When the ACLU released a report Wednesday describing widespread license plate scanning of cars on America's roadways, everyone from privacy advocates to Sunday drivers felt their basic rights of anonymity further slip away. First our data packets, and now our license plates? Isn't anything safe from the prying eyes of the government?
But when you look at how plate scanning is being used at the street level, it's easy to understand the zeal with which police have adopted it. The practice may not appeal to the defenders of civil liberties--we'll get to them soon--but the fact remains that license plates are visible to the public at large, and law enforcement say plate scanning directly benefits anyone who owns a car, and wants to keep it.
Marc Hinch, who is part of a stolen car recovery task force in Oakland, California, uses license plate scanning every day to hunt down hot cars in one of the nation's busiest crime zones.
"Every day, they put out a list of every stolen car, and send that out to us on task forces," Hinch says. "We'll get a report that says, 'These stolen cars were seen in your area' with a Google map linked."
As Hinch drives around scanning plates in target areas, the scans are immediately matched against a database of known stolen vehicles. If a match is detected, a little siren goes off inside his cop car. "Any car that displays a stolen plate, we have more than enough PC [probable cause] to stop it," Hinch says.
"The car might be parked in front of somebody's house, so we can set up surveillance at the location and wait until the person returns to the car," Hinch says.
License plate scanning cameras can be mounted on the roof or the trunk of a police car, or they can be installed inconspicuously in the light bar on the roof of the car. Police also install stationary plate-scanning cameras at the sides of busy thoroughfares or at state or national border crossings.
In some cases, plate scans can be combined with other data to flesh out a sharper profile of a suspect. Hinch says images of drivers captured by police cameras at stoplights can be matched with plates to attach a face with a plate number.
Even when police have only a partial scan of a license plate, or if they have a scan showing the color or type of car its attached to, historical scan data can reveal the full plate number, and eventually the owner of the vehicle. That's exactly how police tracked down and captured a man who abducted a child in San Jose recently, Hinch says.
London calling
Mass license plate scanning got its start in London during the 80s and 90s as a way of keeping track of terrorists from the time they entered city limits to the time they left. Law enforcement around the world quickly saw the appeal of this, and adopted the technology to hunt down stolen vehicles. By 2002, police in the United States were routinely using the technology, Hinch says.
After 9/11, police departments nationwide suddenly had access to a lot more federal funding for all kinds of surveillance gear, several sources told TechHive. Some of that money came from the Department of Homeland Security, and has been used by police departments small and large to buy license plate scanning gear.
As plate scanning technology matured, it became a stand-out tool for chasing bad guys. "They have really ramped up the number of cameras in the last few years. And they're using longer retention times for the data," says Electronic Freedom Foundation staff attorney Jennifer Lynch.
The cameras mounted on police cruisers can scan up to 2,000 license plates a minute, and immediately store the image in the cloud, according to Tripwire security researcher Ken Westin, who routinely works with law enforcement agencies to solve crimes.
And the plate scans yield more than just a series of numbers. The images can include a large portion of a car surrounding the plate, including any identifying marks (dings, stickers, etc.), as well a GPS tag of the exact location of the scan, and a time stamp. All this information can be sent back to a database in milliseconds, Westin says.
With all this data in hand, police can investigate a much larger set of crimes, like burglaries, sexual assaults, child abductions, and even domestic abuse cases, Hinch says.
Because the cameras are constantly scanning, the same vehicles in a given jurisdiction show up over and over again. When these scans are plotted on a map, individual license plate numbers can begin showing up in clusters over time--and some of these locations can be crime scenes.
For example: Let's say the police know the addresses of four burglaries, and the details of each crime indicate a pattern--a common perpetrator. The police can search the database of all plate scans in the vicinity of those crimes, and pull up any vehicles that were present at more than one of the locations at the times the crimes were committed. The owners of these vehicles, then, become serious leads.
Bad for criminals, but at what cost freedom?
It all sounds like a perfectly wonderful law enforcement tool, but the vast majority of plates being scanned are owned by innocent, law-abiding people. The ACLU study shows that less than one percent of the plates scanned are owned by criminals.
For the other 99 percent, the scan data can reveal things we might expect to remain private.
"With the time, date, and location data it includes, you can learn a lot of sensitive things about a person," says EFF's Lynch. "You can see where they live, where they work, where they worship, where their kids go to school, or where their doctor's office is."
While most police departments have rules about how the scan data can be used, there's no telling how the rules are actually enforced. And these rules vary widely from department to department. One police department documented in the ACLU report says the use of the scan database is limited "only by the officer's imagination."
Hinch says in the Oakland jurisdiction, officers may access the scan data on a "need to know" basis only. Also, he says, the California Department of Justice does periodic audits of officers' use of the scan data, in which the officer must justify the necessity of specific queries.
Law enforcement in most parts of the country have resisted laws regulating the use and storage of license plate data, preferring to manage it themselves.
"A lot of the police agencies that are getting questioned about the ACLU report state that 'we have internal policies regarding how this technology is used,'" Westin says. "To me that is usually a sign that they are overreaching."
"Laws are what police are tasked with enforcing and protecting, not creating their own laws through internal policies regarding how our personal data is used," Westin says.
Only time will tell if the new ACLU report will revive efforts to get a federal law passed.