Some Calif. cops still sharing license plate info with anti-abortion states

Dozens of California police agencies are still sharing automated license plate reader (ALPR) data with out-of-state authorities without a warrant, the Electronic Frontier Foundation has revealed. This is occurring despite guidance issued by State Attorney General Rob Bonta last year. Clarifying a state law that limits state public agencies to sharing ALPR data only with other public agencies, Bonta's guidance pointed out that "importantly," the law's definition of "public agency" "does not include out-of-state or federal law enforcement agencies." Bonta's guidance came after EFF uncovered more than 70 California law enforcement agencies sharing ALPR data with cops in other states, including anti-abortion states. After Bonta clarified the statute, approximately half of these agencies told EFF that they updated their practices to fall in line with Bonta's reading of the law. Some states could not verify that the practice had ended yet, though. In a letter to Bonta, EFF praised the guidance as protecting Californians' privacy but also flagged more than 30 police agencies that either expressly rejected Bonta's guidance or else refused to confirm that they've stopped sharing data with out-of-state authorities. EFF staff attorney Jennifer Pinsof told Ars that it's likely that additional agencies are also failing to comply, such as agencies that EFF never contacted or that recently acquired ALPR technology. "We think it is very likely other agencies in the state remain out of compliance with the law," EFF's letter said. EFF is hoping that making Bonta aware of the ongoing non-compliance will end sharing of highly sensitive location data with police agencies in states that do not provide as many privacy protections as California does. If Bonta "takes initiative" to enforce compliance, Pinsof said that police may be more willing to consider the privacy risks involved, since Bonta can "communicate more easily with the law enforcement community" than privacy advocates can. However, even Bonta may struggle, as some agencies "have dug their heels in," Pinsof said. Many state police agencies simply do not agree with Bonta's interpretation of the law, which they claim does allow sharing ALPR data with cops in other states. In a November letter, a lawyer representing the California State Sheriffs’ Association, California Police Chiefs Association, and California Peace Officers’ Association urged Bonta to "revisit" his position that the law "precludes sharing ALPR data with out-of-state governmental entities for legitimate law enforcement purposes." The cops argued that sharing ALPR data with cops in other states assists "in the apprehension and prosecution of child abductors, narcotics traffickers, human traffickers, extremist hate groups, and other cross-state criminal enterprises." They told Bonta that the law "was not designed to block law enforcement from sharing ALPR data outside California where the information could be used to intercede with criminal offenders moving from state to state." As they see it, cooperation between state authorities is "absolutely imperative to effective policing." Here's where cops say the ambiguity lies. The law defines public agency as "the state, any city, county, or city and county, or any agency or political subdivision of the state or a city, county, or city and county, including, but not limited to, a law enforcement agency." According to cops, because the law does not "specifically refer to the State of California" or “this state,” it could be referring to agencies in any state. "Had the legislation referred to 'a State' rather than 'the State,' there would be no debate about whether sharing was prohibited," the police associations' letter said. "We see no basis to read such a limitation into the legislation based on the word 'the' rather than 'a.'" The police associations also reminded Bonta that the California Legislature considered passing a bill that would have explicitly "prohibited the out-of-state sharing of ALPR information" with states interfering with "the right to seek abortion services" but "rejected it." They told Bonta that "the Legislature’s refusal to adopt a position consistent with the position" he is "advancing is troubling." EFF said that California police can still share ALPR data with out-of-state police in situations permitted by law, like when out-of-state cops have a "warrant for ALPR information based on probable cause and particularity." Instead, EFF alleged that cops are "dragnet sharing through commercial cloud storage systems" without warrants, which could be violating Californians' right to privacy, as well as First and Fourth Amendment rights. EFF urged Bonta to reject the police associations' "crabbed interpretation" of the statute, but it's unclear if Bonta will ever respond. Pinsof told Ars that Bonta did not directly respond to EFF's initial investigation, but the guidance he later issued seemed to suggest that he got EFF's message. Police associations and Bonta's office did not respond to Ars' request to comment.

Privacy concerns with ALPRs

Bonta appears determined to protect Californians' privacy, noting when he issued the guidance last year that "the majority of California law enforcement agencies collect and use images captured by ALPR cameras, but few have appropriate usage and privacy policies in place." Further, a 2020 audit of four California police departments "found that the handling and retention of automated license plate reader (ALPR) images and associated data did not always follow practices that adequately consider an individual’s privacy." It appeared that "most of these images" maintained in databases were "unrelated" to criminal investigations, and "agencies may be retaining the images longer than necessary and thus increasing the risk to individuals’ privacy." “As technology that helps us protect the public continues to advance, it is important that we put in place safeguards to ensure that this technology is used appropriately and lawfully,” Bonta said in a press release announcing his ALPR guidance. “While this technology may be a helpful investigative tool, Californians must be able to trust that their information is being kept safe. Today, we remind law enforcement of their responsibility to safeguard this data and ensure its use is consistent with state law.” Pinsof criticized cops' suggestion that sharing data with other states helps deter more crime as "overstated" and "ill-informed." She's concerned that police are weaponizing mass surveillance technologies like ALPR cameras against vulnerable populations, such as immigrant communities, people seeking gender-affirming care, traveling from states that ban it, or abortion seekers and providers from states restricting abortion access who are "trying to come to California to obtain legal reproductive health care." Police associations told Bonta that California police agencies have no "desire to wade into the murky waters of out-of-state abortion services or enforcement activities associated therewith." Cops also noted that "specific legislation prohibits the transfer of information concerning abortion services outside of California," confirming that "we concede that those restrictions apply to" ALPR data. However, EFF said that it found dozens of police agencies sharing ALPR data with anti-abortion states, including Alabama, Oklahoma, and Texas. "They're collecting this highly sensitive location data that's inherently mass surveillance, because it's just taking pictures of cars driving on the streets and collecting it and storing it for up to two years at a time," Pinsof told Ars. While California's law seemingly remains vague to some cops in the state, some agencies have expanded their use of ALPR cameras, reportedly adding hundreds of cameras in cities like Oakland, San Francisco, San Jose, Berkeley, and San Leandro last year. Meanwhile, on the other side of the country, Illinois has recently updated its vehicle code to explicitly ban the sharing of ALPR data with anti-abortion states. Of course, police aren't the only ones collecting ALPR data. Private companies like Flock Safety and Motorola Solutions collect ALPR data in more than a thousand US cities, reportedly tracking more than a billion cars each month. Privacy experts say cops purchase this data to aid investigations, too. EFF plans to continue monitoring compliance with California's ALPR law, but Pinsof said that "certainly a lawsuit is not off the table," should cops continue sharing sensitive data in ways that could harm vulnerable populations. In 2021, EFF sued the Marin County Sheriff’s Office for sharing ALPR data with out-of-state authorities. That battle resulted in a settlement where the sheriff's office agreed to "permanently" stop sharing license plate information with agencies in other states. "We have made some progress, but there's definitely work to be done, and all the legal tools at our disposal are definitely still on the table," Pinsof told Ars.