In Massachusetts, A Registry of Everywhere You’ve Ever Driven?

Back in the fall of 2010, I was perusing the Massachusetts state public safety website when I came upon an interesting notice. The state had received nearly a half a million dollars from the federal Department of Transportation for the purchase and distribution of automatic license plate recognition (ALPR) systems for state and local police. And there was one detail there that really surprised me.

It was the first I’d heard of the technology, so I had to do a little digging. A cursory internet search revealed that police and the organizations that represent them, like the International Association of Chiefs of Police, were thrilled about the new technology. Evangelizing news reports and briefing papers abounded; ALPR was a miracle tool, enabling police to “catch bad guys” like never before. Gone were the days when police officers radioed license plate numbers of “suspicious” looking cars back to the office, looking for information about stolen cars or outstanding warrants. The technology completely automated that process, and operated with thrilling efficiency and ease.

Most police agencies use ALPR technology to look for stolen cars, outstanding warrants, and parking scofflaws. But many also run plates against federal watch lists, which are notoriously secretive and problematic. Some police departments are even checking plate numbers against IRS databases, looking for tax evaders. The system also allows for manual entry of license plate numbers. (It doesn’t take a very advanced imagination to think of the innumerable ways in which that feature can be misused.)

The biggest problem with ALPR systems is the creation of databases with location information on every motorist who encounters the system, not just those against whom some penalty or crime is alleged. Police departments nationwide are using ALPR to quietly accumulate millions of plate records, storing them in backend databases. While we don’t know the full extent of this problem, we know that responsible deletion of data is the exception, not the norm. Only two states have passed legislation barring the retention of “non-hit” plate data for extended periods: Maine and New Hampshire. On the other hand, we know for certain that some departments are eagerly engaging in this surreptitious data collection.

Police in Metro Washington DC and Connecticut, for example, are pooling their captured plate data within their respective geographic regions to create huge databases containing millions of records.

As license plate location data accumulates, the system ceases to be simply a mechanism enabling efficient police work and becomes a warrantless tracking tool, enabling retroactive surveillance of millions of people.

Looking at that Massachusetts public safety web site, it became clear that Massachusetts officials had something similar in mind. What surprised me most was that the state’s grant advertisement to cities and towns contained a provision requiring that recipients of the funds submit allof their captured plate data to the state, where it would be stored in the state’s criminal justice database.

That set off a number of alarms. Why would the state require that cities and towns dump all of this location information into a criminal justice database? After all, it’s not criminal justice data but rather location information on millions of people suspected of no crime whatsoever. Once the data is aggregated into this mega-database, the federal government, fusion centers and other state law enforcement agencies will have access to our data—all without warrants or any judicial oversight. Why does the state of Massachusetts want to hoard the location and travel information of millions of motorists in the state?

The likely answers is that, as one ALPR manufacturer notes, “a repository of collected plates…forms the basis of an ‘after-the-fact’ intelligence database.”

Needless to say, upon learning this we at the ACLU of Massachusetts took action immediately. We fired off a public records request to the state asking for guidelines or data policies governing this database, and for all of the successful grant applications. Over one hundred cities and towns had applied for the money; about sixty ultimately received funds. Among them was Brookline, a verdant, affluent city just outside Boston’s city limits.

When we made them aware of the issue, Brookline residents didn’t like the idea of their captured license plate data getting automatically shipped off to a state database, where federal agencies and even the military would likely have ready access to it. They didn’t like that this captured plate information could be combined with plate data from other states, painting an eerily complete picture of our movements in public, potentially nationwide.

So we organized.

The ACLU and a number of Brookline residents appeared before the Brookline Board of Selectmen to argue that losing control over this personal, revealing information was a bad idea.

The Board agreed with us, and ultimately the Chief of Police did, too, and the city government voted to reject the grant.

The city officials and the police chief still wanted to be able to use the technology, however, so officials urged the police to work with the ACLU to craft an ALPR data policy that would enable the police department to make good use of the technology, while limiting the dangers it poses to our privacy in public.

We are approaching the end of that process in Brookline. The police accepted many of our comments on its proposed data policy. While we still have some disagreements about exactly how long plate data should be retained, and over inclusion of DHS terror watch lists, the policy will put Brookline on a far better footing, privacy-wise, than most departments using ALPR.

It was an important victory. As a researcher and advocate, I also learned something important through this process—not just about ALPR and location tracking, but about our public process itself.

If the ACLU hadn’t stepped in to file the public records request, agitate in Brookline and provide expert testimony to the city government, and commentary to the police department, it’s likely that the expansion of ALPR technology throughout the state would have progressed without so much as a blip of public debate about the very real threats it poses to our privacy and liberty. When we forced the conversation into the public square, the press, residents and public officials throughout the state took notice.

The Brookline example shows that public processes can work. The police there will get their cool new tool, and city residents will be more secure knowing that their voices were heard—and that their location information won’t so easily end up in a nondescript federal warehouse in the Utah desert.

The proper policy prescription for ALPR is pretty simple: it’s all about the data policy. Police don’t need to retain captured plate data in order to find stolen cars or people with outstanding warrants. In the interest of liberty and freedom on the open road, they shouldn’t.