Category Archives: Police

So it’s illegal surveillance, so what?

The Privacy Commissioner has ruled on licence plate tracking, but our police and government seem unwilling to obey the law. Who will hold them to account?

(Originally published in Focus, January 2012.)


Upon its release in November, the BC Privacy Commissioner’s report on the Victoria Police Department’s use of automatic licence plate recognition surveillance (ALPR) looked like an inspiring example of democratic checks and balances working to perfection. Unfortunately, it rapidly became a siren call for how wantonly our governments and police are ever more often tossing aside any pretences to following democratic principles or rule of law.

The ALPR program involves using cruiser-mounted computerized cameras that read passing licence plates at high speeds and run them against hotlists of stolen vehicles and prohibited and unlicensed drivers. However, BC municipal police forces, working with the RCMP, have secretly expanded the program to gather information about the movements of much wider ranges of innocent people (See “Hidden Surveillance,” Focus March 2012, and “Privacy Commissioner Slams Provincial Surveillance Program,” Focus April 2012). In other countries, ALPR data has been used to risk-profile people based on where they travel and who they meet, or to harass activists driving to protests.

Citing her office’s decision to investigate after receiving a letter from “three individuals”—me, political science PhD student Christopher Parsons, and technology-privacy advocate Kevin McArthur—Privacy Commissioner Elizabeth Denham’s press release couldn’t have been clearer: “The Victoria Police Department must make changes to its Automated Licence Plate Recognition program to comply with privacy laws”.

Denham’s report identified the key aspects of VicPD’s ALPR program that are not legal under BC’s Freedom of Information and Protection of Privacy Act (FIPPA): Tracking the movements of law-abiding people of “special interest” to police, such as those who have obtained legal custody of their children, threatened suicide, or are simply relatives or “associates” of people under investigation “is not authorized by FIPPA.” Tracking the movements of all law-abiding BC citizens “is not authorized by FIPPA.” Collecting information about everyone’s movements and passing it to the RCMP to use in unknown ways “is not authorized by FIPPA.” Denham even had strong words for the federal RCMP who’ve been administering much of the program on behalf of municipal police departments: “I do not have jurisdiction to direct the RCMP in their use of ALPR; however, I am nevertheless deeply concerned about the potential privacy implications of this indiscriminate collection of personal information.”


It’s inaccurate, in no particular way

Basically, VicPD’s ALPR program—and by extension the same programs at other BC municipal police departments—was determined by the Commissioner to be in significant respects illegal. Her findings were straightforward, concise and unequivocal. Within the week, citing the Commissioner’s findings, Saanich Mayor and Police Board Chair Frank Leonard announced the Saanich Police Department had suspended their ALPR program pending changes.

Others reacted differently.

VicPD issued a press release in which Chief Jamie Graham said, “the Department respectfully disagrees with certain elements of the Commissioner’s characterization of how the ALPR program functions.”

The RCMP similarly issued a press release stating that the OIPC report “contains inaccurate information in regards to the ALPR system which we will address with the Privacy Commissioner.”

No substantiations were provided; nevertheless, news media across Canada replayed these undermining claims. Yet a month later, the Office of the Information and Privacy Commissioner (OIPC) had still received no indication from the RCMP or VicPD that there was actually anything inaccurate in the report.

And that was all our police did. There were no apologies, no promises to do things differently, no shamefaced announcements of plans to promptly come into compliance with the law.

“It was incredibly heartening to see that the Saanich Police Department is abiding by the law,” commented my co-researcher Christopher Parsons who presents and publishes on privacy and security issues both nationally and internationally. “And I hope that other police departments will similarly decide that they’re going to obey the law with regard to licence plate recognition in the province.”

Nevertheless, it was the same in Vancouver. In response to my questions two weeks after the report came out, VPD media rep Cst. Brian Montague wrote, “I am not sure what you mean when you say the VPD is operating the ALPR system contrary to BC law.”

I suggested Montague read the OIPC report, and then went above his head. Vancouver Mayor and Police Board Chair Gregor Robertson didn’t reply to emails or calls for weeks. Patti Marfleet, executive director of the Vancouver Police Board, emailed me more comments from the Vancouver Police Department. VPD wrote that they were “considering” Denham’s proposed changes, but flatly denied that aspects of their ALPR program were, as I’d termed it, “illegal.” Instead, VPD explained “for clarification” that the Commissioner had merely found the ALPR program was in some aspects “not authorized by FIPPA” and could be “more privacy-compliant.”

