Repo companies have passively scanned & uploaded locations of 9B license plates | Hacker News Reader

Repo companies have passively scanned & uploaded locations of 9B license plates

vice.com

107 pointsmark-ruwt68 comments

I think the scariest part of is in the first part of this; the collection of data was voluntarily crowdsourced by repo men all acting as independent actors. While right now there is still a centralized corporation that can be targeted to stop the practice, I can see a future where this stuff becomes decentralized in the same lieu as software piracy sites and their infrastructure is done today, maintained by "helpful" repomen/investigators that each have a pervasive interest in maintaining such a resource.

The fundamental problem is that technology has made collecting this information too cheap. Instead of manual entry and uploads, it's automated with essentially zero marginal cost over and above putting the cameras on cars or buildings.

The solution is to make license plate collection expensive again - allow people to install license plate covers that people can manually lift to read the plate and automatically retract when the car is started.

Or just get rid of license plates altogether.

Already beat you: local laws that require a valid plate to be visible at all times when parked on public streets. (Private drives/businesses subject to jurisdiction.)

There aren't just repo men scanning in my local area; police cruisers are equipped with automatic scanners, there's numerous scanners posted on traffic poles (with silly blue and red flashing lights as a CYA) throughout the metro area, etc.

The proper solution would be to make data collection like this illegal.

Right, because making things illegal works!

Illegality has a proven track record in stopping the perpetration of malware, computer break-ins, massive sharing of copyrighted files ...

I feel pretty confident saying that the behavior of companies would be way worse if nothing was illegal.

Or just not have licenses at all... oh wait, license plates were made to track cars.

Maybe states could offer CAPTCHA license plates that would be easily readable to a human police officer or other first responder with a legitimate need, but unreadable by license plate OCR.

Or license plates could become programable e-ink displays that display a new hash every X minutes so that a person with a legitimate need could rapidly identify the vehicle but which would defeat bulk passive data collection.

On the other hand, wouldn't organizations collecting this information go quickly further for emissions other than visible light? A car's occupants are likely carrying around devices emitting GSM, Bluetooth and Wifi radio signals, as well as onboard systems. The model for this is Google's collection of household radio emissions with the StreetView surveillance patrols or the gargoyles in Snow Crash.

https://www.theguardian.com/technology/2010/may/15/google-ad...

https://en.wikipedia.org/wiki/Snow_Crash

>Or license plates could become programable e-ink displays that display a new hash every X minutes

Once a week would likely be enough. The point is that you can no longer associate "Plate ABCDEF was at this location at this time" with "Car owned by person X was at this location at this time" without making a lookup in a database that's owned by the government.

I'm a huge proponent of this core idea -- that networked technologies have changed the cost structure that underpins our 20th century implicit understandings about privacy, and that one stopgap approach is to rework the economics of surveillance in a way that re-approximates the cost structure under which our legal and moral consensus was developed.

For example, it was never possible to read, secretly and automatically, in bulk, everyone's correspondence in the 20th century. With email, it's a commonplace that governments do it routinely. Encryption doesn't make it impossible to figure out what someone's corresponding about, it just makes it more expensive (as the investigator may need to devote resources to shoulder-surfing or other means instead of auto-collection). It used to be fairly expensive to have to go to the post office and steam open an envelope, copy it, and seal it back up without detection.

Likewise for various other surveillance technologies, such as the ALPR/ANPRs. The people who (still) write our laws were raised watching TV cops listen for a radio APB on a license plate. For their intuitions about this matter to be valid, it should be roughly as costly in manpower, time, and attention to do a "live alert" on a license plate today as it was for those TV cops.

A pen register used to be an actual box you put at the central office on a specific bad guy of interest, not an excuse to sweep up and cross-correlate every dialed number ever. Again, several orders of magnitude cost difference here, in a way where the difference of degree (cost) becomes a difference of kind.

The big danger IMO is when you have well-meaning legislators and jurists opining about network-enabled privacy intrusions using intuitions and examples formed with 20th century cost expectations.

