Towing companies are a necessary evil when it comes to parking enforcement and property repossession. But in the Google Earth we now inhabit, tow trucks do more than just yank cars out of loading zones. They use license-plate readers (LPRs) to assemble a detailed profile of where your car will be and when. That’s an unnecessary evil.
Plate readers have long been a tool of law enforcement, and police officers swear by them for tracking stolen cars and apprehending dangerous criminals. But private companies, such as repo crews, also photograph millions of plates a day, with scanners mounted on tow trucks and even on purpose-built camera cars whose sole mission is to drive around and collect plate scans. Each scan is GPS-tagged and stamped with the date and time, feeding a massive data trove to any law-enforcement agency—or government-approved private industry—willing to pay for it.
You’ve probably been tagged at the office, at a mall, or even in your own driveway. And the companies that sell specialized monitoring software that assembles all these sightings into a reliable profile stand to profit hugely. Brian Hauss, a legal fellow for the American Civil Liberties Union (ACLU), says: “The whole point is so you can figure out somebody’s long-term location. Unless there are limits on how those transactions can be processed, I think it’s just a matter of time until there are significant privacy violations, if they haven’t already occurred.”
(How Is This Even Legal? License-plate-reader companies don’t have access to DMV registrations, so while they can track your car, they don’t know it’s yours. That information is guarded by the Driver’s Privacy Protection Act of 1994, which keeps your name, address, and driving history from public view. Mostly. There are plenty of exceptions, including for insurance companies and private investigators. LPR companies say only two groups can use its software to find the person behind the plate: law-enforcement agencies and repossession companies. In addition, the encrypted databases keep a log of each plate search and allow the ability to restrict access.)
The companies that push plate readers enjoy unregulated autonomy in most states. Vigilant Solutions of California and its partner, Texas-based Digital Recognition Network, boast at least 2 billion license-plate scans since starting the country’s largest private license-plate database, the National Vehicle Location Service, in 2009.
In total, there are at least 3 billion license-plate photos in private databases. Since many are duplicates and never deleted, analytics can paint a vivid picture of any motorist. Predicting where and when someone will drive is relatively easy; software can sort how many times a car is spotted in a certain area and, when fed enough data, can generate a person’s driving history over time.
And the systems are getting smarter quickly. Vigilant alone adds 100 million photos every month, but company marketing vice president Brian Shockley says the word “tracking” is misleading. LPRs, he says, capture “momentary, point-in-time” information. “LPR is never a smoking gun,” says Shockley. “Just because a car is somewhere doesn’t mean the registered owner is with the car.” And yet, Digital Recognition Network’s website says of its services, “Owners are typically within 1000 feet of the vehicle, so find the vehicle and you find the customer.”
Scott Jackson, CEO of data provider MVTrac, contends that license-plate readers just automate what police officers and repo men have always done—run plates by eye—and that most Americans have accepted that the days of having true privacy are gone. “The pros of this technology far, far outweigh the fear factor of privacy,” he says, referring to its successful police busts. “There are so many ways to track a person; this is not the one you should be worried about.”
Hauss of the ACLU disagrees. He asks, “Is it just so you can have a giant haystack that you can search whenever you want, for whatever purpose you want?”
Paul Kulas, president of Colorado-based BellesLink, which sells verification software to repo companies, says his industry needs to face these public concerns before it’s “lumped in with the surveillance state.” Some privacy statements by plate-reader companies, he says, have been misleading.
Kulas believes that the idea that LPR data cannot be linked to personal information is inaccurate. “Without regulation and without foresight,” he says, “this could get to a point where numerous lawsuits could be brought against lenders and camera companies because they have, in effect, obtained our location information without our permission.”
As ominous as their private-sector deployment is, LPRs have incited controversy with their law-enforcement usage as well. In December 2013, the city of Boston suspended its LPR program after police accidentally revealed DMV-tied information from its cameras to the Boston Globe. While that one incident highlighted failings in the department’s data policy, plenty of agencies don’t even have such a thing. Some keep data for days, others for years. In most states, police can monitor you with LPRs without serving a search warrant or court order. And this February, a Department of Homeland Security proposal for a privately hosted federal plate-tracking system was scrapped days after theWashington Post exposed it.
Last year, police in Tempe, Arizona, refused an offer from Vigilant for free LPR cameras. The catch: Every month, officers would have to serve 25 warrants from a list supplied by Vigilant. Miss the quota, lose the cameras. Such lists, according to the Los Angeles Times investigation that uncovered the offer, commonly come from debt-collector “warrants” against drivers with unpaid municipal fines.
Eventually, police and repo men might not be the only customers buying LPR data. MVTrac recently completed a beta test that tracked Acuras at specific areas and times, logging info including the exact models and colors. That information, far more real-time than state-registration data, could be gold to automakers, marketers, and insurance companies.
There has been pushback. Nine states have passed LPR laws, and four of those states bar private companies such as Vigilant from operating or selling their wares [see map, above]. Some of those states limit usage to legitimate investigations by police and traffic agencies. And some set standards for data security and establish formal processes (such as requiring warrants) and public audits.
In 2007, New Hampshire was the first to ban LPRs completely except for toll collections and security on certain bridges. Maine answered in 2009 with a less restrictive law, followed by California, Arkansas, Utah, Vermont, Florida, Tennessee, and Maryland. In Utah, legislators banned private companies from using LPRs but amended the law after Vigilant and Digital Recognition Network sued the state, claiming the ban violated their First Amendment rights to public photography and free speech. After helping to kill a similar bill in California this past May, the companies are now suing Arkansas, which followed Utah’s original letter in restricting LPRs to police use. At least nine states have pending bills that regulate plate readers.
As with many technologies, license-plate readers are advancing at a rate that is outpacing legislation. Smaller cameras; smartphone apps that can pick out plates from live video; and the potential fusion of public records, DMV databases, and facial-recognition software are already on the horizon. Because police ostensibly use LPRs for public safety, drivers will likely have to accept some erosion of their privacy behind the wheel. But when corporations start buying tracking data in the name of “customer focus” and lawmakers look the other way, we say it’s time to bring on the James Bond–style plate flippers.
