Unlike a previous proposal, this one sets policies on how long data can be retained and how the system could be accessed. But the ACLU says too many shortcomings still remain.
"Certainly it's good they are thinking about privacy and a process," said Jay Stanley, senior policy analyst at the ACLU. "But at the end of the day, we're talking about utilizing, encouraging and supporting a mass surveillance system that keeps records on people, most of whom are never suspected of any wrongdoing."
Homeland Security first announced plans to build its own license-plate reader database a little more than a year ago, but quickly backtracked amid an outcry of privacy concerns. With a renewed push last week, the department isn't looking to create its own program anymore; this time it's seeking to contract with a commercial vendor that's already collecting troves of license-plate data from motorists.
By contracting with an existing private company, Homeland Security may allay some fears that Big Brother would have direct access to license-plate reader data. But there are tradeoffs that could actually make the program more vulnerable to abuses.
"There can be some privacy benefit when you have the data at arm's length from the government," Stanley said. "But companies can abuse data as well, and they're not subject to any of the checks and balances that we have in government, such as FOIA requests, federal register requirements and Congressional oversight."
Some private companies, such as Vigilant Solutions, have amassed an estimated two billion license-plate reader records. Between private vendors and local and regional law-enforcement departments that also operate license-plate readers, there are an estimated 70 million records added to these systems per month, according to Homeland Security. Records are often shared between agencies, and it can often be hard to tell who can see this data – or for how long.
Law enforcement agencies say the license-plate reader data, which can contain the time, location and sometimes captures pictures, has become an invaluable tool in stopping criminals who steal cars and abduct children. Homeland Security and its Immigration and Customs Enforcement division want access to this data because they believe it will help apprehend "priority aliens," solve cold cases and reduce risk to law-enforcement officers in the field.
But studies have shown more than 99 percent of these records aren't connected with any ongoing investigations. And although it only takes a matter of minutes to match a license plate number to a "hot list" of wanted cars kept by authorities, many authorities keep all the data for indefinite periods of time. Privacy advocates want both DHS and other law-enforcement agencies to set strict limits on how long data is stored. There's a chasm between what both sides consider a necessary period of time.
In its proposal, Homeland Security has outlined a five-year general limit, with lengthier exceptions possible with permission from supervisors. Conceding that privacy and civil liberties concerns are exacerbated the longer the data is held, Homeland Security said the longer retention duration is necessary to establish "criminal activity over time as part of ongoing criminal investigation."
In other components of its assessment on how license-plate readers impact privacy, the department says it will require its vendor to allow plate numbers to be removed from lists once an investigation is resolved, require system users to correlate their searches with ongoing cases and periodically will open its records for audit.
Privacy advocates say that may not be enough, but it may be more comprehensive than most law-enforcement agencies. Although more than 70 percent of police departments now use license-plate readers, according to a Rand Corporation study published last year, only about 17 percent of them considered privacy implications when adopting their systems and policies.
Taken together, license-plate reader data can divulge detailed portraits on the lives of everyday Americans. They can show which doctors people use, where they attend worship services or where they go for their daily cup of coffee. Increasingly, they can also be used to determine connections between different people. Earlier this year, documents obtained by the ACLU showed that the Drug Enforcement Agency had planned to station license-plate readers outside a Phoenix-area gun show, though DEA officials say that plan was not implemented.
"We don't know as much as we should on how these agencies are using these in investigations," Stanley said. "Whether its' their own network or a private company, in some ways we end up at the same point, with the same massive infrastructure. It seems once there's vast amounts of data stored on the comings and goings of ordinary people, all kinds of agencies will find use for it. It's just not the way we're supposed to be doing things in this country."