Jody Westby, CEO, Global Cyber Risk
Those teams, she said, “are often very reluctant to turn the maintenance of these systems over to the IT staff,” which is a prime cause of security flaws. Those problems are almost inevitable, she said, with the, “deployment of sophisticated surveillance technologies by departments without the expertise or resources to manage privacy and security risks.”
Even if security concerns are addressed, however, EFF argues that the current use of ALPRs amounts to “a form of mass surveillance.”
The stated purpose of the camera systems is to aid law enforcement in investigations: If the plate matches a number on a so-called “hot list” – where the owner is wanted for anything from an unpaid parking ticket to a probation violation to a felony, or is connected to an AMBER alert or any kind of a gang or terrorist watch list – then the system notifies police or other agencies.
But most ALPR systems collect and store data on every vehicle they scan – they do not discard information on plates that don’t match the hot list. And in many cases, the data is held for years.
“Depending on how much data has been collected, this information in aggregate can reveal all sorts of personal information, including what doctors you visit, what protests you attend, and where you work, shop, worship, and sleep at night,” EFF said.
And when EFF and the American Civil Liberties Union (ACLU) filed a public records request for ALPR data to the Los Angeles Police Department and Los Angeles County Sheriff’s Office, “the agencies refused to hand over the data, citing a provision in California law that allows them to withhold investigative records. Who are they investigating? The answer: all cars in California,” the EFF said.
The ACLU and EFF then sued to compel the release of the data, but lost at both the Superior Court and Appeals Court level, where the courts ruled that even though the large majority of the data collected by the camera systems was on innocent motorists, it still qualified as investigatory material, and therefore not subject to public disclosure.
The case went before the California Supreme Court on Oct. 26. Lynch said the briefs from the city and county are due Jan. 25.
But even if the privacy advocates win, the reality remains that there is little oversight or regulation of ALPR data collection.
According to the National Conference of State Legislatures, only 10 states have laws putting limits on the collection, storage and use of ALPR data – Arkansas, California, Colorado, Florida, Maine, Maryland, New Hampshire, Tennessee, Utah and Vermont.
Sign up for Computerworld eNewsletters.