 My name is Aaron. I am the head of the membership team at the Electronic Frontier Foundation, and welcome all of you to our autumn member speakeasy. Twice each year or sometimes more, we invite current members like you to meet up with fellow internet freedom supporters and the EFF staff. Of course, it's still tough to meet in person, so for the past year and a half, we've been experimenting with different platforms and formats for virtual member meetups, including Zoom. It's been great to see members from far off places who would otherwise not be able to participate, of course. And in fact, if you'd like to say hello to folks here in the room right now, feel free to use the chat box to type in your name and sort of generally where you are in the world, if you'd like. Even though EFF will start having in-person events in the near future, we'll continue holding space for different kinds of virtual ones going forward. So, you know, hooray internet. So a few items of housekeeping before we begin. Many of you are familiar with Zoom at this point, but a couple of reminders. Please keep yourself muted while our guests are speaking. You'll have an opportunity to ask questions in the final portion of the program. If you have a question for our speakers at any time, just type it into the chat and my colleague Christian will note it. Alternatively, you can find a raise hand button when you click on reactions in the bottom of your screen here. In the last 20 minutes of today's program, Christian's going to call on some of you with raised hands and also read out some questions that he's collected from chat, so don't have to worry there. So also note that EFF has a code of conduct for public events, so please be kind. You can check that out at EFF.org slash event expectations. And finally, I just want to thank you all for making EFF's work possible. This is an incredibly important time for us to stand up for the rights, freedoms, and interests of ordinary technology users. So, thank you all for being on our side for that. All right, so in preparation for this event, we asked folks on Twitter to tell us what internet freedom issue they wanted to hear about. A lot has happened lately. So, for example, so much of the web is now encrypted that we're getting ready to deprecate our each sheet to PS everywhere browser extension after a decade of successful advocacy for secure certs. So that's pretty huge and big for us. And we're also fighting to ensure that the European Union's Transformative Digital Services Act can preserve user freedom and human rights. And also in the last few months, we used multiple tactics and pressure points to stop Apple from installing dangerous message and photo scanning capabilities on its devices. So lots and lots of big stuff and important progress for online rights. But today, we have the honor of hosting a discussion about law enforcement and their use of surveillance technologies, its impact on your privacy and what we can do about it. So today, I am pleased to welcome two in-house experts in this area. First, EFF director of investigations, Dave Moss, whose work focuses on surveillance technology, government transparency, press freedoms, immigration enforcement at the U.S., Mexico border, prisoner rights, and much, much more. Welcome, Dave. And also, I would like like everyone to welcome EFF staff attorney, Syrah Hussein, from our civil liberties team. Previously, Syrah was part of the criminal justice reform program at Advancing Justice, Asian Law Caucus, and her current work centers on the intersection of racial justice and surveillance. Syrah and Dave, thank you very much for being here. And please take it away. Excellent. Thank you so much, Erin. So today, Syrah and I are going to be talking primarily about license plate readers. We're going to be talking about probably some other technologies too, but we're going to focus particularly on this technology. And I'm going to switch over to a slideshow. I'm going to sort of start with a very overview slide for folks who like to hear me talk, but also like to have everything jammed into one single slide. But for background, when I joined EFF in 2013, I had no idea that these four letters ALPR would consume so much of my life. I didn't have a car at the point, so I didn't really think too much about vehicle surveillance. But this kind of landed on our lap in about 2012, 2013. And the more I've looked over it, over the last few years, the more I've researched it, the more convinced I am that this is one of the most nefarious technologies in use by law enforcement. This slide, I'm going to go into detail about everything on here. And so I'm just going to go on a sort of overview in this first part of this discussion about what this technology is. What are they, how do they work, and how do we know that police use them? So first thing I want to tell you is that this technology is pretty widespread. We have a project called the Atlas of Surveillance. You can check it out at atlasofsurveillance.org where we have a whole bunch of people pulling together research on about 12 different technologies around the country and adding it to this database and map. And so far, we've documented 950 agencies using ALPR. I think ultimately there's probably about 1500, 2000 using license plate readers, but it's a process of gathering all this information. But the point is, is that wherever you go in the cross the country, you're probably going to have your car scanned by a license plate reader at some point or another, particularly