I refrained from asking the follow-up question which now appeared in Orwellian fashion to be both eminently logical and senselessly inflammatory: So if I speed, I can successfully exonerate myself by explaining to police that I’m not actually doing anything “illegal,” I’m merely innocently doing something that’s “not authorized by the law” and “could be more in compliance with the law”?

“The police are supposed to be the people that are above reproach. And here they’re just thumbing their noses at the law,” observed Parsons. “Not necessarily surprising, I guess, but how disappointing is it?”


Who ensures laws are followed?

I went above their heads. I asked if the BC Minister of Justice intended to ensure police forces operating in BC, including the RCMP, obeyed BC law. In a written statement issued through a media rep, Liberal Justice Minister Shirley Bond wrote that the government would “consider” the Commissioner’s report but, “In the meantime, we expect all agencies deploying ALPR to adhere to approved procedures and polices [sic] presently in place.” Since the present ALPR procedures are illegal, of course, Bond in effect publicly urged all BC police to continue breaking the law.

“If it was some other ministry, it would be disturbing, it would be upsetting, but it wouldn’t have the same level of significance,” commented Parsons. (Yet this same government has recently fired bureaucrats and shut down some of the most renowned health research teams in the country while investigating the mere possibility privacy laws were temporarily breached in the health ministry.)

Not that I think “the law” is in all situations absolutely sacrosanct if there’s a greater moral imperative involved, but what’s the redeeming moral imperative behind huge databases tracking all our movements? Some people dismissively suggest, “If you haven’t done anything wrong, you have nothing to fear.” Why anyone trusts government to always do the right thing, I’m not sure. But the trite phrase also glosses over obvious impacts of even benign surveillance. For instance, most people are anxious and inhibited when public speaking, yet not because they’ve done anything wrong. There’s just something about eyes watching you.

Then, like daylight cresting the horizon, Victoria Mayor and Police Board Chair Dean Fortin wrote to me that, “I believe the Victoria Police are obligated to follow [the Privacy Commissioner’s] recommendations. It is important that our law enforcement tools and operations adhere to privacy regulations at every turn. Now that we have this ruling by the Privacy Commission, I believe we are compelled to act.” Unfortunately, at the Victoria Police Board meeting in December, it took less than 15 seconds and some makeshift muttering from provincial government appointee Lindalee Brougham about how “it deals with operational issues around how we use our manpower” to make them all justify moving the discussion in camera out of public view. The Board finally issued a brief notice directing VicPD “to work constructively with the RCMP to address the [Privacy Commissioner’s] recommendations,” and to report back on progress in three months. How an entire Police Board justifies allowing police to continue breaking the law in the meantime remains a mystery. Fortin receded into darkness, not returning my calls.

Also not surprisingly, then, another key finding by the Commissioner was that neither government authorities nor policing bodies have ever been forthcoming about this surveillance program. Denham wrote, “I recommend that the mandate of ALPR be more accurately described by VicPD and the Ministry of Justice to inform the public of the full scope of the ALPR program.”

Pointedly, and ironically, Liberal MLA John Les was subsequently quoted in The Tyee praising Denham’s report and stating, “Where [the ALPR program] was going was not where it was ever intended to go.” Yet Les was the very Solicitor General who brought the ALPR program into BC in 2006, authorized surveilling all BC citizens, and falsely told news media our privacy commissioners had approved it. So was he now regretful, or was he covering his tracks? Les avoided responding to my emails and calls.

But I soon uncovered how deep the web of deception truly went. Our government and police have even been misleading our privacy commissioners.

For example, police apparently did not clarify to the OIPC that even the ALPR “hit” data is, in fact, mostly information on innocent citizens. Typically about 80 percent of all hits are actually instances where, for example, a spouse or friend is legally and appropriately driving an unlicensed driver’s car. So should all the movements of these law-abiding people still be tracked and stored in databases for years? When I brought this issue to the OIPC’s attention after their report came out, they acknowledged “it may merit a closer look in consultation with law enforcement.”

