Just before Christmas, Muckrock and the ACLU of Massachusetts brought out excellent articles based on a full year of Muckrock’s investigative reporting into Boston PD’s use of automated license plate recognition technology.
ALPR systems automatically photograph and store in a police database the license plates of any car an ALPR-equipped police vehicle passes. The car may be parked or driving. It could be on the Pike, in a driveway, or anywhere a camera can reach. The question was, what does the Boston PD do with the mountain of data once it has it?
It is actually kind of hard to tell. Muckrock reports:
One of the foremost concerns raised by the released data was that BPD failed to protect personal license plate numbers. Even after months of delay to scrub the data of “non-public” license plate numbers, officials from the Bureau of Public Information released two unredacted spreadsheets in July, which together contain 68,924 scans of 45,020 unique vehicles, most of them privately owned. We brought this error and breach of privacy to the department’s attention, and have asked for them to release properly redacted copies, to no avail.
These 70,000 represent only the positive hits in their database – i.e. the cases where a vehicle was flagged as uninsured, behind with its payments, unregistered or (in a small portion of cases) being stolen or having a stolen license plate. They have far more data on all of the negative hits, of license plates not falling into any of those categories and spanning a minimum of three months, but those were not released. Of the released hits, only around 30,000 included geographical information, showing varying locations mainly in Dorchester, Mattapan and South Boston.
There were more than 200 unique vehicle hits in the [South Boston] substation lot. This included a mix of official vehicles and squad cars as well as civilian plates, many of them officers’ personal vehicles.
It seems also that the volume of data collected was vast enough that the Boston PD had trouble following up on even repeated flags for stolen vehicles. Many vehicles appear multiple times in the database, including one stolen motorcycle that was flagged 59 times over the six-month period. Wonder when they’re going to look into that? Maybe if they retained less data in their database, they could follow up more consistently on the most serious violations. Police time, after all, is finite. We have to start asking at some point how much time we want our police to spend flagging down cars where the owners have missed a payment or forgotten a registration, relative to more serious crimes; and whether police department employees are likely to be well enough trained to handle the issues surrounding vast databases of this kind. The evidence so far suggests that ALPR is leading to misallocation of police time, and that they are collecting more than they can process.
The issue raised here is similar to the issue with mass government surveillance more generally. Technology now allows the government, if it wants to, to collect and assemble data on a vastly larger array of legal violations and even, as in this case, cars with missed car payments. It can sit on that data, and there’s no legal barrier to it using that data to assemble a three-month-long picture of a vehicle’s movements that would, according to the Supreme Court, trigger the requirement for a warrant (U. S. v. Jones). No warrants were obtained, no due process was followed, and the assembly of the data itself violated the privacy of all Boston residents.
Though neither Muckrock nor the Globe intend to release the unredacted databases to the public, Boston PD, to their credit, immediately suspended the ALPR program, pending a review by the commissioner. To our knowledge, that review was not completed by the time the new commissioner, William Evans, was appointed in January. It seems also that the police union has its own concerns about people being tracked – the people concerned, of course, being the police officers themselves. We’ll be interested to see what the result of the review will be.
Our approach, as always, is based on the Fourth Amendment, and is this: If there’s no reasonable suspicion (narrowly defined) or probable cause to suspect you of planning, committing, or having committed a crime, the police should not collect, retain or use information on you. It’s not their job to monitor everybody pro-actively in case we’re breaking some law somewhere, and the way the law now is, everybody probably breaks some law at least once a day.
Meanwhile, the ACLU’s License Plate Privacy Act would require Boston PD to discard ALPR data after 48 hours, sharply reducing the impact on privacy. They provide a handy tool here for urging your legislators to vote for it.