February 2011

Not many people know that local police and the RCMP have already begun building a massive public traffic surveillance system. And no one knows how they’re going to use it.

THE A-NEWS REPORTER and Nanaimo constable interwove: “amazing,” “blown away,” “overwhelming.” “This will revolutionize the way we police,” proclaimed Vancouver police in The Province.

Both media and police across North America have engaged in such trumpeting about Automatic Licence Plate Recognition (ALPR). The RCMP and BC government piloted ALPR in 2006 and have expanded it rapidly. BC now has 42 police cruisers equipped with the technology, including one with the Victoria Police Department (VicPD), one in Saanich, and two in our regional Integrated Road Safety Unit.  

Normally, area police manually key in plate numbers to check suspicious cars in the databases of the Canadian Police Information Centre and ICBC. With ALPR, for $27,000, a police cruiser is mounted with two cameras and software that can read licence plates on both passing and stationary cars. According to the vendors, thousands of plates can be read hourly with 95-98 percent accuracy. These plate numbers are automatically compared for “hits” against ICBC and Canadian Police Information Centre “hot lists” of stolen vehicles; prohibited, unlicensed and uninsured drivers; and missing children. When such “hits” occur, plate photos are automatically stamped with time, date, and GPS coordinates, and stored. The officer will investigate details in the above-mentioned databases directly, and may pull over suspect vehicles.

At least, that’s how the popular story goes, and it sounds wonderful. However, some news stories have quoted academics or civil rights advocates worried about what else this plate recognition technology is, or could be, used for. ALPR was developed by the British government in the 1990s to track movements of the Irish Republican Army. By 2007, the International Association of Police Chiefs was issuing a resolution calling for “all countries” to begin using ALPR and sharing population surveillance data for fighting gangs and terrorism. Today in the UK, ALPR is used for charging tolls, “risk profiling” travellers, and tracking or intercepting people using cars photographed near protests.

But most Canadians’ concerns have been assuaged with statements like that in a Times Colonist article: “Both federal and provincial privacy commissioners have approved the system, which must comply with federal privacy legislation, said [RCMP Sgt. Warren] Nelson.”

Yet no one in Canada has actually investigated either police claims or the complaints. 

That lack motivated me, along with Christopher Parsons, a University of Victoria PhD candidate in privacy and surveillance studies, and Kevin McArthur, a web architecture developer and high-tech civil rights advocate, to form a research team.

Federal Privacy Commissioner Jennifer Stoddart’s office gave us our first shock of many.

ALPR was never approved

The federal Privacy Commissioner’s office directed me to statements they’d issued correcting journalists and the RCMP for saying they’d approved ALPR. In fact, the Privacy Commissioner described the ALPR program to parliament as “general and ubiquitous surveillance, without adequate safeguards,” and added, “We also urged [the RCMP] to clearly inform the public about the program and the uses of the information[.]”

BC’s Privacy Commissioner has discussed but never officially reviewed ALPR.

Next, I submitted an Access to Information request (the federal version of a BC Freedom of Information request) to the RCMP for a copy of their Privacy Impact Assessment (PIA) on ALPR. Federal agencies are legally required by Treasury Board to write such assessments detailing how new programs will work and appropriately handle Canadians’ personal information; they’re what Privacy Commissioners usually review. 

In August of 2011, we received an eye-opening 77-page Privacy Impact Assessment dated October 17, 2009 and titled “Final Revision.” 

According to this document, the categories of people that generate alerts or “hits” in the ALPR system, alongside car thieves and child kidnappers, are much broader than has ever been disclosed publicly. And information on these people’s movements is being retained in a database for two or more years. For example, though you may not be stopped, your car is a “hit” and its movements are tracked and recorded if you’re on parole or probation or, in some cases, you’ve simply been accused of breaking a criminal law, federal or provincial statute, or municipal bylaw. You’re also a hit if you ever attended court to establish legal custody of your child, if you’ve ever had an incident due to a mental health problem which police attended, or if you’ve been linked to someone under investigation. The list of hit categories continues through three more pages, and a fourth page that the RCMP completely redacted.

