Don’t let Roanoke murderer justify a license plate reader rise

As someone who has been reporting on license plate readers (LPR) for some time now, it actually surprised me when I heard that Roanoke, Virginia, shooter Vester Lee Flanagan had been first located through the use of the scanning device. While the devices have been in use in Virginia for years, their effectiveness and efficiency there—and nationwide—is questionable.

According to local media accounts, when Virginia State Police Trooper Pamela Neff received the suspect’s plate number over her radio last week, she punched it into her LPR system and got an alert that the car had passed by not three minutes earlier. Within 10 minutes, Neff and other officers converged on Flanagan’s location, finding that he had shot himself, ending the manhunt.

There were a number of news stories and tweets that attempted to explain the technology to a public that is presumably unaware of its presence. One television reporter in Cleveland even asked Twitter for more information, saying he’d never heard of the tools.

How long have these license plate readers been around? Today was the first I'd heard of the technology that helped capture #roanokeshooter

— Chris Tye (@TVTye) August 26, 2015

Herein lies the problem: while everyone wants to hunt for a murder suspect with as many tools as possible, the reality is that such a situation is so rare as to be practically meaningless.

Snoopin'

If you live in a decently large city (over 500,000), chances are quite high that your local cops either already have LPRs or will soon, according to a 2012 survey by the Police Executive Research Forum (PERF).

71 percent of responding agencies use LPRs. 85 percent of agencies plan on acquiring or increasing their use of LPRs over the next five years, and expect that by that time the devices will be deployed in 25 percent of cars on average.

In addition to catching murder suspects, LPR data can also be used as a surveillance tool against the law-abiding public. In response to a public records request, we obtained the entire LPR dataset of the Oakland Police Department this year, and this cache included more than 4.6 million reads of over 1.1 million unique plates collected between December 23, 2010 and May 31, 2014. The dataset is likely one of the largest ever publicly released in the United States, perhaps in the world.

As part of reporting on how LPRs are used in Oakland, California, one city police captain told us that the hit rate on that trove of data is just 0.16 percent. To put it another way, out of every 10,000 cars scanned, just 16 of them are wanted or stolen.

If this rate is even vaguely representative, the Virginia State Police (VSP) got quite lucky.

In Virginia, it also turns out that no one, including one of the state’s largest law enforcement agency, knows just how effective the scanners are on a macro scale. In 2014, the Capitol City Project found that the Fairfax County Police Department (FCPD, which serves Virginia’s largest county) held over 2.7 million LPR records collected for about a year. However, that same agency "does not possess any" metric "to determine the system’s effectiveness."

This same agency found the Roanoke shooter, and it previously used its LPR system to record license plates of people attending political events. Specifically, the cops used LPRs for routine scans of attendees at the 2008 campaign rallies for then-presidential candidate Barack Obama and vice presidential candidate Sarah Palin as well as President Obama’s inauguration in 2009.

The American Civil Liberties Union of Virginia wagged its finger at the VSP at the time:

But by creating and maintaining a database of millions of license plates and targeting political activity, the VSP crossed well over the line from legitimate law enforcement to oppressive surveillance. In the cases of the campaign rallies and the 2009 inauguration, the VSP collected personally identifying information on drivers solely because those drivers were heading to a political event. These drivers were not suspected of or connected to any crime—their only offense was practicing their First Amendment rights to speak freely and assemble peacefully.

Law enforcement policies vary widely across the US concerning how long that information can be retained. Different agencies keep that data anywhere from a few weeks to indefinitely. Some cities have even mounted these cameras at their city borders, monitoring who comes in and out.

In December 2013, the Boston Police Department indefinitely halted its use of LPRs following an investigation into their use by the investigative journalism organization MuckRock and the Boston Globe. The devices have also been banned in New Hampshire since 2007, and LPRs have a 21-day retention limit in Maine.

