Sunday, December 22, 2013

Thinking through state-level regulation of automatic license plate readers

Since Lt. Governor David Dewhurst ordered the Texas Senate State Affairs Committee to research possible privacy-protecting legislation regarding geolocation data, among other electronic privacy topics, I was pleased recently to notice a law review article by Stephen Rushin of the Illinois College of Law titled "The Legislative Response to Mass Police Surveillance." He proposes model legislation for regulating what he calls "digitally efficient investigative technologies," especially Automatic License Plate Readers (ALPR) and surveillance cameras, the latter particularly when they're connected to facial recognition technology that allows police to individually identify people en masse.

To me, his paper is most useful for its analysis of license plate reader regulation. While surveillance cameras are used by many departments, very few (and none I know of in Texas) have them connected with facial recognition software, though one supposes that could be coming. According to a Denver Post article he cited, "[t]hirty-seven states currently load driver's license photographs into state databases, which are searchable using facial recognition software." For now, though, Grits thinks fusing the two issues would unnecessarily muddy the waters. As a legislative matter, I'd rather see the topics confronted separately.

The breathtaking efficiency of license plate readers (which can scan and cross-reference up to 1,800 plates per second) means they're already in a position to be abused in ways that aren't yet broadly true of facial-recognition equipped surveillance cameras. ALPR technology is already quite widespread. A 2009 survey conducted by the International Association of Police Chiefs found that 66% of agencies larger than 501 officers and 80% of agencies larger than 1,001 officers utilize ALPR technology, and 85% of chief at all agencies "plan to acquire more ALPR devices or increase use in the future."

Rushin describes in some detail how and why 20th century Fourth Amendment jurisprudence is ill-equipped to address highly efficient surveillance in public, arguments that are especially on point as they relate to present-day use of ALPR. Courts have long assumed citizens have no reasonable expectation of privacy regarding any activity occurring in public, but those norms were influenced in the past by the fact of limited police resources. Yes, police can theoretically tail a suspect anywhere, but limited resources mean they can't do it forever. OTOH, public surveillance based on location data from license plate readers (or as the NSA scandal demonstrated, cell phones) removes resource limits and makes mass surveillance not just possible but relatively inexpensive. Moreover, noted Rushin, "because the digitally efficient investigative state monitors the entire community, it collects information on illegal activity as well as innocuous behavior," meaning "it will invariably gather enormous amounts of data on innocent people."

While about half of departments retain license-plate reader information for six months for less, 28% of agencies either have no retention limits or by policy retain the information indefinitely. Given that it's possible to identify individuals using a very small number of location data points, this information over time becomes increasingly invasive to everyone's personal privacy. Such expansive powers breed potential for abuse. Wrote Rushin:
Psychological and historical evidence suggests that the availability of pervasive surveillance tools may facilitate law enforcement corruption. With the unregulated ability to monitor an entire community, law enforcement may be incentivized to conduct fishing expeditions that "exacerbate racism, stereotyping, or profiling."  This elevates the risk of false positives and harms citizens' perceptions of procedural fairness. Thus, while the digitally efficient investigative state may be an important development for crime prevention, it also raises numerous privacy concerns.
The article outlines model state-level legislation to regulate these technologies and, while I don't agree with all of his choices, Rushin's discussion provides a useful framework for analyzing the decisions that must be made when implementing state-level regulation.

His model statute differentiates between "observational comparison" and "indiscriminate data collection." The former he defines as "the retention of locational or identifying information after an instantaneous cross-reference with a law enforcement database reveals reasonable suspicion of criminal wrongdoing." The latter involves retention of such data "without any suspicion of criminal wrongdoing" and is the type he suggests should be the focus of the bulk of state regulation.

Among states, Maine, Arkansas, New Hampshire, Vermont, and Utah have regulated ALPR tech through legislative measures. In New Jersey the Attorney General used constitutional authority to hand down directives regulating use of ALPR and limiting data collection, while Virginia has "passed relatively broad laws that regulate the retention of data by the government in all forms." New York has suggested model guidelines on the topic that are not prescriptive. Between them, these states provide examples of the various forms ALPR regulation might take.

All state legislatures regulating this tech put some restriction on data retention. Maine is the most restrictive, limiting retention to 21 days unless it specifically relates to a criminal investigation, while Vermont allows retention up to 18 months. (Rushin's model policy suggests one year, but given that half of departments surveyed have policies maxing out retention at six months or less, to me that seems too long.) New Jersey's Attorney General rules allow for retention for up to five years, which seems flat-out excessive.

Several states, like New Jersey, include limits on disclosure of personally identifying information "unless there is a legitimate and documented law enforcement reason for disclosing" it. In general, the longer states allow such data to be retained, the more important that aspect of regulating ALPR tech becomes. My preference would be to retain "indiscriminate" data for a shorter period, as in Maine, but either way there should be a requirement that the data only be used for legitimate investigative purposes.

