Data Brokers Are Now Selling Your Car's Location For $10 Online | Hacker News Reader

Data Brokers Are Now Selling Your Car's Location For $10 Online

forbes.com

131 pointsbigiain53 comments

This is nothing compared to what cops are putting together, gathering data from all their tag reader cameras including ones monitoring popular roads and ones attached to police cars. And aggregating it at regional "fusion centers".

http://cironline.org/reports/license-plate-readers-let-polic...

That's a great/terrifying link.

I'd love to know the justification the city of San Leandro use to explain why they're keeping photographic records of cars, owners, and their families - and just how uptight the police/city-officials would be if I took photos of them and their families in their driveways at the rate of "1000s every eight hours"…

Devil's advocate: Why would they need justification to at least keep records of where your licence plate has been in public? What expectation of privacy do you have?

As elsewhere, the expectation of "just another face in the crowd" pseudo-privacy.

When we (as a society, by which I mean my grandparents parents) agreed to have "unique identifiers" prominently displayed on vehicles we own, the reasoning behind that decision was based on a different reality.

This is _very much_ scope-creep - without anyone affected being asked whether it's OK.

If there was a proposal to have police all stop 1000 people per shift to check and record their ID, people and civil liberty groups would be up in arms (perhaps literally).

Is this _very_ much different? Shouldn't we at least have had a discussion about it before rolling it out without letting anybody know what was going on?

Does "just another face in the crowd" pseudo-privacy have any legal precedent?

I'm not entirely sure what the US constitution says about a reasonable expectation of privacy, but I certainly have to wonder what the authors of it would have changed, had they envisioned a society in which the government could constantly, reliably, and ubiquitously surveil its' citizens.

That is, perhaps we shouldn't have an expectation of privacy in public, but for a long time, we had a reasonable expectation of relative anonymity, at least, the average person did.

Given the abuses we've seen throughout history (not just now), why on earth would I want the government to be able to know exactly where I am at any given time? If they think I've committed some crime let them use the normal protocols. Otherwise they need to fuck off.

"Of five cars that I looked up, three cars turned up nothing, but I found data on the other two.

"One car had a single sighting: it was parked on Manhattan’s Upper West Side at 12:40 in the morning last December."

This squares with my use of databases sold to lawyers, doing look-ups on myself and close family members. The databases are much less impressive in their power than salesmen suggest. I'm not worried about this. I won't be worried about this, and eventually when most cars are self-driving and many cars are paid for by the use and ridden by many different passengers, license plate recognition will be less informative than ever.

To be sure, aggregating a whole lot of data can add up in its impact. MIT has developed a tool with which you can analyze all of your own Gmail metadata

https://immersion.media.mit.edu/

(I learned about this from a submission to HN from ColinWright, which alas received little discussion here), and I found out from that tool that my use of email is more business-related than I realized: all of the top seven "collaborators" (that program's term) that I have are actual work colleagues, as well as personal friends. A megabyte here, a megabyte there, and pretty soon all the data turn into information. But really the victims here often enough will be the chump clients who pay for license plate record searches and don't find out anything worthwhile.

eventually when most cars are self-driving and many cars are paid for by the use and ridden by many different passengers, license plate recognition will be less informative than ever

Except that then they'll have credit cards matched to continuous GPS data.

Time to find a bitcoin car-share.

To your last point, my gmail reflected the same thing, but I think the cause is that immersion seems to analyze the number of emails for each person.

To get something small done for work purposes requires 10 emails. For personal stuff, it seems to require just a few.

"I won't be worried about this, and eventually when most cars are self-driving and many cars are paid for by the use and ridden by many different passengers, license plate recognition will be less informative than ever."

Just pair it with cell phone meta-data, and you'll know exactly who's inside each vehicle.

Is this the same company that owns all the speeding and red light cameras? If so, what a brilliant way to further monetize their monopoly. "Public safety", indeed.

(One thing I like about riding a bicycle is that you are mostly anonymous, and nobody is going to show up with a picture of you running a red light a couple months later. Of course, once these companies start doing facial recognition based on pictures of you tagged by your friends on social networks...)

