Tiburon, CA. - Tiburon, a small but wealthy town just northeast
of the Golden Gate Bridge, has an unusual distinction: it was one of the
first towns in the country to mount automated license plate readers
(LPRs) at its city borders—the only two roads going in and out of town.
Effectively, that means the cops are keeping an eye on every car coming
and going.
A contentious plan? Not in Tiburon, where the city council approved the cameras
unanimously back in November 2009.
The scanners can read 60 license plates per second, then match
observed plates against a "hot list" of wanted vehicles, stolen cars, or
criminal suspects. LPRs have increasingly become a mainstay of law
enforcement nationwide; many agencies tout them as a highly effective
"force multiplier" for catching bad guys, most notably burglars, car
thieves, child molesters, kidnappers, terrorists, and—potentially—
undocumented immigrants.
Today, tens of thousands of LPRs are being used by law enforcement agencies all over the country-practically every week,
local media around the country
report on some LPR expansion. But the system's unchecked and largely
unmonitored use raises significant privacy concerns. License plates,
dates, times, and locations of all cars seen are kept in law enforcement
databases for months or even years at a time. In the worst case, the
New York State Police keeps all of its LPR data indefinitely. No
universal standard governs how long data can or should be retained.
Not surprisingly, the expanded use of LPRs has drawn the ire of privacy watchdogs. In late July 2012, the
American Civil Liberties Union and its affiliates sent requests to local police departments and state agencies across 38 states to request information on how LPRs are used.
The system is not without flaws. It tends to yield numerous false
positives because the hot list data received from the California
Department of Motor Vehicles takes a long time to be updated—and because
the system cannot distinguish out-of-state plates. This creates a
problem if, for instance, California plate ABC123 has been reported as
stolen and is on the hotlist, and then someone drives through Tiburon
with Oregon plate ABC123. (Other LPR systems can distinguish the plates
from different states.)
Hutton showed me an example of a unique California vanity plate that
the department gets a hit on every day, because that same plate from a
different state was reported stolen. The Tiburon authorities pulled over
the local resident once, his story checked out, but his plate turns up
again every time he enters or leaves the city.
In addition, the cameras miss some plates. When I saw the LPR system,
for instance, I slowed down to get a better look. By the time I reached
Blackfield Drive, I knew I had to turn around to get closer, so I made a
U-turn and pulled over in the shoulder directly across from the
cameras. I parked my car, and walked over to the island to snap a few
pictures with my phone. I got back in my car, drove ahead 20 feet or so
while still on the shoulder, and then moved over to the left turn lane,
making a second U-turn to head back toward the police station. When I
asked Capt. Hutton to see my own log entry, the camera had only recorded
my
inbound entries. Pulling over to the shoulder apparently
put me out of range of the camera—a pretty easily exploitable weakness.
I'd "hacked" the Tiburon Police LPRs without even trying.
LPR systems are doing big business at the moment. The country's largest such company, Federal Signal Corporation (FSC), which sells LPRs under its PIPS brand name,
says it has sold 20,000 mobile systems across North America and another
15,000 fixed devices across the United States and the United Kingdom.
"We work with the 25 largest cities in the United States, over 100
cities in the US and over 200 in North America, including the Royal
Canadian Mounted Police and in Mexico," said Tim O'Leary, a company vice
president, in an interview with Ars. "We think the market is growing at
8 to 10 percent, adjusted growth rate, annually."
In its SEC filing earlier this year, FSC said its sales of LPRs were up by $2.1 million in 2010 alone. One of its primary competitors, Elsag North America, says it has worked with 1,200 agencies nationwide, while declining to state how many LPRs it has sold.
The New York Police Department began using LPR devices made by Elsag in 2006. As of 2011, the NYPD told the
New York Times that it maintains 108 stationary LPRs and 130 mobile devices (Elsag's "
Mobile Plate Hunter".)
The
Times also wrote that in 2005, the year before LPRs were
introduced, New York City had nearly 18,000 reports of stolen cars, a
figure that fell to just over 10,000—a drop of over 40 percent—in the
next six years. The NYPD attributes the benefits of LPR technology to
being "directly responsible" for recovering over 3,600 stolen cars and
for issuing summons to nearly 35,000 unregistered vehicles.
New York isn't alone in its love of LPRs. Washington, DC, with its 250 cameras,
has more than one LPR per square mile, likely the highest concentration in the country.
