newsrackblog.com

Last month I happened to open an email on a neighborhood listserv I follow.  It was a Takoma Park Police Department press release titled “Takoma Park Police to Acquire License Plate Recognition Scanner.”  The announcement was as follows:

Chief Ricucci is pleased to announce that the Takoma Park Police Department has been granted funding in FY2009, through the Governor’s Office of Crime Control & Prevention (GOCCP), for a “License Plate Recognition Scanner (LETC).”

LETC is attached to a police cruiser. It works by capturing digital license plate images as they pass a camera, whether mobile or fixed. The plates are automatically cross-checked in real time against multiple local, regional, statewide and, if appropriate, national databases to identify vehicles that are of interest to the authorities. In fact, LETC can access multiple databases simultaneously and report not only matches but which database contained the vehicle of interest. Vehicle matches are reported instantly, allowing the officer to take appropriate action. [...]

Research has shown that patrol officers equipped with the technology can have arrest rates significantly higher than officers working without it. This will deliver reductions in crime, enhanced community safety and safer roads.”

It turns out that “LETC” is not a technical acronym, but merely a funding source — it stands for “Law Enforcement and Corrections Tech Center” (and is therefore sometimes abbreviated LECTC), which is a federal funding mechanism (via the Department of Justice) for law enforcement technology grants such as this one.  The Maryland Governor’s Office of Crime Control & Prevention (GOCCP) receives LETC funds and disburses them to grant applicants deemed worthy of support; I’ll return to that in a moment.

This kind of program is something security expert Bruce Schneier calls “wholesale surveillance,” and it’s spreading fast.  Possibly the best known example is New York City’s “Operation Sentinel” scanning license plates coming into Manhattan via bridges and tunnels; in August 2008, WJZ (Baltimore) reported that a $4.5 million Homeland Security grant will pay for about 200 of the devices (either fixed or in squad cars) in the Maryland/DC area.

Obviously there are benefits to being able to automatically detect that a car is stolen, or that its owner is wanted for arrest.  But are the costs being counted as well?  As Schneier wrote in a seminal op-ed for the New Haven Register in 2004 (”City Cops’ Scanner is License to Snoop“; emphases added):

Wholesale surveillance is fast becoming the norm. New York’s E-Z Pass tracks cars at tunnels and bridges with tolls. We can all be tracked by our cell phones. Our purchases are tracked by banks and credit card companies, our telephone calls by phone companies, our Internet surfing habits by Web site operators. Security cameras are everywhere. If they wanted, the police could take the database of vehicles outfitted with the OnStar tracking system, and immediately locate all of those New Haven cars.

Like the license-plate scanners, the electronic footprints we leave everywhere can be automatically correlated with databases. The data can be stored forever, allowing police to conduct surveillance backwards in time.

The effects of wholesale surveillance on privacy and civil liberties is profound; but unfortunately, the debate often gets mischaracterized as a question about how much privacy we need to give up in order to be secure. This is wrong. It’s obvious that we are all safer when the police can use all techniques at their disposal. What we need are corresponding mechanisms to prevent abuse, and that don’t place an unreasonable burden on the innocent.

Returning to the Takoma Park Police Department press release, it seems Schneier was on to something:

Every license plate is compared to a list of “vehicles of interest” associated with auto theft, felony warrants, “Be on the Lookouts,” parking violations, or any other license plate-oriented databases, such as Amber Alerts, National Crime Information Center (NCIC) downloads, etc., the police agency wishes to use. By reviewing historical plate reads, information such as a list of all vehicles recorded in an area of interest during a specific period of time can be created. Patterns of movement can also be obtained, enabling a crime analyst, for example, to provide a possible starting point for finding a suspect vehicle.

Generally, between 50,000 and 60,000 plate reads equal one gigabyte of hard drive space. With storage being relatively inexpensive, tens of millions of plate reads can be maintained on a standard hard drive.

After corresponding with the public affairs officer, I was assured that Takoma Park police don’t intend to keep records (“We will not keep any information on vehicles that are scanned”).  But (a) that’s not what the press release sounded like, and (b) at any rate, there’s an interaction component to license plate scanner systems: the license plates need to be checked against “vehicles of interest” databases. Community control and privacy of the Takoma Park license plate data would depend in part on how and where that query takes place — on Takoma Park police premises, using downloaded “vehicle of interest” data, or elsewhere, using uploaded Takoma Park scanner data.

“What exactly are you worried about?”
When I talked about it with a neighbor, he asked “what exactly are you worried about?”  It’s a fair question, and I confess there’s an element of instinctive dislike that I couldn’t immediately explain. Since then, I’ve identified a few reasons.  For one thing, my anonymity is gone; we don’t have license plates with our name and address on them, but we might as well with this technology.  More importantly, perhaps, I’ve been searched for no reason, and at a time and place not requiring it: as a police car drives past mine on my way to the supermarket, a device checks whether I’m a criminal or scofflaw.

