Category Archives: Technology Privacy Surveillance

So it’s illegal surveillance, so what?

The Privacy Commissioner has ruled on licence plate tracking, but our police and government seem unwilling to obey the law. Who will hold them to account?

(Originally published in Focus, January 2012.)

 

Upon its release in November, the BC Privacy Commissioner’s report on the Victoria Police Department’s use of automatic licence plate recognition surveillance (ALPR) looked like an inspiring example of democratic checks and balances working to perfection. Unfortunately, it rapidly became a siren call for how wantonly our governments and police are ever more often tossing aside any pretences to following democratic principles or rule of law.

The ALPR program involves using cruiser-mounted computerized cameras that read passing licence plates at high speeds and run them against hotlists of stolen vehicles and prohibited and unlicensed drivers. However, BC municipal police forces, working with the RCMP, have secretly expanded the program to gather information about the movements of much wider ranges of innocent people (See “Hidden Surveillance,” Focus March 2012, and “Privacy Commissioner Slams Provincial Surveillance Program,” Focus April 2012). In other countries, ALPR data has been used to risk-profile people based on where they travel and who they meet, or to harass activists driving to protests.

Citing her office’s decision to investigate after receiving a letter from “three individuals”—me, political science PhD student Christopher Parsons, and technology-privacy advocate Kevin McArthur—Privacy Commissioner Elizabeth Denham’s press release couldn’t have been clearer: “The Victoria Police Department must make changes to its Automated Licence Plate Recognition program to comply with privacy laws”.

Denham’s report identified the key aspects of VicPD’s ALPR program that are not legal under BC’s Freedom of Information and Protection of Privacy Act (FIPPA): Tracking the movements of law-abiding people of “special interest” to police, such as those who have obtained legal custody of their children, threatened suicide, or are simply relatives or “associates” of people under investigation “is not authorized by FIPPA.” Tracking the movements of all law-abiding BC citizens “is not authorized by FIPPA.” Collecting information about everyone’s movements and passing it to the RCMP to use in unknown ways “is not authorized by FIPPA.” Denham even had strong words for the federal RCMP who’ve been administering much of the program on behalf of municipal police departments: “I do not have jurisdiction to direct the RCMP in their use of ALPR; however, I am nevertheless deeply concerned about the potential privacy implications of this indiscriminate collection of personal information.”

 

It’s inaccurate, in no particular way

Basically, VicPD’s ALPR program—and by extension the same programs at other BC municipal police departments—was determined by the Commissioner to be in significant respects illegal. Her findings were straightforward, concise and unequivocal. Within the week, citing the Commissioner’s findings, Saanich Mayor and Police Board Chair Frank Leonard announced the Saanich Police Department had suspended their ALPR program pending changes.

Others reacted differently.

VicPD issued a press release in which Chief Jamie Graham said, “the Department respectfully disagrees with certain elements of the Commissioner’s characterization of how the ALPR program functions.”

The RCMP similarly issued a press release stating that the OIPC report “contains inaccurate information in regards to the ALPR system which we will address with the Privacy Commissioner.”

No substantiations were provided; nevertheless, news media across Canada replayed these undermining claims. Yet a month later, the Office of the Information and Privacy Commissioner (OIPC) had still received no indication from the RCMP or VicPD that there was actually anything inaccurate in the report.

And that was all our police did. There were no apologies, no promises to do things differently, no shamefaced announcements of plans to promptly come into compliance with the law.

“It was incredibly heartening to see that the Saanich Police Department is abiding by the law,” commented my co-researcher Christopher Parsons who presents and publishes on privacy and security issues both nationally and internationally. “And I hope that other police departments will similarly decide that they’re going to obey the law with regard to licence plate recognition in the province.”

Nevertheless, it was the same in Vancouver. In response to my questions two weeks after the report came out, VPD media rep Cst. Brian Montague wrote, “I am not sure what you mean when you say the VPD is operating the ALPR system contrary to BC law.”

I suggested Montague read the OIPC report, and then went above his head. Vancouver Mayor and Police Board Chair Gregor Robertson didn’t reply to emails or calls for weeks. Patti Marfleet, executive director of the Vancouver Police Board, emailed me more comments from the Vancouver Police Department. VPD wrote that they were “considering” Denham’s proposed changes, but flatly denied that aspects of their ALPR program were, as I’d termed it, “illegal.” Instead, VPD explained “for clarification” that the Commissioner had merely found the ALPR program was in some aspects “not authorized by FIPPA” and could be “more privacy-compliant.”

