The DHS Sends Out The Call For A National License Plate Database

from the more-'harmless'-metadata dept

In what reads like bad news all over, the DHS has just requested quotes for national automatic license plate reader (ALPR) database. There are currently several ALPRs in use and law enforcement agencies have been working hard to link systems up in order to better track vehicles as they move around the country. This has been hampered somewhat by multiple vendors, most of which aren’t particularly interested in working with competitors. But even with multiple vendors, there’s still a whole lot of data being stored — a majority of which is entirely unrelated to criminal activity — in easily-accessible databases.

License plate readers are used not only by police but also by private companies, which themselves make their data available to police with little or no oversight or privacy protections. One of these private databases, run by a company called Vigilant Solutions, holds over 800 million license plate location records and is used by over 2,200 law enforcement agencies, including the U.S. Department of Homeland Security.

A nationwide database, with records accessible by law enforcement and investigative agencies with few restrictions is obviously a concern. Tracking vehicles as they move around the country generates a ton of location data that can reveal a great deal about a person. It’s always argued that what you do in public carries no expectation of privacy, but that statement is somewhat meaningless when you consider the number of plates ALPRs scan and store. Most states with ALPRs have gathered millions of records, which are held for as long as 5 years, with little in the way of minimization procedures. ELSAG, another ALPR vendor, brags in its own promotional Powerpoint presentation that it has collected 50 million records in New York City alone, without a single mention of minimization processes or the disposal of non-hit data.

For the government to actively call for a nationwide database is troubling. Since this is a solicitation for bids, there’s no discussion on what, if anything, will be required from the winning contractor in terms of storage, minimization or disposal. Given the track records of the largest vendors, it’s likely these issues will be of lesser concern than other aspects, like scanning speed and database accessibility.

The call for bids may have something to do with Vigilant’s recent efforts, both on the PR front and in the courtroom.

First off, Vigilant (along with Digital Recognition Network) is suing the state of Utah for, believe it or not, violating its First Amendment rights.

It posits that a new Utah law which bans license plate collection by private companies, effectively put it out of business in the state. The law was intended to keep data from falling into police hands without oversight, and is among the first by surveillance technology firms to argue against privacy laws invoking the First Amendment.

The Texas company fired back, arguing that collecting license plate numbers is free speech. The lawsuit draws upon a recent major Supreme Court ruling, Citizens United v. FEC, which overturned a law curbing corporate and union donations to political campaigns. In effect, the Court ruled that money is speech.

“The Texas company says it’s not a police agency – law enforcement already is exempt from the ban under Utah’s new law — nor can it access in bulk federally protected driver data that personally identifies the letters and numbers it collects from license plates in public,” the Associated Press reported Thursday. “The company said it only wants to find cars that have been stolen or repossessed, not to cull large swaths of data and incriminate people from their travel habits.”

DRN’s press release goes into a little more detail on this rationale.

“Taking and distributing a photograph is an act that is fully protected by the first Amendment,” said DRN / Vigilant Outside Counsel Michael Carvin. “The state of Utah cannot claim that photographing a license plate violates privacy. License plates are public by nature and contain no sensitive or private information. Any citizen of Utah can walk outside and photograph anything they please, including a license plate.”

This is an interesting approach. It’s a bit disingenuous to compare scanning license plates at a rate of hundreds per hour to someone walking around taking pictures of license plates (not the least of which is the fact that a private photographer most likely wouldn’t have a searchable database), but underneath it all, the point remains: these are photographs of publicly-available items. It will be tough for a court to find a “bright line” that separates these two without weakening First Amendment protection. Then again, as the ACLU has noted, it’s not really the photography that’s a problem, it’s the handling of the non-hit data, something that won’t be addressed in this suit. That’s Utah’s problem and if it loses this case, then it needs to push for heavy restrictions on how the data is accessed and used, as well as rules on data disposal.