The data is collected from cameras attached to tow trucks. The people who source the data will come out and install it for free, and a laptop inside the cabin makes a noise and automatically prints out a repossession order if it finds a car on the repo list. They get a cut of the finders fee from the finance company who underwrote the delinquent car loan. (and from this article it sounds like they sell the data to law enforcement and lawyers now too)

I suspect thats why the hits he was able to find were from parking lots. Previous to the automated system repo guys would troll parking lots with a hot sheet of plate numbers looking for hits.

Two years ago in my E & M lab, one of my profs was showing off on of his research projects into materials with negative permeability and negative permittivity… it started to make me think about if people could have clothes(or objects) and spray a lining of these type of materials on them, it could render them "invisible" to traditional optics… Isn't the military doing research like this too? I know they work close with academia as well…

There has been license plate blocking technology for sale for quite some time now, which is definitely more low-tech than James Bond style license plate changers.

http://www.phantomplate.com/photoblocker.html

Mythbusters had worse luck than the local media at your link:

http://dsc.discovery.com/tv-shows/mythbusters/mythbusters-da...

It's too bad current vehicle codes forbid you from obscuring your plate at all at any time, this makes it illegal to hide your identity from would be data collectors, which makes protecting yourself very difficult. I suppose you could just go without plates like Steve Jobs did and pay the fix-it tickets you end up getting.

Personally, I tend to forget to pay my registration for a solid 6 months before I finally get pulled over for it every year, and it costs me about $35 extra, so if this becomes pervasive, it might be worth considering losing the plates. I'm willing to bet that some officers would even be slightly sympathetic if you explained your reasoning, not that they wouldn't still give you a ticket, but maybe.

>I suppose you could just go without plates like Steve Jobs did and pay the fix-it tickets you end up getting.

A minor note, but he never paid any fix-it tickets. IIRC, there's a clause in California's vehicle laws that gives you up to 6 months from the date of purchase to affix plates to a vehicle (although it must still be registered).

Jobs just traded in his MB S500 every 6 months for a new one to avoid ever having to put plates on. It's not exactly feasible for the non-billionaires among us.

I keep hearing this near-urban legend about him trading cars in frequently (even citing a former Apple security guy), but I'm pretty sure it's not true.

You're correct about the plates, but it's 90 days. However, in the Bay Area, there are so many new vehicles that there's no reason to think that a reasonably shiny late-model car isn't within that 90 day period. I drove my new car up and down CA-101 for almost a year without bothering to put them on. You can press your luck for as long as you'd like. The fix-it ticket is a bit of a hassle since you need to find a cop to sign you off. Or you can just pay the significantly higher fine (several hundred I think).

Also, for a man who parked in any open handicapped space in the parking lot whenever he wanted, I'm pretty sure he didn't care much about staying strictly within the law.

One additional point worth noting that the MB SL55 he drove was last produced in 2006. Yet, here's a photo of his car in 2010 -- an SL55: http://gizmodo.com/5503004/steve-jobs-and-eric-schmidt-spott.... Surely he would have traded up to an SL65 if he bought a car from 2006 onward?

The mainstream news reported on this: http://abcnews.go.com/Technology/steve-jobs-car-apple-ceo-li...

While it is claimed that he rotated similar leased vehicles, if we were to look up the VIN (WDBSK72F67F124082), we would find that it was registered as a personal vehicle with only one owner for a number of years.

http://blog.peschfamily.com/2011/08/steve-jobs.html

You may very well be right. The story certainly has the air of one of the fetishistic tales told about him following his death.

Not just following his death...before it too.

Ah yeah, I think you are correct, very clever. I still think that going with the fix-it ticket route would be feasible for the normal folks. Though I am not sure if they end up raising the price if you repeatedly get the same fix-it ticket, that might be a problem.

"Strategies" that involve throwing around lots of money, like buying a new car every 6 months, never seem that clever to me.

It depends on what you are optimizing for. In his case, I presume it was privacy.

I live in LA, and I see cars without plates every day, often multiple times a day. When I do, I habitually check for temporary tags. They never, ever have them. It's bizarre--you'd think that driving without plates would be a guaranteed way to get yourself pulled over constantly. How does this work?

