Why Won't Cops Share the License Plate Data They Collect?

A report released this week by the ACLU explores the widespread deployment of automatic license plate recognition (ALPR) scanners by law enforcement across the country. As police tout the advantages of ALPR and seek millions in federal funds to the equipment, many departments insist that license plate and vehicle location information don't require special protection or oversight.

Until you ask for the data.

ALPR scanners take photos of passing license plates and compare them against "hotlists"—databases of stolen, wanted, or scofflaw vehicles, or any list of vehicles drawn up by the industrious user. These readers are capable of scanning as many as 1,800 plates per minute, according to manufacturer specs. Although in the field these stats are doubtless much lower, law enforcement are able to scan thousands of plates in a single shift. (On my own ridealong with an ALPR-equipped squad car, the traffic officer ran 786 plates in an hour just driving around side streets of Chelsea, Mass.)

These scanners are already widely deployed, and proliferating fast. One manufacturer, ELSAG, claims its system is in place by at least 1,000 departments in all 50 states.

Indefinite retention for imaginative purposes

The kicker for privacy advocates is that ALPR scanners don't just record the date, time and GPS location for vehicles that register a hit against their databases. In most departments across the country, license plate scanners gobble up and store location data for each and every vehicle that passes. And, according to the ACLU's survey, many departments hold onto this data for 90 days, a year, 5 years or even indefinitely.

This information could prove incredibly useful to some very legitimate law enforcement purposes. Dead-end arson case? Check the ALPR database for all plates in the vicinity around the time the blaze was set. Flasher on the prowl at your mid-size university? Put in a call to nearby departments to verify whether the suspect's car was scanned along particular roads.

But what about the flipside? ALPR data allows law enforcement a detailed record of a person's movements even without any probable cause for investigation. Beyond hypothetical abuses such as a wayward cop using the database to check up on a former flame, ALPR has already been implicated in NYPD's surveillance program of the Muslim community in New York and New Jersey. According to the Associated Press, unmarked cars outfitted with license plate scanners patrolled the streets around particular mosques, recording the vehicles of all in attendance.

As one ill-worded memo from the police in Scarsdale put it, the potential uses for license plate readers "is only limited by the officer's imagination."

Don't take it personally

Law enforcement rebut Big Brother accusations by pointing out that license plate scanners augment and accelerate a capacity cops have always had, in that patrol officers have always been able to write down plates from suspicious vehicles and check vehicle history.

When pressed to put special protections on their massive license plate databases, the law enforcement community writ large argues that license plate numbers are not personally identifiable information (PII), and thus not subject to restricted access or probable cause requirements for detectives to paw through it. A legal category of data that varies from one jurisdiction to the next, PII is most generically defined in a plain-text way: information that identifies an individual.

Now, try as they might, police are unable to see how the license plate on your car falls into the PII category. In its 2012 guidelines on ALPR, the International Association of Chiefs of Police remind us that a license plate "identifies a particular vehicle, not a particular person." When the Drug Enforcement Agency wanted to install ALPR along Utah highways in 2012, an official told local legislators, "We're not trying to capture any personal information--all that this captures is the tag, regardless of who the driver is."

It's self-evident, folks. An address identifies a particular building, not a particular occupant. And a phone number identifies a particular device, not its user, right? Not according to the federal definition of personal information, which brings both address and phone number (but not vehicle license plate) beneath its cloak.

ACLU policy analyst Jay Stanley has understandably called the idea that a license plate number is not personally identifiable outright "laughable."

Just private enough

Now, if license plate numbers aren't protected as personal information, then all of these ALPR databases that police are cultivating are kosher for public consumption, right?

If police don't need legally mandated protocols to restrict access to license plate scans, you'd think all the movements of so many individual vehicles would be fair game for release.

But you'd be wrong.

When one citizen requested anonymized ALPR data from the LA County Sheriff earlier this month via a public records request, his request was denied primarily on confidentiality grounds. Again, he wanted anonymous data, but was denied based on confidentiality.

When I asked for data from the Boston police, the department indicated it was only willing to produce redacted records "without images of license plates and license plate numbers." (I'm still waiting for this data after three months.)

After a Minneapolis open data advocate paid $5.91 last December for a USB drive packed with 2.1 million ALPR scans complete with license plate numbers and photos, including the mayor's, the city's police chief successfully petitioned for a change in the public records law. In the same breath, Chief Harteau asserted that an ALPR scanner "does not record personally identifiable information," but that its scans "should be private data, available to only the subject and not the general public." The mayor quickly obliged.

In sum, ALPR data is not quite private enough to merit protection from spurious police use, but just private enough to allow them to withhold it from public release.

Just as they've managed to apply vastly different rules to emails and physical letters (no warrant necessary for the first, by the way, if it's older than 180 days), police maintain a nonsense distinction between vehicle plate info and other personal identifiers because it suits their investigative convenience. It is precisely that convenience that leaves license plate scanners, like so many wonders of modern law enforcement, so grossly exposed to abuse of privacy and civil liberties.