if you're in a very heavily populated area in California or in the Northeast or in the South. So license plate readers are essentially just cameras, cameras attached to computers that are directed in the direction of where a license plate might be. And when it sees letters and numbers, the algorithm grabs them, turns them into machine readable characters. It might document the color of your vehicle. It might make note of what model your vehicle is. It might grab information about your bumper sticker. Some of the systems out there might note whether your car has damaged to it or scratches or your fender is bent in a little bit, but it attaches a time and date stamp to it, as well as the GPS coordinates for that scan, and then uploads that to a database that police can then search. So I want to go over what these look like in the real world. So there's a few different flavors of license plate readers. And the first flavor I would describe as a fixed license plate reader or a stationary license plate reader. Frequently, if you're driving around, you might see these mounted on traffic signals or light posts. They're going to look pretty similar often to other kinds of surveillance cameras. And so really, you'll notice them in the sense that if they are pointed at a road, then they're probably going to be a license plate reader. I do want to flag the one at the bottom right here in the image. That is a newer license plate reader called a Flock camera. And Flock has been selling these cameras, particularly to homeowners associations. So if you live in a neighborhood that's a gated community or has a homeowner association, you might see that these cameras have started to pop up. Another version of the license plate reader is what I would call a mobile ALPR or a patrol mounted ALPR. These are the same cameras, but instead of being mounted in one fixed position that captures all the cars passing by, these are actually attached to vehicles. So usually police cars or police vans, and they capture not only the cars that pass by this police car, but the police car could actually drive around and collect license plates. So it's not just collecting moving vehicles, but also parked vehicles. And there's this technique called gridding that police do to gather information on entire neighborhoods. So this slide right here is from the Chandler Police Department in Arizona. And this slide specifically tells police that if you have one of the vehicles with a license plate reader on it, whenever you have downtime or you're not responding to a call, go gridding. And they define gridding as driving up and down every street in an area to capture all license plates. And I want to flag in their, this sort of third line of their presentation in which they say the reason to do this is to help us gather intelligence to solve future cases. This is not about solving crimes that happened in the past. That's not about crimes that are happening right now. They are actually collecting this stuff in case one day there is a crime. They're building a kind of time machine of sorts of where people's cars are. Another way that you have license plate readers are with these speed trailers. Not all speed trailers are going to be license plate readers. A lot of them are based on radar. But if you see one of these as you're driving up and you see that it's telling you your speed limit is whatever, look to see if there are cameras. See if you can spot that because, I mean, don't get in a car accident by paying too much attention. But take a look and see if you can recognize whether it's a radar based truck or a license plate reader. Because really the main purpose of this device that I'm showing you is not to check your speed. The checking your speed part is kind of like camouflage for it. It puts it there, you're noticing it, but ultimately it's there to collect your data. Something to emphasize as well is that it's not just like cops have their cameras and that's the only data that they access. They can purchase access to a private database of a license plate data that was collected by a private company. So there's a private company called DRN Data that equips repo cars and tow truck drivers with ALPRs and then masses this gigantic database that it then sells access to. But police can actually share data with each other. One police department might get data from 500 other police departments. So you don't actually need to have, if you're a police department, you actually don't have to have the cameras yourself to surveil people's driving patterns. You can actually just buy access to a database. Like I said, this just kind of goes into a little bit more detail about what kind of data they might access. Any given police department is probably going to have access to other law enforcement agencies data, that private data, there might be homeowners associations using those flock cameras that are sharing data with the police, business associations and might set up their own systems for collecting license plate readers. A lot of parking garages, particularly on college campuses are collecting data and feeding it to police, but toll bridges and parking enforcement often rely on license plate readers as well. Some terms you might hear come up are this term called the hot list. A hot list is the same thing as a watch list. It's just a list of vehicles that police are actively looking for. And so if they put a hot list into their system, they can get real time alerts on whenever a car on that hot list is seen by a camera. Or