Law enforcement, private companies using plate readers to build enormous database

LPR systems automatically capture an image of a vehicle’s license plate.

Where do you shop? Whose house do you visit after work? What restaurants do you frequent? When are you most likely to be away from home?

Thanks to automated license plate recognition systems (ALPRs), or license plate readers (LPRs), the answers to those questions may be easily accessible to anyone willing to pay for it, as the data is collected on at least one network touted as inclusive of more than 2 billion images.

LPR systems automatically capture an image of a vehicle’s license plate, transform that image into alphanumeric characters using optical character recognition software, then compare the plate number to one or more databases of vehicles of interest to law enforcement and other agencies (hotlists), and alert the officer when a vehicle of interest is observed. The cameras utilized in the systems are either stationary, like those seen on telephone poles or traffic signals, or mobile, such as those used by law enforcement and others.

One company offering LPRs and the related software is Vigilant Solutions, and it has contracts with multiple area law enforcement agencies as well as private companies. Some of the policing agencies say they are not sharing or inputting their data into Vigilant’s gargantuan network, but some are, and many peace officers, whether they realize it or not, are – in effect – mining data for the company, data that could then potentially be sold.

In January, Dave Maass of the Electronic Frontier Foundation (EFF) expressed his group’s unease about the use of such intrusive vehicle surveillance technology.

“EFF has long been concerned with this technology, because (LPRs) typically capture sensitive location information on all drivers — not just criminal suspects — and, in aggregate, the information can reveal personal information, such as where you go to church, what doctors you visit, and where you sleep at night.”

That’s a scary thought for many who value their privacy.

Local agencies using LPR technology

Most local law enforcement agencies in Southeast Texas are utilizing some type of LPR technology. Some have their own equipment purchased from Vigilant Solutions or another surveillance technology vendor, like the Beaumont Police Department’s vendor, ELSAG. Other agencies are being provided with the LPR hardware, software and credit card readers by Vigilant Solutions “at no cost” for those participating in the Warrant Redemption Program.

Port Arthur Police Department (PAPD) traffic enforcement supervisor Lt. Steve Brinson told The Examiner his department has a deal with Vigilant and has been using LPRs and the related software sold by the company since 2010. He said PAPD paid for theirs outright and owns the cameras. The department updates warrant data regularly and allows license plate info to feed into Vigilant’s network (the Law Enforcement Archival Reporting Network Server, or LEARN), which Brinson asserted is a secure network utilized only by law enforcement.

“I’ve been very pleased with the LPRs,” said Brinson. “We bought six of them in 2010. We have three or four that are functional. They work well. We just bought a new one this year. It’s a little better than the old ones, but basically the same system.

“We pay Vigilant about $13,000 per car to outfit the vehicle with the license plate readers. We also have to pay for the software and updates annually. Vigilant hosts the database. Ours is combined with numerous other agencies as part of the agreement. It’s all encrypted, blessed by the feds and all that good stuff. If I’m looking for someone or a stolen car, and a law enforcement agency in Houston finds the person or vehicle, they will know I’m looking for them and can take them into custody.

“There is an approved list of agencies allowed to access the (LEARN) database. It’s got the highest level of encryption you can get.”

Supposedly, the 2-billion-plus and rising number of images are not all available to the private companies, as law enforcers are on a separate database from the private users; however, the bourgeoning technology could give hackers access to information on Vigilant’s network, and legal loopholes may exist that would allow Vigilant to sell any data collected by their clients.

In his January article, EFF’s Maass asserted that in Vigilant’s memorandum of understanding (MOU), or contract, with the city of Kyle, the company retains its right to hold onto LPR data collected by the law enforcement agency.

“Buried in the fine print of the contract with Vigilant is a clause that says the company also gets to keep a copy of all the license-plate data collected by the agency, even after the contract ends,” Maass explained. “According to the company’s usage and privacy policy, Vigilant ‘retains LPR data as long as it has commercial value.’ Vigilant can sell or license that information to other law enforcement bodies and potentially use it for other purposes.”

Maass later clarified, “Vigilant generally agrees in its contracts and policies that ALPR data collected by law enforcement agencies will only be shared with (i.e. sold to) other law enforcement agencies. However, data collected by Vigilant directly may be shared for a variety of purposes, including insurance and repossession. We used the word ‘potentially’ because it gets murky when it comes to ALPR systems licensed to law enforcement that are not the property of the agency, but rather are Vigilant’s property attached to a police vehicle.”

On Vigilant’s website, regarding LPR usage and privacy, the company again mentions it retains LPR data “as long as it has commercial use,” the company’s standard practice with all its affiliates, not just Kyle.