If getting yourself surveilled by private parties due to your visible license plate becomes a thing, I can see the temptation for people to start removing them in protest.

New cars in CA get registrations folded up and affixed to the front windshield [1]. You get your plates in the mail in a couple of weeks and it's up to you to put them on within 90 days of purchase.

[1] http://www.bimmerfest.com/forums/showpost.php?s=27de0586326d...

That's what I look for, and on every single car driving without plates (that I've seen for years now) it's not there.

It's entirely likely they're not licensed drivers, and that the vehicle isn't registered, and never will be. California seems to semi-intentionally not enforce registration/licenses for political reasons.

There are products designed to obscure license plates from mounted cameras while still being visible in most circumstances. I can't vouch for their effectiveness, though, and Mythbusters didn't have any success when they tested some in 2007.

http://www.buyradardetectors.com/blog/2009/03/the_great_lice...

I wonder if there are other methods that could be used just to break automatic OCR?

I thought I saw a post here of a company making an anti-flash system for license plates but it might only work with the big bright flashes on red light cameras...

It basically blasted a lot of IR light to obscure the image whenever it sensed a flash going off.

Some of the products tested on Mythbusters were able to partially obscure the plates. The issue was that it was easy to find the full plate from a partial when you have the DMV database behind you (and a photo which gives you things like color, make and model). Seems like obscuring might be enough to make this a non-starter for private companies though.

I've heard from a person who works in the civilian section of the traffic enforcement - that while some of the products/tactics being used to obscure plates work against the automated numberplate reading software, that he's never seen one that wouldn't be obvious enough from visial instection, fail for a human operator with a photoshop-like image tweaking interface - he says they can _always_ get enough of a plate to match up with vehicle make/model/colour details.

He says the only thing he sees that "works" is flip-up plate holders on motorcycles - and that when they see them, the photos get distributed to the local police who the have a "vehicle of interest" notice for that make/model/colour bike (and jacket/helmet).

I'm not sure how kindly the law would look at you using the plate obscuring products, but these products could be a privacy measure if they are ineffective against law enforcement. The idea being once there is a human involved, the cost goes up. This would drive up the minimum price that these private companies could sell their services for.

But there has never been any expectation of privacy when in public. Especially when it comes to something regulated like driving a car. Should there be some change in the law now forbidding collecting licence plate data because it is easier to do en-masse?

"But there has never been any expectation of privacy when in public."

There's been an assumption about "just another face in the crowd" pseudo-privacy though.

"Should there be some change in the law now forbidding collecting licence plate data because it is easier to do en-masse?"

Yeah, I think there should. There's a fundamental difference between law enforcement (or even commercial businesses) being able to target specific people or locations to do time-limited licence plate collection - and this new "record everything and archive it all forever" surveillance capability.

I don't claim to "know for sure that everybody considers it wrong", but I do claim that so far nobody has asked if I think it's OK. There are examples of industries that have tight regulation over the privacy-relevant data they collect and store (medical, financial, childcare are a few I've bumped into) - we should at least have the discussion about whether people involved in widespread collection of vehicle location/time data should have HIPPA/PCI type regulation of that practice, and some well known (and enforced) repercussions for mis-using that data.

That's the question, isn't it? LE uses facial recognition to scan crowds. Now cars are tracked, not using GPS, an observing officer, or a member of the public (who may need to report a crime), but by snarfing video of all the license plates with a geolocated camera, timestamping and OCRing them, and storing the resulting information.

The next thing that pops into my head is the fingerprint. Not because it's "easy" to get, but you also have no reasonable expectation of privacy with them.

Imagine the embarrassment when "no two fingerprints are alike" is finally disproven as some poor bastard is arrested and charged with a crime committed by another person solely on the basis of his thumbprint.

It doesn't seem to embarrass prosecutors too much when they jail someone for five months based on "conclusive DNA evidence" - even though the suspect was in hospital with a blood alcohol reading on 0.4 from two hours before the crime to 12 hours afterwards. And who'd been take to hospital by the same ambulance crew that attended the crime later on and moved the victim… You can see where this is going right? - "The paramedics physically moved both Anderson and Kumra, resulting in the inadvertent DNA transfer…"

How on earth can someone end up in jail for five months under those circumstances?