if the patrol car is rolling around with its own license plate reader on it, it'll get like a beep every time they pass a vehicle on a hot list. And then they can choose to follow that car until it makes a traffic mistake and then pull that person over. To give you an idea about how law enforcement actually uses license plate readers in practice, so there are those real time alerts, like I said, you add you to a hot list and then I can get updates like emails or text messages, whatever you're seen by one of these cameras. I can go into the database and I can put in your license plate and I can see backwards in time where your car has been sometimes going years back. I can put in a location, say that's like, let's say cannabis dispensary or a gun store or a mosque and I can put that in there and I can see what vehicles were seen near that address or I can put in multiple addresses and see what cars were seen at all of those addresses. I can do something called network mapping where I can put in your vehicle's license plate and the system will tell me what vehicles were seen near your vehicle on a regular basis and that would reveal maybe who your family members are, who your coworkers are and that kind of thing. And then finally, something we see police do is use the predictive capacity of these algorithms. They want to find out where you are going to be tomorrow at one o'clock. They can go look at the system and the system, depending on how much data they have on you, will predict where you might be at any given time. I'll show you what this looks like. So these are public records we've gotten through our research. So this is one of the online interfaces and you can see here, they're looking for a particular vehicle here and you can see that it says, I think down here at the bottom to move my little cursor here, but it'll say that the times the subject's vehicle was cited, at this particular location when was it last seen, you can see that this vehicle goes back to, so it was like what, seven times between May and December. So this is kind of what that looks like. And then another version of it, so this is when they do what's called geofencing where they pick a particular address and they want to see what cars were near that particular address. Some reporters in Atlanta did a really good investigation where they were able to get access to license plate reader data and they mapped out what it looked like for one vehicle traveling around. And so this particular vehicle in 2018, just driving it around the Atlanta area in the course of one day was captured 15 times just driving around. Now this was in 2018 and I can tell you that the Atlanta area over the last two years has exploded with ALPR. There are homeowners associations with license plate readers. The power company has installed license plate readers on their electric poles. There have been more and more adoption by law enforcement agencies of various systems and increasing the systems they have. So even though there's only 15 scans here in 2018, this same vehicle, if this research was done again, would probably be astronomically higher. Unfortunately, following this research, the state of Georgia banned their ability to do this research. So we won't actually be able to see information like this again, at least not out of Georgia. And I think the last point I want to get across is that by definition for me, license plate readers are a form of mass surveillance. And what I mean by that is that they are collecting massive amount of data on every driver regardless of suspicion. This is not a targeted surveillance where they have a suspect and they're doing a stake outside their house and they get a warrant for it. It's none of that. It is everybody's under investigation. And to give you an idea of the scale, we recently published a survey, I say survey, but it's actually like a collection of public records we pulled together using the California Public Records Act. We found that of 65 agencies we looked at, they collected 1.4 billion scans just over a two-year period. But by their own records, less than 0.05% of those plates were on a hot list, meaning that 99.9% of these plates were just of innocent people who had no suspected connection to a crime at the time it was collected. And I'm going to put this slide up for just another second, but that's my kind of introduction. From there, I want to sort of bring in Saira so we can talk through some of the worries and concerns we have about this technology and how this might impact people. I'm going to actually stop screen sharing that now. And Saira, when we're talking about license plate readers, what for you are like the immediate concerns that come to mind? Yeah, I mean, I think a lot of it can be apparent, right? The fact that you're driving around in public and that automatically means that your information is being collected, not just the information about where your car has been, but also information related to who's in the vicinity, if there's a passenger, if there's a driver. And when you can piece together all that information, it can be highly revealing of your movements. But like most surveillance technologies that are used by law enforcement as in addition to the tools that non-technological tools that law enforcement uses, we know that this has a particular impact, a disproportionate impact on communities of color. And so there was an ACLU report that came out a couple of years ago that with the aid of public records request showed that ICE immigration and customs