Meanwhile, according to the Privacy Impact Assessment, the RCMP is also keeping records for three months on the whereabouts of everybody else’s cars, too—this is called “non-hit” data. 

What, our team asked, did keeping massive databases of records on everyone’s movements have to do with catching stolen vehicles or uninsured drivers? Kevin McArthur suggested: “[ALPR] is not intended to be a police cruiser improvement and efficiency tool, but to be a surveillance tool.” 

I promptly submitted official information requests to the RCMP and VicPD for “all documents” related to Automated Licence Plate Recognition.

We have nothing, except everything

Normally, a journalist wouldn’t name or quote information access officers. They don’t publicly speak for the agencies at which they work. However, they’ve played such an important role in this investigation, some conversations merit reporting.

In August 2011, VicPD Information and Privacy Manager Debra Taylor called me to explain that, even though VicPD had the ALPR system in one of their cruisers, the RCMP ran the system, and I should contact them for any information.

“We actually don’t have a program,” Taylor said. “We don’t have any documents per se.”

She also said VicPD didn’t have any photographed Victoria cars, because that data was transmitted via encrypted USB drive to the RCMP’s database daily. Taylor read aloud an email from VicPD Sgt. Glenn Vermette which explained, with capitals and underlines, “to clarify, we (the VicPD) do not retain ANY data whatsoever regarding the ALPR… We retain absolutely NOTHING in the way of data, images, scans, NOTHING.”

I might have dropped it. But I heard my expert team in my head: VicPD is simultaneously admitting they’re collecting the data, and denying they have the data? And they’ve launched a major program with the RCMP without a single documented security protocol or working agreement?

So for 20 minutes I struggled with Taylor to explain why VicPD must have some documents.

“There must be at least some exchanges…Presumably somebody communicated with someone to actually set up this system, and continues to communicate,” I kept saying. “There must be some sort of memorandum of understanding…”

Taylor kept responding: “We don’t have it… I have nothing to give you…I’m not trying to withhold any information from you, I just, nobody, I can’t locate anything…They probably just have a note saying please follow the RCMP policy, but you’d have to get that policy from the RCMP.”

Finally, Taylor relented. “I’ll do a little bit more research and hopefully there’s some kind of administration paper trail.”

A month later, Taylor handed over 600 pages. We discovered that Vermette’s email was actually sent to Taylor herself over a year earlier in response to her questions. And it was just one of 80 pages of emails, of which 40 pages were sent or cc’d to Taylor, or written by Taylor, discussing the ALPR program. 

Meanwhile, what Vermette meant by “absolutely NOTHING” from ALPR hit records being kept by VicPD was apparently only in reference to digital information. VicPD had kept 500 pages of written, hard- copy logs of every ALPR hit they’d ever seen. 

VicPD refused interviews. So while my team members McArthur and Parsons pored over their documents, I contacted the RCMP.

It’s personal information, and not

During frequent emails and calls with two RCMP Access to Information and Privacy analysts, I was repeatedly asked to reduce the scope of my request for “all documents” about ALPR. Whenever I did, though, there were always eyebrow-raising reasons those specific documents couldn’t be produced. In five months, I got nothing. They also hadn’t sent the legally required deadline extension request. 

But the most remarkable responses emerged in relation to my continuing request for the ALPR database data.

The RCMP’s Privacy Impact Assessment declares that licence plate photos are not “personal” information—a supposition that helps them skirt privacy laws and deflect public concerns about surveillance. So McArthur had an idea: Put all the data on the web, and watch how long the public agreed with the RCMP’s position, once anyone could punch in a plate number and see where and when the cars belonging to Victoria’s mayor, police chief, the premier, union leaders, journalists, government employees, armoured car companies, romantic obsessions and ex-lovers had been driving or parked for the past three months.

Access to Information and Privacy analyst Yan Bellisle sent a search fee estimate. “The guy in BC called me and he’s like, ‘If you want everything, it means I’m going to have to pull out all the data from every car that has that system,’” she explained.

I suggested the data from the Victoria cruiser alone would do. Then, we waited like a bait car.

