So it’s illegal surveillance, so what?

The Privacy Commissioner has ruled on licence plate tracking, but our police and government seem unwilling to obey the law. Who will hold them to account?

(Originally published in Focus, January 2012.)

Upon its release in November, the BC Privacy Commissioner’s report on the Victoria Police Department’s use of automatic licence plate recognition surveillance (ALPR) looked like an inspiring example of democratic checks and balances working to perfection. Unfortunately, it rapidly became a siren call for how wantonly our governments and police are ever more often tossing aside any pretences to following democratic principles or rule of law.

The ALPR program involves using cruiser-mounted computerized cameras that read passing licence plates at high speeds and run them against hotlists of stolen vehicles and prohibited and unlicensed drivers. However, BC municipal police forces, working with the RCMP, have secretly expanded the program to gather information about the movements of much wider ranges of innocent people (See “Hidden Surveillance,” Focus March 2012, and “Privacy Commissioner Slams Provincial Surveillance Program,” Focus April 2012). In other countries, ALPR data has been used to risk-profile people based on where they travel and who they meet, or to harass activists driving to protests.

Citing her office’s decision to investigate after receiving a letter from “three individuals”—me, political science PhD student Christopher Parsons, and technology-privacy advocate Kevin McArthur—Privacy Commissioner Elizabeth Denham’s press release couldn’t have been clearer: “The Victoria Police Department must make changes to its Automated Licence Plate Recognition program to comply with privacy laws”.

Denham’s report identified the key aspects of VicPD’s ALPR program that are not legal under BC’s Freedom of Information and Protection of Privacy Act (FIPPA): Tracking the movements of law-abiding people of “special interest” to police, such as those who have obtained legal custody of their children, threatened suicide, or are simply relatives or “associates” of people under investigation “is not authorized by FIPPA.” Tracking the movements of all law-abiding BC citizens “is not authorized by FIPPA.” Collecting information about everyone’s movements and passing it to the RCMP to use in unknown ways “is not authorized by FIPPA.” Denham even had strong words for the federal RCMP who’ve been administering much of the program on behalf of municipal police departments: “I do not have jurisdiction to direct the RCMP in their use of ALPR; however, I am nevertheless deeply concerned about the potential privacy implications of this indiscriminate collection of personal information.”

It’s inaccurate, in no particular way

Basically, VicPD’s ALPR program—and by extension the same programs at other BC municipal police departments—was determined by the Commissioner to be in significant respects illegal. Her findings were straightforward, concise and unequivocal. Within the week, citing the Commissioner’s findings, Saanich Mayor and Police Board Chair Frank Leonard announced the Saanich Police Department had suspended their ALPR program pending changes.

Others reacted differently.

VicPD issued a press release in which Chief Jamie Graham said, “the Department respectfully disagrees with certain elements of the Commissioner’s characterization of how the ALPR program functions.”

The RCMP similarly issued a press release stating that the OIPC report “contains inaccurate information in regards to the ALPR system which we will address with the Privacy Commissioner.”

No substantiations were provided; nevertheless, news media across Canada replayed these undermining claims. Yet a month later, the Office of the Information and Privacy Commissioner (OIPC) had still received no indication from the RCMP or VicPD that there was actually anything inaccurate in the report.

And that was all our police did. There were no apologies, no promises to do things differently, no shamefaced announcements of plans to promptly come into compliance with the law.

“It was incredibly heartening to see that the Saanich Police Department is abiding by the law,” commented my co-researcher Christopher Parsons who presents and publishes on privacy and security issues both nationally and internationally. “And I hope that other police departments will similarly decide that they’re going to obey the law with regard to licence plate recognition in the province.”

Nevertheless, it was the same in Vancouver. In response to my questions two weeks after the report came out, VPD media rep Cst. Brian Montague wrote, “I am not sure what you mean when you say the VPD is operating the ALPR system contrary to BC law.”

I suggested Montague read the OIPC report, and then went above his head. Vancouver Mayor and Police Board Chair Gregor Robertson didn’t reply to emails or calls for weeks. Patti Marfleet, executive director of the Vancouver Police Board, emailed me more comments from the Vancouver Police Department. VPD wrote that they were “considering” Denham’s proposed changes, but flatly denied that aspects of their ALPR program were, as I’d termed it, “illegal.” Instead, VPD explained “for clarification” that the Commissioner had merely found the ALPR program was in some aspects “not authorized by FIPPA” and could be “more privacy-compliant.”

