The Washington PostDemocracy Dies in Darkness

Are the police tracking you? Push to restrict license plate readers heads to Va. Supreme Court

Newport News, Va., Sheriff’s Deputy Robert Forrest with an automatic license-plate reader. (Joe Fudge/AP)

The police use of automatic license plate readers, photographing hundreds of license plates per minute and capturing the exact time and place of the photo, has become routine in law enforcement and is credited with helping to solve all manner of crimes, find missing persons and locate stolen autos. But the vast data those readers generate continues to alarm civil liberties advocates, troubled by the possibility of police tracking people’s movements, and now a legal challenge is headed to Virginia’s Supreme Court to determine whether the police can keep the information indefinitely — or not at all.

Different states, and individual police departments, have varying policies on how long the police can keep the data from their license plate readers. In Colorado, the data can be kept for three years. In New Hampshire, state law says the readers can’t be used at all. In Virginia, where there is no restriction, the American Civil Liberties Union entered the swirling controversy over data retention by suing the Fairfax County Police Department, seeking an injunction to prevent them from keeping the license data they currently maintain for a year. Last month, a Fairfax judge threw the case out, ruling that a license plate is not “personal information,” in what appears to be the first court ruling nationwide on that issue, important in states which prohibit government from keeping citizens’ personal information.

The ACLU is appealing that ruling to the Virginia Supreme Court. If the state high court reviews the case, its ruling would likely set a precedent in Virginia — either allowing police departments to maintain license data indefinitely, or requiring them to purge it almost immediately — that could launch a similar legal shift in state laws and police departments nationwide.

The Virginia case has attracted attention from national groups such as the Electronic Frontier Foundation and Vigilant Solutions, one of the largest manufacturers of LPRs, and both filed amicus briefs in the case. The Electronic Frontier Foundation said that some readers can capture 1,800 plate numbers per minute, and that one Northern California law enforcement agency had collected data on 3.2 million plates in just three months. Of those 3.2 million, only 720 were linked to crime, and the other 99.09 percent were not, the foundation said.

Vigilant argued that a license plate “is essentially a ‘mobile billboard’ that is seen by countless others whenever a vehicle is in public view,” and that since government mandates license plates be publicly visible, “the additional act of recording what everyone can see entails no invasion of privacy distinct from this universal viewing.”

When it comes to license plate readers, “data retention is in fact the most critical issue nationwide,” said Chad Marlow, advocacy and policy counsel for the ACLU. He said the police argument for maintaining data can be summarized as, “Just because, just in case. ‘Just because we’re collecting the ALPR data,'” Marlow said, “‘we might as well keep it just in case one of you might be a criminal.’ That is mass surveillance to a ‘T.'”

Twelve states have enacted laws specific to license plate readers, according to the National Conference of State Legislatures, with some limiting the amount of time the data may be kept from 21 days (Maine) to 90 days (Tennessee and North Carolina) to 18 months (Vermont). A survey by the Electronic Frontier Foundation found most California police departments kept the license data for one to two years, though the Los Angeles County sheriff keeps it for five. There is no reader-specific law in Virginia.

The Virginia lawsuit centers on another state law, “the Data Act,” which says that agencies “shall not collect personal information except as explicitly or implicitly authorized by law.” The Virginia State Police, concerned about whether their collection of license plate data violated the Data Act, asked the state attorney general for an opinion. Then-Attorney General Ken Cuccinelli (R) advised in 2013 that active collection of information for an ongoing case was legal but passive collection of license plates, without a need “clearly established in advance,” was illegal. The state police began purging their databases every 24 hours.

Despite Cuccinelli’s advice, Northern Va. police still maintaining database of license plates

But many police departments in Virginia ignored the advisory opinion and kept the data, some for as long as two years. A bipartisan measure to limit the data retention to seven days overwhelmingly passed both houses of the state General Assembly in 2015, but Gov. Terry McAuliffe (D) vetoed the bill at the urging of police groups, saying it would “negatively impact public safety.” The ACLU, representing a Fairfax County man whose license plate had been recorded twice by the automatic readers, sued the Fairfax police days later.

License plate readers automatically photograph up to hundreds of plates per minute, while in motion, then convert the numbers into text and continuously compare those with a “Hot List” of stolen auto plates and cars related to other crimes. If a connection is made with the Hot List, a monitor in the car alerts the officer, who can act immediately. Storing the plate numbers, and their locations, also enables police to look back in time to try to link a car to a crime scene, or to find a missing person.

License plate readers were used by police in New York to help track down a man suspected of planting bombs in Manhattan in September. Police in Arlington, Va., found a 67-year-old man who had been missing for two days, and was near death, when his car was recorded blocks away from his residence. A 2012 survey of police departments by the International Association of Chiefs of Police found that departments using license plate readers had increased their stolen auto recoveries by 68 percent. Don DeLucca, chief of the Doral, Fla., police and president of the IACP, said the readers had led to 42 stolen cars and one missing person in 2016 in his city of 56,000. He said the use of stationary readers at the entrances to the city was well known and served as a deterrent to criminals.

