Tue, Feb 18th 2014
from the more-'harmless'-metadata dept
In what reads like bad news all over, the DHS has just requested quotes for national automatic license plate reader (ALPR) database. There are currently several ALPRs in use and law enforcement agencies have been working hard to link systems up in order to better track vehicles as they move around the country. This has been hampered somewhat by multiple vendors, most of which aren't particularly interested in working with competitors. But even with multiple vendors, there's still a whole lot of data being stored -- a majority of which is entirely unrelated to criminal activity -- in easily-accessible databases.
License plate readers are used not only by police but also by private companies, which themselves make their data available to police with little or no oversight or privacy protections. One of these private databases, run by a company called Vigilant Solutions, holds over 800 million license plate location records and is used by over 2,200 law enforcement agencies, including the U.S. Department of Homeland Security.
A nationwide database, with records accessible by law enforcement and investigative agencies with few restrictions is obviously a concern. Tracking vehicles as they move around the country generates a ton of location data that can reveal a great deal about a person. It's always argued that what you do in public carries no expectation of privacy, but that statement is somewhat meaningless when you consider the number of plates ALPRs scan and store. Most states with ALPRs have gathered millions of records, which are held for as long as 5 years, with little in the way of minimization procedures. ELSAG, another ALPR vendor, brags in its own promotional Powerpoint presentation that it has collected 50 million records in New York City alone, without a single mention of minimization processes or the disposal of non-hit data.
For the government to actively call for a nationwide database is troubling. Since this is a solicitation for bids, there's no discussion on what, if anything, will be required from the winning contractor in terms of storage, minimization or disposal. Given the track records of the largest vendors, it's likely these issues will be of lesser concern than other aspects, like scanning speed and database accessibility.
The call for bids may have something to do with Vigilant's recent efforts, both on the PR front and in the courtroom.
First off, Vigilant (along with Digital Recognition Network) is suing the state of Utah for, believe it or not, violating its First Amendment rights.
For the government to actively call for a nationwide database is troubling. Since this is a solicitation for bids, there's no discussion on what, if anything, will be required from the winning contractor in terms of storage, minimization or disposal. Given the track records of the largest vendors, it's likely these issues will be of lesser concern than other aspects, like scanning speed and database accessibility.
The call for bids may have something to do with Vigilant's recent efforts, both on the PR front and in the courtroom.
First off, Vigilant (along with Digital Recognition Network) is suing the state of Utah for, believe it or not, violating its First Amendment rights.
It posits that a new Utah law which bans license plate collection by private companies, effectively put it out of business in the state. The law was intended to keep data from falling into police hands without oversight, and is among the first by surveillance technology firms to argue against privacy laws invoking the First Amendment.
The Texas company fired back, arguing that collecting license plate numbers is free speech. The lawsuit draws upon a recent major Supreme Court ruling, Citizens United v. FEC, which overturned a law curbing corporate and union donations to political campaigns. In effect, the Court ruled that money is speech.
“The Texas company says it’s not a police agency – law enforcement already is exempt from the ban under Utah’s new law — nor can it access in bulk federally protected driver data that personally identifies the letters and numbers it collects from license plates in public,” the Associated Press reported Thursday. “The company said it only wants to find cars that have been stolen or repossessed, not to cull large swaths of data and incriminate people from their travel habits.”
The Texas company fired back, arguing that collecting license plate numbers is free speech. The lawsuit draws upon a recent major Supreme Court ruling, Citizens United v. FEC, which overturned a law curbing corporate and union donations to political campaigns. In effect, the Court ruled that money is speech.
“The Texas company says it’s not a police agency – law enforcement already is exempt from the ban under Utah’s new law — nor can it access in bulk federally protected driver data that personally identifies the letters and numbers it collects from license plates in public,” the Associated Press reported Thursday. “The company said it only wants to find cars that have been stolen or repossessed, not to cull large swaths of data and incriminate people from their travel habits.”
DRN's press release goes into a little more detail on this rationale.
“Taking and distributing a photograph is an act that is fully protected by the first Amendment,” said DRN / Vigilant Outside Counsel Michael Carvin. “The state of Utah cannot claim that photographing a license plate violates privacy. License plates are public by nature and contain no sensitive or private information. Any citizen of Utah can walk outside and photograph anything they please, including a license plate.”
