License-plate readersBoston Police has suspended use of license plate scanners

The Boston Police Department (BPD) has suspended its use of license plate scanners which enable law enforcement agencies automatically to scan vehicles for traffic or criminal violations. The announcement comes after a Boston Globe investigation raised privacy concerns regarding whether BPD is capable of securing the data collected from the license plate scanners.

BPD accidentally released to the Globe more than 68,000 plate numbers scanned during a 6-month period, raising privacy alarms.. Many of the vehicles were scanned several times within that period.

The release of the data raises questions about whether law enforcement agencies can protect sensitive data accumulated from the scanners. It also raises questions about whether the BPD was following up on alerts from the scanners, since several vehicles repeatedly raised alarms for the same offenses. The Globe reports that one motorcycle reported stolen raised scanner alerts fifty-nine times over a six month period. Another plate number with expired insurance was scanned ninety-seven times within the same time span.

In January 2013 investigators at MuckRock, a public-records group, joined theGlobe to request data accumulated from scanners. After initially denying the request, BPD agreed in April 2013 to release a collection of plates which had raised alarms, but without releasing individual plate numbers. The collection eventually released in July 2013, revealed full plate numbers and the GPS location of more than 40,000 vehicles, most belonging to private citizens.

MuckRock and the Globe notified BPD of the disclosure in September 2013 but BPD did not acknowledged the error until November 2013, when they requested theGlobe to return the database, but the Globe declined.

“We just took [the scanner program] off-line while the commissioner reviews it,” said Boston police spokeswoman Cheryl Fiandaca. Commissioner William Evans “wants to review it so he knows that it’s being used effectively and that it doesn’t invade anyone’s privacy.”

Privacy advocates insist that the BPD’s mishandling of data from scanners underscores how easily the technology can be misused. The BPD has in place policies to protect privacy, but the release of sensitive data to the press raises questions about how effective these policies are. “It’s not realistic to think that law enforcement will police itself when it comes to technologies like license plate readers,” said state Representative Jonathan Hecht, who recently filed a bill to regulate law enforcement’s use of scanners and the data they collect. According to Hecht, the scanner technology has “gotten ahead of thoughtful policy making on its use…. From their point of view, more information is always better.”

The American Civil Liberties Union of Massachusetts commended BPD for suspending its scanner operations and urged other law enforcement agencies in the state to follow suit. “We call on police departments statewide to cease using license plate recognition technology until the state Legislature passes regulation,” said Kade Crockford of the civil liberties union.

About sixty law enforcement agencies in Massachusetts use license plate scanners. BPD began experimenting with a scanner in 2006, but expanded the operation to fourteen scanners in spring 2013, enabling the department to scan as many as four million vehicles annually. The scanner operation has never been audited to determine its effectiveness, nor has its privacy policy been reviewed. According to a statewide investigation into license plate scanners recently published by MuckRock and the Globe, fewer than a third of police departments using scanners had a policy to govern the use of data accumulated.

The Globe claims that BPD’s release of six months of data violates the department’s policy, which stipulates that he department would only keep records for three months. Fiandaca claims that since the Globe’s data request took so long to resolve, the department collected data on two occasions, preserving three months of records on both occasions.

Hecht’s License Plate Privacy Act would limit the scanner retention period to forty-eight hours except by court order and require agencies to report annually on their scanner use. “If you go too far in collecting information just because you can, it undermines people’s confidence in government,” said Hecht. “That ultimately makes law enforcement’s job much more difficult.”