Using an unpopular decision (Citizens United) to argue that losing income equals losing free speech rights is a bit more troublesome. Of course, those opposed to that decision may welcome a court battle on the issue, as it may cast further doubt on the validity of that ruling. But does a company deserve to make money, much in the way it might deserve First Amendment protections? That’s another grey area with no bright line and this two-pronged approach may allow Vigilant and DRN to set up their ALPR systems despite the state of Utah’s opposition. (Of course, Utah would be free to use another vendor, but any decision in the ALPR companies’ favor will help them attack similar laws elsewhere.)

It would appear that Vigilant is trying to knock down state laws that might curtail its national aspirations. Appearing on the same day as this lawsuit announcement was a Vigilant press release touting its ALPR’s crime fighting abilities.

Vigilant Solutions announces today that the Loganville Police Department in Georgia attributes recent and significant arrests to their use of license plate recognition (LPR) technology from Vigilant Solutions.

Assistant Chief M.D. Lowry comments, “On January 7, one of our officers received an alert from his license plate reader (LPR) system on a vehicle which was associated with an active arrest warrant out of Texas. Our officer initiated a traffic stop per policy and identified the driver. Following protocol, the officer used other systems to validate the hit and was able to confirm the driver was wanted out of Del Rio, Texas for Indecent Acts with a Child, 2nd Degree. The suspect was taken into custody without incident and transported to the Walton County Jail to await extradition…”

We have only had our single unit for only a few months, but it is already proving its value by helping us to remove these threats from our community. I can tell you that the capture of a child molester from nearly 1,200 miles away was more than worth the cost of the LPR unit. If we never make another case with it, it was worth the cost.”

Two immediate questions arise. The first is: if you never make another case with it, what’s the point of gathering all that data? Does the arrest of one child molester make the routine harvesting of thousands of plates of non-child molesters “worth it?”

Second: pointing out the ends as justification for the means is a rhetorical dodge. There are any number of things law enforcement could do to bump arrest numbers — like house-to-house searches and eliminating the probable cause requirement for warrants — but neither takes into consideration the constitutional rights of those on the receiving end of these actions. Law enforcement is supposed to work within these limitations, rather than see how hard they can push back against them.

The call for bids on a national ALPR database takes a localized problem and makes it worse. The government (both on local and national levels) has shown repeatedly that it prefers to implement technology before considering the privacy implications. Post facto “repairs” generally only come into play once widespread misuse has already been reported. This is a chilling, but not unexpected, development. If it can be construed as “public,” then it’s the government’s for the taking, apparently.

Filed Under: , , ,

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “The DHS Sends Out The Call For A National License Plate Database”

Subscribe: RSS Leave a comment
Anonymous Coward says:

Could this create an argument that the use of identifying license plate is now onerous and is causing the government to force identifying speech on travelers, namely by making public to the whole country their location and movements?

I feel like the traditional privacy rights and right to free movement encompassed an unstated right to move without publicizing your movements or location.

Anonymous Coward says:

From History

License plates were specifically intended to have random number and letters to protect a persons privacy… INCLUDING FROM LAW ENFORCEMENT!

The idea was to force a police officer to go through checks to match a plate with the owner and their address.

We already see the wheels turning where ‘certain’ political opponents/figures are being actively harassed when traveling through the airport.

The benefits of law enforcement being able see who is doing what where have NEVER outweighed the negatives. Once you allow the government to crush liberty, then all the criminals join the government.

Andy says:

Re: From History

A randomized license plate probably was considered pretty secure 100 years ago, but maybe now we need to take the next step. Let’s assume that roadside scanners will become ubiquitous and stop trying to fight that battle.

Instead, use something like an encrypted RFID chip sticker (similar to a toll pass sticker) that changes identifying information periodically (say, hourly). It can be scanned by anyone without violating privacy, but with a warrant the encrypted ID history could be retrieved to target a particular vehicle. The goal is to enable individualized record retrieval for valid court approved purposes, while not mandating every person use an easily tracked identifying badge while traveling in public.

artp (profile) says:

About that lawsuit against Utah...

First off, Vigilant (along with Digital Recognition Network) is suing the state of Utah for, believe it or not, violating its First Amendment rights.