Some states restrict sharing of ALPR data, though Rushin's model statute would allow it. He suggests limiting sharing to agencies that comply with minimum standards on retention, access, etc.. To me, at a minimum, states also should forbid sharing the data with commercial vendors. (For that matter, there's a gaping hole in his model statute in that it doesn't regulate the collection and sale of data by privately owned ALPRs, like those used by towing companies.)

Rushin also suggested rules limiting who may access ALPR data stored by police, requiring prior authorization as well as maintenance of logs documenting every user and every time they access the information. His model policy would require that stored data only be accessed only for legitimate law enforcement purposes, though IMO his limiting language could be stronger. He also suggests mandatory training in proper procedures for handling and accessing data, as well as discipline for police employees "who fail to follow policy parameters." The New York guidelines sensibly suggest "that departments establish a list of designated personnel who are authorized to access ALPR data."

Enforcement may be the most difficult nut to crack. In New Jersey, the AG can revoke an agency's authority to use ALPR if they don't comply with state rules. Arkansas provides for civil remedies if individuals can show harm, while Utah, New Hampshire and Maine criminalize misuse of ALPR data. Rushin's model statute would give the Attorney General of the state authority to file civil suits over misuse, but that structure wouldn't fit well with the historical role of the AG in Texas. I do like his suggestion that the AG perform and publish the results of regular compliance audits of ALPR use.

During the 83rd Texas Legislature, the Texas Electronic Privacy Coalition, of which your correspondent was a member, proposed two pieces of legislation: Requiring warrants for law enforcement to access cloud-based email and other content, which passed, and requiring warrants for them to access personal location data from cell phones and other electronic devices, which cleared the House by a 126-4 margin but did not make it through the Senate side. There have already been behind-the-scenes discussions among TXEPC members about whether regulating license-plate readers should be the next phase of regulating government tracking of geolocation data. Lt. Gov. Dewhurst's interim charges on electronic privacy gave such suggestions additional, recent momentum.

While I don't agree with every jot and tittle of Rushin's model statute - in particular he'd allow data retention for longer than I'd prefer and his enforcement mechanisms wouldn't be a great fit for Texas - I appreciate the good professor's efforts to think through the fundamental components such legislation might include. His article provides a fine starting point for considering how automatic license plate readers should be regulated at the state level.

See related Grits posts:


Gadfly said...

Having reported, a few years back, on Duncanville's massive amount of red-light camera ticketing, I'm all in favor of regulating both license plate AND facial cams to the fullest degree possible, since red-light cams often use facial cams to "prove" you and not somebody else was driving your car.

Let's also not forget that on red-light cams, cities usually privatize the whole operation to one of a few major operators in this industry. So, any legislation needs to address privacy not only vis-a-vis governments, but also versus private industry.

Gritsforbreakfast said...

I agree with you in principle on the cameras, Gadfly. But the ALPR issue is newer, cleaner and its indiscriminate use less defensible than the cameras, which have been around for a while and, because they've not been integrated with facial recognition, so far are less intrusive to personal privacy. Bills in Texas can only address one topic and IMO the issues surrounding surveillance cameras and ALPRs are different enough to warrant separate legislation.

FWIW, red light cameras identify folks by their license plate numbers, not facial recognition software.

Anonymous said...

First they said these cameras were to be installed on major intersections where there were alot of accidents for studies,then it was for tickets. Now they read your plates when you're entering DC. All this technology really sucks. Next thing they'll have one of these things on every block and if they think you're doing something odd they'll be investigating you for that.Hitler would be proud.

Gritsforbreakfast said...

Proving Godwin's Law in three comments ... not a record, but impressive. Your comment was fine until the last sentence, 2:17, which is absurd.

Gadfly said...

The ones in D-ville shot front of car pics, as well as rear of car pics. Even if not specifically designed for facial recognition, that's part of how they were (are?) used.

rodmsith said...

not sure how you figure that grits!

You think hitler and stalin wouldn't have KILLED for the spy tech we now use on our own citizens?

if so your back in that dream world again.

you know that same one where govt agents are free to lie, cheat, steal, kill and whatever and we're just supposed to shutup and say "yes'sir masser!"

Anonymous said...

GFLY, did any of your reporting cover the cops pulling over people that exited the highway ramps 5 miles an hour over the posted 40 miles per hour sign?

If not, there are hundreds waiting to be interviewed regarding the D-ville money making scam.

Gadfly said...

Anon, I just focused on the red-light issue. As it was, D-ville was making more money off them at that time than any other city in Dallas county except Dallas itself, and, IIRC, 10x that of neighboring Cedar Hill.

At one exit off US 67 (as you may know if you're from there), people would stop behind the white stop line. But, because the intersection isn't a 90-degree angle, they would then pull up a bit to see if it was safe to make a right on red. If they didn't have immediate clearance, they'd stop again. And, if they stopped on the stop line, they got ticketed.

Gritsforbreakfast said...

rod, Hitler and Stalin also engaged in genocide. Comparing modern police overreach in America to what happened under those two dictators is simply ridiculous.

Anonymous said...

Doesn't Sugarland have cameras with ALPR's at all city entrances? It seems they can monitor everyone coming and going.