Eventually those expectations will need to reflect current technology, but in the meantime, anything that can be done to raise the cost of pervasive surveillance is IMO a good thing as it buys time for legal and moral intuitions (much slower rate of change) to adapt.

That was such a great comment that I sent it to a few of my friends. Thank you.

> The solution is to make license plate collection expensive again - allow people to install license plate covers that people can manually lift to read the plate and automatically retract when the car is started.

The public at large would never go for any proposal of removing the requirement for two-ton murder weapons and get-away rides to show identifying marks at all times.

Yes, and such 'crowdsourced' decentralized sites will suffer the same bit-rot as all the other ones, and we'll see all sorts of outrages caused because 5 years ago or whatever a bad actor lived at such and such an address, but the "helpful" repomen/investigators never updated things, and we'll that's just too bad and if you shut down our database everyone will steal a car and won't someone think of the children and (this is the only part I completely, 100% guarantee) no "helpful" person will take a single shred of responsibility for any collateral damage.

I saw an ALPS vehicle a few months back in the parking lot of a local Wal-Mart (AZ). It was rolling slowly up and down the aisles searching for what at first I presumed was a parking spot closer to the front doors.

Closer inspection revealed it's true nature. Mounted on the trunk lid were four cameras, two on each side, angled slightly downward.

The vehicle was an old piece of sht Ford Crown Vic P71 with white doors, black body, black rims, rusted spotlight, and slightly visible police decal adhesive. The kind you purchase at government auction for $750. It looked like something Reevers would use as a daily driver.

Certainly not as classy as a Google Maps car, but apparently getting the job done because parked in the outer lot was a shiny-new, jet-black, "deluxe" companion tow truck with chrome rims and full stealthiness -- waiting for a hit.

As someone pointed out below, the entire purpose of license plates is to easily track and identify cars. There's no reason to require the outward display of a license plate otherwise. In fact, there's already a more accurate and up to date piece of information that isn't required to be displayed: your registration card.

I'd never seriously thought about this until reading this story, probably because they've been ubiquitous for decades and as a little kid I loved seeing the different state versions, but I'm surprised that I've never come across a serious discussion about the privacy implications and whether or not it's Constitutional (if it's been addressed, would love a pointer to the case). It doesn't seem like a huge logical leap from the idea of digital anonymity.

whether or not it's Constitutional (if it's been addressed, would love a pointer to the case)

https://www.oyez.org/cases/2014/14-144

An interesting one, that's close, but still interesting on the merits.

>privacy implications

I think you voluntarily giving up a certain amount of privacy when you choose to drive on the road. Sure yes you can argue most places you don't really have a choice since you need a car. But then I could argue back- if you value that type of privacy SO MUCH then you can choose to move to an area where you can walk or use public transportation.

I just think this is one of those times where the pros heavily outweigh the cons. Criminals and people who should not be on the road can be way more easily tracked with license plates. I can't really think of a situation where I would care that someone is passively recording my plate location as I drive by?

Also what if you are illegally parked somewhere. How is an officer supposed to issue you a ticket without your plates?

> But then I could argue back- if you value that type of privacy SO MUCH then you can choose to move to an area where you can walk or use public transportation.

This same style of argument when applied to freedom of speech leads to the appropriately criticized "free speech zones". I have a right to travel and a right to privacy. Saying that I can only use one of these rights at a time is absurd. My opinion on this specific instance might change if the US invested as much into public transportation as it does into roadways, but that is not the case.

> I can't really think of a situation where I would care that someone is passively recording my plate location as I drive by?

Driving to a union meeting? Driving to an abortion clinic? Driving to a church of a different religion/denomination than your family? Driving away from an abusive partner?

> I have a right to travel and a right to privacy. Saying that I can only use one of these rights at a time is absurd.

You are so fixated on the car in this mindeset.

Do you have the right to fly an airplane and have privacy at the same time? If you don't have it in the air, why do you think you should have it on the roads?

Good point with the car fixation. We're very close to easy personalized air travel (eg: the English Channel hoverboard crossing of earlier this summer). License plates are made for objects with a clear front and back, traveling mostly forwards and backwards. How will we identify personal carrier drones? Maybe the answer to this question will move us out of the box and provide a more robust solution to this general license plate issue, and then we can apply that to cars.

