License-Plate Readers Let Police Collect Millions of Records on Drivers | Hacker News Reader

License-Plate Readers Let Police Collect Millions of Records on Drivers

cryptogon.com

I used to be a software engineer on an ALPR system.

There are things I like about ALPR and things I don't like -- it's up to you guys to make sure it isn't abused. This technology could be abused without oversight.

Images are taken from cameras and matched against known "hot lists" of wanted people. Wanted for what? That depends. There's a list for expired plates (a.k.a. revenue generation - the selling point is that law enforcement will recoup the cost of the systems very quickly), stolen cars, murder suspects, missing people, sex offenders. There is even a notion of a "secret" list where the cops operating the system aren't even aware of what the analysts are looking for. These systems can also do geofencing -- if a plate for a known sex offender is spotted within a certain distance of a school, they're busted. Lots of stolen cars have been recovered via ALPR -- and remember most serious crime starts with the criminals obtaining a stolen car.

The system can also be used for internal investigations -- for instance there was a cop who was stalking his ex-wife who happened to have an ALPR. They pulled the capture history and her license plate came up multiple times. So he's busted.

Depending on how the system is set up they could store and back up the images and geolocations forever. There is current pending legislation regarding how long they can store data. The highway patrol can only store data for 60 days, most police departments have no such limitations. Update it looks like this failed--http://gizmodo.com/how-automated-license-plate-readers-threa...

Given enough mobile and fixed ALPR cameras the end result would be the same as having a GPS tracking device on everyone's car. I don't see why citizens should subject themselves to that long term data collection.

How about controls? Anyone querying the data leaves an audit trail behind. There are lots and lots of auditing and authorization levels built into the systems. That being said if something isn't configured correctly as was depicted here... http://money.cnn.com/2013/04/08/technology/security/shodan/

Something to note, this technology is out of the bag. In the future 3M which makes most license plates are going to be adding QR codes to license plates. http://www.tollroadsnews.com/node/6029 You won't really need specialty cameras.

Presently there isn't a national database for ALPR but they're working very very hard to make this a reality. It's up to you guys to make sure this technology is used with proper restrictions and oversight. As I heard out of the mouth of a salesman after a sale to a middle eastern country "Hey regimes are great for business!"

> Given enough mobile and fixed ALPR cameras the end result would be the same as having a GPS tracking device on everyone's car. I don't see why citizens should subject themselves to that long term data collection.

The common argument for privacy in relation to democracy, is that:

If being associated to a political group will be counted against you and the data from such a system could be used to prove your attendance or affiliation to such a group...

...then you are unable to freely express your political beliefs as a consequence of being tracked.

Exactly.

Too often I hear people say "I don't mind personally." But it does affect everyone, since it chills political speech which hurts democracy.

> If being associated to a political group will be counted against you

It bothers me that this can happen.

I have much less of a problem with instant lookups against "hot lists" for expired plates, or wanted individuals (though no guarantee that the driver of a car at any particular time is that person, however) than I do with them keeping the data.

I don't see any good reason that they should be allowed to store the data for later analysis, especially if the "hot list" check comes up empty.

The fact that I'm spotted in public is not an unreasonable invasion of my privacy. Nor is a check of my license plate; this has already been possible, if less efficient, ever since patrol cars had radios.

Keeping a log forever of everywhere I've been spotted is unreasonable, if I'm not otherwise under active investigation.

>Presently there isn't a national database for ALPR but >they're working very very hard to make this a reality.

Maybe not a government run one, but there sure are private ones. Companies like Vigilant (http://vigilantsolutions.com/) probably have over 1-2 billion plate reads nationwide, and law enforcement agencies can get free access to it (http://nvls-lpr.com/nvls/).

There is also a project which was funded by National Institute of Justice which tried to allow all ALPR systems to insert data into a single repository. That's the present problem right now - two neighboring jurisdictions might have different systems.

source code http://gemini.gmu.edu/cebcp/LPR/for-police-leadership_LPRD.h...

well, the code used to be there. I wonder when they pulled the code?

Can I ask you a couple of questions privately?

pm me on twitter @gostermag

sigh

I'm going to cross-post from another forum, where we had a similar discussion on ALPRs.

My reply was in response to how a town can use ALPRs to justify the layoffs of 2-3 parking personnel.

"Nope, the way you justify this is you don't pay for it.

The way it actually works is the manufacturer employs a team of grant writers, whose job is to know about any and all municipal, county, state, federal grants. In conjunction, with a team of lobbyists to influence the increased disbursement of funds to towns to help in the "war on terror". And the cherry on top, is the team that works with each state (or each regional purchasing authority) to get the manufacturer's products onto the approved list of law enforcement-related purchasing items.

The manufacturer then sells 2-5 systems to your town as a way of increasing revenue collection for the cost of $0 (see, grant writers?) plus annual maintenance cost. Your town sells it as a way to crack down on drug dealers and other undesirables. The manufacturer gets about $100K in revenue at this turn.