I refrained from asking the follow-up question which now appeared in Orwellian fashion to be both eminently logical and senselessly inflammatory: So if I speed, I can successfully exonerate myself by explaining to police that I’m not actually doing anything “illegal,” I’m merely innocently doing something that’s “not authorized by the law” and “could be more in compliance with the law”?

“The police are supposed to be the people that are above reproach. And here they’re just thumbing their noses at the law,” observed Parsons. “Not necessarily surprising, I guess, but how disappointing is it?”

 

Who ensures laws are followed?

I went above their heads. I asked if the BC Minister of Justice intended to ensure police forces operating in BC, including the RCMP, obeyed BC law. In a written statement issued through a media rep, Liberal Justice Minister Shirley Bond wrote that the government would “consider” the Commissioner’s report but, “In the meantime, we expect all agencies deploying ALPR to adhere to approved procedures and polices [sic] presently in place.” Since the present ALPR procedures are illegal, of course, Bond in effect publicly urged all BC police to continue breaking the law.

“If it was some other ministry, it would be disturbing, it would be upsetting, but it wouldn’t have the same level of significance,” commented Parsons. (Yet this same government has recently fired bureaucrats and shut down some of the most renowned health research teams in the country while investigating the mere possibility privacy laws were temporarily breached in the health ministry.)

Not that I think “the law” is in all situations absolutely sacrosanct if there’s a greater moral imperative involved, but what’s the redeeming moral imperative behind huge databases tracking all our movements? Some people dismissively suggest, “If you haven’t done anything wrong, you have nothing to fear.” Why anyone trusts government to always do the right thing, I’m not sure. But the trite phrase also glosses over obvious impacts of even benign surveillance. For instance, most people are anxious and inhibited when public speaking, yet not because they’ve done anything wrong. There’s just something about eyes watching you.

Then, like daylight cresting the horizon, Victoria Mayor and Police Board Chair Dean Fortin wrote to me that, “I believe the Victoria Police are obligated to follow [the Privacy Commissioner’s] recommendations. It is important that our law enforcement tools and operations adhere to privacy regulations at every turn. Now that we have this ruling by the Privacy Commission, I believe we are compelled to act.” Unfortunately, at the Victoria Police Board meeting in December, it took less than 15 seconds and some makeshift muttering from provincial government appointee Lindalee Brougham about how “it deals with operational issues around how we use our manpower” to make them all justify moving the discussion in camera out of public view. The Board finally issued a brief notice directing VicPD “to work constructively with the RCMP to address the [Privacy Commissioner’s] recommendations,” and to report back on progress in three months. How an entire Police Board justifies allowing police to continue breaking the law in the meantime remains a mystery. Fortin receded into darkness, not returning my calls.

Also not surprisingly, then, another key finding by the Commissioner was that neither government authorities nor policing bodies have ever been forthcoming about this surveillance program. Denham wrote, “I recommend that the mandate of ALPR be more accurately described by VicPD and the Ministry of Justice to inform the public of the full scope of the ALPR program.”

Pointedly, and ironically, Liberal MLA John Les was subsequently quoted in The Tyee praising Denham’s report and stating, “Where [the ALPR program] was going was not where it was ever intended to go.” Yet Les was the very Solicitor General who brought the ALPR program into BC in 2006, authorized surveilling all BC citizens, and falsely told news media our privacy commissioners had approved it. So was he now regretful, or was he covering his tracks? Les avoided responding to my emails and calls.

But I soon uncovered how deep the web of deception truly went. Our government and police have even been misleading our privacy commissioners.

For example, police apparently did not clarify to the OIPC that even the ALPR “hit” data is, in fact, mostly information on innocent citizens. Typically about 80 percent of all hits are actually instances where, for example, a spouse or friend is legally and appropriately driving an unlicensed driver’s car. So should all the movements of these law-abiding people still be tracked and stored in databases for years? When I brought this issue to the OIPC’s attention after their report came out, they acknowledged “it may merit a closer look in consultation with law enforcement.”

But I uncovered a much more disturbing deception.

 

Lying to the commissioners

The first clue was the one fact in the OIPC report that completely surprised me: VicPD is indeed currently collecting data on the movements of all citizens and passing that data to the RCMP. The RCMP say they’re deleting the secondary “non-hit” data about innocent citizens, and only keeping the “hit” data. But Commissioner Denham said VicPD officers must by law delete the non-hit data during each police shift before passing anything to the RCMP. VicPD Cst. Mike Russell replied to media as if Denham’s suggestion were utterly novel: “She’s asking us to do something we just can’t do right now.”