Shortly thereafter, Bellisle said the non-hit data didn’t exist. “In the Privacy Impact Assessment you probably read that all the data is kept...But the privacy commissioner came back saying that it was a privacy invasion.” Consequently the RCMP doesn’t store any non-hit data anymore, she said. 

Could she provide any documentation of that fact? She responded, “It’s not written anywhere.”

And the hit data? Bellisle said it was personal information, and consequently, “It’s going to be exempted under the Access to Information Act.” So I wouldn’t be getting that, either.

A second analyst, Christine Richard, also affirmed this. “Licence plates and such would be personal information.”

I pointed out the RCMP’s Privacy Impact Assessment stated it was not personal information.

Bellisle later said I’d get the hit data after all, but it would cost a lot because the records could only be extracted one by one. “It takes two to ten minutes to get one [record].” She offered to send a free, printout sample.

I asked my tech savvy team-mate McArthur if it could possibly take that long to pull the records.

“If you were to do it in a maximally complicated way on purpose, that could be,” he said. “But it should take seconds. That’s ridiculous, the idea that you couldn’t produce a report with all that data in it, with just the columns you want. Everybody who works with databases or knows databases knows that’s the primary function of a database.”

The free sample never appeared.

Does ALPR work? To what end?

McArthur, Parsons and I were relieved to hear the RCMP wasn’t storing non-hit data, but we were disturbed by the implications. Together with the flip-flopping on what qualified as personal information, this meant major policies and procedures around automated plate recognition weren’t coincident with their Privacy Impact Assessment. Was that even legal? And what else was the RCMP doing with ALPR and not documenting?  

Perplexingly, the federal and provincial privacy commissioners seemed less than forthcoming themselves.

McArthur added a salient observation: None of the touted benefits of ALPR required any retention of either hit or non-hit data. The system could compare licence plates to hot lists and nab stolen cars and prohibited drivers in real time. There was no normal policing need to store any ALPR data in a centralized database. The RCMP must have other reasons for retaining that data, but would they admit that publicly?

I was about to find out.

Superintendent Mike Diack and Sgt. Warren Nelson run the ALPR program out of RCMP “E” Division in Langley, BC. 

“I know more than anybody probably in Canada about ALPR within the RCMP,” said Diack. He apologized for the document delays from the RCMP’s Access to Information and Privacy analysts in Ottawa. “I said, ‘Hey, give him everything, absolutely everything, because this is the best program and it’s the future of policing.’”

Diack and Nelson seemed like good-hearted cops, but the future of policing seemed surprisingly underwhelming. Since 2007, about 100-150 stolen vehicles in BC have been recovered thanks to ALPR (in Victoria: zero). By comparison, Vancouver volunteers doing weekend patrols boast an annual stolen car recovery rate ten times that. 

Primarily, ALPR hits have led to 7,191 charges for no driver’s licence, 2,215 for no insurance, and 1,199 for driving while prohibited or suspended. But Nelson couldn’t show if crime or charge rates have been trending up or down due to ALPR, or are above or below areas in BC not using ALPR. 

Though commonsensically ALPR could increase some charge rates—hence its popularity with traffic police—a 2011 study in the Journal of Experimental Criminology noted that “the crime prevention effects and cost-effectiveness” of ALPR systems “remain under-evaluated.” Theirs, and the other lone study done, found that ALPR “does not achieve a prevention or deterrent effect” on any types of crime. This is the case with most camera-surveillance operations.

ALPR is definitely a make-work program for police officers—or one that seems to have little result other than possible citizen intimidation. Police easily get dozens of hit alerts per shift but, typically, less than one in four results in charges. Nelson explained that this is partly because police usually discover the cars of prohibited or suspended drivers are being legally driven by someone else. (Their whereabouts are still recorded and stored, though.)

“They do cause an awful lot of extra work,” acknowledged Nelson, “unless you’re really dedicated to doing it and don’t have other duties pressing.”

Last year, VicPD told the RCMP, “We do not anticipate obtaining any more ALPR units as we cannot keep up with the volume of work they produce.”

Nevertheless, the RCMP is hoping to expand ALPR, so I probed deeper.

I shouldn’t draw too much from the Privacy Impact Assessment, suggested Superintendent Diack. Between technology or program changes, he said, “Every two or three years there’s a new PIA...But it’s a horrendous amount of work doing those things...We usually contract it out.”

