America's Surveillance Roadmap: The Expanding Use Of License Plate Surveillance

The rise of automated license plate readers (ALPRs) across the United States has triggered a growing wave of lawsuits, public outcry, and legislative debates, as concerns mount over their implications for privacy and civil liberties. These systems, like the one recently challenged in Norfolk, Virginia, by the Institute for Justice, are increasingly seen as a form of government surveillance that crosses constitutional boundaries, raising alarm among citizens and advocacy groups alike.

The lawsuit against Norfolk's city officials and the use of a network of 170 ALPRs represents only one part of a broader legal pushback. Cities such as San Francisco, Los Angeles, and Chicago have similarly adopted expansive license plate tracking systems, sparking lawsuits and calls for stricter regulation. Civil liberties groups argue that these networks infringe on Fourth Amendment protections against unreasonable searches and seizures, asserting that collecting and storing data on citizens' movements without probable cause amounts to "dragnet" surveillance.

In Virginia, the use of ALPRs has already been challenged before, with courts acknowledging concerns over the potential for misuse. Last year, the American Civil Liberties Union (ACLU) sued Fairfax County after it was revealed that law enforcement retained ALPR data for years without any warrants, tracking individuals with no criminal background. The case echoed the concerns now being voiced in Norfolk, as plaintiffs in both cases argued that being monitored every time they drive amounts to a violation of their privacy rights.

ALPRs are only one facet of the expanding surveillance infrastructure. Across the country, many cities are now implementing these devices with the assistance of private surveillance companies like Flock Safety, whose business model includes not only gathering license plate data but retaining it for extended periods--often up to 30 days. 

This data, stored in vast databases accessible by multiple law enforcement agencies, raises questions about long-term retention, the lack of judicial oversight, and the potential for abuse. Critics warn that ALPRs have gone far beyond their initial purpose of aiding in specific criminal investigations, now serving as tools for constant and comprehensive monitoring.

Flock Safety, one of the largest providers of ALPR technology, describes its system as a way to assist in preventing crime, advertising a proprietary "Vehicle Fingerprint" feature. This technology goes beyond simply capturing license plates; it records details such as vehicle color, make, and any distinguishing features, creating a comprehensive profile that is shareable across jurisdictions. 

In Norfolk's case, Flock's data-sharing network means police nationwide could access detailed movement data on any vehicle within the system, vastly expanding the reach and depth of surveillance.

Real-world abuses of ALPR systems have already demonstrated the risks of this surveillance technology. In Kansas, a police chief was caught using Flock's license plate tracking system 228 times in just four months to stalk his ex-girlfriend and her new boyfriend. This case, along with others, has highlighted the potential for misuse by law enforcement officers who have access to these vast databases. Such instances have fueled arguments for stricter regulations or outright bans on ALPRs in certain states.

California's experience further underscores these risks. Despite a state law limiting ALPR data sharing, investigations found that several departments across California had shared data with other agencies nationwide without proper authorization. The lack of clear oversight and uniform policy enforcement reveals how ALPR systems, while promising enhanced security, can easily cross ethical and legal lines.

Concerns about ALPR data go beyond abuse by individuals within law enforcement. Cybersecurity experts warn that the massive databases containing billions of data points from ALPR systems are prime targets for hackers. A breach of ALPR data could expose highly sensitive details about citizens' daily routines, locations frequented, and even patterns of behavior. Given the scope of these data sets and the frequency with which information is shared among agencies, a single security flaw could compromise millions of drivers' privacy.

In 2021, the San Diego Police Department suffered a data breach that exposed the license plate information of thousands of vehicles. This event underscored the need for robust cybersecurity measures to protect the data gathered by ALPR systems. Critics argue that, with the frequency and scale of data sharing, such databases become increasingly difficult to secure, amplifying the risks posed by potential data leaks or cyber attacks.

The U.S. Supreme Court has previously expressed concerns over prolonged, warrantless tracking. In the landmark 2018 case Carpenter v. United States, the Court ruled that tracking a person's location over an extended period without a warrant constituted an invasion of privacy. Although this ruling specifically concerned cell phone data, its implications resonate with ALPR technology. Just as tracking cell phone locations over time can reveal intimate details about a person's life, so too can tracking their vehicle's movements across weeks or months.

In United States v. Jones, another relevant case, the Supreme Court ruled that placing a GPS tracker on a vehicle without a warrant amounted to an unconstitutional search. Many privacy advocates see ALPR systems as a form of virtual GPS tracking, in which the government can monitor individuals' whereabouts with little to no oversight. As ALPR technology becomes more widespread, the likelihood of a future Supreme Court case specifically addressing it grows, with advocates pushing for judicial recognition of the privacy dangers posed by these systems.

In response to growing privacy concerns, several states have introduced legislation to limit or regulate ALPR use. Virginia, where the Norfolk lawsuit is pending, recently passed a law requiring that ALPR data be purged after 30 days unless it is tied to a specific investigation. California has also introduced data retention limits and strict guidelines for data sharing. 

However, activists argue that these regulations are inadequate, advocating instead for stricter rules on data retention, limitations on data sharing, and mandatory warrant requirements for accessing ALPR information.

Transparency is another critical issue. While law enforcement agencies often justify ALPR deployment as a means to combat crime, studies indicate that these systems are frequently used for monitoring rather than active criminal investigations. For instance, an audit of the Los Angeles Police Department's ALPR program found that only a small fraction of the data collected was used in criminal cases, with most of it accumulating without any corresponding investigations or arrests.

As the use of ALPR technology spreads, the challenge of balancing public safety with constitutional protections becomes more pressing. While proponents argue that ALPRs serve as a valuable tool for crime prevention, the unchecked expansion of these systems raises questions about personal privacy and civil liberties. The Norfolk case, along with similar lawsuits and documented abuses, underscores the need for clear limits and robust oversight of this technology.

With lawmakers, courts, and the public increasingly scrutinizing ALPR systems, it remains to be seen how far government agencies will be allowed to monitor citizens' daily lives without probable cause. Until then, the controversy over license plate readers serves as a powerful reminder of the enduring importance of Fourth Amendment protections in the face of advancing surveillance technology.