enforcement has been using ALPR information to identify people for detention and deportation. They do this through access to some of these private networks in which law enforcement agencies are contributing and listing ICE as a sharing partner. So they're able to basically go into the system and not just get access to all of the data that they've collected, but also wide swaths of data from across the country about individuals who may be under their suspicion. Moreover, we know that NYPD, when it was targeting Muslim communities for surveillance, oftentimes what they were doing was setting up ALPR scanners to be in the vicinity of mosques to determine who's driving by a mosque or who's entering a mosque. And all of that is very concerning because you can blanket surveil. And then after that, you may use that to target certain communities. And that is a real concern here at EFF and real concern of the work that I do. Thank you. I want to add on to that a little bit. A few other things that are concerned to me, and these are problems we've encountered in researching ALPR, you know, similar to how this can be abused to target immigrant communities and you know, religious minorities. We've also seen this used to target activists, whether that be the collecting license plates for people who attend protests, to sort of more, you know, heinous uses. There was a case out of Canada where police were upset about a particular journalist who'd been critical of law enforcement, and they added him to a license plate reader database, hoping they could catch him leaving a bar so they could arrest him and then, you know, discredit his reporting. Certainly with these systems, we see a lot of issues with data breaches. One of the vendors for face recognition and license plate reader technology to DHS had a pretty significant breach, I believe about two years ago called perceptics. But then we have a lot of issues with errors, like these, you know, just like you might hear about errors with face recognition, there are plenty of errors that happen with license plate readers. One of the earliest cases happened in San Francisco where a woman who happened to be a municipal bus driver was just driving doing her thing, and a police license plate reader misread one of the letters in her license plate, matching it to a hot list. And the next thing you know, she's having a very traumatic encounter with police, with guns, with them putting their hands on her, and she ended up winning a pretty large settlement because of that. Similarly in Aurora, Colorado, fairly recently, there was a group of teenagers who were hauled out of their car and put in a traumatic situation because a license plate reader told cops that, oh, this person, you know, this is a stolen vehicle, when really the license plate was like a stolen vehicle in a whole different state, and that the system did not register that this was the same number, but for a different state than the wanted vehicle. Yeah, and I think there's just some other, you know, issues that come up along with secrecy and police not being particularly open about how they use license plate readers, but also the companies themselves tend to set up a relationship with law enforcement where they can tell police to not tell the press about the technology without them signing off on the messaging. So there's a lot of stuff that comes up. Before we go on to the next part, sorry, did any other concerns pop out at you as we were discussing? I think you've covered the vast majority of them, but you know, it really is about the fact of surveillance and the surveillance targeting particular communities as well as the abuse and misuse of the system that we've seen over and over again. So I wanted to talk a little bit about the history of EFF's work in this area, and I'm going to talk a lot about the transparency efforts related to this and some of the legislative efforts and then hand off to Syra to talk about some of the legal work that we've done and particularly our big new case on this. So for one, a lot of what we've done has been related to government transparency and just trying to learn about license plate readers. So back in 2012, one of our lead attorneys in this area, Jennifer Lynch, joined the ACLU in suing the Los Angeles Police Department and the Los Angeles County Sheriff's Office trying because they just wanted to get one week's worth of license plate reader data to analyze what the privacy impact was on it. And, you know, outrageously, LAPD and LA Sheriff came back and said, we can't give you these records because they're investigative records. And we're like, what do you mean they're investigative records? Like who's under investigation? And they pretty much came back and said, everyone who drives an LA is under investigation, therefore, we can use our investigative privilege to withhold that. Jennifer Lynch and our co-cancellate ACLU did not accept that and took it all the way up to the California Supreme Court where many years later we emerged victorious and we do now have our hands on that data. We did something similar in Oakland where we were able to get a week's worth of data several years ago. And we analyzed it and sure enough, that data showed that Oakland Police Department officers were gritting neighborhoods and particularly black and lower income neighborhoods. A lot of what we, here we talk a lot about our work we do in California. And part of that is because we have a law in California that does require some regulation and transparency around