When asked if the database contains personal information, he and Nelson said absolutely not.

“All that’s in those hot lists is lists of numbers...and that image of the licence plate or the image of your car are in there, [but] neither are personal,” said Nelson.

Contradictions emerged, though: They later explained they kept hit data for exactly two years because it was a requirement for police under the Privacy Act—but that requirement applies only to “personal information.”

I read from the PIA hit list: Why were they tracking, say, people who went to court to get child custody?

“That can’t be what it says,” responded Diack. 

“I think perhaps you’re not reading it the way it’s intended,” said Sgt Nelson.

I wasn’t the only one wondering, though. When I’d read these sections to the federal Privacy Commissioner’s ALPR expert, she’d been surprised and directed me to Diack. Meanwhile, VicPD documents show BC’s assistant privacy commissioner expressing concern in 2010 and requesting “a list of the proposed [hit] alerts.” VicPD officials directed Taylor to ask Nelson, and there the paper trail ends.

I requested written clarification. Nelson confirmed those four pages I had received described ALPR hits. He provided explanations: if you try to cross a border, police should know if you have legal custody of your child; if you’re seriously mentally ill you could be dangerous, etc.

As for the non-hit data, Diack confirmed that, at the request of the federal Privacy Commissioner, it was no longer being retained. However, they’re planning to start tracking all of us again. “We’re now working on a new Privacy Impact Assessment in regards to being able to retain our non-hit data for one year,” said Diack. 

According to my fellow researcher and PhD candidate in surveillance, Christopher Parsons, last October, at a privacy conference, VicPD Chief Jamie Graham also publicly expressed interest in retaining ALPR non-hit data. 

Diack said he’d take seriously any concerns Federal Privacy Commissioner Stoddart’s office had with their plan; however, he added, “I’m not aware that we need approval of the Privacy Commissioner.”

The real agenda and function creep

Micheal Vonn, policy director for the BC Civil Liberties Association, has long been expressing concerns about surveillance. 

When I described our team’s efforts figuring out what was going on with ALPR, she commented, “It’s increasingly difficult to speak about getting information from the police, and I would say in particular the RCMP, without invoking either Lewis Carroll or Kafka...You get the sense that it’s strategic, that it’s tactical, that simply having nothing to have a debate about by moving the targets constantly and not providing transparent information is actually part of the program...If you’re not troubled by the surveillance technologies at issue, you should be deeply concerned about the citizens’ ability to understand what their government is up to.”

Vonn disagreed with Diack’s lack of concern about the PIA’s differences from the program itself. “As you’ve discovered in your inquiries, it’s like trying to nail Jell-O to the wall. Trying to say, ‘What is it exactly that you’re proposing? What exactly is it that you’re doing?’...So the policy documents are incredibly important.”

And if the RCMP hired an outside contractor to write their PIA, said Vonn, “Then you have to ask yourself, to what degree is it ‘baked into the system’? It just seems to be applied like icing on top. And what you’re discovering is, people don’t even know the content of it.”

As for Diack and Nelson’s contention that the ALPR system doesn’t collect personal information, Vonn said, “What a pile of hooey. Personal information is any information that has the inherent ability to identify you personally...They’re not stopping the car because they think your neighbour is driving it.”

The RCMP’s intent to keep all non-hit data for one year drew a silence. Then Vonn said, “Shocking…What essentially you heard from them is, ‘We want a massive surveillance system of all travellers on the highway that we encounter. We want an absolutely massive surveillance system of general population travel patterns.’ It doesn’t mean anything else.”

She continued, “As an illustration of function creep, you have an absolutely brilliant illustration here...It means we go from instituting a technology that comes in through the back door of a pilot project, never properly debated up front…and the whole rationale is going to be stolen cars. And within how many months of the pilot, we’re already pushing for population-based surveillance...Now that as an illustration of function creep is about as tidy as it gets: ‘How about stolen cars? Oh, hells bells, how about everybody.’”

Distracting police from real work?