But I uncovered a much more disturbing deception.


Lying to the commissioners

The first clue was the one fact in the OIPC report that completely surprised me: VicPD is indeed currently collecting data on the movements of all citizens and passing that data to the RCMP. The RCMP say they’re deleting the secondary “non-hit” data about innocent citizens, and only keeping the “hit” data. But Commissioner Denham said VicPD officers must by law delete the non-hit data during each police shift before passing anything to the RCMP. VicPD Cst. Mike Russell replied to media as if Denham’s suggestion were utterly novel: “She’s asking us to do something we just can’t do right now.”

But I’d always thought that was exactly what VicPD was already doing.  For the past year, I’d simply been warning the public that police had collected the non-hit data between 2006 and 2009, and wanted to again in the future. And this was, after all, the most important issue with respect to the ALPR system—whether police would or would not collect information on the movements of all innocent British Columbians. So how had I gotten this centrally important fact wrong?

I went back into the documents I’d obtained from VicPD through a Freedom of Information request, and followed a thread of communications that suddenly took on a whole new light.

After criticisms from the federal Privacy Commissioner’s office in 2009 about their “ubiquitous surveillance” of innocent citizens, RCMP Inspector Mike Diack pledged in a March 30, 2010 letter to the federal Assistant Commissioner that police ALPR systems in BC would no longer collect the secondary, or non-hit data. Diack wrote, “I have instructed the manufacturer to reconfigure our ALPR systems to collect only primary hit data. The manufacturer indicates that this will take approximately 4-6 weeks[.]” For those intervening weeks, Diack added, the RCMP themselves would delete the non-hit data as soon as they received it from VicPD.

Several weeks later, VicPD chief information officer Hervey Simard drew up an overview of how VicPD’s ALPR system operated, indicating that the promised technical change had occurred. Simard explained: “When the shift ends, the [VicPD] officer will click on the ‘End Shift’ button on the screen. The process will delete all [non-hit] ‘reads’, which consist of 95 percent of data. The [VicPD] officer will bring back the USB [to the RCMP] which contains only ‘hits’.”

In June 2010, then, in response to similar concerns about non-hit data collection expressed by the BC Privacy Commissioner’s office, VicPD in turn explained this technical update to the OIPC. VicPD Information and Privacy Manager Debra Taylor assured the OIPC, “In March of 2010 the RCMP instructed the manufacturer of the PIPS technology for the ALPR systems to reconfigure the systems to ensure that only primary (hit) data would be collected and stored. I have confirmed with their agency that the technology now has an auto purge feature for all secondary data, thus retaining only primary data.”

Yet a month later, the RCMP’s Diack admitted in an internal police email that the technological change actually had yet to occur. “I anticipate having these issues resolved by Christmas as my resources are committed for the next several months,” he wrote. In a December 2010 email, the manufacturer wrote to police that the non-hit data was still being collected by VicPD and transferred to the RCMP. The paper trail ended there, with no indication police updated either privacy commissioner that this crucial pledge to conform with privacy laws hadn’t actually been fulfilled as promised. And so, two years later in November 2012, the BC Privacy Commissioner discovered VicPD was actually still illegally collecting and transferring all that personal information about innocent BC citizens to the RCMP.

Parsons was shocked. “This is a guarantee they’re offering the commissioners. You can’t just offer a guarantee and then not do it,” he commented. “It calls into question all the other instances where police may have said something similar. Is it now a requirement to go through all the old privacy statements that these organizations have made and say, well, we can’t trust you anymore, so we have to go check?”

Maybe so. Here’s another example of how untrustworthy our police have become with respect to this secretive surveillance system: I’ve long felt RCMP officers were stonewalling my information requests about ALPR—18 months after my first request, they’ve still released next to nothing. Last March, the federal Office of the Information Commissioner (OIC) issued a five-page independent investigation report in which they determined that, indeed, RCMP Access to Information and Privacy (ATIP) officers “fell remarkably short” of complying with their legal duties in responding to my information requests. RCMP ATIP officials “deliberately ignored” my requests for long spans of time, the OIC wrote, and other times “deliberately acted contrary to [my] wishes” in “unacceptable” ways. The OIC even uncovered that RCMP ATIP officials once copied and pasted parts of an email from me while deleting other key parts, and then forwarded the resulting “misleading” letter to others as if it were my complete letter.