“The LPR system is a valuable crime fighting tool,” Fairfax police Chief Edwin Roessler Jr. said. “Often times crimes are not discovered immediately and/or we eventually develop leads in which we have to go back in time to develop probable cause and bring a suspect to justice to prevent further harm to the community.  This is a primary reason why it’s important to retain the data within the scope” of the Virginia Data Act.

Still, most of the stolen autos and missing persons are located quickly if not immediately by the plate readers. Maintaining time and location data of cars over time creates the possibility for abuse by creating a trail of personal movement, many experts said. “It becomes very seductive as a law enforcement tool,” said Joseph Schafer, professor of criminology at Southern Illinois University, “because you’ve got a lot of data.” Officers could use it secretly to obtain leads on cases, Schafer said, or monitor the movements of someone either for professional or personal reasons, and if violations occur, they would not likely become public.”This is a great example of how technology and data systems can encroach into our lives.”

The ACLU’s Fairfax lawsuit on behalf of Harrison Neal focused on Virginia’s Data Act law prohibiting the collection of personal information, defined to include an “agency-issued identification number.” Lawyers Edward Rosenthal and Hope Amezquita argued that “it is difficult to understand how the tag number assigned by the DMV…is anything other than an agency-issued identification number…which FCPD admits it stores in its ALPR database.”

In Fairfax’s first attempt to dismiss the case, a judge agreed with the ACLU. Fairfax Circuit Court Judge Grace B. Carroll ruled that the license plate, “by virtue of the link to the data bank to DMV tells you who that vehicle belongs to…this court finds that that is personal information.” Carroll added, “Otherwise, what would be the point of holding that information?”

But Fairfax moved for summary judgment in the case. Assistant County Attorney Kimberly Baucom argued that the license plate number of a vehicle “says absolutely nothing about an individual, his personal characteristics such as his fingerprints, or his membership in an organization…The FCPD’s ALPR database contains no additional information associated with the license plate number, nor did it contain any information specific to Neal.”

Fairfax Circuit Court Judge Robert J. Smith issued an opinion on November 18, embedded below, after finding no precedent anywhere on the issue of whether a license plate qualifies as personal information. Smith examined the issue from a privacy perspective, reasoning that if information isn’t private, how can it be personal? He noted that federal appeals courts have found that “there is no privacy interest in a license plate number,” in part because it’s in plain view, and that running a check of a license plate by an officer is not a violation of the Constitution.

“A reading of these cases,” Smith wrote, “logically leads to but one conclusion to that issue — license plate numbers are not personal information.” He dismissed the ACLU’s suit. The ACLU filed its notice of appeal on Dec. 20. ACLU-VA Executive Director Claire Guthrie Gastañaga said of the judge’s ruling, “It’s very hard to understand how a social security number or other government-issued number is deemed personal information, but your license plate number is not. All these numbers are indexed to your name across various databases easily accessible to law enforcement agencies.”

If the Virginia General Assembly added license plate numbers to the Data Act’s definition of personal information, as it did in the bill vetoed in 2015, the case would become moot. State Sen. J. Chapman Petersen (D), who helped create the bipartisan Ben Franklin Liberty Caucus in the General Assembly after the license plate reader issue intensified, said he would be taking another run at the matter in 2017. “Any type of surveillance technology that just randomly accumulates data,” Petersen said, “and makes it available to the police, I don’t accept it. I think it’s incumbent on us to put restraints on these types of technologies.”

A similar debate is rumbling through statehouses across the country, with about a quarter having already enacted reader-specific laws and another quarter of the states considering one, Schafer said. “It’s split,” the ACLU’s Marlow said of debates over how long to allow the data to be kept, “but because of politics, not philosophy. A lot of states have a practice of deferring to law enforcement, and a lot of the police departments are political forces in and of themselves. The politicians don’t want to take on that fight.” Politicians who oppose police on an issue could find embarrassing data about their whereabouts leaked, in one possible scenario of abuse of reader data, Marlow said.

Fairfax Chief Roessler said that wouldn’t happen. Existing laws “prohibit anyone from accessing the system for mere curiosity and/or abuse. Accessing the system is strictly held to law enforcement purposes only.” He said Fairfax’s policy “demonstrates how we safeguard from ‘big brother’ abuses. I will not tolerate such abuses by any employee as the public’s trust is paramount with this data.”

Marlow said he had spoken to a number of chiefs who understood the privacy concerns. “But they do not have a privacy mission,” Marlow said. “They take their responsibility as stopping crime. I understand that keeping data on every American would enhance crime fighting. Just as locking up every American would fight crime. We have to balance the equation.”

Here is Smith’s ruling in the Fairfax case headed to the Virginia Supreme Court: