July 19, 2013 - Four Oregon jurisdictions are known to be among the hundreds nationwide that the American Civil Liberties Union says are using automatic license plate recognition (ALPR) scanners to assemble a "single, high-resolution image of our lives.” Clackamas County, Oregon City, Portland, and Salem had confirmed local use of ALPRs by fall 2012—one vehicle-mounted device in Oregon City, four devices each in in Portland and Clackamas (we have since learned that Portland utilizes an additional twelve ALPRs), and one “system” with an unspecified number of devices in Salem. Medford provided a draft policy but no information about actual systems in use. The ACLU of Oregon was one of 38 state affiliates that participated in the coordinated nationwide effort that netted more than 26,000 pages of documents from 300 police departments and agencies through 587 freedom of information requests.

The rapid proliferation of ALPR systems in the U.S. through 2012 and the dangers of collecting and storing information about innocent people without uniform policies and procedures are decried in “You Are Being Tracked,” an ACLU report released Wednesday, July 17, 2013. Law enforcement agencies use ALPRs without probable cause or warrants. These tools were designed to enable efficient police work but, in effect, enable retroactive surveillance of millions of unsuspected—and unsuspecting—people. They allow authorities to know how often a driver frequents a place (such as a bar), joins a protest, gets medical or mental help, is being unfaithful to a spouse, and much more, and existing restrictions on how the information can be used are vague at best.

The ACLU report shows that instances in which ALPRs serve legitimate law enforcement purpose by assisting criminal investigations account for a tiny fraction of license plate scans (the highest hit rate was 0.3 percent, in Burbank, IL), and many police departments are storing millions of records for periods that range from 48 hours to indefinite retention. ALPRs gather information including time and location from all passing cars, at rates up to 3,000 cars per minute. The cameras usually operate on both infrared and visual light spectrums, allowing the system to operate day and night. Private companies also use ALPRs for purposes such as repossession and they share information with police with little or no oversight or privacy protections.

ALPR policy documents obtained by ACLU of Oregon typically identify potential uses for database contents and cite basic regulations that govern their use, such as circumstances under which action may be taken following a matching license plate “hit,” but the policies vary widely in content and level of detail. Most contain generally worded statements that data may be queried, accessed, or disseminated for official law enforcement investigative purposes only, and some contain provisions for accountability and safeguards in areas such as access to data and maintaining confidentiality. Specifics about duration of data storage, however, show striking disparity. A Clackamas County draft policy that the ACLU received in December 2012 states that information gathered by ALPR shall be retained for 10 years. An Oregon City policy dated August 29, 2012, specifies only that ALPR data “should be stored for the minimum period established by department records retention guidelines, and thereafter may be purged unless it has become, or…will become, evidence in a criminal or civil action.” In Portland, Mayor Charlie Hales issued an Executive Order April 9, 2013, that dictates data retention for a minimum of 30 days and maximum of 4 years.

The creeping growth of the use of ALPRs in Oregon and the U.S. is part of escalating concerns and debate about what ACLU staff attorney Catherine Crump, author of “You Are Being Tracked,” calls “the most important surveillance issue of our time.” Should government collect and store data from telephone calls, Internet usage, emails, vehicle movement, or any other kind of personal information, just in case it should become useful in identifying a criminal? Should private industry such as electric companies using “smart grids” collect data that could allow them to know when you take a shower or run your dishwasher? Should government and private industry share such information? And most importantly, when will there be consistent statutory limits on access to, use of, and storage of such data—and what will those limits be?