Last month, the Department of Homeland Security called for bids on a national license plate tracking system. The database would contain information from license-plate-reader cameras that scan and log passing cars and assist Immigration and Customs Enforcement in hunting down "criminal aliens and absconders," according to the contract proposal. As the Washington Post pointed out, DHS failed to address the privacy issues that might arise from recording the movements of anyone who's ever been in a car.

After the bid unleashed a torrent of criticism and bad publicity, DHS canceled the contract proposal and claimed that ICE leadership didn't even know about this effort to up their game. Everyone relaxed; DHS was not trying to build a database of everybody's vehicular movements after all. As it turns out, DHS didn't need a national license-plate database, because such a database already exists. It's run by a private company called Vigilant Solutions, and ICE and other law enforcement agencies have been dipping into it for years, according to documents obtained by ACLU Massachusetts.

According to its website, Vigilant "creates intelligence by merging previously disparate data sets such as fixed and mobile license plate recognition, public records, facial recognition, and more." In its spare time, it's suing the state of Utah for passing a law restricting the collection of license plate data.

AlterNet spoke with Kade Crockford, director of the Technology for Liberty program at the Massachusetts ACLU, about Vigilant Solutions, law enforcement abuses of privacy and the dangers posed by license plate reader databases.

Tana Ganeva: Why do you think there was so much confusion around this story and what should people know?

Kade Crockford: I'm not sure why there was so much confusion about the story. The first references to it I saw were from the right-wing blogosphere and basically the headlines were things like, "DHS plans to build massive license plate reader database!" Naturally I was interested in that because it is a pet obsession of mine. And so I clicked on the solicitation for bids and I actually read it—unlike that many people who wrote about it. And it was pretty clear to me that in fact no, DHS did not intend to build its own nationwide license plate reader database. The solicitation read almost exactly like it was written by the company Vigilant Solutions, a description of a database the company already offers law enforcement nationwide.

So my assumption is that in fact what DHS was doing was going through a relatively mundane bureaucratic procedure that they have to go through in order to apportion funds for the purchase of more subscriptions to this database.

As a document we posted to the ACLU website shows, ICE has been tapping into this database for years. Law enforcement all over the country has been tapping into it. The FBI more than likely does as well. It holds about 2 billion individual license plate records in it, and according to the company it grows almost 100 million plate reads per month and those numbers are just going to keep going up. So ultimately what we're looking at is a database that contains billions of records and law enforcement has access both for free on a tier one subscription plan, which allows a limited number of searches per week or month and then a tier two subscription service that they have to pay for, which I believe gives unlimited search of the database.

So it's false to say that this database is not actually happening as a result of DHS withdrawing the solicitation. More than likely DHS is going to in fact pursue more subscriptions to this database. I would be very, very surprised if [Homeland Security Secretary] Jeh Johnson instructs ICE to never use this database again. I think there's been a lot of misunderstanding about some of the basic facts about the state of license plate tracking technology today.

TG: How is the database being used?

KC: In the documents we obtained they're using it to do what ICE does, which is to hunt people down to deport them. There's one reference in the document about an ICE agent who was looking for this mother and her two kids to deport the mother. But he couldn't find her because she wasn't living at the address they had on file for her. But thank God for the Vigilant Solutions database, which contained records of her license plate and so this ICE agent staked out the house where her car was last seen by the surveillance system and sure enough, there she was, and success story—he separated this mother from her children and deported her.

And police are using license plate readers for a variety of purposes. We found a couple years ago in one of the reports the AP published about the NYPD spying on Muslims. The NYPD was using license plate readers, parking them outside of mosques to collect records of every person who drove to the mosques.

But your imagination is the limit in how police can use this information, for legitimate purposes and illegitimate purposes. I'm sure that police departments are using them in the way they say they are, to track down people they suspect of criminal activity, but frankly I would be very surprised if police departments were also not using them to track dissidents and ex-girlfriends and all the other abusive ways information can be used inappropriately.

TG: Groups that defend the technology say there's nothing to worry about, it's just to track stolen cars or bad guys. And the technology doesn't sound that bad—it's just taking pictures of your license plate.

What should people know about how the data is collected and used? What are the ramifications of having a giant national database of license plate information?

KC: Ultimately, as the technology proliferates and we get to the point where we are now with surveillance cameras in urban areas—they are everywhere. The same is going to be true with license plate readers soon and once that happens law enforcement or anybody else with access to these private databases are going to be able to enter someone's license plate number into a database and up will pop a map showing where you've driven over a period of years or decades, depending on how long these companies retain the information.

As of right now, my assumption is that they retain it indefinitely. We've heard nothing from the company about them deleting this information after a certain amount of time. What we're really looking at is a massive retroactive location tracking system: completely warrantless, completely suspicionless, targeted at the entire population.

And if I need to spell out why that's a problem for people, then really that's a problem.

We have a Fourth Amendment in the United States, which protects us from unwarranted intrusion into our private life unless the government has reason to believe we're up to no good and shows that reason to a judge and gets a warrant.

We're finding that in the absence of legislators updating the law to reflect the kind of technologies we use to communicate and the technologies that law enforcement uses to spy on us, courts are hashing out how to apply the Fourth Amendment, and the First Amendment in the digital age and it's a very uneven playing field right now. There are some places in which there are more restrictive laws as a result of courts ruling that certain law enforcement techniques can only be done with warrants, and there are other places in the country where it's the Wild West, there are no meaningful restrictions.

And license plate readers are one area in which we think it's very obvious that if we wait for some sort of case in which somebody's brought up on charges that were based off of retroactive long-term location tracking through a license plate reader, of course they'll make the same kind of judgements they've made about cell site location information for example, which is a good thing in a sense, but we don't want to wait for someone's rights to be violated before we actually fix the law.

