Background

Automated Number Plate Recognition (ANPR) uses digital cameras and software similar to Optical Character Recognition (OCR) software to extract the registration data of vehicles. This can be done by pointing the camera at parked cars, but is most commonly done by deploying the camera adjacent to a road, and monitoring passing traffic. Variants have been used in most Australian States since the 1980s for heavy vehicle traffic. The technology is related to, but differs in some ways from, that used for 'speed cameras' and 'red light cameras'.

ANPR has reached epidemic proportions in the U.K., has been implemented in an uncontrolled manner, and relies on seriously error-prone underlying data. It has very serious implications for privacy, and for democratic freedoms more generally. It is crucial that Australian implementations not make the same gross mistakes as the U.K.

Until 2008, Australian Parliaments appear to have given virtually no consideration to ANPR, and law enforcement agencies have been conducting trials without guidance from their legislatures or oversight from anyone at all. (It appears that one Committee of the federal Parliament may have held hearings, but it is unclear which one it was, what information was publicly available, and who was invited. The APF wasn't).

In late 2007 and early 2008, the Queensland Parliamentary Travelsafe Committee has been undertaking an Inquiry into ANPR. This was naturally focussed on the traffic applications, rather than the broader policing and 'national security' justifications that are often advanced for ANPR. The Inquiry was conducted in an open and informative manner, and received 32 Submissions. The APF was invited to submit, and did so on 18 January 2008. The APF was subsequently invited to present verbal evidence, and did so on 14 March 2008.

This document contains the notes prepared for the Hearings. It should be read in conjunction with the APF's formal submission. See also the submission by QCCL. (The Submission by the OFPC contains material of value. The brief Submission by the OVPC swallows the unjustified assertions of the UK police, but also has some material of value in it).

APF POLICY re Automated Number Plate Recognition (ANPR)

1. ANPR has the potential to make contributions in several areas:

• directly, to the enforcement of traffic administration law:
  • Vehicles can be detected that are carrying registration plates for which the current annual payment has not been made. If resources are available to intercept such vehicles, enforcement may improve
  • Because many such vehicles are known to be driven by unlicensed drivers, this also assists in the interception of unlicensed drivers. If unlicensed drivers have a higher incidence of unpaid traffic fines, it could lead to a higher level of collection of traffic fines
• indirectly, to traffic safety:
  • Unregistered vehicles are known to have a higher incidence of defects, and a higher level of involvement in traffic accidents, than registered vehicles. To the extent that fewer road-miles are driven by unregistered vehicles (e.g. because they are confiscated, or miscreants are deterred from using them), there could be a reduction in traffic accidents
  • Unlicensed drivers are known to have a higher incidence of involvement in traffic accidents than licensed drivers. To the extent that fewer road-miles are driven by unlicensed drivers (e.g. because they are gaoled, or deterred from driving), there could be a reduction in traffic accidents
• indirectly, to traffic law. Unlicensed drivers are known to have a higher incidence of traffic offences than registered drivers. To the extent that fewer road-miles are driven by unlicensed drivers (e.g. because they are gaoled, or deterred from driving), there could be a reduction in traffic offences
• indirectly, to policing generally, in relation to the enforcement of criminal laws. Vehicles can be detected that are carrying registration plates that are, for example:
  • 'stolen vehicles' (i.e. reported stolen and not yet withdrawn from the list)
  • 'associated with a crime' (e.g. reported as a 'getaway vehicle')
  • associated with an individual for whom a warrant is outstanding
  • associated with an individual wanted for questioning
  • associated with a person of interest
• indirectly, to security agencies, in relation to the exercise of powers that are in most cases excessive and inadequately controlled. The historical patterns of movement of vehicles can be detected that are of interest to security agencies. Associations among vehicles can be detected that are of interest to security agencies. Many inferences can be loosely drawn, haystacks-full of which are likely to be wrong, and a few needles of which are potentially valuable intelligence

2. Wild claims have been made about the potential benefits of ANPR in some countries (not, thankfully, in Australia). Among them is the assertion by senior UK police executives that ANPR can "deny criminals use of the road". This does not stand up to any analysis. It is vital that assertions of benefits not be taken at face value, and that they be subjected to consideration, and testing.

