It turns out that U.S. Customs and Border Protection could now keep an eye on your car without even getting a warrant. This month, we learned that CBP bought access to a commercial license plate database, meaning the agency can look up the historical location of cars across the U.S., no legal red tape necessary.
CBP revealed the purchase in its updated Privacy Impact Assessment, which discloses that agency had been using commercially owned cameras and license plate readers since 2017, when CBP released the original assessment. “Accordingly,” it reads, “CBP is updating this PIA to provide additional notice to the public and assess the unique privacy risks associated with the use of a commercial vendor license plate database.” The update, published earlier this month, says the agency’s deal with a commercial database “provide[s] CBP law enforcement personnel with a broader ability to search license plates of interest nationwide.”
Although the Privacy Impact Assessment didn’t name the commercial database in question, Motherboard points to Vigilant Solutions as a likely suspect. A public procurement record between CBP and Vigilant from 2019 is listed as “Law Enforcement Archival Reporting.” As it happens, “Law Enforcement Archival Reporting” is the name of a license plate reader product from Vigilant.
License plate readers do exactly what the name sounds like: They collect the plate information of cars that pass by. They can be found all over the country, and each can record thousands of plates per minute. Vigilant’s sister company, DRN, also has a database of crowdsourced license plates. Drivers whose cars are equipped with license plate reader cameras just tour around and seize data on passing vehicles. The firm says it has more than 9 billion scans. All of those scans are available to Vigilant’s customers. And it’s hard to avoid ending up in such a database: Per TechCrunch, people can’t opt out of license plate surveillance unless they steer clear of areas where the cameras are present—which is basically impossible, particularly since people don’t know where those cameras are located. Doing so, to quote CBP’s own Privacy Impact Assessment, “may pose significant hardships and be generally unrealistic.”
Already, data from license plate readers has resulted in convictions. In April, the Massachusetts Supreme Judicial Court OK’d the use of license plate readers to track a heroin dealer’s comings and goings from a bridge.
But this does not mean that license plate readers should be used in all criminal cases. In the ruling, Justice Frank M. Gaziano warned, “Where the [automated license plate readers] are placed matters.” He added, “ALPRs near constitutionally sensitive locations—the home, a place of worship, etc.—reveal more of an individual’s life and associations than does an ALPR trained on an interstate highway. A network of ALPRs that surveils every residential side street paints a much more nuanced and invasive picture of a driver’s life and public movements than one limited to major highways that open into innumerable possible destinations.”
Sen. Ron Wdyen also weighed in. “Customs and Border Protection owes the public an explanation of what it’s using this vast database of Americans’ movements for, whether there are safeguards to prevent sensitive information from being abused and how many Americans have their movements swept up into this dragnet surveillance program,” he said in a statement. “While more information is needed in this specific case, it’s now clear that several government agencies are purchasing data as an end-run around the Fourth Amendment, which is why I am preparing legislation to close that yawning gap in Americans’ Constitutional protections.”
This is another example of law enforcement agencies turning to private companies to bypass limitations on their ability to collect information.
In February, the Department of Homeland Security got into hot water for tracking people’s whereabouts through commercially available cellphone records. Instead of subpoenaing location records from service providers, it bought the information from the data broker Venntel. As was the case with license plate readers, opting out of that situation is, for all intents and purposes, impossible. In the Supreme Court ruling of Carpenter v. United States, a 2017 case regarding the FBI’s decision to subpoena the cellphone location records of Timothy Carpenter, Chief Justice John Roberts warned, “Only the few without cell phones could escape this tireless and absolute surveillance.”
Now, if you drive a car, surveillance is even more difficult to sidestep.