment by local police forces in the first place. Elsewhere, private sector "repo men" have obtained ALPR data from police departments to find vehicles they seek to repossess.
But it is the case of someone who is being stalked or who might have a restraining or protection order in place against an abusive partner, for instance, that causes privacy advocates enormous, immediate concern. If anyone who knows your license plate can request data about your historic travel patterns through a city — that information can surely help them find you — no matter that you are not a criminal and never mind that you do not want to be found ... for legitimate reasons.
Concerns such as these have prompted the American Civil Liberties Union to focus on the issue nationally and to call for new legislation to regulate the use and retention of such data by law enforcement authorities.
"This is another good example of a technology that has some really good uses — locating stolen cars is great — but the question is how can you use the technology to get the benefit without turning it into a Big Brother style surveillance system," said Klunder of the ACLU. "I think what we need is some statewide regulation of it. Right now different departments take radically different views of both the purpose of it and data retention policies. Our position is that you should be really very limited in going against 'hotlists' and that the data (on non-suspect plates) should be purged immediately."
The states of Maine and New Hampshire have both enacted laws regulating the use of ALPR systems and data. Maine's law limits data retention to 21 days. New Hampshire's law bans automatic surveillance on public roadways, except when specifically authorized by statute and places limits on recording data. New Hampshire also added a statute preventing government entities from purchasing such data from private providers.
Klunder of the ACLU says that he would not be surprised to see an effort to legislate the use of ALPR emerge in the current session of the Washington legislature. Possible components of such legislation could include time limits on data retention, bans on collecting data on non-suspects, or categorization of aggregate license plate data as "private" information that would exempt them from public disclosure requests, in the same way that vehicle registration data is protected.