by Matt Miller on Jul 19, 2012
There is a strong possibility that if you drove a vehicle along the freeways sometime in the last year, your whereabouts were documented by law enforcement.
Four years of data detailing the locations of hundreds of thousands of drivers who have passed through San Jose resides in a server somewhere in Costa Mesa. The server belongs to Plate Scan LLC, a now-defunct company that sold License Plate Recognition (LPR) technology to police departments, including San Jose’s.
This technology, with which police patrol cars around Silicon Valley and the country are increasingly being equipped, takes a picture of the front or back of every car it passes and records the license plate number and location of the vehicle. These plates are then automatically run through police databases of stolen cars, which alerts officers if any of the scanned cars are reported stolen or linked to a crime.
Law enforcement officials say this technology is just another tool to combat crime, but there are no legal restrictions on what private companies can do with data collected by law enforcement with LPRs. In some cases, as with the San Jose Police Department, the data is stored indefinitely by a private company, and the amount of oversight on who can access this data is minimal at best.
While Plate Scan—out of business since a year ago—could potentially access its license plate information and even sell it, company president John Dalinsky says he hasn’t touched the data as he liquidates assets. He does, however, have the option to sell it to essentially whomever he wanted.
“There’s no law against it that I know of,” Dalinsky says. “There are really no guidelines for the data in the United States.”
Government watchdog organizations are increasingly raising their concerns about such invasive data collection and potential compromises of privacy.
“The real key issue here is the collecting data, storing it and accessing it later has real potential to create a comprehensive map of how people travel throughout the day,” says Rebecca Jeschke, an analyst with the San Francisco-based digital rights group Electronic Frontier Foundation (EFF).
According to Sgt. Jason Dwyer of SJPD, one LPR-equipped patrol car could scan hundreds of vehicles’ plates each day. During the four years the technology was working—which was paid for by a grant from the Department of Homeland Security—San Jose police collected more data than the department’s servers could handle.
Plate Scan offered computers with drives large enough to store the data but ceased operations last year, leaving the four SJPD LPRs useless. Four years’ worth of data, including the known whereabouts of drivers, has been in limbo ever since, and lawmakers are starting to wonder if there should be some sort of regulation or expiration date on the data.
“It’s sort of like the wild, wild West out there,” says state Senator Joe Simitian (D-Palo Alto). “There is no form of regulation.”
In March, Simitian proposed legislation (SB 1330) that restricted how personal information from LPRs could be stored and collected. Only three groups—EFF, the American Civil Liberties Union of California and Privacy Rights Clearinghouse—supported Simitian’s bill. Nine groups opposed the bill, including the California Fraternal Order of Police, California Police Chiefs Association and California State Sheriffs’ Association. After pushback from law enforcement and private-sector lobbyists, Simitian was forced to abandon the bill.
What concerns Simitian is the unrestricted stockpiling of data by private companies. Specifically, Simitian was concerned with the California-based company Vigilant Video, which has a database of more than 450 million data points.
Vigilant Video acquires data through law enforcement, repossession companies, other private firms and their own scout cars. This information is then made available to law enforcement agencies, but the data acquired by private companies can be made available to other companies, according to Simitian’s office.
“Someone willing to write a check can find all your vehicle location information and know everywhere your 16-year-old daughter was going,” Simitian throws out as an example.