This project is based on data processed by student journalist Olivia Ali, 2020 intern JJ Mazzucotelli, and research assistant Liam Harton, based on California Public Records Act requests filed by EFF and dozens of students at the University of Nevada, Reno Reynolds School of Journalism. 

Tiburon, California: a 13-square-mile peninsula town in Marin County, known for its glorious views of the San Francisco Bay and its eclectic retail district. 

What the town's tourism bureau may not want you to know: from the moment you drive into the city limits, your vehicle will be under extreme surveillance. The Tiburon Police Department has the dubious distinction of collecting, mile-for-mile, more data on drivers than any other agency surveyed for a new EFF data set. 

Today, EFF is releasing Data Driven 2: California Dragnet, a new public records collection and data set that shines light on the massive amount of vehicle surveillance conducted by police in California using automated license plate readers (ALPRs)—and how very little of this surveillance is actually relevant to an active public safety interest. 

Download the Data Driven 2: California Dragnet data set.

In 2019 alone, just 82 agencies collected more than 1 billion license plate scans using ALPRs. Yet, 99.9% of this surveillance data was not actively related to an investigation when it was collected. Nevertheless, law enforcement agencies stockpile this data, often for years, and often share the data with hundreds of agencies around the country.  

This means that law enforcement agencies have built massive databases that document our travel patterns, regardless of whether we're under suspicion. With a few keystrokes, a police officer can generate a list of places a vehicle has been seen, with few safeguards and little oversight.  

EFF's dataset also shows for the first time how some jurisdictions—such as Tiburon and  Sausalito in Northern California, and Beverly Hills and Laguna Beach in Southern California—are scanning drivers at a rate far higher than the statewide mean. In each of those cities, an average vehicle will be scanned by ALPRs every few miles it drives.

Tiburon first installed Vigilant Solutions ALPRs at the town's entrance and exit points and downtown about a decade ago. Today, with just six cameras, it has evolved into a massive surveillance program: on average, a vehicle will be scanned by cops once for every 1.85 miles it drives.  

Tiburon Police stockpile about 7.7-million license plate scans annually, and yet only .01% or 1 in 10,000 of those records were related to a crime or other public safety interest when they were collected. The data is retained for a year. 

ALPRs are a form of location surveillance: the data they collect can reveal our travel patterns and daily routines, the places we visit, and the people with whom we associate. In addition to the civil liberties threat, these data systems also create great security risks, with multiple known breaches of ALPR data and technology occurring over the last few years. 

EFF sought comment from Tiburon Police Chief Ryan Monaghan, who defended the program via email. "Since the deployment of the ALPRs, our crime data from the five years prior to having the ALPRs as well as the five years after and beyond have shown marked reductions in stolen vehicles and thefts from vehicles and an increase in the recovery of stolen vehicles," he wrote.  

EFF’s public records data set, which builds on a 2016-2017 survey (Data Driven 1), aims to provide journalists, policymakers, researchers, and local residents with data to independently evaluate and understand the state of California's ALPR dragnet. 

What Are Automated License Plate Readers?

A fixed ALPR and a mobile ALPR. Credit: Mike Katz-Lacabe (CC BY)

ALPRs are cameras that snap photographs of license plates and then upload the plate numbers, time/data, and GPS coordinates to a searchable database. This allows police to identify and track vehicles in real time, search the historical travel patterns of any vehicle, and identify vehicles that have been spotted near certain locations. 

Cops attach these cameras to fixed locations, like highway overpasses or traffic lights. Law enforcement agencies also install ALPRs on patrol vehicles, allowing police to capture data on whole neighborhoods by driving block-by-block, a tactic known as "gridding." In 2020, the California State Auditor issued a report that found that agencies were collecting large amounts of data without following state law and without addressing some of the most basic cybersecurity and civil liberties concerns when it comes to Californians' data. 

About the Data Set

The Data Driven 2: California Dragnet data set is downloadable as an Excel (.xlsx) file, with the data analysis broken into various tabs. We have also presented selections from the data as a table below. 