Then the manufacturer sells professional services to integrate the camera lookup system into your town's DMV, property tax, and criminal databases. So, you're not limited to just parking tickets.

Then the manufacturer sells the use of a certified company employee as an "expert witness" in case you need someone to testify to the accuracy of the system during a court proceeding (that is a result of their surveillance technology).

Then they sell the mapping/GIS software integration at a rate of $300/mile driven for cities, and ~$80/mile driven for highway patrol/state troopers.

I seriously wish I was joking about how the game is played. *

This is what happens when you base all of your municipal revenue on inflated real estate prices/assessments and the floor disappears from under you. You go scrambling for any sort of revenue you can get.

* = I've talked to some officers and detectives in my old town, and they state that they turn the system off when riding with it, because it generates so many hits that they cannot possibly respond to each individual one. My suspicion is that its both that, and the cost per mile driven."

And someone else's follow-up to my post:

"Thanks, you gave me the perfect lead-in to explain my comment.

A lot of these will receive "grant money" from the DHS with the stipulation that the culled data is fed to the DHS for their global database.

There was a PBS Frontline on this subject about a year ago."

My small home town in Georgia has one of those. I really like the fact that they are doing a lot to take drivers that have no insurance, no licence, or registration off the road. Those people are why we pay so much for car insurance. From what I heard the local PD took out a combo 30k loan/grant to buy a set of those. They wrote enough tickets in the first week to cover it.

On the other the idea that they are logging every time, and place they see your vehicle is very disconcerting to me.

Insurance and registration are tied to the vehicle.

License is tied to the person, and I'd hope that solely recognizing the plate of a car owned by someone with a suspended, revoked or never-existing license doesn't represent probable cause to stop the car and check out the driver. I suspect some PDs probably claim it is.

Yeah I mis-spoke. it Queries by Licence Plate, I know they said it checks insurance, registration, and if the car is registered to a person that is wanted or has warrants out against them it will flag that vehicle.

I disagree. I think that is probable cause.

I don't think there should be a penalty for it, but it's definitely worth checking out.

For example, if there's a man with a suspended license and no wife or kids, it would be suspicious for his car to just be on the road.

If you own a car, and your license is suspended- what are the chances you are going to either a) loan your car to a friend or family member; b) ask a friend or family member to drive you somewhere (possibly in your own car) to get groceries/run other errands? I think the odds are pretty good.

Easy enough to clear that up when the car is pulled over.

I agree, it's fair game for probable cause. Otherwise, they couldn't pull over a car driven by bank robbers or kidnappers on the basis of its license number.

> Those people are why we pay so much for car insurance.

I don't get it. Why?

Uninsured motorist protection. i.e. you get hit by a driver with out insurance.

I don't see how this could be. Uninsured motorist protection for my wife is $22/6 months and $19/6 months for me (older car). Compare that to $130 and $120 for liability. It would seem that I am much more likely to run into someone than it is for someone who is uninsured to run into me.

Your liability coverage has to be able to cover you doing significant damage to basically anything or anyone else out there on the road (potentially something really expensive), and probably includes some coverage for you being sued by the owner of whatever you hit. In contrast, the uninsured motorist protection is not only relatively unlikely to kick in for any given incident, it only has to cover your particular vehicle, and is probably actually subsidized by the rest of your premium.

Original article: http://cironline.org/reports/license-plate-readers-let-polic...

Maine, New Jersey, and Virginia have limited the use of ALPRs, and New Hampshire has banned them outright, according to http://www.infowars.com/automated-license-plate-readers-thre...

If you drive into Manhattan your plate is scanned. Every entrance has permanent readers in place.

I read about LPRs a while ago, and since then I've noticed the cameras everywhere, all over LA. They are so much more prevalent than you think.

The hardware is cheap enough ($1000/camera) that there's no purely financial reason private interests couldn't start using them, e.g., for billboard advertising, etc. But for sure the idea is pretty scary.

UK has had these for a long time. They first appeared in the "ring of steel" around the financial district in London, and Heathrow Airport. But they've spread out across the country.

We also have a law that describes what a licence plate must look like. (https://www.gov.uk/displaying-number-plates/overview)

I have no idea what happens to the data these machines collects - there's potentially a lot of information about people's movements there.

Wow, I am actually very impressed with that Gov.uk page: it was easy to follow, clear and seemed to have the right amount of detail to cover most questions without overwhelming me. It also had links to relevant outside resources.

On top of this, it actually looks pretty good--far better than I would expect a government website to look!

and most of it is on github https://github.com/alphagov

The same technology caught Soulja Boy's car as the one who caused a hit in run a few months ago. The article goes into some of the details of how he was caught.

http://www.tmz.com/2013/05/23/soulja-boy-bentley-impounded-h...

Updated to fix link.

Steve Jobs famously re-leased his SLK every 6 months and never put plates on it -- seems like a great way to avoid this type of tracking if you're in the financial position to do so.