In September 2011, the FBI
reported
that its Criminal Justice Information Services Advisory Policy Board
(CJIS APB) had approved the use of LPRs years earlier through a pilot
project conducted by the Ohio State Highway Patrol. That pilot has since
expanded to "46 states, the District of Columbia, 33 local agencies,
and one federal agency," which have "formal agreements with the FBI to
receive the [National Crime Information Center] information for the
purpose of using LPRs."
The FBI also added that a survey of its pilot partners "reported a
total of 1,102 stolen vehicles recovered with a value of more than $6.5
million, as well as contraband recovered that included stolen license
plates, stolen property, vehicles, drugs, weapons, larceny proceeds,
suspended registrations, credit cards, and a police badge. Also as a
result of the LPR technology, participating agencies located 818
subjects listed in the Wanted Persons File and 19 listed in the Missing
Persons File. Another 2,611 persons were apprehended."
The recent uptick in LPR deployments is likely due to a combination
of price drops—each camera can cost between $8,000 and $20,000 now—and
increased federal grants for the tech. Various agencies, in particular
the Department of Homeland Security, the Drug Enforcement Agency, and
Customs and Border Protection have
issued many
millions of
dollars in
federal grants to state and local law enforcement to buy the hardware. (Both FSC and Elsag provide
prominent links on their websites to help cops apply for these grants, too.)
Help ArsTechnica watch the watchers.
In the course of this story, ArsTechnica e-mailed the state law enforcement
agencies of all 50 states to learn more about how LPRs are used; we
received replies from just a handful. We followed up with FOIA and
public information requests asking for LPR purchase orders, privacy
guidelines, and other documents from ten state, ten local, and three
federal agencies, including the FBI, the DEA, and Customs and Border
Protection.
We learned, for example, that the Bismarck, North Dakota Police
Department and the Hawaii State Police both deny using LPRs at all. The
Delaware State Police, meanwhile, says it owns three readers. After a
month, we've had relatively few responses, though many of the requests
are still pending.
http://arstechnica.com/tech-policy/2012/08/your-car-tracked-the-rapid-rise-of-license-plate-readers/
U.S. Customs tracks millions of license plates & shares data with insurance firms.
It may come as little surprise that every time you cross the border, cameras record your license plate number and feed it into a database of driver locations. More disturbing, perhaps, is the fact that the government seems to share that automobile surveillance data with an unexpected third party: insurance companies.
Documents obtained through a Freedom of Information Act request and released Tuesday by the Electronic Privacy Information Center (EPIC) catalogue just how pervasive automatic license plate readers have become at the Mexican and Canadian borders, with cameras placed in dozens of U.S. cities each capturing images of millions or tens of millions of plates a year. But the FOIA’d records (PDF
here) also include memos outlining the sharing of that license plate data between the Department of Homeland Security’s Customs and Border Protection, the Drug Enforcement Agency, and most significantly, the National Insurance Crime Bureau, an Illinois non-profit composed of hundreds of insurance firms including branches of Allstate, GEICO, Liberty, Nationwide, Progressive, and State Farm.
“This is warrantless collection of very private data, location data about where you’ve been and when,” says Ginger McCall, an attorney with EPIC. “It’s being shared with unknown organizations, not just in the government where there may be Privacy Act protections, but outside the government with third parties, possibly in contravention of the Privacy Act.”
According to an undated “memorandum of understanding” included in EPIC’s document release, license-plate reader “information on vehicles departing from and arriving into the United States will be provided to the [National Insurance Crime Bureau or] NICB for the purpose of deterring the export of stolen vehicles, identifying vehicle theft patterns and trends…and returning vehicles to the rightful parties of interest.” The data can also be used, according to the document, to identify so-called “owner-give-up” insurance fraud, in which a vehicle’s owner fakes its theft by giving it to a friend and claiming it as stolen.
http://www.forbes.com/sites/andygreenberg/2012/08/21/documents-show-u-s-customs-tracking-millions-of-license-plates-and-sharing-data-with-insurance-firms/
Government standard for vehicle "Event Data Recorders" will go forward.
The National Highway Traffic Safety Administration has
denied a petition for rulemaking that would delay the effective date of national requirements for
event data recorders.
The government requirements for the devices that are installed in
vehicles will be effective on September 1, 2012. Commonly referred to as
"black boxes," event data recorders collect and store vehicle operation
information before, during, and after a vehicle crash, including
vehicle location, driver speed, seat belt use, and number of vehicle
occupants.
http://epic.org/2012/08/government-standard-for-vehicl.html