The dataset is based on dozens of California Public Records Act Requests filed by EFF and students at the Reynolds School of Journalism at the University of Nevada, Reno in collaboration with MuckRock News. Data Driven 2 is a sequel to the EFF and MuckRock's 2018 Data Driven report. 

To create the data set, we filed more than 100 requests for information under the California Public Records Act. We sought the following records from each agency: 

1. The number of license plate scans captured by ALPRs per year in 2018 and 2019. These are also called "detections." 
2. The number of scanned license plates each year for 2018 and 2019 that matched a "hot list," the term of art for a list of vehicles of interest. These matches are called "hits." 
3. The list of other agencies that the law enforcement agency is exchanging data with, including both ALPR scans and hot lists. 

Most of these public records requests were filed in 2020. For a limited number of requests filed in 2021, we also requested detection and hit information for 2020. The agencies were selected because they had previously provided records for the original report or were known to use an ALPR system that could export the type of aggregate data required for this analysis. Not all agencies provided records in response to our requests. 

The spreadsheet includes links to public records for each agency, along with a table of their statistics. In addition, we have included "Daily Vehicle Miles Travelled" from the California Department of Transportation for help in comparing jurisdictions. 

The dataset covers 89 agencies from all corners of the state. However, the data was not always presented by the agencies in a uniform manner. Only 63 agencies provided comprehensive and separated data for both 2018 and 2019. Other agencies either produced data for incomparable time periods or provided incomplete or clearly erroneous data. In some cases, agencies did not have ALPRs for the full period, having either started or ended their programs mid-year.  (Note: More than 250 agencies use ALPR in California).

In general, our analysis below only includes agencies that provided both 2018 and 2019 data, which we then averaged together. However, we are including all the data we received in the spreadsheet.

Hit Ratio: Most ALPR Data Involves Vehicles Not Under Active Suspicion 

One way to examine ALPR data is to ask whether the data collected is relevant to an active investigation or other public safety interest at the time it is collected. 

Law enforcement agencies create "hot lists" of license plates, essentially lists of vehicles they are actively looking for, for example, because they're stolen, are suspected of being connected to a crime, or belong to an individual under state supervision, such as a sex offender. When an ALPR scans a license plate that matches a hot list, the system issues an alert to the law enforcement agency that the vehicle was sighted. 

Data that is not on a hot list is still stored, often for more than a year depending on the agency's policy, despite a lack of relevance to an active public safety interest. Police have argued they need this data in case one day you commit a crime, at which point they can look back at your historical travel patterns. EFF and other privacy organizations argue that this a fundamental violation of the privacy of millions of innocent drivers, as well as an enormous cybersecurity risk. 

The 63 agencies that provided us 2018-2019 data collected a combined average 840,000,000 plate images each year. However, only 0.05% of the data matched a hot list. 

Some agencies only provided us data for three months or one year. Other agencies lumped all the data together. While we have left them out of this analysis, their hit ratios closely followed what we saw in the agencies that provided us consistent data. 

The top 15 data-collecting law enforcement agencies accounted for 1.4 billion license plate scans over two years. On average, those 15 law enforcement agencies reported that only .05% of the data was on a hot list. 

In his written response to our finding that Tiburon Police store data for a year, even though 99.9% of the data was not tied to an alert, Chief Monaghan wrote: "Our retention cycle for the scan data is in line with industry-wide standards for ALPRs and does not contain any personal identifying information. Like other agencies that deploy ALPRs, we retain the information to use for investigative purposes only as many crimes are reported after the fact and license plate data captured by the ALPRs can be used as an investigative tool after the fact." 

Monaghan presents a few misconceptions worth dispelling. First, while many agencies do store data for one year or more, there is no industry standard for ALPR.  For example, Flock Safety, a vendor that provides ALPR to many California agencies, deletes data after 30 days. The California Highway Patrol is only allowed to hang onto data for 60 days. According to the National Conferences of State Legislatures, Maine has a 21 day retention period  and Arkansas has a 150 day retention period.  In New Hampshire, the law requires deletion after three minutes if the data is not connected to a crime.