“I think people should be outraged,” commented my fellow researcher McArthur. “The public needs to know what’s going on...The concept that somebody’s going to record where I was, at a point in time, for no reason, with no probable cause, with no warrant, with no anything...And it’s not just me, it’s going to be thousands of people. Every day. It’s too much. It crosses a line...It’s not what I think we need, or is safe to have, in a democratic society.”

How might BC’s ALPR system be used if the RCMP implement their plan?

McArthur noted that typical commercial ALPR software boasts built-in tools for movement mapping, data mining, and intelligence analyses. People who live in high-crime areas or who have unusual travel patterns may be targeted with more suspicion, for example. But it could easily go further.

“This isn’t just as simple as I collected a licence plate and I checked it against a database. It’s a geographic piece of information that says this person and this person were in the same place…And when you start doing social network analysis or group analysis, you can learn associations, you can start to make inferences,” explained McArthur. He added, “There are certain activities that need to be secret from the state. Meeting with a journalist. Organizing a trade union...This could be very dangerous in the wrong hands. Maybe that’s not today’s place, but what about 10 years from now?”

Vonn agreed, adding that ALPR and other surveillance systems are notorious for drawing police away from traditional policing (following leads after a crime has been committed) towards intelligence operations.

“So we’re not looking at a situation where we’re investigating a particular wrongdoing. We’re capturing data for a potential for wrongdoing,” Vonn explained. “That’s criminal intelligence...Essentially a mapping of the population with pre-crime in mind. We’re collecting data on you in case you are a criminal. We’re collecting data on you in case we need it later.” 

Information collected may also be used outside judicial processes, said Vonn, to build no-fly lists, intercept protesters going to protests or, as in Vancouver’s infamous program, prevent certain people from entering pubs.

“And the reason you need to be worried even if you’re not a ‘bad guy’,” continued Vonn, “is because that’s not the criteria anymore. The criteria is whether or not you’re a risk...And what constitutes being a risk is something that’s a formula, an algorithm, a series of data points...You are a risk when you fly if any of the following gets checked off...It’s a kind of intelligence-generated slander...a prejudice generating machine...And your ability to defend yourself against surmise is extremely difficult.”

However, the RCMP’s Privacy Impact Assessment states ALPR is “not to be used as an intelligence gathering tool.”

“It’s not the intended use of this system,” confirmed Diack. “It’s to identify licence plates associated with criminality, people who have committed an offence or suspected of committed offences, so we can interdict them and act appropriately.”

If RCMP retain the ALPR data on everyone, said Diack, then it could help active criminal investigations. Police could be allowed appropriately regulated access to a potentially rich repository of information about a suspect's prior movements.

Even if Diack and Nelson have the best intentions, Christopher Parsons, my fellow researcher, commented, those aren’t inscribed in solid policy documents. So what might a future RCMP, other government agencies, secret services, or US Homeland Security do with detailed information on specific Canadians’ daily movements? “The fields, the things they’re looking for now, the things they’re recording now, the current data-sharing framework, that is what we see today. But there’s no reason to suspect or to believe that it will remain static. That isn’t the nature of these programs.”

A good example is the Canadian Police Information Centre itself, designed as a shared repository of Canadian police records. Who envisioned its newest uses—US border personnel turning back Canadians with mental health incidents in their past (as Ontario’s Psychiatric Patient Advocate Office revealed recently), and local police tracking their movements via ALPR?

And fluidity is already evident: Sgt Nelson contended, “Our information is our information and we don’t share it.” Yet the ALPR Privacy Impact Assessment states, “Eventually information may be shared, disclosed and retained internationally.”

Who’s protecting us?

Privacy expert Raymond Wacks writes that attacks on privacy have an “air of injured gentility” and often aren’t taken seriously in comparison to other social problems. Yet privacy, he points out, is the foundation of free speech, free association and equality before the law, and essential for our sense of freedom to be ourselves, for emotional release and sharing confidences and intimacies, and for test-running new ways of being.

And while ALPR is just one of many surveillance systems encroaching upon us, it’s illustrative of the dearth of mechanisms in place to protect us. 

For starters, BC Civil Liberties’ Vonn explained, our legal limits on police rights to gather personal information are scant. 