But I’d always thought that was exactly what VicPD was already doing.  For the past year, I’d simply been warning the public that police had collected the non-hit data between 2006 and 2009, and wanted to again in the future. And this was, after all, the most important issue with respect to the ALPR system—whether police would or would not collect information on the movements of all innocent British Columbians. So how had I gotten this centrally important fact wrong?

I went back into the documents I’d obtained from VicPD through a Freedom of Information request, and followed a thread of communications that suddenly took on a whole new light.

After criticisms from the federal Privacy Commissioner’s office in 2009 about their “ubiquitous surveillance” of innocent citizens, RCMP Inspector Mike Diack pledged in a March 30, 2010 letter to the federal Assistant Commissioner that police ALPR systems in BC would no longer collect the secondary, or non-hit data. Diack wrote, “I have instructed the manufacturer to reconfigure our ALPR systems to collect only primary hit data. The manufacturer indicates that this will take approximately 4-6 weeks[.]” For those intervening weeks, Diack added, the RCMP themselves would delete the non-hit data as soon as they received it from VicPD.

Several weeks later, VicPD chief information officer Hervey Simard drew up an overview of how VicPD’s ALPR system operated, indicating that the promised technical change had occurred. Simard explained: “When the shift ends, the [VicPD] officer will click on the ‘End Shift’ button on the screen. The process will delete all [non-hit] ‘reads’, which consist of 95 percent of data. The [VicPD] officer will bring back the USB [to the RCMP] which contains only ‘hits’.”

In June 2010, then, in response to similar concerns about non-hit data collection expressed by the BC Privacy Commissioner’s office, VicPD in turn explained this technical update to the OIPC. VicPD Information and Privacy Manager Debra Taylor assured the OIPC, “In March of 2010 the RCMP instructed the manufacturer of the PIPS technology for the ALPR systems to reconfigure the systems to ensure that only primary (hit) data would be collected and stored. I have confirmed with their agency that the technology now has an auto purge feature for all secondary data, thus retaining only primary data.”

Yet a month later, the RCMP’s Diack admitted in an internal police email that the technological change actually had yet to occur. “I anticipate having these issues resolved by Christmas as my resources are committed for the next several months,” he wrote. In a December 2010 email, the manufacturer wrote to police that the non-hit data was still being collected by VicPD and transferred to the RCMP. The paper trail ended there, with no indication police updated either privacy commissioner that this crucial pledge to conform with privacy laws hadn’t actually been fulfilled as promised. And so, two years later in November 2012, the BC Privacy Commissioner discovered VicPD was actually still illegally collecting and transferring all that personal information about innocent BC citizens to the RCMP.

Parsons was shocked. “This is a guarantee they’re offering the commissioners. You can’t just offer a guarantee and then not do it,” he commented. “It calls into question all the other instances where police may have said something similar. Is it now a requirement to go through all the old privacy statements that these organizations have made and say, well, we can’t trust you anymore, so we have to go check?”

Maybe so. Here’s another example of how untrustworthy our police have become with respect to this secretive surveillance system: I’ve long felt RCMP officers were stonewalling my information requests about ALPR—18 months after my first request, they’ve still released next to nothing. Last March, the federal Office of the Information Commissioner (OIC) issued a five-page independent investigation report in which they determined that, indeed, RCMP Access to Information and Privacy (ATIP) officers “fell remarkably short” of complying with their legal duties in responding to my information requests. RCMP ATIP officials “deliberately ignored” my requests for long spans of time, the OIC wrote, and other times “deliberately acted contrary to [my] wishes” in “unacceptable” ways. The OIC even uncovered that RCMP ATIP officials once copied and pasted parts of an email from me while deleting other key parts, and then forwarded the resulting “misleading” letter to others as if it were my complete letter.

So can anyone make our police obey the law in how they use ALPR? BC’s OIPC answered in writing: “The Commissioner’s expectation is that public bodies found to be in non-compliance will do what is necessary to come into compliance. The Commissioner has order-making power which she could use to compel a public body to comply with FIPPA.”

However, Denham has no jurisdiction over the RCMP, and the federal privacy commissioner doesn’t have Denham’s order-making powers, so the RCMP can continue breaking BC and Canadian privacy laws unless the provincial or federal government intervenes. This is significant, because most of the ALPR cruisers in BC, including in the capital region, are run by the RCMP or Integrated Road Safety Units that combine members from municipal police forces under RCMP authority.

Parsons called this ever-expanding legal loophole in BC policing “insane,” and asked, “What other laws can you do an end-run around?”