Port Arthur’s state and local law enforcement agency agreement with Vigilant Solutions signed in October 2015 pertaining to the police department’s use of LPRs and the LEARN software and server says, “Vigilant reserves the right to provide LPR Data to third-party entities for purposes of promotion, marketing, business development or any other commercially reasonable reason that Vigilant deems necessary and appropriate.”

That seems to give the company a very broad range of what could be considered “reasonable reason(s)” for which the data could be redistributed or resold.

Even if the LEARN network used by peace officers could only be accessed by other law enforcement personnel, law enforcement agencies aren’t the only ones using LPR technology and Vigilant Solutions, so they aren’t the only ones collecting the information.

Drivers may be aware of the LPRs attached to police cruisers, but the devices are also in use by private businesses, like wrecker companies looking for repossessions. These private companies are collecting information for Vigilant’s databases too, with unmarked cars sporting cameras trolling parking lots of shopping malls, hospitals and other private properties accessed by the public, recording the time, date and location of vehicles that just so happen to be in their path.

The information compiled by police has stipulations, according to user agreements and officer testimonials, but information generated from private businesses can be – and is – shared with much less stringent restrictions on access.

Brinson confirmed that wrecker companies also often use LPR technology, but added that those private business owners do not have access to the police data, only certain hotlists.

“A lot of wrecker companies have gone to LPRs,” Brinson explained. “The company downloads repo lists from different sites, and it makes it easier for the repo guys. It’s helpful to us, too. They do not have access to our database, but we have access to all of their reads. Their uploads go into a separate database that we can access.”

Hardin County Sheriff’s Office Lt. Aaron Tupper said his office is getting the hardware and software at no charge because they are going to participate in the Warrant Redemption Program. According to him, LPR technology helps catch criminals.

“Basically, this license plate reader is going to assist in solving crime,” said Tupper. “It’s also going to help in updating traffic fines and things of that nature. There’s only one deputy with the plate reader right now.”

During a Feb. 22 Hardin County Commissioners Court meeting, Lt. Tupper explained to commissioners and Judge Wayne McDaniel that the LPR cameras would record license plate data and the credit card readers would allow people with outstanding warrants to pay for warrants on the side of the road to avoid going to jail and to avoid having their vehicle’s impounded.

Tupper added, “This is actually free to the county. There is no cost for us to use this system.”

Before inquiring about the technology, its potential usefulness, or possible privacy concerns, Judge McDaniel said, “I think that’s what we were waiting to hear.”

As a Vigilant representative explained how the company and county would split credit card payments received, with the warrant amount going to the county’s bank account and the 25 percent “lift fee” or “technology fee” going into Vigilant’s coffers – McDaniel again hinted at where his interests and his support lie.

“So if the ticket was $400 we get the full $400?” he asked the Vigilant rep.

“Absolutely,” she replied.

The Beaumont Police Department does not use Vigilant Solutions’ hardware, software or network. According to Officer Carol Riley, BPD purchased their LPR cameras from ELSAG, a different surveillance technology vendor, and enters warrant data into a closed system. The only time Vigilant could have access to BPD warrants is during multi-agency warrant roundups when the data has to be shared with other agencies, like Bridge City and Lumberton. However, the LPRs mounted on patrol cars of agencies that do have contracts with Vigilant are capturing images of Beaumonters’ plates during those warrant roundups when officers operating them are posted at locations across the city, like on MLK Parkway or College Street.

Bridge City, Lumberton, Vidor and Orange have Vigilant LPRs. The city of Orange Police Department (OPD) was part of a pilot study for Vigilant’s Warrant Redemption Program, so they were one of the first law enforcement agencies in Texas to be provided with a credit card reader along with an LPR system and software in exchange for warrant upcharges. Vidor and Hardin County have both recently signed on to participate in the Warrant Redemption Program with Vigilant Solutions.

Warrant Redemption Program

Not only is Vigilant Solutions collecting and selling drivers’ data; in some local communities, they are even collecting payments for outstanding warrants, or actually having the police do it for them, jacking up the cost with a 25 percent fee that is paid back to Vigilant.

According to the company’s Facebook page, “Vigilant’s Warrant Redemption Program (WRP) offers LPR equipment at little/no out-of-pocket cost for the agency, while allowing for the enforcement of capias warrants, as well as the identification of stolen vehicles, Amber Alerts, felony vehicles, and other vehicles of interest.”

Here’s how it works: if a person who is identified by an LPR has a warrant that costs $400 to clear, they may pay the fine on the side of the road to avoid going to jail by paying the 25 percent in additional fees, bringing the total they would have to spend up to $500. That’s $100 more for a $400 warrant. And the higher the cost of the warrant, the more Vigilant collects in fees. House Bill 121, passed into law in Texas last year, allows officers to accept payments for outstanding warrants using a credit card machine, which Vigilant generously provides “at no cost” to the policing agency. They instead make their money by taxing people with outstanding warrants.