(Note too, the other suspect jailed for seven months - for, several months before the killing, posting a photo of the future-victim's house to Instagram…)

http://wrongfulconvictionsblog.org/2013/06/28/how-innocent-m...

Not quite charged, but held for two weeks and only released when someone without an alibi of being on the other side of the planet was found to also have matching prints...

http://articles.latimes.com/2004/may/21/nation/na-mayfield21

When you hear diplomats and intelligence types on radio interviews, as I have in the past week, talking of never having sensitive conversations in private homes or hotel rooms, but instead going outdoors where audio surveillance is difficult, the whole "expectation of privacy" gets turned on its head.

The law may not recognize this (though I suspect that's a tad fuzzy). Spycraft most certainly does.

I know we're in different jurisdictions, but if I haven't paid my registration, I'm uninsured.

Please don't be that uninsured driver…

In California, the reverse is true. Your registration becomes revoked when your insurance expires, not the other way around. I am still insured since I pay a private party for coverage and the vehicle code here doesn't have the power to revoke that contract.

Forget the cars. How long before people accept discounts on Google glass (or similar) in exchange for continuously running face recognition software and streaming the information back to some company providing a similar service where you can look up people instead of cars?

"User #129334, we have detected a person of interest in your field of view. A client would like Enhanced Position Information (TM) on this individual. Nod if you agree to keep him in sight for the next hour and receive a month of free cable!"

For a long time we've enjoyed the goods arising from the fact that technology can rarely be stopped. I have a feeling we'll see some awful things in the coming decade... It unsettles me greatly that I have this newfound fear or technology, but I really do.

It's a done deal: everywhere your car with a license plate goes is and will be tracked, and stored forever.

It's already happening, it is already cheap, and there's no way to stop it short of a massive swell of public support for enacting laws to limit it -- in the USA, that seems very unlikely.

What I think is important to extrapolate from this stuff is that everything we can do with license plate recognition now will soon be doable with facial recognition.

Tracking everywhere your car has been and storing the record forever is one thing. It's very hard to imagine that tracking everywhere your face has been isn't the next step.

So who is actually going around photographing the cars? Do they have regular employees, fixed cameras, or do people just turn in photographs for small change?

Repo men.

There is at least one company that works with repo men - they put ANPR cameras on the repo men's dashboards, it records every plate that comes into view and uploads it in near real-time to a central databases along with gps info. Any repo man who subscribes to the service can put out an alert for a plate, once that plate of interest shows up in the central database they get a text message telling then when and where it was scanned. When I first heard about these guys a few years ago they already had a very large number of repomen participating in the service.

I am not surprised to hear that the companies have expanded their market beyond repomen, that is the nature of databases - once you've got the data centralized all kinds of ideas come up for how to exploit it.

And all of this is legal? Does this mean anyone can put up a camera on his dashboard, roof and capture these info?

Yes, in the US, the current state of the law is that anything done in public is fair game for anyone - there is no expectation of privacy when in public.

However, this point of law was determined back in the late 60's or early 70's, back when the concept of an indexed database of millions of permanent records of essentially everybody in public was barely even the stuff of science fiction, much less everyday fact. I think we are long overdue for a revaluation of the legal situation given the drastic change in circumstances of the last 40 years.

Life begins to suck more every day, soon everyone will know everything about all of us. I wonder what an open source life will be like.

Agree about the sucking part. But IMO the problem is not that everyone will know everything about everyone. That would be weird (utopian?) but kind of fair.

The fear is about the rich and privileged knowing everything about the poor and underprivileged (using databases that are expensive, protected by IP laws, and/or require clearance), and opaqueness the other way around. Information as a means of control.

Well, I have a seemingly infinite world of information at my disposal already. And I spend most of my free time reading HN. I don't think it will be that big of a deal. Most people will just willingly choose not to invade your privacy even if no one would find out if they did (besides, who's to say I don't start a database of people who look at databases of this private info?). Anyhow, I should cruise wikipedia more.

Reply on news.ycombinator.com