Researchers Encouraged by BC Privacy Commissioner’s Investigation Report

For Immediate Release
November 15, 2012

Researchers Encouraged by BC Privacy Commissioner’s Investigation Report

The three researchers whose report prompted the BC Privacy Commissioner’s investigation into Automatic License Plate Recognition (ALPR) are very encouraged by the findings of Elizabeth Denham’s report, released today.

Since 2006, the RCMP and a growing number of BC police forces have used cruiser-mounted automated camera systems to ubiquitously take pictures of BC vehicles’ licence plates. Ostensibly used for catching stolen vehicles and unlicensed drivers, the researchers found that the ALPR system had “function creeped” into many more, highly questionable uses. As a result of concerns raised by the researchers, the Commissioner investigated how Victoria Police have been using ALPR. Her findings validate the concerns that the researchers’ have raised to the Commissioner, to police, and to the public, especially in relation to the technology functioning as a massive public surveillance system.

Amongst other findings, the Privacy Commissioner determined that Victoria Police were:

  • improperly collecting personal information in many circumstances
  • compiling information about the movements of too wide a range of people, many innocent of any crimes, including parents with legal custody of children, individuals who have attempted suicide in the past, and individuals prohibited from operating a boat
  • improperly disclosing and sharing personal information with the RCMP
  • misleading to the public when suggesting that any Canadian privacy commissioner has approved an ALPR system in Canada

She recommended that the Victoria Police Department immediately modify their ALPR program to bring it into compliance with BC’s privacy legislation. For example, the department must:

  • amend the composition of their surveillance categories to include only information that is related to a legitimate law enforcement purpose
  • work with the Ministry of Justice to inform the public of the full scope of the ALPR program
  • configure the program so that innocent individuals’ personal information is deleted automatically

Not all the researchers concerns have been addressed yet, however. For example, neither issues concerning the overall inaccuracy of the ALPR system nor whether data is still retained on too many people have been addressed. While Commissioner Denham has determined what is legal, it is now up to the public to establish whether this type of police surveillance is right.

The researchers conclude: “This is a great day for British Columbians who value privacy, freedom of association and movement, and their right to be free of unwarranted government surveillance. The rule of law has prevailed, and we trust that our police and government will obey it moving forward.”

***********

Reseachers’ Contact Information:

Rob Wipond
(250) 388-6064
rob (at) robwipond-dot-com

Kevin McArthur
kevin@stormtide.ca

Christopher Parsons
(778) 977-5653
parsons@uvic.ca

Previous articles from the reseachers’ work examining ALPR can be found here.

The Privacy Commissioner’s press release is here. The full report is here.

City of Vancouver flouts its own CCTV surveillance rules

The City of Vancouver’s emergency-management department has been ignoring the city’s policies governing closed-circuit-television surveillance since those policies were created in 2005.

This became clear last May after the Georgia Straight reviewed the city’s “City of Vancouver REM CCTV Policy” and submitted freedom-of-information (FOI) requests for documents wherever the policy mandated record-keeping. Subsequently, the Straight found evidence of severe and chronic policy breaches. Read more at the Georgia Straight.

Privacy Commissioner to Review ALPR Surveillance

I’m thrilled that the BC Office of the Information and Privacy Commissioner has decided to launch a full investigation into the use of Automatic Licence Plate Recognition by police in British Columbia. Here are links to all my published writings on the topic, plus my media release, and the OIPC’s press release.

Hidden Surveillance (article)
RCMP and VicPD ALPR Documents Released (documents)
Privacy Commissioner Slams Provincial Surveillance Program (Article)
What the Privacy Commissioner Really Said (Documents)
RCMP: We’ve Never Spoken About ALPR Program (Blog update)

***********************************************************

***FOR IMMEDIATE RELEASE***

July 30, 2012

RESEARCHERS PRAISE PRIVACY COMMISSIONER’S DECISION TO INVESTIGATE VEHICLE  SURVEILLANCE PROGRAM

Three independent researchers are praising the Office of the Information and Privacy Commissioner of British Columbia (OIPC) for today’s announcement that it is launching a review into the use of Automatic Licence Plate Recognition (ALPR) in the province. (See the full text of the OIPC announcement below.) For the past year, the researchers have been using access to information laws to investigate BC police ALPR programs, and have shared their findings through articles, presentations, and blogs.

“The Commissioner’s decision to investigate and issue a public report is an important validation of the concerns we’ve been raising,” said freelance journalist Rob Wipond. “Authorities have frequently represented the ALPR program to the public as having been ‘reviewed and approved’ by Canada’s privacy commissioners, but that’s not true.”