Reading plates is more like listening, not like speech. Speech would be writing graffiti over the plates so they can’t be read by red-light cameras.

I guess when your mind is made up, facts and logic are optional.

bob (profile) says:

citizens stalking citizens

If the police confiscated a laptop from a man and found detailed travel records of a local female, it would be assumed he is stalking her.
what these companies are doing sounds like stalking everyone.
what does it take to get a restraining order, to tell someone to stop following me.
would this at all apply to this scenario of them following me through their network of electronic cameras?
sounds like a stretch, but so does what they’re doing.

btrussell (profile) says:

Re: Re: citizens stalking citizens

Yes and I would like to add:
“It’s always argued that what you do in public carries no expectation of privacy, but that statement is somewhat meaningless when you consider the number of plates ALPRs scan and store.”

This is akin to the two of us in a park. If I am taking a picture, you have no expectation of privacy, not just because it is public, but also because you have the freedom to move away from me. A little different situation if I start following you though.

aldestrawk says:

I would be very surprised if there was not a national ALPR database already. Most of the funds that police departments use to purchase these systems are grants from various agencies under DHS. The main focus of those grants is providing for protection of critical infrastructure. It would be hard to believe that such grants did not come without strings attached requiring the sharing of collected information. A large number of documents requesting and issuing these grants for various police departments across the country was requested by the ACLU for their report which was issued last year. There is always some redacted information in the contracts related to the grants. Already, a lot of information is shared with the fusion centers operated under DHS purview. Why not just one more step of aggregating ALPR database information from the 72 fusion centers. This proposal may be just to unify and improve the database so that there are no barriers in merging information from disparate databases and improving the ability to conduct queries.

Anonymous Coward says:

Vigilant supports child molesters, rapists and kidnappers

Predators that target children do so in part because they’re vulnerable. They aren’t interested in adults nor do they want to have to confront adults while trying to get at children. They know that kids are physically and psychologically weaker (in general) — which is why they want to go after them when they’re alone.

Most people are creatures of habit, partly because of age but mostly because of location, employment, school, recreation, shopping and other routine travel. The license plate tracking data accumulated by Vigilant will of course reveal that. Even a cursory glance at a month’s worth of data will show clearly-identifiable patterns of movement, helpfully timestamped.

When predators get their hands on this data (not “if”, and anyone disagreeing with that is naive and stupid), they will find it one of the most useful tools they could possibly hope for. It will show them that little Johnny’s parents don’t arrive home until 5 PM, two hours after he gets home from junior high school. It will show them that Susie drives back to high school two nights a week for a special class. And so on.

Vigilant knows this. They know that the data they’re collecting will be used to target children for horrible, brutal assaults. They have to: it’s obvious on inspection.

But they don’t care. They’ll lie about it, like they’ve lied about other things, because they want to make a profit and they’re willing to exploit the national paranoia (and DHS budget) in order to do it.

And when it slowly starts coming out, in trial transcripts that are painful to read, that Vigilant’s data was used to plan rapes and murders of children, they will tell the lie that everyone in their position always uses: “Nobody could have foreseen…”

That One Guy (profile) says:

Re: Vigilant supports child molesters, rapists and kidnappers

On the one hand, using such examples to attack them really seems over the top, yet on the other hand, if they’re going to claim that their database is useful to stop those kinds of people, then it does seem fair to point out how that same database could very well end up helping them instead.

Pragmatic says:

Re: Re: Vigilant supports child molesters, rapists and kidnappers

Good points, both of you, but do we really need this when other means of collecting that data are available? We have already seen examples of abusive conduct by people who had access to “metadata,” e.g. NSA staff spying on ex-lovers, etc.

Finally, I knew the “money as speech” thing would come back to bite us sooner or later. The question is, how soon can we get Citizens United overturned? It didn’t do us any favors.

