Feb. 20 2013 11:20 AM

With 36 million location scans and counting, local police know where you've been

Illustration by Adam Vieyra
Where's your car? Well, dude, it's in a huge Orwellian police database.

That might seem like the plot of a bad movie, but since around 2010, police agencies in San Diego County have quietly used a network of sophisticated devices called license-plate readers (LPR) to monitor and record the movements of thousands of everyday drivers. Even as you read this, police cars equipped with LPR are patrolling the streets, automatically scanning and photographing every license plate in sight, tagging each with a GPS coordinate and filing the information away. For years.

With 36 million scans and counting—an average of 14 for every registered vehicle in the county—the database provides a mappable, searchable record of the movements of thousands of individual drivers. It's sort of like FourSquare for cops, except that it's involuntary, the data is secret and there aren't quite as many narcissistic hipsters.

The system's become a routine part of police work in San Diego County. Investigators at several local agencies say the historical data, stored in a database maintained by the San Diego Association of Governments (SANDAG), allows police to challenge alibis, locate witnesses and generally nab a lot of bad guys. It's not just local cops who use it; the FBI, DEA and investigators with Immigration and Customs Enforcement (ICE) are also tapping into SANDAG's records, leveraging the broader community presence of local police to prosecute federal crimes and immigration violations.

Police say LPR is the future of law enforcement, a Robocop-style "force multiplier" that maximizes what officers can accomplish. But privacy advocates say the sheer volume of information collected, and the indiscriminate logging of mostly innocent people's movements, amounts to a broad system of surveillance.

"With so much data, it becomes very easy to build a composite picture of what a person is doing, and to reveal an enormous amount of personal information, simply by tracking their movements," says David Loy, legal director of the ACLU of San Diego and Imperial Counties. When police can pull up a map of your travels—visits to your church or mosque, your doctor's office or weekly AA meeting—they have access to a great deal of sensitive information. "It becomes analogous to GPS tracking without a warrant," Loy says.

Most of the LPR devices in San Diego County are vehicle-mounted, but there are also portable LPR that can be set up at special events, and fixed devices installed at hotspot terrorist targets, or other places deemed worthy of monitoring, like along Highway 94 in East County.

The system's coverage is impressive. Lt. Glenn Giannantonio of the San Diego County Sheriffs Department says that when he types in a suspect's plate number, he can be confident that he's going to get a hit. "If it's a normal person driving around, you can pretty much guarantee that the car's going to get scanned," he says.

He seems to be right. According to information gleaned from a public-records request, my Subaru was scanned, and its location logged, 24 times in the past 13 months.

SANDAG declined to release the full details of the records, so there's no telling what scandalous predicaments I've been implicated in. But Dale Stockton, who manages the system for SANDAG, says that most of the reads occurred on a particular North Park street, not far from my home. This is typical of the system, Stockton says. If you happen to live on a heavily patrolled street, you're more likely to appear in the database frequently.

San Diego County's system is unusual; it's one of the most seamlessly integrated LPR databases in the U.S. Thirteen different agencies operating at least 56 units—each one costs about $25,000—all send their information to a shared, countywide server.

That the SANDAG system spans the county is especially troubling to privacy experts. In most of the U.S., individual agencies keep their own data in their own systems, making it hard to search across jurisdictions.

Stockton says the interconnectivity of the data systems is critical to making LPR a useable technology for law enforcement in the county. "The value is in the data, but the value is only there if we can share with each other," Stockton says. Criminals don't respect town boundaries.

SANDAG's system is worth paying attention to, because it may offer a glimpse into the future of LPR. As more and more departments acquire the technology—the majority of U.S. police departments already have at least one unit— shared systems like SANDAG's will likely serve as a model.

When LPR devices first showed up in the arsenals of local police more than a decade ago, they were used mainly to look for unregistered drivers and bums with overdue parking citations—less Robocop, more Bionic Meter Maid—and LPR is still used for this kind of real-time, "hot list" policing. As the device scans license plates nearby, it compares each one to a list of known, wanted vehicles. When there's a match, an alarm sounds inside the cruiser. San Diego Police Department spokesperson Lt. Andra Brown says in an email statement that LPR has been especially helpful in finding stolen cars with this kind of instant alert. But that application is becoming secondary to the mining of data.