license plate readers. And so I'll talk a little bit more about that law in just a second. But one of those things that it requires is that every agency that uses license plate reader needs to have a policy on their website. And so we've been going around trying to find those policies. And one of the things we found was that the Sacramento County Department of Health and Human Services, they're the ones who manage food stamps, SNAP benefits, and other, you know, social welfare programs had been using license plate reader to investigate benefit recipients. And they never had a policy in place. They never went through the public process they're supposed to go to. And when we called them out, they ended up canceling that program. So this is for another example of the success we've had in pushing back on this. We have also filed more than a thousand public records requests nationwide for license plate reader data to find out how much data people are collecting, who they're sharing it with. And we're also able to uncover how some shopping malls in Southern California were sharing data, license plate reader data, specifically with ICE. On the legislative front, as I mentioned, we supported a bill called SB 34, which did put some regulations in place, including regulations on who they could, who police can share data with, what kind of policies they need to have, and what kind of process they need to go through. We've also had some not successful times in the legislature. We proposed a bill called SB 712 that would have allowed Californians to cover their license plates when parked. And we were very, very happy with this bill. We had bipartisan support. But unfortunately, the police also have bipartisan support. And ultimately, it was voted down in the California Senate. But we didn't come back, and we're able to work with Senator Scott Wiener to get a state audit into license plate readers, which totally found that everything that we've been complaining about was true. That four police departments they looked at were violating the law on a regular basis, and it was a problem. And so now we're supporting a new bill called SB 210 that is working its way through the legislature. So that kind of carries through a lot of the research and legislation we've done on this. Sorry, I got a little echo there. I want to pass on to Saira. Saira, do you talk to us first a little bit about some of the legal work we've done in amicus briefs? And then maybe you move on to the new case. Yeah, that sounds great. And I'll just note that SB 210, unfortunately, did die this past year. And we were not able to basically get a lesser retention period. So that is still something that we're thinking through. And I know many other organizations are also thinking through ways of protecting people and making sure that ALPR information isn't just readily available to everybody, essentially. And that law enforcement agencies aren't collecting it and retaining it indefinitely. So moving on a little bit to our amicus work. So amicus briefs are something that EFF regularly engages in. They're basically friend of the court briefs, so we're not a party in the litigation. But what we are seeking to do is try to weigh in with our expertise on these issues of surveillance technologies and the impact that they have. And so one of the things that we have done is we filed an amicus brief talking about ALPR data. This was in the context of a Virginia state law that identified automated license plate reader potentially as being personally identifiable information. We supported that. We said that ALPR data is, in fact, personally identifiable because it reveals so much about a person, including the location of where their car is. It can piece together where you live, where you work, potentially who you're associating with, as well as other issues like capturing photographs of the driver and passenger, for example. So we said that this information is not just personally identifiable, but it can also chill First Amendment activity. And the Virginia Supreme Court ruled that that, in fact, was the case that it is personally identifiable information. We also filed an amicus brief talking about automated license plate reader data. And we argued that the Supreme Court's decision in Carpenter back in 2018, which was a decision that said law enforcement must get a warrant to access historical cell site location information data. We said that that should apply to automated license plate readers. And the Massachusetts Supreme Judicial Court, in that case, adopted many of these arguments, finding that this is, in fact, personally identifiable information that should be limited by a warrant. I think in that particular case, it didn't apply. But overall, some of these arguments were definitely persuasive to courts. And we continue to push for this type of advocacy and legal reasoning as it comes up. We imagine that it will continue to because, as Davis said, ALPRs have exploded over the last several years in terms of who is using them, particularly and including used by law enforcement. Thanks, Sarah. So I am super excited about the case we just filed. It just blows me away. Just reading this thing, it's just gripping and it's intense. Tell us about this case. I'm not even going to pre-fix it anymore. Sure. So last month, EFF and several affiliates of the ACLU, all three affiliates of the ACLU in California, actually, filed a lawsuit in Marin County against the Marin County Sheriff on behalf of three activists for violating two California