ALPRs Are Designed To Be Invasive

Data minimization, design principles, and dishonesty

Let’s talk about how ALPR systems, like Flock, are designed in a way that is far more invasive than it needs to be to do the work they are purported to do.

Pro-ALPR arguments usually center on their usefulness for solving crimes that have happened. Police and Flock officials like to talk about abductions and missing persons, and more commonly, the tech is used to solve car theft cases. The data about how much ALPRs help, on what crimes, and how much is extremely poor (and I have a lot to say about that in future newsletters) but, for now, let’s say it is useful for police to know when a license plate of a stolen car drives past a camera.

Right now, every car that drives past a camera has its license plate recorded with the time and location. That is stored and police can search through it if a crime occurs. Billions of data points are collected every month about innocent people that will never be of use for solving these crimes.

An alternative approach would be to store no data at all. In this scenario, if my car is stolen, I report it to the police, they put an alert for it into the ALPR system, and the ALPR alerts the police if that plate drives past. No data is recorded except for the license plates that are part of an active investigation. Even if we wanted to allow the more dubious searches for a vehicle type (e.g. “a red SUV with a roof rack”), the cameras could do that recognition and only report matches in real time rather than storing all that information on vehicles that will never match a search.

This uses a well-known principle of data governance called data minimization. Under data minimization, (1) the minimum amount of data is collected for the system’s purpose, (2) it is only used for that purpose (never anything else), and (3) it is stored for the minimum amount of time.

This is good governance for several reasons. First, it is more secure. It reduces the impact of data breaches; if a hacker gets in, there is less for them to steal and thus less damage that can be done. It also means that your security budget per data point is higher, so the data you do store is better protected. Second, data minimization reduces the opportunity for abuse because there is less data there to be abused. A cop cannot stalk his ex with an ALPR if that ALPR is not recording her movements in the first place. Third, it is cheaper. Storing, managing, and computing with data is expensive. If you only store the data you need, all those costs decline.

Given this, why would Flock or another ALPR system choose to store all that data? Why would they raise their costs, make their systems less secure, and wildly increase the opportunities for abuse? We don’t have an honest answer.

They would argue, I’m sure, that we may want data on a vehicle’s movements before a crime is reported. But how often are those searches conducted and how often are they useful for actually solving a crime? It is telling that nearly all of the examples we have heard from police and from Flock are cases where the data minimization approach would be just as effective. We need hard data about how these systems are used and when they are effective to assess if there is a legitimate argument for wider surveillance. But we don’t have that data. It would be straightforward for Flock or a police department to partner with academics (like me!) to do this analysis, so it is telling that it hasn’t been done (or it has been done and the results have not been reported).

Also, Flock’s statements about how their system is abused are either dishonest or incompetent (I vote for dishonest). Data minimization is a concept that has been around since the 1980s, and reducing data misuse is one of its core motivations. Yet when asked about the dozens of cases of law enforcement officers using Flock to stalk their exes, Flock CEO Garret Langley basically shrugged and declared that abuse is inevitable: “We’re not going to change humans, and humans make bad decisions.” When I was on a panel with Flock Chief Communications Officer Joshua Thomas at the City Club of Cleveland in July, he was asked about the abuse and his somewhat sarcastic response was “So your ask is, is there anything we can do from Flock’s point of view to stop bad people from doing bad things?”

Yes! That is the ask. And Yes! There are totally things Flock could be doing about it. Data minimization would drastically reduce the abuse that can happen with these cameras. Flock officials acting like they are unaware of data minimization as a solution is either dishonest or disqualifyingly incompetent.

The data maximizing approach is costing ALPR companies a huge amount of money to store billions of photos and data points every month. The systems are regularly being abused because of it. There are clear technological alternatives that support the main types of searches they and police use in their arguments to justify the technology. So why do they continue on the data maximal path?

We don’t know.

If there were data - not just an occasional anecdote but real, solid data - that showed that searching through history, rather than searching in real time for a car, was a frequent and important use of ALPR data, we would have been told. The fact that we hear nothing but anecdotes and hypotheticals means that this data does not exist. Thus, Flock and other ALPR companies must have other reasons that justify the added expense, lowered security, and increased abuse.

I can think of reasons, and they all skew authoritarian. The historical data could be used to retrieve a list of people who participated in a legal activity that someone in power has decided they don’t like (attending a protest, going to a gun range, going to a legal dispensary). As a data scientist, I can certainly see applications for future “features”. The data could be analyzed to build patterns of movement, to predict who is going to do what in when, to flag when a person is behaving in a “suspicious” way. It could be used to alert police that someone might do something wrong in the future.

There are still concerns about the alternative, data minimizing surveillance systems I describe. But we deserve to know why Flock, ALPR companies, and police are intentionally designing systems that violate data minimization principles. There is a reason and, whatever it is, they are not telling us.