No need. New cars in California come without license plates. Instead, you get a temporary registration document affixed to the inside of your windshield and plates are mailed to you in a few weeks. It's your responsibility to put them on.

OR, you can simply not put the plates on and blend in with all the other new cars -- and there's no shortage of new cars in the Bay Area. Usually, the dealer has placed their own cardboard/paper license plate with their own company logo in its place. When I bought a new car, I just flipped it around so it was just plain white.

As long as your car is a late model and reasonably clean, with the registration stuck to the windshield, cops probably won't bother pulling you over. Parking tickets may still be issued from the VIN. If you are pulled over, you might get a dressing down and a fix-it ticket to put your plates on within x days. You can do this for as long as you'd like to press your luck.

The truth is even weirder: in California there is a "celebrity exemption" that allows one to drive around with no license tags at all, if one meets certain qualifications.

Apparently you do get a bar code (according to one 2005 article), so the exemption would be of no use against automated readers. It just keeps ordinary citizens from being able to identify your car.

No, this is a myth. Many manufacturers (including MB) put a tamper-proof sticker with the VIN (sometimes barcoded) on every body panel of the vehicle so that theft or replacement can be detected. One location is behind the rear license plate.

[1] http://pictures.dealer.com/m/mercedesbenzoftampa/1069/537b8d... [2] http://bimmerboard.com/members/q/original/VIN%20located%20be... [3] http://www.m3forum.net/m3forum/showpost.php?p=3856500&postco...

Hmm, I'm having trouble finding any evidence for the public figure exemption, so it sounds like you're right. They certainly don't seem to advertise it on the DMV site, at least.

They are also presently working on tracking and taking pictures of cars with missing plates. They'll still be able to figure out the model and year ranges. There might not be that many silver SLK with missing plates. They could also auto alert when a vehicle with missing plates is encountered.

I recognize that there are security implications for this sort of technology, but I think that if we used it properly, the convenience would be well worth the trade-off.

For example, in Ontario, ALPRs were used in conjunction with RFID to build a toll road that was free of toll booths in 1997. (Politics later led the toll road to be sold by the provincial government to a privately-owned European company, which has been surprisingly good at maintaining said tollway, even during winter storms.)

I see that the police patrol your neighborhood pretty often. Also, the other question to ask, if possible, is how many times they spotted stolen cars, expired plates, and "criminal" cars in your neighborhood? With that data, I think it could help police track down burglaries faster. After a while, the cars that case the neighborhood will stand out with a few records, whereas the resident cars will have many records.

"After a while, the cars that case the neighborhood will stand out with a few records, whereas the resident cars will have many records."

Along with all the cars that are just visiting friends in the neighborhood, &c. I'm not saying it couldn't be useful, but it should be treated with care.

I'm conflicted about license-plate cameras. On one hand, I think there is definitely the privacy risk. On the other hand, if we had speeding cameras everywhere (like in say Sydney), we'd have a lot less need for traffic cops and all of the abuse that comes from them.

The cameras are operated by cops. Therefore there is still abuse.

He's talking about a different kind of abuse: when police actually pull you over, they can troll for additional offenses, for instance by having a drug dog false your car.

You can't drive onto Manhattan without being read by one of these.

Bicycle license plates? The Dutch still use them? Anywhere in the US?

Boats? Yes:

Every vessel in Puget Sound, Washington State, is tracked with cameras and radar. We see two stereo cameras mounted on top of the channel marker from Rich Passage at south end of Agate Pass.

I've read this is now all part of the USCG-Coast Guard, the NW is in District 14(?).

What's to stop individuals or companies from using the same tech to collect data? After all, what you do in public is public, and private detectives are allowed to follow and film their targets in public to show their clients and use in court.

In my city there's a very big department store (El Corte Inglés, if you're curious) which uses this technology in their entrance/exit. They've been doing this for years, and it's obvious they're collecting customer data.

There are very good reasons for some businesses to use ALPR technology. EasyPass and other automatic toll-collection schemes use RFID tags on cars to uniquely identify them. There are parking-lot control systems that use RFID tags to allow access to paid parking lots. ICS, the largest vendor of car wash management systems, sells an RFID subscription package. One of their tags is on my car's windshield: http://www.icscarwashsystems.com/index.php?product=17

ALPR has some technical and business advantages over RFID. The RFID car-identification solution has been around over ten years; ALPR wasn't as effective then. If it has been, we'd probably have ALPR toll-collection systems instead of RFID.

I hope this pushback against ALPR won't extend to private uses of it for reasonable and limited purposes.

We _do_ have ALPR toll systems, at least here in California. You can leave your Fastrak RFID in your kitchen drawer forever, as long as you associate your license plates with your Fastrak account.

Nice. I didn't know that. I wonder when they started that? https://www.bayareafastrak.org/vector/dynamic/signup/VTconfi...

Illinois' tollways use cameras (and RFID) as well, but yes, you could leave the pass behind and it'd all work without issue.

Reply on news.ycombinator.com