A live issue

To be clear, I personally don’t believe that LPRs should be banned. During an active manhunt, they clearly can be a useful tool for law enforcement. The same goes for an active investigation—even if we don't know precisely how often they're used for a positive outcome. It's easy to imagine a scenario where short-term historical plate scans could be useful, and cops are quick to share plenty of anecdotes to illustrate this point. That said, a de facto or de jure weeks-, months-, or years-long retention period is invasive, unnecessary, and ineffective.

I would prefer a scan-and-delete regime. Under such an approach, unless a plate is on a hot list, its presence is deleted immediately from the historical record. However, if I were in the shoes of a local or state policymaker, I would be willing to hear law enforcement argue why at least a short data retention period (a few weeks or months at most) is necessary.

Earlier this year in Virginia, state lawmakers did just that. They presented Gov. Terry McAuliffe (D) with a bill that would have reduced the retention period to seven days absent an ongoing criminal investigation. He, in turn, amended the bill to 60 days. The state senate rejected this, sending the seven-day bill back to the governor’s desk—and McAuliffe vetoed it. That act effectively sealed the deal for the year-long retention policy, which means that such data can more easily be abused.

Back in the case of Oakland, after analyzing this data with a custom-built visualization tool, Ars was able to definitively demonstrate the data's revelatory potential. Anyone in possession of enough data can often—but not always—make educated guesses about a target’s home or workplace, particularly when someone's movements are consistent (as with a regular commute). Knowing nothing else besides an Oakland city councilman’s license plate, we were able to accurately guess the block where he lived in under a minute.

So clearly, this question of scan-and-delete is not merely an academic exercise. Luckily, there is a lawsuit currently before the state court in Virginia attempting to address this exact point.

Virginia Data Act of 1976 to the rescue?

The case, filed in May 2015 by the American Civil Liberties Union (ACLU) of Virginia on behalf of Harrison Neal, marks a unique legal challenge to the use of LPR by local law enforcement. In 2014, Neal asked via a public records request for all instances in which his car had been read by the FCPD LPR system; the agency provided documentation showing that he had been seen twice in 2014.

The case alleges that the FCPD, through its "passive" collection and storage of massive amounts of data (license plate number, date, time and GPS location), contravenes the Virginia Data Act of 1976. Passive collection is distinct from the FCPD’s "active" use of the data, when it scans an unknown plate against a "hot list" of wanted or stolen vehicles to determine if a plate is part of an ongoing criminal investigation.

In Virginia, the state’s own attorney general, in a 2013 letter to the head of the state police, said that such active collection violates the Data Act. Neal now wants the court to forbid the FCPD from continuing its passive scanning, where it routinely collects and stores thousands of LPR records on a daily basis.

The FCPD attempted to get the case thrown out, but last Friday, a state judge ruled that it can move forward.

"As we saw on Wednesday when the Virginia State Police used an automatic license plate reader to locate the individual suspected of killing two Roanoke journalists, when used correctly modern technology can be used to make us safer," Claire Guthrie Gastañaga, executive director of the ACLU of Virginia, said in a statement.

"Our client is not asking for the Fairfax County Police Department to stop using automatic license plate readers for active criminal investigations or for Amber or Blue Alerts. In those cases, the technology serves a valuable law enforcement purpose. He’s just asking that the Fairfax County Police Department stop using automatic license plate readers to collect everyone else’s data too."

I do hope the Fairfax County Circuit Court rules in Neal’s favor. It would do wonders for those of us that care about privacy in the face of an ever-widening collect-it-all mentality.

So in light of this high-profile LPR success story and this pending legal case, let's keep in mind three things when considering LPR use going forward. First, while license plate readers are becoming increasingly common, finding stolen or wanted cars—"hits" in police parlance—is extremely unusual. Second, the recent Roanoke manhunt is actually a great example of how LPRs should be used in practice—in short-term situations searching for a specific individual or group. Finally, as the Virginia lawsuit reminds us, LPR retention periods vary wildly from state to state. It's up to citizens to urge their local politicians to challenge such lengthy LPR data retention periods.