Since 2005, the RCMP and a growing number of municipal and regional police forces in BC have been using cruiser-mounted automated camera systems to take snapshots of thousands of vehicle licence plates per hour. Ostensibly used mainly for catching stolen vehicles and unlicensed drivers, the researchers found that much of the ALPR data is being saved and stored for undisclosed purposes.

“Tracking the movements of innocent drivers represents a serious threat to Canadian privacy rights – rights which are essential for our freedom of expression and association,” said technical security specialist and digital rights activist Kevin McArthur. “When combined with new federal and provincial laws expanding other types of secret digital surveillance and information gathering, the dangers are all the more heightened. So this review could not be more timely.”

The researchers have been frequently stymied by police in their efforts to obtain information about ALPR. They feel more open public disclosure and discussion is needed, especially in light of recent indications that ALPR data may be being combined with data concerning people’s ethnicity, blood type, and financial transactions. “Hopefully this will lead to a more public airing of how BC police forces are conducting surveillance in public spaces, and of how much information they’re sharing with other authorities across North America,” said University of Victoria political science PhD candidate Christopher Parsons. “Ideally, this review will also serve to remind government ministries that they must protect the basic privacy rights of all citizens.”

Wipond published two articles reporting on the group’s investigations in Victoria’s Focus magazine. The articles have drawn international interest online, hitting the front pages of Slashdot and Reddit, and drawing a combined 100,000 readers. Parsons presented more of the group’s findings at the Reboot Privacy and Security Conference in February, 2012. In March, Wipond, Parsons and McArthur sent a 16-page letter to the OIPC outlining their concerns and questions about the BC ALPR program.

Contact:
Rob Wipond        Christopher Parsons        Kevin McArthur
250-388-6064        parsons@uvic.ca        Kevin.McArthur@stormtide.ca

For more information:

http://robwipond.com/?p=1037

Parsons will also soon be presenting the team’s research findings, and comparing them to current uses of ALPR in the UK, at a Scalable Measures for Automated Recognition Technologies workshop in Italy involving industry, academic and policy experts.

*************************************************************

NEWS RELEASE
For Immediate Release
July 30, 2012

http://www.oipc.bc.ca/news/2012Releases/NR_ALPR-s25-Investigation.pdf

Office of the B.C. Information and Privacy Commissioner

Privacy Commissioner to investigate licence plate recognition and disclosure of
risks to health and safety

VICTORIA – B.C.’s Information and Privacy Commissioner Elizabeth Denham today
announced two new investigations, prompted by written submissions from concerned
citizens.

The first is a review of the use of automated licence plate recognition (“ALPR”)
programs by law enforcement and whether they comply with the Freedom of
Information and Protection of Privacy Act (FIPPA).

ALPR is a technology that allows for automated collection of photographs of
vehicles and licence plates by cameras mounted on police cars, which are then
compared to a list of licence plate numbers associated with individuals who are
of interest to police. The program instantly notifies police when there is a
match.

Members of the public have raised concerns about the use of ALPR technology by
municipal police, and the implications of this surveillance technology on the
privacy of British Columbians.

While the Commissioner’s investigation will focus on the use of ALPR by the
Victoria Police Department, the published report will provide guidance to law
enforcement agencies using the technology in B.C.

The ALPR investigation is underway and a public report is expected later this
summer.

The second investigation focuses on public interest disclosure under section 25
of FIPPA, which requires public bodies to disclose information in the public
interest, such as environmental harms or public risks to health and safety.

The Commissioner received a research report from the University of Victoria’s
Environmental Law Clinic, on behalf of the Freedom of Information and Privacy
Association, examining the extent to which certain public bodies are complying
with s.25. The Commissioner’s investigation will focus on the effectiveness of
this section of the Act.

The public interest disclosure investigation (s.25) will commence in August. A
public report will be issued when the investigation has concluded.

-30-

Media Contact:

Cara McGregor
Manager of Communications and Public Education
Office of the B.C. Information and Privacy Commissioner
250 217-5535

City of Vancouver CCTV Policy Documents

For interested researchers, here is the City of Vancouver’s Privacy Impact Assessment for its Closed Circuit Television (CCTV) surveillance camera systems, written in 2009. And here’s the City of Vancouver REM CCTV Policy, active as of 2012, but written in 2005. I obtained these through freedom of information requests. For more background on these documents and the contradictions they expose, see my article in Vancouver’s Georgia Straight, which also discusses the 2009 report to Vancouver Council about the CCTV project.