Policing Project calls for heightened regulation of Flock and ALPR cameras

Flock cameras are seemingly everywhere, both on real-world streets and in the news. In mid-September, the company made headlines when one of its cameras was hacked and the collected data of 50,000 vehicles was stolen. Just weeks prior, Texas Governor Greg Abbott barred state agencies from spending funds on Flock cameras and the state of Florida announced the ban of Flock cameras on state-maintained roads.

Flock is a specific brand name for a broader and increasingly controversial camera technology: automated license plate readers (ALPR). These special cameras use artificial intelligence software to take photos of vehicles and collect information about cars’ license plate numbers, make, model, and color. The result can be a robust cataloging of all vehicle traffic on a road at any time of day.

“We call them vehicle surveillance systems,” says Max Isaacs ’17, the Policing Project’s director of technology law and policy. “[We call] them that because we think it's inaccurate to call them license plate readers. They’re surveillance systems, with far greater capabilities than just reading license plates.”

The Policing Project at NYU School of Law, which works with communities and public safety departments around the US to promote accountability and transparency in policing, has been a longtime advocate for the regulation of ALPRs. One recent effort is a comprehensive scorecard for state legislation regulating ALPRs such as Flock cameras. According to the scorecard, half of all US states have no laws regulating the use of ALPRs or the data they collect. Of the 25 states that have such laws, many fail to address key issues such as privacy, data sharing, and false positives.

To learn more about these camera systems—including their potential for abuse, avenues for regulation, and the Policing Project’s work in this area—we spoke with both Isaacs and Barry Friedman, the Policing Project’s founder and faculty director. Friedman, the author of Unwarranted: Policing Without Permission, is a preeminent authority on constitutional law, policing, and criminal procedure. Isaacs leads work focusing on emerging policing technologies and their implications for civil rights, civil liberties, and racial justice.

What are ALPRs used for? Why do they seem to be so commonplace? 
Max Isaacs: There are various things that police can do with the collected data. One thing they can do with that data is search it. For example, police might want to know where a suspect has traveled over the past 30 days. Well, you can type in a car’s license plate and the system will search all that collected data and find the locations the vehicle was detected—you can think of that as a location tracking function.

There’s also a much different way the data can be used. Police have lists of vehicles that are wanted — maybe a driver has a warrant or the car has been reported stolen. And when the ALPR detects a vehicle that’s on one of these lists, it’ll generate an alert.

What I’ve just described, that’s sort of ALPR 1.0. These are the classic functions—but what Flock and a lot of the other companies are doing is developing entirely new ways to use the data. One thing ALPRs can now do, for example, is take all of that collected license plate reader data and try to find connections between vehicles, — try to determine who might know whom — based just on their driving patterns. Once you've collected all of this data, there are a lot of things that you can do with it. Often jurisdictions bought these tools thinking they were quite limited, but with the advent of AI they’re becoming more and more powerful.

Barry Friedman: I’m just going to add a couple of things. One is the cameras actually can do even more than Max said, in the sense that, for example, you could search for cars that have body damage on the back left fender. Because some of them are taking pictures of the drivers, you could use facial recognition. And so they are very smart cameras. They get very smart about knowing where everybody is [on the road].

Are all of the hot lists for situations where there would be a warrant, or is it more general? 
Isaacs: Sometimes yes, but oftentimes, no. In fact, there are hot lists for things like people failing to pay registration fees for their cars.

One thing about Flock—and it may be true of other vendors now, but Flock popularized this—is that their software lets police create custom hot lists: any person police want to put on the list, they can, and officers are going to be alerted every time that person is detected.

So you’re now creating this sort of constant intrusion on people’s lives. Police potentially can be alerted to your whereabouts at all times. And who’s checking to make sure the people on the list really belong there? Who’s reining all of this in? Right now, as you may have seen from our ALPR scorecard, half of states don’t have any laws whatsoever about license plate readers. And of the ones that do, many of them have minimum, bare-bones protections [as documented in the ALPR scorecard].

So I think that’s why you’re seeing people react the way they are. They’re kind of waking up to the fact that these things are in our communities, and they didn’t know about all of the dangers.

As you had alluded to, there aren’t any real safeguards in place because this technology is so new. Are there laws that we already have that can be retrofitted—like laws that already exist around wiretapping—to regulate these cameras?
Isaacs: Wiretapping is actually a perfect example because lawmakers stepped in and put together very strong regulation of wiretapping — wiretapping needs court approval and so forth. And so there is a role for lawmakers to set the rules. We don’t need to wait for judges to decide the rules through litigation.

I’ll give you an example of a jurisdiction that has done exactly what you’re describing: Minnesota requires police to get a warrant before they conduct tracking through license plate readers. And the logic is really straightforward. It’s a basic principle of policing that, before you engage in conduct as an officer that’s going to intrude on someone’s privacy, you generally need two things. First, you need cause, meaning you need a good reason why you’re targeting that person. Second, you generally need to go to a judge and get a court order or a warrant, to make sure that the cause is sufficient.

Minnesota looked at the use of license plate readers and said, “Okay, we’re going to follow that model. We’re going to require probable cause and a warrant before you engage in tracking.” That law has been in place for years, and it hasn’t caused any issues. The sky hasn’t fallen.. I think you can look at a jurisdiction like Minnesota as a really promising model and proof that strong regulation is possible.

Friedman: [Max] wrote legislation—which is on our website—that is the bill that we want other jurisdictions to adopt. And we are actually now, finally, hearing from other jurisdictions that are interested in looking at it.

You said something about how this technology is new, but this technology is 40 years old. And there’s just this presumption in the world that we let the police do whatever they want and then we try to fix the mess after it happens. And the whole point of the Policing Project is, “Why wait, why don’t we do what we do what is true for everybody else in government? Just tell them what we expect out of them.” And that’s what my book’s about, that’s what the Policing Project’s about, and that’s what our work here is about. Which is, “Let’s set the rules so that everybody doesn’t wake up one day and realize that the cops are doing all this stuff we didn’t know they were doing, we didn’t ask them to do it, and there are insufficient safeguards for things we hold dear – like liberty.”

This interview has been condensed and edited.