Who’s Tracking Your License Plate?

Over the last decade, cities have increasingly embraced the crime-fighting potential of automated license plate reader technology. These camera systems are now ubiquitous at malls and train stations; they appear on street signs and perch on the dashboards of police cars. ALPRs can snap up thousands of geotagged photos per minute, and can help construct an incredibly detailed picture of a driver’s whereabouts over time.

For law enforcement, ALPR represents a powerful tool that can track suspects in real time. Let’s say the police are pursuing a robber fleeing in a vehicle. They can add the suspect’s license plate to a “hot list” and receive alerts whenever an ALPR camera in their city snaps a picture of it. Using what’s essentially a real-time map, the police can track and intercept the suspect.

But critics of the technology—including civil liberties and privacy groups—argue that license readers gather too much sensitive information about people who have nothing to do with crime, and it’s not always clear with whom it is being shared and to what end.

“In a nutshell, it’s like face recognition—except every single face comes in a standard format and is directly linkable to a government identity record,” Alvaro Bedoya, the executive director of the Center on Privacy and Technology at Georgetown Law, said via email. “It allows mass tracking and because plates are issued by the government, we’re a bit desensitized to the idea that they’ll be tracked. It’s powerful stuff, and it’s not under control.”

This year, the Electronic Frontier Foundation, a digital rights organization, filed hundreds of Freedom of Information Act requests via Muckrock, a government transparency platform. The organization was looking for information on deals local and federal agencies have made with Vigilant Solutions, the largest private company selling ALPR technology and data. Recently, EFF released results from 200 responses.

“We found a staggering amount of data that agencies are collecting on people—very little of which is of public interest,” said Dave Maass, senior investigative researcher at EFF.

A total of 173 entities (largely police departments and sheriff’s offices, but also some federal agencies) in 23 states scanned a total of 2.5 billion license plates in 2016 and 2017. On average, 99.5 percent of scans belonged to cars that weren’t associated with crimes.

This information was widely shared. EFF also found that, on average, each agency was directly sharing this information with 160 other jurisdictions at various levels of government. These could be police departments, university police units, airports, or Customs and Border Protection, for example. In addition, several agencies on the list also subscribed to Vigilant Solutions’ central database, which pools its own trove of ALPR data with that collected by various local agencies with which it has agreements, and sells access to this dataset to an undisclosed list of entities. What that means is even if your plates were shot in Georgia, your location data may be accessible to cops in say, Illinois. Or it may be bought by private companies or Immigration and Customs Enforcement.

The Burr Ridge Police Department in Illinois, which sought to install ALPR and facial recognition technology in their squad cars back in 2016, now shares this data with 851 other agencies—the highest of any other in this dataset. “It sounds futuristic,” city board trustee Janet Ryan Grasso said in support of the technology at the time the department proposed the program. “It would provide cutting edge technology for our patrol officers to protect residents. I like the idea.”

Although heavily redacted, records provided by the U.S. Forest Service suggest that the federal agency, too, shares information—with around 390 entities, according to EFF.

Here is a map of all the agencies EFF has requested information on. You can click through to explore the map, or look up your local police department in the data here.

So, if you’re a law-abiding motorist, how worried should you be about this technology—and what exactly should you be worried about?

One big concern, says EFF’s Maass, is data security. Sharing such sensitive information across state lines makes it harder to conduct appropriate oversight because the data and privacy laws in one place may differ from another. It also makes that information more susceptible to breaches. “Every time you create an access point to your data, that’s another vector where it can be used gain information on people,” Maass said. “If you’re the city of Sacramento and you’re sharing with 800 agencies, that’s 800 points of vulnerabilities.”

If hackers get a hold on what is essentially a geotagged map of your movements, they could sell that stalkers, robbers, or other individuals who wish you harm. Or, a large trove of that data for multiple people—law enforcement officials or political leaders, for example—could fall in the hands of foreign adversaries.

Vigilant Solutions advertises this technology to law enforcement as a much-needed modern upgrade to scribbling down license-plate numbers by hand. “The technology in use today basically replaces an old analog function—your eyeballs,” Chris Metaxas, then-chief executive of Digital Recognition Network, a subsidiary of Vigilant Solutions, said in 2014. “It’s the same thing as a guy holding his head out the window, looking down the block, and writing license-plate numbers down and comparing them against a list. The technology just makes things better and more productive.”

Law enforcement officials seem convinced. But how effective is this tool? The “hit ratio”—the total number of “hot list” license plates detected per the total number of scans—is one useful metric. This number has been minuscule in past examinations—often less than 1 percent. In this new trove of data, too, EFF found that on average, the hit rate was 0.5 percent. In other words, law enforcement cast a very wide dragnet, for a very tiny catch of suspects.

The exact number of crimes ALPR technology has helped solve is unclear. Vigilant believes it’s a lot. “[T]he success stories are so frequent, I can’t even keep up with them all,” writes Tom Joyce, a retired NYPD officer who works at Vigilant Solutions, on the company’s website. Police officials who defend this technology despite the low hit ratio also highlight individual cases that were assisted by ALPR investigations: a shooting suspect in Cincinnati, Ohio; a U.S. postal service robber in Alexandria, Virginia;

In the dataset, the Kansas City Police Department in Missouri stood out with an abnormally high hit ratio—7.6 percent of the 37 million license plates it scanned in 2017. Maass doesn’t know what’s going on there, but guesses that it may be because they keep a large hot list based on very broad criteria. “I can only speculate that it could be related to court fines or proof of insurance,” he said. “It’s alarming that they’re keeping such close tabs on so many people.”

That itself raises a huge red flag about hot lists: Police departments have wide discretion in creating them, which may leave a lot of room for abuse. EFF has previously found that Vigilant has been incentivizing local police departments in Texas to focus on debt collection. Free Vigilant technology would alert police when people with pending court fines drive by. After they pulled the driver over, they could offer two choices: Go to jail, or pay the fine … plus a 25 percent “processing fee” that Vigilant largely pockets. In 2016, Buzzfeed found that Port Arthur’s sheriff used similar technology to shake down black and brown motorists who owed the city money. Remember that exploitative practice of squeezing the poor for municipal revenues that came to light after the Justice Department’s investigation of Ferguson, Missouri? These practices were high-tech variations on the same idea.

Then, there’s also the fact that ordinary citizens with potentially nefarious motives can often obtain this license-tracker data through a public records requests in some places, or by having the police give it to them as favors or in exchange for bribes. They may then use it to target violence survivors, political organizers, journalists, or abortion-seekers.

Police and other government agencies have a long track record of disproportionally surveilling populations of color, immigrants, and the poor, and ALPR offers another means of pursuing that practice. In 2015, EFF mapped how ALPR was used in Oakland. Police cars equipped with cameras would patrol low-income neighborhoods, snapping up more plates in these areas. That meant the residents of these neighborhoods were more likely to end up in the ALPR system—even though their neighborhoods weren’t necessarily correlated with higher crime.

Surveillance tools like ALPR are often first used against vulnerable communities. But those who aren’t used to being singled out because of their skin color might want to remember that every driver on the road is fair game for this technology. To reduce the potential for abusing ALPR, advocates suggest purging the scans that do not generate a match on the hot list immediately, or at least after a few days. But underlying it all is the question: Should police have access to this kind of data at all?

”The government makes us put license plates on our cars,” Maass said. “They have a responsibility not to exploit it.”