Finally there is a certain irony when law enforcement claims that ALPR data is not personally identifying information, when one of the primary purposes of the data is to assist in identifying suspects. In fact, California's data breach laws explicitly name ALPR as a form of personal information when it is combined with a person's name. It is very easy for law enforcement to connect ALPR data to other data sets, such as a vehicle registration database, to determine the identity of the owner of the vehicle. In addition, ALPR systems also store photographs, which can potentially capture images of drivers' faces. 

Indeed, Tiburon's own ALPR policy says that raw ALPR data cannot be released publicly because it may contain confidential information. This is consistent with a California Supreme Court decision that found that the Los Angeles Police Department and Los Angeles County Sheriff's Department could not release unredacted ALPR data in response to a CPRA request because "the act of revealing the data would itself jeopardize the privacy of everyone associated with a scanned plate. Given that real parties each conduct more than one million scans per week, this threat to privacy is significant." The Supreme Court agreed with a lower court ruling that "ALPR data showing where a person was at a certain time could potentially reveal where that person lives, works, or frequently visits. ALPR data could also be used to identify people whom the police frequently encounter, such as witnesses or suspects under investigation."

Scans Per Mile: Comparing the Rate of ALPR Surveillance 

While the agencies listed in the previous section are each collecting a massive amount of data, it can be difficult to interpret how  law enforcement agencies' practices compare to one another. Obviously, some cities are bigger than others, and so we sought to establish a way to measure the proportionality of the ALPR data collected. 

One way to do this is to compare the number of license plate scans to the size of the jurisdiction's population. However, this method may not provide the clearest picture, since many commuters, tourists, and rideshare drivers cross city lines many times a day. In addition, the larger and more dense a population is, fewer people may own vehicles with more relying on public transit instead. So we ruled out that method. 

Another method is to compare the license plate scans to the number of vehicles registered or owned in a city. That runs into a similar problem: people don't always work in the same city where their car is registered, particularly in the San Francisco Bay Area and Los Angeles County. 

So, we looked for some metric that would allow us to compare the number of license plate scans to how much road traffic there is in a city. 

Fortunately, for each city and county in the state, the California Department of Transportation compiles annual data on "Vehicle Miles Traveled" (VMT), a number representing the average number of miles driven by vehicles on roads in the jurisdiction each day. VMT is becoming a standard metric in urban and transportation planning.

By comparing license plate scans to VMT we can begin to address the question: Are some cities disproportionally collecting more data than others? The answer is yes: Many cities are collecting data at a far higher rate than others.

There are a few different ways to interpret the rate. For example, in Tiburon, police are collecting on average one license plate scan for every 1.85 miles driven. That means that the average vehicle will be captured every 1.85 miles. To put that in perspective, a driver from outside of town who commutes to and from downtown Tiburon (about four miles each way to the town limits), five days a week, 52 weeks a year, should expect their license plate to be scanned on average 1,124 times annually.  

Another way to look at it is that for every 100 cars that drive one mile, Tiburon ALPRs on average will scan 54 license plates. 

Via email, Tiburon Chief Monaghan responded: "In terms of the number of scans compared to VMT, our ALPRS are strategically placed on two main arterial roadways leading in and out of Tiburon, Belvedere, and incorporated sections of Tiburon. As Tiburon is located on a peninsula, there are limited roadways in and out. The roadways where the ALPRs are deployed are not only used by those who live in the area, but also by commuters who use the ferries that operate out of Tiburon, those who work in Tiburon and Belvedere, parents taking their kids to schools in the area, and those visiting."

Tiburon isn't the only agency collecting data at a high rate. 