Some feel the practice is discriminatory and ends up targeting impoverished people in communities, those who cannot afford the ticket, much less the additional fee.

Port Arthur native Jessie Castro said he was unnerved by the appearance that warrant roundups always seem to be hosted in low-income areas of the city.

“They’re being given an excuse to arrest people – a certain group of people,” Castro said. “There’s a disproportionate number of tickets given to minorities, and then turning into warrants.

“The group that can’t pay is going to get a higher warrant level.”

That means the cost to clear up the warrant grows.

The city of Kyle, Guadalupe County and the City of Orange all signed on to participate in Vigilant Solutions pilot program for its WRP. The city of Kyle has since rescinded its agreement with Vigilant after City Council members and members of the community voiced concerns over discrimination against poor drivers, as well as privacy concerns.

The city of Orange is still participating in the WRP with Vigilant, but OPD Major Sparky Robinson told The Examiner having credit card machines in police vehicles has not done much to clear up outstanding warrants.

“We’re participating in that program,” said Major Robinson. “We have them in three cars. If we come across someone with a warrant, they can correct that warrant.

“For us at least, the credit card readers have not been a big help. When we got the LPRs initially, we made a lot of arrests. Now, a lot of people know we have them, which I believe deters them from driving around with outstanding warrants. I think a lot of people took care of their warrants once they realized we had them. Knowing the system is out there helps. Now, the people who still haven’t taken care of their warrants are generally the people who can’t afford to pay for them.

“I find that most people aren’t in a position to take care of that on the side of the road. Many can’t afford it, and a lot of them don’t have credit cards. I haven’t noticed a significant difference in outstanding warrants since we got the credit card readers.”

Robinson said the program was meant to cut costs, and sometimes it does.

“It does help cut down on our jail costs,” Robinson remarked. “We don’t have to go through the booking process, which saves time and money. It costs the county $50 to book someone into jail whether they are there all night or just a few hours – it’s the same cost.”

Regarding the LPR cameras, Robinson said those are helpful and asserted that Orange PD does not share data with Vigilant or anyone else.

“It helps solve cases,” Robinson said of the LPR tech. “Technology has changed a lot in the two-and-a-half decades I’ve been in law enforcement. We’ve gone from using typewriters to computers, from fingerprints to DNA. This is just new technology.

“We use a closed system. We download our warrant database to our cars. We do not share data with other agencies. We do not communicate with them that way. We don’t participate in large, multi-agency warrant roundups.”

Robinson also said police officers with OPD don’t follow orders from Vigilant Solutions, and he’s not sure they will continue participating in the WRP.

“We’re not just going to go pick someone up because they tell us to. We don’t always arrest people with warrants when we stop them. There are often other options. I have taken people to the courthouse myself to see a judge and set up a payment plan rather than taking them to jail. What if they have children in the car? Should we arrest them and get CPS involved for a Class C misdemeanor ticket they may have forgotten to pay? No. It pays to have an open mind.

“We’re not sure we’re going to stick with it (the program). As of right now, we use it.”

Robinson said, generally speaking, people who show up at the courthouse to arrange a payment plan or community service to take care of their warrants will not be arrested.

The Vidor Police Department recently signed up for a Warrant Redemption Program with Vigilant. Police Chief Dave Shows said his department just got outfitted with a brand new Vigilant Solutions LPR package in one of its vehicles in the past couple of weeks, although it isn’t quite up and running yet. He indicated that his goal is to have the warrant data input into the system to allow for the LPR to be fully functional by the end of March.

Shows said he hopes to clear up as many of the numerous outstanding warrants as possible using the new tech, but he also expressed some reservations.

“I don’t think it’s right to just go around recording everything,” Shows said, adding that the Vigilant LPR “reads everything.”

However, according to Shows, the Vigilant LPR in use for Vidor only hits on warrants input into the agency’s personalized system, which is then not shared elsewhere.

“It discards everything that does not match,” he said.

Whether he will be happy with the product the way it is, or want to expand, or get rid of it altogether is something Shows will decide on in the coming months.

“It’s not going to take long,” he said. “It may be one and a half, two months, to see how it’s going.

“Basically, what we’re trying to do is to get people to take care of their business. I’m hoping we see an increase of people coming in to take care of their warrants. We’re going to supply … data associated with our current warrant list. We have to agree to share our data with other agencies.”

For now, Vidor has not agreed to share its data, but that could change, Shows said, if the department participates in events such as warrant roundups.

Shows said there is over $1 million in outstanding warrants for the city of Vidor.