AricTheRed says:


As someone who provided surveillance evidence, from a retail store, and testified on the states behalf in a relatively high-profile attempted murder case where public and private surveillance was used to convict a minor child to life in prison, even if the state did what they say they do with license plate readers I’d still be against them.
Max Wade was recently sentenced to life in prison for attempted murder, you can read a bunch about him on the web, he’s easy to find. Check out,
Also have a look at what municipalities in the San Francisco bay area, and California in general, are doing with license plate readers?
Now consider that if the local thugs, er, uh, I mean police, were doing what they say they were doing with license plate readers how is it that “Mad” Max Wade was not caught driving Guy’s stolen Lambo all over Northern California (stolen in 2011) before he tried to murder a girl’s (he was trying to date her, and may not have even noticed she was in the SUV when he shot it up) date while dressed as a Biker-Ninja over a year later. The car either had its original plates, stolen ones, fake ones, or no plates on it while he drove it past hundreds of license plate readers for OVER A YEAR!
The surveillance state is being built to convict We The People of crimes with evidence collected even before anything occurs, and not as “they”, and believe me we all know who they are, say to prevent crime or stop it during commission.
I may not have a realistic expectation of Privacy while I’m in public, however I do have an expectation of anonymity, and there is a big difference.

Anonymous Coward says:

Re: "They"

Well, to summarize it better.

The government is not putting all of this tracking into place to catch criminals. They are putting it into place to make it easier for them to target citizens they do not like or want to have a reason to pester harass or blackmail. Sure they will use it to catch criminals here and there, but that is not the true purpose.

My wife was in a hit and run. There was only minimal damage to the vehicle but she was able to get the plate of the runner. Guess what the police did? NOTHING! Had the person hit say… the mayor then it would have been a massive man hunt.

Remember everyone… you are nothing but serfs. The Police are not actually required to save your ass from anything! They only do their jobs at their leisure and/or when it benefits them.

Eldakka (profile) says:

It’s always argued that what you do in public carries no expectation of privacy,

“no expectation of privacy” is the LACK of privacy, not the OPPOSITE of privacy.

However it seems that “no expectation of privacy” has somehow morphed into the opposite of privacy, “you WILL be tracked, followed, eaves-dropped on, bugged, and collated into a database”.

That One Guy (profile) says:

Cribbing from the patent trolls' playbook are we?

‘It posits that a new Utah law which bans license plate collection by private companies, effectively put it out of business in the state.

The Texas company fired back, arguing that collecting license plate numbers is free speech.’

Talk about deja vu…

‘If I want to send out extortion letters, that’s my right, and it’s a violation of my free speech to tell me to stop!’

Yes free speech is important, but it does have some limits, ‘not breaking the law’ being one of them, and while sometimes breaking the law when exercising free speech is justified(objecting to an unjust law for example), doing so purely for profit doesn’t really cut it I’d say.

This actually seems to be kinda dicy, on the one hand, when dealing with free speech, it’s always better to err on the side of more freedom, yet the idea of completely sidestepping a law designed to protect peoples’ privacy by claiming the actions constitute ‘free speech’, and are therefor immune, would seem to open up a huge can of worms.

goldmagic (profile) says:

say what ?

i get it, scan plates for bad guys. what is the reason for saving all the info like direction of travel and speed for years ? do red light and speeding cameras record this data and keep it forever ?

i have said for a long time that i would never have a system like Onstar in any of my vehicles. but i cant get away from the black boxes that need a warrant to access (wink, wink) but what do we know ? when do they start hoovering it up and we get even more bad tickets ?

i get the reader thing, what i don’t get is the retention of that data. my car is good, don’t save the data. so simple.

Jane Q Public says:

LPR Data

This information when used for law enforcement is useful, however The privacy that is being violated is the fact that we have a perceived right to our privacy on Private property alot of people don’t’ realize that even malls are in fact private property. Only an agent acting on behalf of the owners should be able to give permission to scan in these lots. that means Churches, Shopping Malls, Apartment Complexes, even Walmart are all defined as private property. When these camera’s scan they do so in a shady way, looking as if they are normal cars.

If your vehicle isn’t up for repo or you or the car sought in connection with a crime the data then should be erased from the system. it’s in fact not. there needs to be laws in place to protect the privacy or perceived privacy of all Americans.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...