So can anyone make our police obey the law in how they use ALPR? BC’s OIPC answered in writing: “The Commissioner’s expectation is that public bodies found to be in non-compliance will do what is necessary to come into compliance. The Commissioner has order-making power which she could use to compel a public body to comply with FIPPA.”

However, Denham has no jurisdiction over the RCMP, and the federal privacy commissioner doesn’t have Denham’s order-making powers, so the RCMP can continue breaking BC and Canadian privacy laws unless the provincial or federal government intervenes. This is significant, because most of the ALPR cruisers in BC, including in the capital region, are run by the RCMP or Integrated Road Safety Units that combine members from municipal police forces under RCMP authority.

Parsons called this ever-expanding legal loophole in BC policing “insane,” and asked, “What other laws can you do an end-run around?”

Lobbyist Registrar Investigating BC Police Chiefs

I recently investigated two sister groups, the BC Association of Municipal Chiefs of Police and the BC Association of Chiefs of Police. I found that both groups are playing a shellgame with the law: On the one hand, they’re claiming they are “private groups” whose activities are not subject to BC’s freedom of information laws covering public bodies. On the other hand, they are operating these “private groups” out of their police departments using police staff and public police resources. (Read the article to see how much more complicated and dubious their shellgames become when I try to obtain even basic documentation about their groups.) And even though they spend a lot of time meeting with politicians and bureaucrats and helping craft legislation and lobby for laws, they also think they don’t need to be legally registered as a lobby group because they’re just doing all this as part of their normal day to day policing duties.

At the end of that article, I explained that I had submitted complaints to both the Lobbyist Registry and the Office of the Information and Privacy Commissioner, arguing that these police chief groups were either public bodies subject to laws covering public bodies, or private groups subject to laws covering private groups — they could not escape being either. One way or another, I argued, our police chiefs have to be subject to at least some laws of transparency and accountability like the rest of our society.

The OIPC is investigating. And now, in a recent email to me, the Lobbyist Registrar has deemed these concerns to be valid enough to warrant an investigation as well. Here is the full text of the email from the Lobbyist Registrar:

Dear Rob Wipond:

This is to acknowledge receipt of your complaint under the BC Lobbyists Registration Act (“LRA”) that the Association of Chiefs of Police may be engaging in activities that qualify as lobbying and have not registered as required by the LRA.

I attach for your reference our policy in respect of complaints.

Requesting the Registrar Conduct an Investigation

7.1 Where a person requests the Registrar to conduct an investigation to establish whether there is or has been compliance with this Act, the requester will be expected to provide the registrar with the name and address of the subject of the allegation and a description of the facts that are alleged to constitute a violation of the LRA.
7.2 If no investigation is commenced as a result of the request, and the request for investigation has not otherwise been made public, the identity of the requester will be kept confidential.
7.3 If an investigation is commenced as a result of the request, the identity of the person requesting the investigation may be disclosed to the person under investigation, to the extent that it is necessary to conduct the investigation and adhere to the principles of procedural fairness.
7.4 Despite paragraph 8.3, the registrar may direct that the identity of the person requesting the investigation, and any information disclosed by that person, be kept confidential to the exclusion of any other person including the person directly affected, on terms the registrar considers necessary, if the registrar believes that direction is necessary to ensure the proper administration of the Act, including the protecting that person from physical or other harm.
7.5 A person who requests an investigation has no rights to notice or information during the investigation, and has no greater procedural rights in an investigation or subsequent hearing than any member of the public.

Please be advised that we have not disclosed your identity to the Association of Chiefs of Police, however, given the public nature of this complaint, it is not our intention to keep your identity secret, unless you can provide reasons otherwise.

In response to your complaint, we have commenced an investigation under section 7.1 of the LRA, which states that if it is considered necessary to establish whether there is or has been compliance by any person with the LRA or the regulations, the Registrar may conduct an investigation.  You will be notified of our findings in respect of your complaint.
Yours truly,
Mary Carlson
Deputy Registrar of Lobbyists for British Columbia

Researchers Encouraged by BC Privacy Commissioner’s Investigation Report

For Immediate Release
November 15, 2012

Researchers Encouraged by BC Privacy Commissioner’s Investigation Report

The three researchers whose report prompted the BC Privacy Commissioner’s investigation into Automatic License Plate Recognition (ALPR) are very encouraged by the findings of Elizabeth Denham’s report, released today.