“A lot of it came from out of state,” Shows said, so he is not too hopeful that those warrant absconders could be tracked with only local-access LPRs.

Still, if an out-of-town warrant jumper was arrested out of town if the city of Vidor were to allow its data to be shared with other law enforcement agencies around the state or nation, Shows isn’t sure that would be a good thing either.

“Let’s say they get stopped in El Paso, and it shows that they have a warrant and they get arrested on that warrant,” he posed as a scenario. “We can’t go to El Paso for even a $400 warrant.”

Shows said innocent people should have nothing to worry about, but he still worries about privacy.

“If you’re not doing anything wrong, nobody is probably looking for anything you’re doing,” he said, adding that, “every technology today is a double-edged sword. It could be used for good or for evil.”

Privacy breaches and technological errors

In spite of government support and Vigilant’s claim that its encrypted network is secure, no network is impenetrable in this age of technology and terrorism. Neither is it infallible.

In December 2015, Vigilant Solutions issued a notice to agencies participating in the Warrant Redemption Program in Texas revealing the system had made an egregious error.

The notice read, “During the second week of December, as part of its Warrant Redemption Program, Vigilant Solutions sent several warrant notices – on behalf of our law enforcement partners – in error to citizens across the state of Texas. A technical error caused us to send warrant notices to the wrong recipients.

“These types of mistakes are not acceptable and we deeply apologize to those who received the warrant correspondence in error and to our law enforcement customers.

“We can say with certainty that no personal information was divulged to any unintended recipients. However, we have conducted a thorough review of the incident and have implemented several internal policies to ensure that such a mistake does not happen again.”

As for the money the company collected from false warrant notices, Vigilant said it was to be returned to payees who were mistakenly notified and had already paid.

The American Civil Liberties Union (ACLU) posted an article by New York Civil Liberties Union staff attorney Mariko Hirose a week later that revealed several instances during which LPR technology was utilized inappropriately or produced inaccurate results.

In one instance noted by Hirose, a police officer in Washington D.C. pleaded guilty to extortion after looking up the plates of cars near a gay bar and blackmailing the car’s owners.

In another, the DEA reportedly contemplated using license plate readers to monitor people in attendance at a gun show. The devices do not distinguish between vendors selling illegal guns and those who are not, so a person’s presence at the gun show would have placed them in a DEA database.

Hirose also detailed an instance during which a SWAT team in Kansas raided a man’s house where he lived with his wife, 7-year-old daughter, and 13-year-old son based in part on the mass monitoring of cars parked at a gardening store. The man was said to have been held at gunpoint for two hours as police officers combed through his home looking for a marijuana growing operation, which did not exist.

According to WIRED media, a woman was held at gunpoint by four San Francisco police officers in 2009 after an LPR misread a digit of her license plate and misidentified the car as stolen.

Backchannel.com reported that in 2013, a union dues administrator heading to work was surrounded by multiple armed police units and a helicopter when a license plate reader confused his Colorado plates with California plates bearing the  same number but belonging to a wanted drug felon.

And the list of errors goes on and on.

Vigilant’s counterpoint

Vigilant Solutions claims that data collected on its network is safe and offers no real personal data anyway. According to Vigilant representatives and its website, license plate information is public information and contains no personal data.

“The issue of LPR and privacy is a heated national debate,” Vigilant’s website reads. “But it’s really quite simple. If you can’t tie a plate to a person, then there is no privacy issue. Notice the information that is included in the … license plate reader data record. There is no personal information included in this. There is no information on the owner, their address, their Social Security number, etc. The LPR system doesn’t even know what state issued the license plate … and there are duplicate license plates issued across the states. In short, this is all information that could be easily witnessed in public by a police officer or even a casual bystander.”

In spite of that assessment, there are databases available that do allow a user to match a plate with a person, their last known address, and the name of the previous registered owner, etc. Vigilant says people who do so are violating the Driver’s Privacy Protection Act (DPPA), which was enacted in 1994 to protect the privacy of personal information assembled by state departments of motor vehicles (DMVs). The DPPA prohibits the release or use by any state DMV (or any officer, employee, or contractor thereof) of personal information about an individual obtained by the department in connection with a motor vehicle record, sets penalties for violations and makes violators liable on a civil action to the individual to whom the released information pertains. However, the Act has a number of exceptions. A driver’s personal information may be obtained from the department of motor vehicles for any federal, state or local agency use in carrying out its functions; for any state, federal or local proceeding if the proceeding involves a motor vehicle; for automobile and driver safety purposes, such as conducting recalls of motor vehicles; and for use in market research activities. Personal data is also available to licensed private investigators. 

So, whether Vigilant likes it or not, a license plate image could easily be tied to an individual.

— Jennifer Johnson and Sharon Brooks

shadow