• In Sausalito, on average police are capturing a plate for every 2.14 miles a car drives. That's the equivalent of 46 scans per 100 vehicles that drive one mile. 
• In Laguna Beach, it's one ALPR scan for every three miles. On average, ALPRs will scan 33 plates for every 100 cars that drive a single mile. 
• In Beverly Hills, it's one ALPR scan for every 4.63 miles, or 21 scans per 100 cars that drive one mile. 

In comparison: Across 60 cities, police collectively scanned on average one plate for every 48 miles driven by vehicles. Tiburon scanned license plates at more than 25 times that rate. 

For this analysis, we only included municipal police that provided data for both 2018 and 2019. We then used those figures to find an average number of daily plates scanned, which we then compared to the cities' average daily VMTs for 2018-2019. 

Here are the top 15 municipal police department based on miles per scan. 

A few caveats about this analysis: 

We must emphasize the term “average.” Road traffic is not even across every street, nor are ALPRs distributed evenly across a city or county. A driver who only drives a half mile along backroads each day may never be scanned. Or if a city installs ALPRs at every entrance and exit to town, as Tiburon has, a driver who commutes to and from the city everyday would likely be scanned at a much higher rate. 

In addition, many police departments attach ALPRs to their patrol cars. This means they are capturing data on parked cars they pass. Your risk of being scanned by an ALPR does not increase linearly with driving—someone who leaves their car parked all year may still be scanned several times. In many jurisdictions, both the city police and the county sheriff use ALPRs; our data analysis does not cover overlapping data collection. Our intention is not to help drivers determine exactly how often they’ve been scanned but to compare the volume of data collection across municipalities of different sizes. 

Finally, VMT is not an exact measurement but rather an estimate that is based on measuring roadway traffic on major arteries and projecting across the total number of miles of road in the city. 

As such, this ratio presents a useful metric to gauge proportionality broadly and should be interpreted as an estimate or a projection. 

What to Do With This Data

The Data Driven 2 dataset is designed to give a bird’s eye view of the size and scope of data collection through ALPRs. 

However, it does not dive into more granular variations in ALPR programs between agencies, such as the number or type of ALPR cameras used by each agency. For example, some agencies might use 50 stationary cameras, while others may use three mobile cameras on patrol cars and still others use a combination of both. Some agencies may distribute data collection evenly across a city, and others may target particular neighborhoods. 

In many cases, agencies provided us with "Data Sharing Reports" that list everyone with whom they are sharing data. This can be useful for ascertaining whether agencies are sharing data broadly with agencies outside of California or even with federal agencies, such as immigration enforcement. Please note that the data sharing list does change from day-to-day as agencies join and leave information exchange networks. 

Journalists and researchers can and should use our dataset as a jumping-off point to probe deeper.  By filing public records requests or posing questions directly to police leaders, we can find out how agencies are deploying ALPRs and how that impacts the amount of data collected, the usefulness of the data, and the proportionality of the data. Under a California Supreme Court ruling, requesters may also be able to obtain anonymized data on where ALPR data was collected.

Conclusion 

Law enforcement often tries to argue that using ALPR technology to scan license plates is no different than a police officer on a stakeout outside a suspected criminal enterprise who writes down the license plates of every car that pulls up. 

But let's say you lived in a place like Brentwood, where police collect on average 25-million license plates a year.

Let's assume that a police observer is able to snap a photo and scribble down the plate number, make, model, and color of a vehicle once every minute (which is still pretty superhuman).  Brentwood would have to add 200 full-time employees to collect as much data manually as they can with their ALPRs.  By comparison: The Brentwood Police Department currently has 71 officers, 36 civilian support workers, and 20 volunteers. The entire city of Brentwood has only 283 employees. 

If 200 human data recorders were positioned throughout a city, spying on civilians, it's unlikely people would stand for it. This report illustrates how that level of surveillance is indeed occurring in many cities across California. Just because the cameras are more subtle, doesn't make them any less creepy or authoritarian.  

2018-2019 Detections with Hit Ratio

Irregular Agencies

These agencies responded to our records requests, but did not provide complete, reliable or directly comparable information.