“The police can collect information without consent for the purposes of law enforcement, or else they couldn’t investigate anybody,” said Vonn. “Does that mean they can film anybody and walk around behind them?...Anything a police officer does is for a law enforcement purpose?...What are the parameters? We don’t have any case law on that...I envision there being a [legal] challenge at some point, an inquiry or otherwise, into this kind of sweeping definition of what constitutes personal information collected for law enforcement.”

Parsons added that police themselves have traditionally limited and prioritized their investigations, because they simply couldn’t afford to conduct unlimited investigations on everyone. Cheap, modern surveillance technologies remove that limitation.

“The more you add efficient surveillance mechanisms,” said Parsons, “the easier it is to start hammering at those underlying assumptions, those underlying frictions that guarantee our freedoms.”

And it’s nearly impossible for the public to hold police to account. Any agency can avoid releasing information for years. According to an Access to Information and Privacy source, federal agencies that repeatedly get annual poor grades from Treasury Board on meeting access-to-information responsibilities may simply be directed to hire more staff. BC’s rules are similarly anemic.

Who else could help?

Neither federal nor provincial Privacy Commissioners have enforcement powers. Consequently, a source in the federal office explained, they regard Privacy Impact Assessments as ever-evolving frameworks for discussion, and rely on collegial, consultative, cooperative relationships for any leverage they have. That’s likely why no official representatives from either office would speak to me about this controversial program, instead offering either cryptically crafted letters or “backgrounder” responses from unnameable sources.

Treasury Board holds ultimate authority federally to ensure PIAs are up to date and programs comply with privacy law. Yet when I bluntly asked whether the RCMP’s PIA must reflect how the program actually works, a Treasury Board source answered that “it is the responsibility of each institution to determine how to develop and maintain these assessments” and directed me back to the RCMP. 

“I worry to think that we should be relying on the police to decide when and when not to surveil the public,” said McArthur. “It should be that you submit your PIA to the Commissioner for approval, get it approved, ‘Okay, you’re allowed to do that.’ And then when you want to do something else, you go back and say, ‘Here’s the updated one.’” 

Certainly, our governments must lay legal groundwork, and the 2009 Madrid Privacy Declaration, signed by privacy experts around the world, provides direction: “Noting with alarm the dramatic expansion of secret and unaccountable surveillance” threatening democracies world-wide, they call for “meaningful Privacy Impact Assessments that require compliance” and a moratorium on mass surveillance to allow for public debate.

Parsons wondered why police aren’t collaborating with people like these. “It seems as though [civil liberties] advocates are seen as a problem, a potential issue that has to be resolved, rather than as collaborators to sit down and work with to safeguard Canadians.”

Vonn similarly observed that police and politicians use the rhetoric of “Batman and Robin” and “good guys versus bad guys” so often to promote their agendas, that it makes critics seem antipolice, and sidesteps honest, transparent debate.

“Of course we need policing,” said Vonn. “We need appropriate, responsible policing, and we need transparent policing, with civilian oversight...It’s a very basic democratic model. I think this retrenchment into ‘you’re for us or against us’ is deeply unfortunate.”

Vonn added, “If we care about a free and democratic country, we’d better not allow an entire infrastructure of unaccountable surveillance to be built up around us as we are placated with Batman and Robin homilies.”

WHEN MY RESEARCH TEAM REGROUPED, Kevin McArthur said, “I can’t say I know what’s going on.”

Christopher Parsons noted: “The three of us are probably some of the most informed citizens on ALPR in Canada, and we’re still asking these [basic] questions. That’s absurd.”

Examining it more closely for this article, I found my own best summary right in the RCMP’s Privacy Impact Assessment. In lengthy sections answering legal and policy questions, some pages declared, “No personal information is recorded during the ALPR operation.” But I found other pages declaring the opposite: “The only personal information stored in the ALPR database is the vehicle plate number.” So here we had Canada’s national police force addressing the key issues of privacy protection in the defining document for a massive surveillance program authorized by our federal and provincial governments...but had anybody other than us three even read this thing carefully? 

Holy lack of accountability, Batman.

Rob Wipond has posted hundreds of pages from his access to information requests about ALPR.