"The spread of these scanners is creating what are, in effect, government location tracking systems recording the movements of many millions of innocent Americans in huge databases," said Catherine Crump, a staff attorney at the ACLU and lead author of the report, said in a statement. "We don't object to the use of these systems to flag cars that are stolen or belong to fugitives, but these documents show a dire need for rules to make sure that this technology isn't used for unbridled government surveillance."
License plate readers, which use cameras to take pictures of license plates they spot, can be placed on top of patrol cars or road signs and bridges. Software embedded in the readers adds a time and location stamp to the photo of the license plate.
Although police departments commonly use the license plate readers to spot "hits" or matches to plates uploaded to their systems, the report says they are "typically programmed to retain the location information and photograph of every vehicle that crosses their path, not simply those that generate a hit."
"Because they snap pictures of every passing vehicle, they generate millions of data points on the movements of individuals whom no one suspects of violating any law," the report says.
To conduct the study, the ACLU and its affiliates sent 587 public records requests to place departments and state agencies in 38 states and Washington, D.C., to procure information on how they use license plate readers. The civil liberties group said 293 agencies responded, and the report's findings are gleaned from more than 26,000 pages of documents it received from them.
The report found that some police departments have tight data retention policies that require them to delete license plate information from their systems after a few hours or days. But it found that others store the license plate data for 18 months or two to five years.
The report found that authorities in Grapevine, Texas, and Yonkers, N.Y., store the data indefinitely.
"Databases of license plate reader information create opportunities for institutional abuse, such as using them to identify protest attendees merely because these individuals have exercised their First Amendment-protected right to free speech," the report reads. "If not properly secured, license plate reader databases open the door to abusive tracking, enabling anyone with access to pry into the lives of his boss, his ex-wife, or his romantic, political or workplace rivals."
The ACLU notes that federal agencies, such as Immigration and Customs Enforcement, and private companies also use license plate readers.
The group crafted a set of recommended policies that law enforcement should follow when using license plate readers. They include limiting law enforcement's use of license plate readers to investigating hits, or when they reasonably believe license plate data is relevant to a criminal investigation; allowing people to find out if their license plate data has been stored in a police database; and preventing authorities from sharing license plate data with third parties that do not have data retention principles in place.