> I have the right to travel

This is actually a serious debate in the political philosophy community, notably with georgists.

Travel implies that you are traversing some real property on land, sea or air. So the ownership (or lack of ownership) of the property that you're traversing would in theory dictate whether you could cross it and how.

Different countries have different laws in this regard, including "easement" requirements, but it's not universal, hence national borders.

So while it seems like you have the "right," it's not so simple legally or philosophically to determine who is guaranteeing or violating that right at any given moment.

The officer can read the less visible VIN. But more importantly, cops aren't everywhere, many laws are structured with this fact in mind. Having a visible license plate enables the bystander or witness of a crime to safely report it so that the accused can be located and investigated/cited/apprehended later by professionals.

I very much understand that this is the "value" of license plates. However, the same argument could be made for requiring everyone to display their social security number, which would pretty obviously not make through a court challenge. As I mentioned elsewhere, having just started thinking about this, I don't have a strong opinion yet, but this is a great example of an argument that strongly overlaps with those made in other privacy cases.

>However, the same argument could be made for requiring everyone to display their social security number, which would pretty obviously not make through a court challenge.

I really think that's a stretch. I get the similarity, however driving in a vehicle is not the same as walking down the street.

You need to be registered to have a vehicle, you need to have a drivers license, you need to have insurance. There is nothing you need while walking down the street, except clothes in most places. So there is no good argument for forcing identification.

As I took one step further for someone else, is the next argument going to be you don't have to publicly identify your aircraft when flying? Are we going to argue it removes privacy that an aircraft must identify itself with the FAA?

I know you are just starting to toy with this argument. But I think it's easy enough to find so many differences between a person walking down the street and having a vehicle which we regulate for many good reasons.

Interesting topic though, for sure.

"Pros outweighing the cons" is often a solid indicator of a real Constitutional challenge, as most Constitutional protections are around things that the founders decided had pros that outweighed their cons so substantially that they wrote them into the founding document of the nation.

Your comment about illegal parking is a pretty good one for highlighting the consequences though - issuing tickets would become functionally impossible, which would likely result in more booting (which is effective at ensuring compliance by the owner, but wildly counterproductive to the goals of parking restrictions) or towing (which has plenty of its own issues).

I've only started thinking about this today, so I don't have a strong opinion on this. I'm more interested in whether or not this sort of thing has every been seriously covered in court given its overlap with other privacy arguments.

Those interested in this issue will definitely want to check out Grassland. It's basically a blockchain project to democratize video surveillance. http://grassland.network

"Grassland is a self-organizing , self-sustaining and self-correcting, anonymous network of AI software that quickly and cheaply turns any 2D video feed from any single-perspective camera into live 3D models and can organize data captured from millions of cameras around the world into a real-time, secure, global simulation. It lets humans view the world in a manner like the games SimCity® or Civilization®[1] and lets machines internalize, understand and interact intuitively with the real world."

Previous Hacker News discussion: https://news.ycombinator.com/item?id=19529921

A word of advice for those of you that live in the 19 states that don't require a front license: always back into parking spots to make it difficult or impossible to read your plates. There are other good reasons (like increased safety) for backing into parking spots and keeping your travel history private is just one of them.

don't back into parking spots that are right in front of an apartment window or the entrance of a store though, you'll be piping escape gases in people's faces, especially with a truck.

I would REALLY like to know what's controversial about this statement.

Probably the exhaust/escape typo.

Here in NJ, its required but I rarely have one. My Audi A6 didn't come stock with a front plate holder (and honestly wasn't aesthetically designed for one) so didn't have one for its 3-year lease. I was never pulled over for it.

I removed the front plate off my Wrangler to install a winch and haven't been pulled over yet.

I do prefer to back into parking spots, but I'm curious why you think it increases safety?

To clarify: the DRN database contains 9B _scans_ of license plates, not scans of 9B license plates.

Privacy is dead because technology enables ubiquitous surveillance and economics and politics drive it to the limit.