Since 2006, the RCMP and a growing number of BC police forces have used cruiser-mounted automated camera systems to ubiquitously take pictures of BC vehicles’ licence plates. Ostensibly used for catching stolen vehicles and unlicensed drivers, the researchers found that the ALPR system had “function creeped” into many more, highly questionable uses. As a result of concerns raised by the researchers, the Commissioner investigated how Victoria Police have been using ALPR. Her findings validate the concerns that the researchers’ have raised to the Commissioner, to police, and to the public, especially in relation to the technology functioning as a massive public surveillance system.

Amongst other findings, the Privacy Commissioner determined that Victoria Police were:

  • improperly collecting personal information in many circumstances
  • compiling information about the movements of too wide a range of people, many innocent of any crimes, including parents with legal custody of children, individuals who have attempted suicide in the past, and individuals prohibited from operating a boat
  • improperly disclosing and sharing personal information with the RCMP
  • misleading to the public when suggesting that any Canadian privacy commissioner has approved an ALPR system in Canada

She recommended that the Victoria Police Department immediately modify their ALPR program to bring it into compliance with BC’s privacy legislation. For example, the department must:

  • amend the composition of their surveillance categories to include only information that is related to a legitimate law enforcement purpose
  • work with the Ministry of Justice to inform the public of the full scope of the ALPR program
  • configure the program so that innocent individuals’ personal information is deleted automatically

Not all the researchers concerns have been addressed yet, however. For example, neither issues concerning the overall inaccuracy of the ALPR system nor whether data is still retained on too many people have been addressed. While Commissioner Denham has determined what is legal, it is now up to the public to establish whether this type of police surveillance is right.

The researchers conclude: “This is a great day for British Columbians who value privacy, freedom of association and movement, and their right to be free of unwarranted government surveillance. The rule of law has prevailed, and we trust that our police and government will obey it moving forward.”


Reseachers’ Contact Information:

Rob Wipond
(250) 388-6064
rob (at) robwipond-dot-com

Kevin McArthur

Christopher Parsons
(778) 977-5653

Previous articles from the reseachers’ work examining ALPR can be found here.

The Privacy Commissioner’s press release is here. The full report is here.

Are BC Police Chiefs Evading the Law?

At the same time as their associations channel public resources into private political lobbying, they claim immunity from BC’s laws governing public access to their records.

They’re the two most prominent and influential policing organizations in British Columbia, appearing frequently in public promoting their strong positions on criminal justice reform, use of tasers, drug laws, or expanding police powers. But little else is widely known about the BC Association of Chiefs of Police (BCACP) and its smaller sister, the BC Association of Municipal Chiefs of Police (BCAMCP).

I became more aware of these associations in July, after the BC Office of the Information and Privacy Commissioner launched an investigation into the Victoria Police Department’s use of automatic licence plate recognition in the wake of Focus’ investigations (see “Hidden Surveillance” Feb 2012). Extensive media coverage ensued, and the BC Ministry of Justice issued a statement in which they assured the public that they “recently wrote a letter to the BC Association of Chiefs of Police” to re-emphasize the program’s proper “terms of use.” I’d been investigating the RCMP and VicPD’s licence plate tracking system for 18 months, and had never come across this group—and now suddenly I learn that they are the ones actually in charge of it? Read more at Focus online.

Privacy Commissioner to Review ALPR Surveillance

I’m thrilled that the BC Office of the Information and Privacy Commissioner has decided to launch a full investigation into the use of Automatic Licence Plate Recognition by police in British Columbia. Here are links to all my published writings on the topic, plus my media release, and the OIPC’s press release.

Hidden Surveillance (article)
RCMP and VicPD ALPR Documents Released (documents)
Privacy Commissioner Slams Provincial Surveillance Program (Article)
What the Privacy Commissioner Really Said (Documents)
RCMP: We’ve Never Spoken About ALPR Program (Blog update)



July 30, 2012


Three independent researchers are praising the Office of the Information and Privacy Commissioner of British Columbia (OIPC) for today’s announcement that it is launching a review into the use of Automatic Licence Plate Recognition (ALPR) in the province. (See the full text of the OIPC announcement below.) For the past year, the researchers have been using access to information laws to investigate BC police ALPR programs, and have shared their findings through articles, presentations, and blogs.