Grants from the federal government, primarily the Department of Homeland Security, provided much of the funding for the county's LPR system. In an elegantly circular arrangement, Homeland Security agencies like ICE are now reaping the fruits of that largesse, by tapping into local databases for their own investigations.

Christian Ramirez, human-rights director for the socialjustice group Alliance San Diego, says such close cooperation can blur the line between local police and immigration authorities.

"It runs the risk of creating a gap between local law enforcement and local communities, and particularly immigrant communities," Ramirez says. "When that trust is eroded, when local communities believe there is close cooperation between local law enforcement and immigration authorities, they may be hesitant to contact local police."

Both Loy and Kade Crockford, a researcher with the Massachusetts ACLU, whose work has focused on LPR technology in agencies across the country, say they don't have a problem with using LPR in real-time to catch crooks. They don't even object to holding the data for a short period of time. But they consider the retention periods in the SANDAG system excessive. Currently, the shared database holds scans for between one to two years, which is typical of agencies nationwide. The San Diego County Sheriff holds on to its information indefinitely, in a duplicate, parallel system independent of SANDAG.

In Massachusetts, Crockford's group is pushing for a 10-day retention limit—enough time, they argue, to investigate crimes while also avoiding a long-term privacy threat.

"LPR is a really interesting technology," Crockford says. With some basic protections and limits on retention, many of the privacy concerns are alleviated. "It's really not hard to strike a balance between privacy and public safety."

Police say they understand the apprehension some people feel about LPR and stress that there are controls in place to protect data. Any investigator accessing the system has their activity logged.

"Short of a criminal investigation, no one is accessing this data," says Giannantonio with the Sheriff's Department, "so there really is no need to dispose of it."

Besides, police say, the system works. Sgt. Scott Walters of the Escondido Police Department says the data's been critical in solving hit-and-run cases, homicides, burglaries—you name it.

I've lost count of how many crimes we've solved because we've been able to go back and pinpoint locations," he says.

While it wasn't reported at the time, LPR data figured into one of the biggest criminal cases in recent county history. When police began to investigate John Gardner's role in the disappearance of Amber Dubois, LPR scans collected more than a year earlier in Escondido helped place him in that city around the time of her disappearance. If privacy advocates had their way, police point out, the data in that case would have been deleted long before it proved useful. Gardner was later convicted of the rape and murder of both Dubois and Poway teenager Chelsea King.

The question of whether this data gathering is legal is a matter of some disagreement. Police argue that a person traveling in public doesn't have an expectation of privacy. Furthermore, they say, no cop needs a warrant to write down your plate number. In that sense, LPR only does what a human cop can already do.

But privacy advocates say the sheer quantity of data being collected might change that basic principle. LPR isn't analogous to a human cop, because they're just too powerful. To match the performance of an LPR device, a police officer would have to read a license plate, take a GPS coordinate and note the date and time once every seven seconds, for the entirety of their 10-hour shift. That could get exhausting.

Crockford and others are hopeful that the courts might place some restrictions on LPR in the future, pointing to a concurring opinion from Supreme Court Justice Sonia Sotomayor in a recent GPS tracking case. But no court has ruled on the questions directly. Loy says he doesn't want to take away a powerful tool; he just wants to make sure that there are controls in place.

"I don't blame law enforcement for wanting to get more information," Loy says. "If I was in their position, I'd want all the information I could get. But we have a Constitution, and we have checks and balances precisely because no branch of government should be trusted completely." Envisioning a future where everyone's travels are constantly monitored? "That is extremely frightening" Loy says. "I don't think that's the world we want to live in."

After San Diego Mayor Bob Filner trumpeted the removal of redlight cameras in the city—which he's called, among other things, an invasion of privacy—we reached out to him for comment on LPR. His office didn't return calls or emails. But a written statement he provided for a congressional hearing in 2001 might shed light on his feelings. He was talking about redlight cameras, but maybe he'd say something similar about LPR.

"Will we be faced with the government acting as "Big Brother" continuously spying on law-abiding citizens?" Filner wrote. "I realize this might seem far-fetched to some, but we must remain vigilant against these types of abuse. … Technology changes faster than most of us can keep up with at this point. We must continue to try to use its benefits to better our society, but it must not be at the expense of fairness or freedom."

Correction: The original version of this story reported that Supreme Court Justice Sotomayor's opinion in the GPS tracking case was a dissenting opinion.

Write to editor@sdcitybeat.com.


See all events on Friday, Dec 2