I don't like it and I'm not advocating it, but the question of what a truly, deeply post-privacy society will be like is fascinating.

A very important question is whether or not the administrators of the system were subject to it as well.

This would be an interesting database to play with. Using the data here you could backtrack where all the customers in a business live and work. Or you could go forward and figure out where all the people in an area shop. You can do the same with google maps and Apple data but idk if that info would be accessible

That was my first thought: I'd be surprised if hedge funds don't already ingest this tracking data for their analytics.

If by interesting you mean horrifying then yes. Let's be clear, tracking people this way potentially gives you information about their job, religion, health status, clubs, friends, romantic relationships, and family members. It is a massive data liability, comparable to the credit score companies.

It’s nothing compared to the database chase has. Chase can tell you not only the above but they can break down what brand of mustard each neighborhood consumes and what color and style of underwear you prefer. This just seems like it would be easier for a startup to get access to.

Are merchants sharing purchase-level information with credit card companies now?

I think the corporate chase card breaks down a lot of the purchase details for my employer

Once I asked a company how they calculated the conversion rate of a billboard ad, I was told they got data from smart billboards reading car plates and linking them to people's online presence.

Wow okay, that's terrifying. Especially since it's so passive!

Is it legal to hide your car's license plate while the car is not in motion? Seems like a 'privacy shutter' that deploys when the car is turned off could be a useful feature.

I think it varies by jurisdiction. For example, Oregon requires plates to be visible on any vehicle being operated on public roads, which might be interpreted as excluding parked cars (assuming that taking up parking space does not constitute operation). But the city of Portland has an ordinance specifically requiring parked cars to have visible plates.

A story of repo cars driving and scanning tags has been seen on HN first time many years ago. Meanwhile a buddy of mine works for a "secret" company that has cars driving around ten most criminal infested cities (such as Detroit) and mass-scanning people's faces behind mirror glass. A single car in a busy city is able to scan over 25,000 people daily. This info is later fed into the system and usual clients are Sheriff offices and bounty hunters. I wish someone like VICE did the story on it, but my buddy only showed me screen shoots, no company name, nothing.

In 2019 you cannot assume you have any sort of privacy once you leave your door step, literally.

In NH we banned automated license plate readers (ALPRs), including private use and law enforcement ones. I think this option will get more popular, like SF banning certain facial recognition scanners.

Why shouldn't law enforcement be able to use it?

I mean.. wouldn't it be great to know if people are driving without valid registrations? Or if a criminal is trying to get somewhere, and you have their plates?

Not sure I see a downside here...

They tend to get put into databases that are abused, sometimes by LE officers looking up family members or exes, and sometimes by hackers. Also it's creepy for the government to keep tabs on millions (well NH is only 1.4 million) of innocent people. If there's some specific car you're looking for, humans can keep an eye out for it. Anyone can still track the plates etc. but it's harder to make a all-encompasing database without automated readers.

Live free or die, eh?

Ban collection. Permit surveillance with a warrant.

There's currently an amber alert for a 5-year-old girl (presumptively) abducted here in NJ [1]. They don't (that I know of) have a license plate but if they did I don't think any person nor court would have an issue with a warrant enabling automated surveillance of that plate number.

In an idyllic scenario, you could even enable automated collection and storage but only allow access with a warrant.

[1] https://nypost.com/2019/09/18/amber-alert-issued-for-new-jer...

Out him. You won't.

Because of this problem, do we have recourse now to hide license plates until requested by law enforcement? Is there an opportunity for us to update (change) the old law?

Anyone else feel like paying for everything in cash again? This is so creepy, and it's nothing compared to the data cell phone companies and credit card companies have on you.

I've wondered whether cash serial numbers are scanned at ATMS and bank deposits. The metadata could be quite informative.

I want information on that, too, though for Europe.

I'm pretty certain that they are. Can't remember the source at the moment though.

Another reason to take a bus ;)

Is it legal to build such systems? What if tomorrow someone will decide to replace the government with a private system like this? We've done something like that in the area of finance, with cryptocurrencies.

Not legal in Europe.

Reply on news.ycombinator.com