Lost in the big Keno public hearing scheduled for this afternoon, is a hearing on House Bill 5389 “An Act Concerning the Use of an Automated Number Plate Recognition System. Here is the testimony from the American Civil Liberties Union-CT:
“Senator Hartley, Representative Dargan and distinguished members of the Public Safety Committee, my name is David McGuire. I’m the staff attorney for the American Civil Liberties Union of Connecticut and I’m here to testify on House Bill 5389, An Act Concerning the Use of an Automated Number Plate Recognition System. While we commend the committee for taking up this important issue, we must oppose this legislation because it does not go nearly far enough to protect the privacy of millions of innocent drivers in the state of Connecticut.
Police use automated license plate recognition systems (ALPRs) to capture the license plate numbers of parked and moving vehicles. Cameras, usually mounted on police cars but sometimes mounted on traffic barrels or speed radar signs, record the plate number, the precise GPS location where the plate was scanned and the time and date of the capture. When the system matches a license plate scan to a vehicle listed as stolen, unregistered or uninsured, it produces an alert so that a police officer can pull the vehicle over. Used in this way, ALPR systems are an important, helpful and powerful tool for law enforcement.
The trouble arises when license plate scan data is collected, pooled and archived for months or years, storing a detailed and vivid picture of the movements of drivers who are not even suspected of doing anything wrong. From these ever-growing databases it’s easy to reconstruct an individual’s movements or to identify the vehicles that visit a particular location, such as a church, mosque, adult bookstore or motel. This opens the door to retroactive surveillance of innocent people without a warrant, without probable cause and without any form of judicial oversight.
We discovered through Freedom of Information requests that in about three years, between 2009 and 2012, ten towns in central Connecticut accumulated about 6 million plate scans. In 2012, the Newington Police Department alone recorded 612,673 scans; with 29,208 registered vehicles in town, that’s more than 20 scans for each vehicle. As more police departments acquire more ALPR systems, we can expect that number to continue growing exponentially. A national database maintained by a private contractor and aggregated from private and law-enforcement sources now holds more than 1.8 billion scans.1 It is reportedly growing by 100 million scans a month.2
There is growing unease across the country about this unbridled and unregulated accumulation of data. After a public outcry, the Department of Homeland Security recently abandoned a plan that would
have provided the agency with wider access to the private database. Six states already regulate ALPR use by law enforcement. Many others—including Massachusetts, Maryland, Illinois, Minnesota, Virginia, Tennessee and Colorado—are now considering bills that would limit the amount of time police can keep ALPR data. Massachusetts legislators are considering a 48-hour data retention limit. Just a few weeks ago Virginia’s attorney general declared that data from license plate readers may not be stored at all unless it is directly relevant to an investigation into criminal activity.3 New Hampshire forbids almost all use of ALPR and its legislature overwhelmingly rejected a bill in January that would have allowed only active use by law enforcement, with data retention of only three minutes.
In order to effectively protect the privacy of the people of Connecticut, ALPR legislation must set a meaningful data retention period, not a matter of years but of days. Five years of license plate scans could build a frighteningly detailed dossier on the movements and associations of every driver in the state. The police do not need, nor should they have, this information. The Connecticut State Police discard ALPR data after 90 days. If the state police use this technology effectively with that restriction, so can municipal departments. We believe they can do with less. The ACLU of Connecticut supports a requirement to dump the data after 14 days, with an exception allowing scans to be retained for active criminal investigations.
We are also very troubled that this bill attempts to exempt license plate scanning from release under the Freedom of Information Act and includes no requirements for police to audit, report on or track their use of the technology. We agree that scanned license plate numbers should not be released, but there is no need to keep the entire data set secret. It can be released with masked plate numbers so that it’s possible to know how many times an individual vehicle was scanned without revealing the real plate number. The data should also include the notifications generated by the ALPR system, so the public can evaluate how well it is working, for example, in tracking down stolen and unregistered cars.
The importance of allowing the public to evaluate how ALPR is used became apparent in December, when The Boston Globe published an analysis of scan data provided by the Boston Police Department. The newspaper reported that police failed to take action in many cases where vehicles triggered alarms. A stolen motorcycle triggered alerts 59 times and a plate with lapsed insurance was scanned 97 times. The Boston Police Department subsequently suspended all ALPR use while the issue is investigated.4 The findings raise an important question: if police were not using the system for its stated purpose, why were they collecting all that data? Was it for surveillance alone?
No free society gives unlimited powers to its law enforcement authorities. There are always restrictions and there are always compromises. This bill is not a good compromise. —We urge you to reject the bill in its current form and to amend it to provide more meaningful protections for individual privacy.”