I refrained from asking the follow-up question which now appeared in Orwellian fashion to be both eminently logical and senselessly inflammatory: So if I speed, I can successfully exonerate myself by explaining to police that I’m not actually doing anything “illegal,” I’m merely innocently doing something that’s “not authorized by the law” and “could be more in compliance with the law”?

“The police are supposed to be the people that are above reproach. And here they’re just thumbing their noses at the law,” observed Parsons. “Not necessarily surprising, I guess, but how disappointing is it?”

Who ensures laws are followed?

I went above their heads. I asked if the BC Minister of Justice intended to ensure police forces operating in BC, including the RCMP, obeyed BC law. In a written statement issued through a media rep, Liberal Justice Minister Shirley Bond wrote that the government would “consider” the Commissioner’s report but, “In the meantime, we expect all agencies deploying ALPR to adhere to approved procedures and polices [sic] presently in place.” Since the present ALPR procedures are illegal, of course, Bond in effect publicly urged all BC police to continue breaking the law.

“If it was some other ministry, it would be disturbing, it would be upsetting, but it wouldn’t have the same level of significance,” commented Parsons. (Yet this same government has recently fired bureaucrats and shut down some of the most renowned health research teams in the country while investigating the mere possibility privacy laws were temporarily breached in the health ministry.)

Not that I think “the law” is in all situations absolutely sacrosanct if there’s a greater moral imperative involved, but what’s the redeeming moral imperative behind huge databases tracking all our movements? Some people dismissively suggest, “If you haven’t done anything wrong, you have nothing to fear.” Why anyone trusts government to always do the right thing, I’m not sure. But the trite phrase also glosses over obvious impacts of even benign surveillance. For instance, most people are anxious and inhibited when public speaking, yet not because they’ve done anything wrong. There’s just something about eyes watching you.

Then, like daylight cresting the horizon, Victoria Mayor and Police Board Chair Dean Fortin wrote to me that, “I believe the Victoria Police are obligated to follow [the Privacy Commissioner’s] recommendations. It is important that our law enforcement tools and operations adhere to privacy regulations at every turn. Now that we have this ruling by the Privacy Commission, I believe we are compelled to act.” Unfortunately, at the Victoria Police Board meeting in December, it took less than 15 seconds and some makeshift muttering from provincial government appointee Lindalee Brougham about how “it deals with operational issues around how we use our manpower” to make them all justify moving the discussion in camera out of public view. The Board finally issued a brief notice directing VicPD “to work constructively with the RCMP to address the [Privacy Commissioner’s] recommendations,” and to report back on progress in three months. How an entire Police Board justifies allowing police to continue breaking the law in the meantime remains a mystery. Fortin receded into darkness, not returning my calls.

Also not surprisingly, then, another key finding by the Commissioner was that neither government authorities nor policing bodies have ever been forthcoming about this surveillance program. Denham wrote, “I recommend that the mandate of ALPR be more accurately described by VicPD and the Ministry of Justice to inform the public of the full scope of the ALPR program.”

Pointedly, and ironically, Liberal MLA John Les was subsequently quoted in The Tyee praising Denham’s report and stating, “Where [the ALPR program] was going was not where it was ever intended to go.” Yet Les was the very Solicitor General who brought the ALPR program into BC in 2006, authorized surveilling all BC citizens, and falsely told news media our privacy commissioners had approved it. So was he now regretful, or was he covering his tracks? Les avoided responding to my emails and calls.

But I soon uncovered how deep the web of deception truly went. Our government and police have even been misleading our privacy commissioners.

For example, police apparently did not clarify to the OIPC that even the ALPR “hit” data is, in fact, mostly information on innocent citizens. Typically about 80 percent of all hits are actually instances where, for example, a spouse or friend is legally and appropriately driving an unlicensed driver’s car. So should all the movements of these law-abiding people still be tracked and stored in databases for years? When I brought this issue to the OIPC’s attention after their report came out, they acknowledged “it may merit a closer look in consultation with law enforcement.”

But I uncovered a much more disturbing deception.

Lying to the commissioners

The first clue was the one fact in the OIPC report that completely surprised me: VicPD is indeed currently collecting data on the movements of all citizens and passing that data to the RCMP. The RCMP say they’re deleting the secondary “non-hit” data about innocent citizens, and only keeping the “hit” data. But Commissioner Denham said VicPD officers must by law delete the non-hit data during each police shift before passing anything to the RCMP. VicPD Cst. Mike Russell replied to media as if Denham’s suggestion were utterly novel: “She’s asking us to do something we just can’t do right now.”