laws that protect immigrants and motorists' privacy. So in Marin County, what happens is the Sheriff shares ALPR data with 18 federal agencies, including ICE and Customs and Border Protection, and over 400 out-of-state agencies. And so if you remember back to that law that Dave told you about SB 34, within that law, it limits the sharing of ALPR data only to California agencies. And so the sharing of this data with federal and out-of-state agencies is a violation of the law. So we have filed suit. One of the claims is under SB 34. And the other claim is under SB 54, which is known as the California Values Act. And that was a law passed back in, believe it was 2017, so it went into effect in 2018. And that law limits the ability of local law enforcement, local and state law enforcement in California, to collaborate with federal immigration enforcement. And so it says do not spend money or other types of resources like personnel to engage in federal immigration enforcement. And here, by sharing this ALPR data with ICE and CBP, we allege that this violates SB 54, because the Marin County Sheriff is basically assisting with immigration enforcement by passing along this ALPR data to these agencies. So we are really excited about this. This is the first lawsuit of its kind under SB 34 to be filed. And to note, Marin County, the Sheriff's Department, interestingly enough, was one of the four agencies that the California State Auditors Report covered. And it basically found that they were sharing with these agencies that they weren't supposed to. And despite being put on notice through the State Auditors Report, they have continued to share with these agencies that they're not supposed to be sharing with. So we have sued. So, sorry, who are we suing on behalf of in this case? We're suing on behalf of three activists who are very involved in Marin County, they're community members, and they have been trying to hold the Sheriff accountable for his collaboration with ICE, not just in the ALPR context, but also in the ways in which the Sheriff is assisting ICE with identifying people in jails and things like that, turning people over when the Sheriff isn't supposed to be doing that. So these are longtime community members, activists, and folks who were horrified by the fact that this ALPR data is being shared with ICE and CBP and many out-of-state agencies in violation of the law. So what's the hopeful outcome? If we win, what happens? Yeah, so we have sued for an injunction and for a declaration that the Sheriff has violated the law and the injunction would seek to stop the Sheriff from sharing with any out-of-state or federal agencies, including ICE and CBP, and basically to follow the law, follow SB 34, it's very clear that the sharing is only supposed to be restricted to California agencies and so this out-of-state sharing is in violation of the law. And I imagine that in that case we would also hope that any other California agency that might be sharing with ICE would look at this case and realize that maybe they need to change their policies as well. Yeah, it's interesting that you raised that because Marin County is not the only one that is in violation of the law. As Dave noted, there were three other entities that also were part of the California State Auditors Report and found that those three were also violating the law and we know that there are hundreds of agencies throughout California that are really playing fast and loose. They are sharing all kinds of ALPR data with entities as far as the Monroe County Sheriff's Department in Louisiana or with law enforcement agencies in Connecticut and New York and really these agencies have no business having this information and being able to query Marin County's information about who's been driving where and for being able to piece together pieces of people's lives. So we hope that this lawsuit puts many of those other entities on notice that they need to stop sharing now without a state and federal agencies or risk potential legal liability. I remember going through these documents showing all these police departments and who they're sharing data with and it always amused me to see the places all over the continental US were sharing data with the Honolulu Police Department because maybe there are some cars coming from Honolulu to New York State but I imagine there's just not enough of it to really justify in any remote way that kind of data sharing because cars just don't move across the ocean. Okay so Sarah what are some changes we'd like to see in the world when it comes to ALPR beyond you know just ending the sharing with ICE? Yeah so you know many of the activists in Monroe County in our lawsuit they are really asking for the sheriff to stop using ALPR altogether for all the reasons that we've identified the fact that you could piece together pieces of people's lives you can tell where they live and work where they drop their kids off to school where they associate where they're attending an immigration clinic or going to the doctor or going to religious services and that really is very very revealing information you know I think we have identified in courts have identified the issues with location location-based tracking and this is another form of location-based tracking that we need to we need to stop so you know law enforcement agencies really need to consider whether they want to continue using this type of technology especially as Davis shown it's rather unjustifiable in many senses when you have this vast amount of