But there’s more to it than that.  Thinking about it some more, for the system to have some of the utilities advertised, the query would necessarily reveal — to the second — when the license plate was encountered; most systems are probably also like the “PIPS Technology” system (described in a Portland Tribune story) in recording the location of the car (by GPS).  Though that might not always be part of a “query string” sent by radio to database servers, it might also be a routine feature of many systems.

Imagine — speaking purely hypothetically, of course — that a rogue NSA warrantless surveillance operation learned that cell phone user 240-123-4567 had a car with Maryland license plate AB12345.  Thanks to Takoma Park police license plate scanning, they could also quickly learn that said car often parked near a storefront at the intersection of Cedar and Eastern Avenue on Monday evenings 14 months ago — which, the NSA is reliably informed by the Maryland State Police, was a meeting place and time for numerous suspected terrorists.

That sounds like a perfect “24″ plot –  until it turns out that the “terrorist” is a nun, the meetings are about opposing the death penalty, and the Maryland State Police involved are a bunch of knuckleheads.  Said nun, now spreadeagled on her living room floor with a helicopter overhead, flashing police car lights outside, and a SWAT team crashing through the house, might wish that Takoma Park police had not been part of the surveillance process that put her reputation and liberties in danger.

That last sentence is fiction… so far.  The rest, unfortunately, is not; too much of this scenario has already taken place — NSA warrantless surveillance, Maryland State Police misjudgments, nuns, death penalty activists, and environmentalists surveilled — for anyone to feel confident the rest could not.

So issues include…

• minimizing data sent to the rest of the world,
• the length of time data is stored, and
• the proper, judicially warranted initial use and secondary reuse of such data.

And that’s only the beginning:

• How would the equal application of license plate scanning throughout Takoma Park be assured?
• How would inevitable errors be handled and corrected?
• Would scanner use be covert or would the police car using it be distinctively marked?
• Could (or should) owners of scanned license plates be informed of the time and place of scanning?
• How would possible misuse be sanctioned?

There are probably more.

Model guidelines and legislation to prevent abuse
In the LETC grant application on the GOCCP web site, LETC goals are stated to include:

• Enhancing data information-sharing capacity within every region in Maryland.
• Promoting effective partnerships for information sharing among government and law enforcement entities.

That’s reasonable, as far as it goes.

But to repeat Schneier’s words, we also need “corresponding mechanisms to prevent abuse, and that don’t place an unreasonable burden on the innocent.” It may be time that local and state legislators give some thought to enhancing liberty- and privacy-preserving capacity within every region in Maryland.  It may be time to promote partnerships with other law enforcement agencies that aren’t just about sharing data, but are also about taking steps to minimize how much data is shared, how that shared data may be used, and how much is stored for how long by anybody seeing that data.

The good news is that the system hasn’t actually been purchased yet, so there’s some time to at least think about and possibly set some guidelines for its use — or even to decide not to get it. So I’ve been looking around for suggested best practices and model legislation about this issue, and while the match I’ve found isn’t perfect, it’s very good.

In 2007, the Constitution Project published “Guidelines for Public Video Surveillance” (PDF, 104 pages) and I think many of the principles and (extensive) model legislation they propose can be adapted to license plate scanning.  I’ll excerpt some of the guidelines enumerated in section III of the document (pp. 14-36); readers can decide for themselves whether substituting “license plate scanning” for “public video surveillance system” works.  I think it usually does:

• Create a public video surveillance system only to further a clearly articulated law enforcement purpose. (p. 14)
• Design the scope and capabilities of a public video surveillance system to minimize its negative impact on constitutional rights and values. (p. 19)
  
• Create technological and administrative safeguards to reduce the potential for misuse and abuse of the system. (p. 20)
  
• For permanent or long-term public video surveillance systems, conduct a civil liberties impact assessment and overall cost-benefit analysis. (p. 21)
• Under most circumstances, individuals may be “tracked” or “identified” by a public video surveillance system only pursuant to a warrant. (p. 27)
• Law enforcement must obtain a warrant for secondary use of “archival” stored video surveillance footage. (p. 30)

All emphases added.  Much of the above discussion assumes license plate scanning will be adopted in the end, though hopefully with some controls and oversight imposed.  Still, I should point out license plate scanning does appear to fail at least one of the proposed guidelines:

• Create permanent public video surveillance systems only to address serious threats to public safety that are of indefinite duration. (p. 16)

…i.e., terrorism, as the authors specify.  That does not seem to be the likely use and purpose in a town like Takoma Park, and we are well within our rights to question whether to voluntarily contribute to a pervasive “Surveillance State” around us.  That’s why some of the most important Constitution Project guidelines are those recommending community input.  As a Privacy International summary points out:

Among other things, the Constitution Project suggests a community should perform an open review process before installing [such a system], such a system should only be used for a clearly articulated law enforcement purpose, detailed rules should be written governing the use of cameras and retention of their data, and the systems should be designed, from the beginning, to minimize privacy and civil liberty risks.

I hope Takoma Park will be able to do just that.