3. Whether the potential benefits can be achieved is questionable. Factors include the following:

• considerable infrastructure is needed
• considerable human resources must be directed (or re-directed) to ANPR. This preferably involves teams of police committed to interception duties downstream from the detection equipment, or alternatively larger teams committed to susbequent analysis and follow-up
• the technology is known to be highly error-prone (in terms of missed readings and perhaps also of erroneous readings)
• the inferences drawn from detected plates are entirely dependent on the quality of the databases against which the registration plate data is compared. Concerns include:
  • registration databases contain errors, and timeliness of update is a particular weakness
  • stolen car lists are highly unreliable, because recovery is not reliably reported and updated
  • registration plates of interest to law enforcement and security agencies are even more unreliable in regard to their accuracy, currency and relevance
• the errors result in 'false-positives' (i.e. detections that would not have been detections had the error not arisen). As a result:
  • the resources committed to analysis and interception have to cope with large numbers of cases to choose, it is difficult to distinguish in advance likely real-positives from false-positives, and the proportion of false-positives may result in the real-positives not being addressed
  • when an interception is made, procedures must be used to establish whether the case is a real-positive or a false-positive, which uses up more resources
  • the inference that a vehicle is being driven by the registered owner is a highly unreliable one, and hence the likelihood of a false-positive is higher, and additional procedures need to be taken to distinguish real-positives from false-positives
• only a proportion of vehicles are being driven by their registered owner, and hence assumptions about the identity of the driver are frequently wrong

4. Despite deployment in a significant number of countries, and ample evidence of difficulties in the technology's application to policing, little or no independent testing has been reported, and no reliable independent assessments have been published. There is a serious shortfall in reliable information about:

• operational error-rates of various kinds under various conditions
• database error-rates
• resource-wastage through false-positives
• the consequences of false-positives for the individuals who are the subject of the undue suspicion and/or interception

5. As commonly practised, and as supported by currently available technologies, ANPR represents a gross privacy intrusion, and in some jurisdictions breaches privacy law, in the following ways:

• it involves arbitrary collection of personal data not for a specific, defined purpose to which it is clearly relevant, but opportunistically and for vague purposes
• it generates a very large database of personal data, containing:
  • registration data
  • one set – but very probably multiple sets – of:
    • the date and time of sighting
    • the location
    • the direction of movement
• the database can be used to draw inferences and generate suspicions
• the database is a 'honeypot' that attracts attention from many organisations for many purposes, resulting in 'scope creep'
• the database is impossible to protect against unauthorised access, resulting in leakage of content

6. As commonly practised, and as supported by currently available technologies, ANPR is a mass surveillance technique and breaches the human right of liberty of movement (UDHR 13.1, ICCPR 12.1). More specifically, with conventional ANPR:

• an unknown proportion of the large data-holdings is unreliable, and there is no simple or inexpensive way of sifting the accurate from the inaccurate
• suspicions can be readily generated, some of which are reasonable and some of which are not, and there is no simple or inexpensive way of sifting the reasonable from the unreasonable
• embarrassment is created for law-abiding citizens who are intercepted on the basis of incorrect data and unreasonable suspicion
• danger is created for law-abiding citizens who are intercepted by a law enforcement officer who has been given wrong information about the possible dangerousness of the vehicle's occupants
• the deterrent effect on miscreants appears unlikely to be all that great
• the unjustified chilling effect on law-abiding citizens appears likely to be much greater than the deterrent effect on miscreants. This applies especially to the many categories of persons at risk, including victims of domestic violence, protected witnesses, celebrities, and undercover law enforcement operatives

7. The practice of ANPR can readily become arbitrary interference by law enforcement officers, in such ways as the following:

• undue interception of false-positives
• misunderstandings, unpleasantness and altercations between officers and vehicle-occupants
• further actions in relation to the intercepted vehicle, such as roadworthiness inspections, bookings for minor transgressions (e.g. broken light-covers and mirrors), and search on the off-chance of finding infringing materials such as drugs
• further actions in relation to the driver, such as delay, questioning and search
• further actions in relation to other vehicle occupants, such as delay, questioning and search

8. The effects of the practice of ANPR on the public reputation of law enforcement agencies and individuals can be positive, in that they will be seen to be active, and to be effective; but run a great risk of being seriously negative, in that they will be seen to be intrusive into the activities of law-abiding citizens, and a key part of a 'police state' apparatus that gathers vast quantities of information about people's movements.

9. An alternative approach to ANPR addresses many of these issues. The 'blacklist in camera' design involves:

• release from the on-site camera device of only those detections that match to the current 'blacklist' of registration plates that are being sought
• certified non-accessibility and non-recording of any personal data other than that arising under the above circumstances
• substantial controls over the download of the blacklist to the device and the maintenance of the blacklist
• substantial controls over the quality of data used to prepare the blacklist, and exclusion of sources of data that are of insufficient quality

10. Considerable commitment and investment are required in order to implement the alternative approach to ANPR in the face of the momentum that has been achieved in some countries overseas by the orthodox, grossly privacy-invasive form of ANPR.

11. It is vital that ANPR projects be conducted in a transparent manner, including published information, consultation, privacy impact assessment, and published results.

12. It is vital that Parliaments expressly preclude inappropriate designs for uses of ANPR, and expressly authorise appropriate designs for and uses of it.