But I’d always thought that was exactly what VicPD was already doing.  For the past year, I’d simply been warning the public that police had collected the non-hit data between 2006 and 2009, and wanted to again in the future. And this was, after all, the most important issue with respect to the ALPR system—whether police would or would not collect information on the movements of all innocent British Columbians. So how had I gotten this centrally important fact wrong?

I went back into the documents I’d obtained from VicPD through a Freedom of Information request, and followed a thread of communications that suddenly took on a whole new light.

After criticisms from the federal Privacy Commissioner’s office in 2009 about their “ubiquitous surveillance” of innocent citizens, RCMP Inspector Mike Diack pledged in a March 30, 2010 letter to the federal Assistant Commissioner that police ALPR systems in BC would no longer collect the secondary, or non-hit data. Diack wrote, “I have instructed the manufacturer to reconfigure our ALPR systems to collect only primary hit data. The manufacturer indicates that this will take approximately 4-6 weeks[.]” For those intervening weeks, Diack added, the RCMP themselves would delete the non-hit data as soon as they received it from VicPD.

Several weeks later, VicPD chief information officer Hervey Simard drew up an overview of how VicPD’s ALPR system operated, indicating that the promised technical change had occurred. Simard explained: “When the shift ends, the [VicPD] officer will click on the ‘End Shift’ button on the screen. The process will delete all [non-hit] ‘reads’, which consist of 95 percent of data. The [VicPD] officer will bring back the USB [to the RCMP] which contains only ‘hits’.”

In June 2010, then, in response to similar concerns about non-hit data collection expressed by the BC Privacy Commissioner’s office, VicPD in turn explained this technical update to the OIPC. VicPD Information and Privacy Manager Debra Taylor assured the OIPC, “In March of 2010 the RCMP instructed the manufacturer of the PIPS technology for the ALPR systems to reconfigure the systems to ensure that only primary (hit) data would be collected and stored. I have confirmed with their agency that the technology now has an auto purge feature for all secondary data, thus retaining only primary data.”

Yet a month later, the RCMP’s Diack admitted in an internal police email that the technological change actually had yet to occur. “I anticipate having these issues resolved by Christmas as my resources are committed for the next several months,” he wrote. In a December 2010 email, the manufacturer wrote to police that the non-hit data was still being collected by VicPD and transferred to the RCMP. The paper trail ended there, with no indication police updated either privacy commissioner that this crucial pledge to conform with privacy laws hadn’t actually been fulfilled as promised. And so, two years later in November 2012, the BC Privacy Commissioner discovered VicPD was actually still illegally collecting and transferring all that personal information about innocent BC citizens to the RCMP.

Parsons was shocked. “This is a guarantee they’re offering the commissioners. You can’t just offer a guarantee and then not do it,” he commented. “It calls into question all the other instances where police may have said something similar. Is it now a requirement to go through all the old privacy statements that these organizations have made and say, well, we can’t trust you anymore, so we have to go check?”

Maybe so. Here’s another example of how untrustworthy our police have become with respect to this secretive surveillance system: I’ve long felt RCMP officers were stonewalling my information requests about ALPR—18 months after my first request, they’ve still released next to nothing. Last March, the federal Office of the Information Commissioner (OIC) issued a five-page independent investigation report in which they determined that, indeed, RCMP Access to Information and Privacy (ATIP) officers “fell remarkably short” of complying with their legal duties in responding to my information requests. RCMP ATIP officials “deliberately ignored” my requests for long spans of time, the OIC wrote, and other times “deliberately acted contrary to [my] wishes” in “unacceptable” ways. The OIC even uncovered that RCMP ATIP officials once copied and pasted parts of an email from me while deleting other key parts, and then forwarded the resulting “misleading” letter to others as if it were my complete letter.

So can anyone make our police obey the law in how they use ALPR? BC’s OIPC answered in writing: “The Commissioner’s expectation is that public bodies found to be in non-compliance will do what is necessary to come into compliance. The Commissioner has order-making power which she could use to compel a public body to comply with FIPPA.”

However, Denham has no jurisdiction over the RCMP, and the federal privacy commissioner doesn’t have Denham’s order-making powers, so the RCMP can continue breaking BC and Canadian privacy laws unless the provincial or federal government intervenes. This is significant, because most of the ALPR cruisers in BC, including in the capital region, are run by the RCMP or Integrated Road Safety Units that combine members from municipal police forces under RCMP authority.

Parsons called this ever-expanding legal loophole in BC policing “insane,” and asked, “What other laws can you do an end-run around?”