information being collected and very little yielding any sort of real leads but apart from that we've also we know we also believe in curtailing down the retention periods for this type of information there really is no need for law enforcement to retain people's ALPR data for years on end if it's not you know doesn't lead to a hit immediately if it's not on a hot list what's the purpose of storing this information and so we have called for this and surely in in our own state legislation but around the country there is very little there are very few safeguards being being placed there is one state New Hampshire that has a fairly short retention period but most states just haven't identified the issue or haven't addressed the issue and so it really then becomes up to each entity each law enforcement agency to put their own safeguards on it which you know spoiler alert they won't or for some of the companies that are retaining this information to potentially say okay we'll put a retention period on it but we really are at the whims of like law enforcement and private industry in order to make that happen so just to sort of wrap it up before we get into questions I just wanted to just express like how how pleased I was to see this win the Twitter poll because this is something we're working on for so many years and you know every year I'm like do people still care about license plate readers anymore or we've moved on to face recognition if we moved on to something else like you know have we lost people's attention before we've actually like had the impact and clearly you know you all still care about this I still care about this we're still filing lawsuits and so this isn't just some technology that people have accepted and so to leave things on a positive note I would say you shouldn't accept this technology I would say that you know things that you can do to empower yourself or to have an impact or just keep an eye on on city council minutes and you know county minutes like county commission minutes to see if you're if they're going to be acquiring new license plate readers and just you know you can't wait to show up at city hall or during a city council hearing and just you know give a good three minutes of testimony about how they should pause ask more questions really nail down answers to all the things like why do you say you need it for a year when you could have it for three days what's the difference between that and asking questions like who's going to have access to this data and who are you going to share this data with you can also file public records requests pretty easy to do we have some samples on our website that you could file with your local agency but also you know just keep an eye out for for you know legislation or other kinds of activism opportunities where just sending a letter to your member of congress or your state legislator might you know might have an impact and also we're advocating for these ordinance models around the country that are called C cops that's cc ops for community control over police surveillance and that is trying to convince municipal bodies to put a process in place where police can't acquire technology without having a public hearing and without having an approved by a city council first so making sure that your elected representatives are signing off on anything and that police just can't grab it and then you know start using it without any safeguards in place so we're at 20 minutes to the hour and so I figure we're going to hand over to some questions at this point okay hello everyone I'm Christian I work on the membership team here to chat with all of y'all here we have a ton of questions in the chat so I think that I'm going to go through some of them we'll see how many we can go through but also if you raise your hand I can see that too and hopefully I can call on some folks with their hands raised as well um but to start I thought this question was interesting from blue wombat which is at what level would it be most effective to have legislation limiting and rolling back the use of alpr's federal state or local do you guys have any thoughts on that um I mean I tend to not I mean I I don't want to speak too much for our legislative team um but I tend to focus on what is like you know most achievable and you know we have seen that there's been a lot of effort to influence policy on the municipal level um mostly because city council members are just more responsive to their constituents than say a US senator um you know if you have a big enough state like California and you're able to get a law passed that is going to you know help a whole bunch of people in one swath and I think that if you just look at the number of bills passed by the California legislature every year versus the number of bills passed by congress every year you'll know that that it's just a different process uh that results in more things getting passed and so I feel like the chances are better at the state legislative level but in very state to state because some state legislatures only meet every two years and only for like 60 days so it may be difficult there um but certainly I don't know sorry do you have any ideas on whether like how well a congressional like a federal law would would impact it yeah that's a that's a good question I don't think that we've um really talked about that too much you know there have been um various federal laws that have been introduced to you know to impact certain types of surveillance technologies like I'm thinking