With broad and near-unanimous bipartisan support, the Virginia General Assembly passed a series of bills this year to defend the public’s right to privacy from new mass surveillance technologies.
To his credit, Gov. Terry McAuliffe almost immediately signed a bill to require law enforcement to obtain a warrant before tracking people’s mobile phones with cell tower emulators, often called “stingrays.” But he initially balked at two other bills: one that would have also required police to get a warrant before using drones and another that would’ve placed strict limitations on other mass surveillance technologies, including a seven-day limit on the retention of locational data collected through automatic license plate readers (ALPR).
McAuliffe sent these two measures back to the legislature with suggested amendments, who sent them right back to his desk with only the slightest changes. The message was clear: these protections are what Virginians want and what they deserve.
The second time around, McAuliffe signed the drone bill, but he vetoed the ALPR bill, parroting the flawed talking points of the device manufacturers and law enforcement lobby groups:
Many localities in Virginia retain this data for 60 days to two years. Seven days is a substantial reduction. Additionally, law enforcement agencies demonstrate that crimes are often not reported until several weeks later. Under this bill, essential data would not be available at the time of those reports. This is particularly concerning when considering implications for the National Capitol Region, where cross-state collaboration and information-sharing are essential to responding to potential criminal or terrorist activity occurring near Virginia’s borders.
What McAuliffe fails to mention is those law enforcement agencies are already breaking Virginia’s Data Act by storing ALPR data, as the Virginia Attorney General determined in a 2013 legal opinion [PDF]. He also pays little attention to the threat to personal privacy that ALPRs represent: by collecting information on every driver, police are treating the entire population as if they’re suspects in a criminal investigation. Even more worrisome is how these cameras, which are capable of collecting thousands of locational data points a day, can potentially reveal the intimate details of a person’s life, including religious preferences, political affiliations, medical conditions, and romantic relationships. Indeed, as the ACLU of Virginia notes:
In 2013, public records revealed that during the 2008 election, Virginia State Police used ALPRs to collect information about people attending rallies for candidates Sarah Palin and Barack Obama, and later targeted vehicles crossing from Virginia to Washington for Obama’s inauguration.
McAuliffe also failed to address some of the more questionable techniques used by ALPR companies to shield their products from public scrutiny, such as contracts that forbid agencies from talking candidly publicly about the technology. In Lansing, Michigan, police have given up on ALPRs because they were unreliable and drained the batteries of their cars. In San Francisco, police have been sued after a false positive resulted in a confrontation between officers and an innocent government employee.
The ACLU of Virginia isn’t giving up. Five days after McAuliffe acted on the bills, the organization filed a lawsuit [PDF] against the Fairfax County Police Department, which, despite the Attorney General’s guidance, has been storing ALPR data for up to a year and sharing that data with other law enforcement agencies in the region. If successful, the lawsuit could potentially have an even stronger impact on ALPR limits than what the bill would have provided.
We're very proud of the hundreds of EFF supporters in Virginia who sent letters to their lawmakers and tweeted at the governor about these measures. And, again, we commend McAuliffe for signing bills to limit the use of stingrays and drones, but we’ll be rooting for the ACLU as they pursue other means to challenge invasive technologies such as ALPRs.