“The Commissioner’s decision to investigate and issue a public report is an important validation of the concerns we’ve been raising,” said freelance journalist Rob Wipond. “Authorities have frequently represented the ALPR program to the public as having been ‘reviewed and approved’ by Canada’s privacy commissioners, but that’s not true.”

Since 2005, the RCMP and a growing number of municipal and regional police forces in BC have been using cruiser-mounted automated camera systems to take snapshots of thousands of vehicle licence plates per hour. Ostensibly used mainly for catching stolen vehicles and unlicensed drivers, the researchers found that much of the ALPR data is being saved and stored for undisclosed purposes.

“Tracking the movements of innocent drivers represents a serious threat to Canadian privacy rights – rights which are essential for our freedom of expression and association,” said technical security specialist and digital rights activist Kevin McArthur. “When combined with new federal and provincial laws expanding other types of secret digital surveillance and information gathering, the dangers are all the more heightened. So this review could not be more timely.”

The researchers have been frequently stymied by police in their efforts to obtain information about ALPR. They feel more open public disclosure and discussion is needed, especially in light of recent indications that ALPR data may be being combined with data concerning people’s ethnicity, blood type, and financial transactions. “Hopefully this will lead to a more public airing of how BC police forces are conducting surveillance in public spaces, and of how much information they’re sharing with other authorities across North America,” said University of Victoria political science PhD candidate Christopher Parsons. “Ideally, this review will also serve to remind government ministries that they must protect the basic privacy rights of all citizens.”

Wipond published two articles reporting on the group’s investigations in Victoria’s Focus magazine. The articles have drawn international interest online, hitting the front pages of Slashdot and Reddit, and drawing a combined 100,000 readers. Parsons presented more of the group’s findings at the Reboot Privacy and Security Conference in February, 2012. In March, Wipond, Parsons and McArthur sent a 16-page letter to the OIPC outlining their concerns and questions about the BC ALPR program.

Rob Wipond        Christopher Parsons        Kevin McArthur

For more information:

Parsons will also soon be presenting the team’s research findings, and comparing them to current uses of ALPR in the UK, at a Scalable Measures for Automated Recognition Technologies workshop in Italy involving industry, academic and policy experts.


For Immediate Release
July 30, 2012

Office of the B.C. Information and Privacy Commissioner

Privacy Commissioner to investigate licence plate recognition and disclosure of
risks to health and safety

VICTORIA – B.C.’s Information and Privacy Commissioner Elizabeth Denham today
announced two new investigations, prompted by written submissions from concerned

The first is a review of the use of automated licence plate recognition (“ALPR”)
programs by law enforcement and whether they comply with the Freedom of
Information and Protection of Privacy Act (FIPPA).

ALPR is a technology that allows for automated collection of photographs of
vehicles and licence plates by cameras mounted on police cars, which are then
compared to a list of licence plate numbers associated with individuals who are
of interest to police. The program instantly notifies police when there is a

Members of the public have raised concerns about the use of ALPR technology by
municipal police, and the implications of this surveillance technology on the
privacy of British Columbians.

While the Commissioner’s investigation will focus on the use of ALPR by the
Victoria Police Department, the published report will provide guidance to law
enforcement agencies using the technology in B.C.

The ALPR investigation is underway and a public report is expected later this

The second investigation focuses on public interest disclosure under section 25
of FIPPA, which requires public bodies to disclose information in the public
interest, such as environmental harms or public risks to health and safety.

The Commissioner received a research report from the University of Victoria’s
Environmental Law Clinic, on behalf of the Freedom of Information and Privacy
Association, examining the extent to which certain public bodies are complying
with s.25. The Commissioner’s investigation will focus on the effectiveness of
this section of the Act.

The public interest disclosure investigation (s.25) will commence in August. A
public report will be issued when the investigation has concluded.


Media Contact:

Cara McGregor
Manager of Communications and Public Education
Office of the B.C. Information and Privacy Commissioner
250 217-5535