We believe that it's legislators' responsibility to step up to the plate and regulate these tools. Contrary to the claims of companies like Vigilant Solutions, which profit from hits to people's privacy, the ACLU's position is not that we oppose all uses of license place readers. I understand that there are probably a lot of people who do, and I sympathize with them, but our position is in fact that there's a compromise that can be made. That there are reasonable interests on the law enforcement side, in retaining even non-derogatory license plate data for a couple of days. A week or two tops. Because it's possible that in the event of a serious crime, a rape, a murder, that information will be incredibly useful to law enforcement agencies, to see who's in the area at the time of this crime, and that's OK—we acknowledge that.

What is not legitimate and not OK is for law enforcement to be tracking innocent people's movements over a period of months or years or decades or indefinitely. This is not acceptable in a free society, and we believe that courts are ultimately going to make that judgment. It's just that we shouldn't wait five or 10 or 20 years until the courts get this question before them. We should act now to update the law to just require the same thing that we want of cops when they go to a cell phone company to get information about where our cell phones have been.

Our argument is that that should be protected by a warrant, and the same should go for license plate data. If the cops collect it themselves, they should only be able to retain it for a limited amount of time. Again, days or weeks, not months or years. And if they're getting it from a private company like Digital Solutions that they should have to get a warrant for that, in the same way that you have to get a warrant to go to AT&T and demand cell site location information.

TG: What are the ramifications of having private companies collect this kind of data?

KC: It's really tricky because in a sense it allows law enforcement to obtain access to months or years or even decades of this information through a sort of back door. And that's why need to make sure there's a warrant protection in there. So Vigilant is obviously the leader in this field, it's the company we have to worry about right now (it also has a sister corporation called Digital Recognition Network that sells this information to insurance companies).

Anyway, they're suing the state of Utah right now, citing a First Amendment claim, because the state of Utah passed a very restrictive bill that says that private companies can't collect this information, so this is a real problem where maybe the First and Fourth Amendments do conflict in a way, but that doesn't mean that we as data subjects, essentially, should completely lose our right to privacy and information showing very detailed maps of where we've been over a period of months or years, so the question of exactly how to regulate privately held data sets is a very complicated one and one that people are trying to work out.

But the very immediate answer to the problem of law enforcement's deployment of this tool is to require police to get a warrant before they access this data because that would essentially prevent police from doing what they do now, which is simply log onto this website and perform searches. As far as we know, there's nothing stopping police officers from making 1,000 searches a day if they want to, if they have paid for the access. So we want to prevent those kinds of fishing expeditions.

Even though it's disturbing and very creepy that a private company is tracking you and selling this data to other companies, Vigilant Solutions can't lock you up and the police can. And so it's critical that we deal with this immediately. The much more difficult question of how to regulate privately held data sets we're really just beginning to grapple with. And there are some sort of consumer protection analogues that we might want to think about, but right away the law enforcement question is easy to deal with, and we should deal with it.

TG: What are other states doing to restrict police use of license plate data?

KC: New Hampshire's law bans license plate readers almost entirely front the state, including police use of them. The only license plate readers that are used in the state are at certain bridges. But cops are even prevented from using them in New Hampshire. There are department policies in places like Ohio, with the Ohio state troopers—they don't keep any plate data unless it's a hit, shows evidence of a crime.

So police departments throughout the country are using this technology in very different ways. A good way of explaining the two different ways to use the tool is, one of them is what the Ohio state patrol is doing, which is to automate a process that law enforcement has always done which is to check license plates against lists of stolen cars, etc. And to go after the people if there's some sort of allegation. The second way of using license plate readers is what Vigilant is doing, and what many law enfacement agencies around the country are doing, which is to use them as intelligence tracking databases. And that is the piece of this technology that we think incompatible with a free society.

Even something that's not suspicious, like where your girlfriend was last night or to see where the journalist who's been bothering you about the license plate readers has been hanging out, to see if you can catch them drinking at a bar.

That actually happened in Canada. There was a journalist who was getting under the skin of a police department and they used a license plate reader and discovered this journalist hung out at a certain bar and they sent a cop there hoping to catch the journalist driving drunk. Again, your imagination is really the limit over how you can use this information. And that's precisely the problem, so we need to have judicial involvement and for there to be specific evidence of a crime instead of just this free-for-all.

TG: There are various efforts at the state level to regulate these different types of mass surveillance, but at the federal level the pull seems to be in the opposite direction.

KC: Congress has moved in the wrong direction since 9/11, breaking down barriers between different law enforcement agencies, making it easier for agencies to share information about perfectly innocent people, the creation of massive domestic database storage. There's the National Counterterrorism Center, which is run by the CIA but staffed by members of all sorts of domestic law enforcement agencies. So Congress has moved in the wrong direction.

But I do think there's a huge role for state legislators to play here. Obviously when state legislators enact laws to protect people's privacy from unwarranted cell phone tracking, or license plate tracking, or drone surveillance—that does not restrict the FBI and DHS from doing those things in the states. So that's a major problem. Particularly given the level of coordination and organization between state and federal law enforcement at this point. So even if we pass local and state laws, state cops might be able to get around them just by calling up their buddy at the FBI and asking them to do the surveillance for them because they can't do it without a warrant, but the FBI can.

We need Congress to act to bring the Fourth Amendment into the digital age. In the absence of Congress acting, the courts are doing it, and the problem with that is that it's giving law enforcement a patchwork of laws. In order not to just protect people's privacy but lessen headaches for people trying to understand the state of the law, and for law enforcement trying to apply it, we absolutely need a uniform federal law reform.

1247211_orig.jpg