What the Flock?! Can the data from your car be captured?

A recent BBC article described a product from Flock Safety that comprises a mailbox-mounted, solar-powered automated license plate recognition reader (ALPR) that transmits its data to a repository using 3G cellular. The idea is for neighborhoods to log vehicles entering and leaving, enabling reporting suspicious visitors to police, who can then look up the tags to find the owners. The company claims one arrest has resulted already.

Data SecurityIf you’re like me, your first reaction was “That can’t be legal!” A bit of pondering and research reveals that it’s absolutely legal for the most part. In general, there is no expectation of privacy when in a public space, which a road certainly is; and license plate numbers themselves are not considered personally identifiable information (PII). Thus ALPRs have been deemed legal for the most part thus far.

Readers will note the qualifiers above—“for the most part”, “in general”, “thus far”. There are a number of legal actions underway over ALPRs. Most are more focused on what happens to data after it’s captured than on whether capture itself is legal. That’s probably wise, as in general, courts have not had a problem with automating activities that would be legal if done manually. For example, street cameras automate the process of surveilling intersections. If a police officer were simply posted at the intersection, it seems clear that there would be no reasonable objection to his or her presence. Posting a camera is not seen as substantively different.

However, material from public cameras is rarely stored. One good reason is that doing so would be expensive, though storage is cheaper by the minute. But perhaps another reason is that doing so would open up the legal can of worms: Who should be allowed to access the footage? Under what circumstances? For how long? Who pays to manage that access? And so on. Storing captured license plates is much easier: the cost is minimal and the data is easily searchable. But the same legal issues apply: Is a warrant required? Should a suspicious spouse be given access? Etc.

The wise police department thus strives to avoid these legal issues by storing most data briefly, and keeping it longer only when it is specifically needed—that is, if the bank and Fifth and Main is robbed, that data can be saved before it is deleted.

What about this case—a private organization such as a neighborhood capturing data and sending it to a third party (Flock Safety)? Constitutional arguments tend not to apply to non-governmental cases. Instead, it’s usually a simple question of law. And so without an explicit law saying “It is illegal for a private individual or organization to use ALPRs to record license plates on public streets”, the Flock readers are likely perfectly legal. In addition, some neighborhood roadways are actually not public streets—further increasing the neighborhood’s rights over what they can do. That doesn’t mean someone can’t sue the neighborhood organization, however—civil law is a whole ’nother matter!

No matter the legality, most people seem to feel that there’s something creepy about having your comings and goings recorded—especially in someone else’s neighborhood!


About the Author
Phil Smith III is Senior Architect & Product Manager, Mainframe & Enterprise, at Micro Focus, formerly HPE Software. He is the author of the popular blog series, Cryptography for Mere Mortals.

The post What the Flock?! Can the data from your car be captured? appeared first on Voltage.

*** This is a Security Bloggers Network syndicated blog from Voltage authored by Phil Smith III. Read the original post at: http://feedproxy.google.com/~r/voltage/VDQg/~3/37YSxyV6aaM/