about Ron Wyden's um the Fourth Amendment is not for sale act which um you know tries to limit the amount of information that that uh the federal government can collect through data brokers and things like that um but we haven't really discussed something um as large as ALPRs I mean the the real issue is that many of the law enforcement agencies are at the local and state levels they're the ones who are collecting this they're the ones who are networking um sometimes with federal agencies like we've seen ICE and CBP but oftentimes they're really just connecting with other state and local entities to share this information and so I think like state the state and local level both are great to consider potential legislation cool thanks for your thoughts on those let's look um this question comes from H um you mentioned law enforcement buying access to this data have there been any instances of the opposite where private companies can buy ALPR data from law enforcement agencies is that something that can happen so I am not aware of uh private companies purchasing data collected by law enforcement agencies I'm not going to say that's not that hasn't happened um I just don't have any like paper evidence that it's happened what does happen is that is that private companies are able to purchase license plate reader data from the private companies that collect it so um I mentioned DRN data you know DRN data will often claim it has like 10 billion you know 10 billion license plate scans in its database and one third of those those plates were collected by law enforcement but two thirds uh were created were collected by their private contractors so the bulk of that data is stuff that people can buy access to and usually you see insurance companies and lenders and a lot of the most predatory industries using that to to invade people's privacy cool um all right and then we'll go through another question that was in the chat from David um talking about um a law allowing parked cars to cover their license plates um what other solutions are available um would capture style license plate letters slash numbers be a possible solution the the difficulty is is that a lot of states and particularly California uh we know this was very specific to California is that California has a law that says that you cannot do anything to your license plate that would interfere with a license plate reader with the exception that you can cover your entire vehicle to protect it from the elements and so it was this law that written that if you wanted to mess with your license plate that was against the law but you you cover your entire car it's weird just saying that like if you can cover your entire car when you're parked why can't you just cover the license plate certainly not while you're driving but like while you're parked while you're in your driveway what's the big deal um but unfortunately there's not a lot of other other options because the way the law is written in California it doesn't really leave much room um the the one thing I would say uh it's kind of more of a novelty idea than an actual practical one is the idea of uh putting up like fake license plates around a city um so that the license plates are just reading a bunch of garbage all the time and I was talking to this um activist slash fashion designer named Kate Bertash uh about just this you know bizarre idea that would just be you know cost tons of money and require lots of volunteers and maybe not even be effective but she was like you know what let's put this on some fashion so she made some license plate reader patterns and has made shirts and dresses and jackets with the idea that police cars will actually read these as cars and create garbage data for their system um I can't like recommend that as an actual thing because I think that it's it just doesn't work at scale but there's an interesting thought experiment okay let's uh break some things up and it looks like we've got one hand raised from the audience uh David do you want to take it over for a second um hi uh what I'm wondering about is a similar technology it should be facial recognition do uh the license plate readers also take facial recognition data maybe pair who the driver in the car is along with what vehicle the driving and what would be your your concern with the risk of if the license plate readers would uh just skip over the license plate entirely and just start you start monitoring all the faces of who's driving vehicles and track people that way um yeah so I'll answer part of them maybe Sarah can answer part of it as well um so the company the main company that sells license plate readers to police is a company called Vigilant Solutions and it does offer face recognition technology their license plate reader technology is called plate search their face recognition technology is called face search um so they are actually out now offering that technology to police um it's less a case of saying of uh so what we're we're seeing what we're seeing is less a case of adding face recognition to license plate readers and more adding license plate recognition and face recognition technology to existing camera systems or adding you know having camera systems that are connected to computers that are doing face recognition license plate recognition pattern recognition object tracing hot spot identification you know like these these kind of computer vision views of the road I haven't seen so much of um of hardware systems that are designed to both capture the plate and the face of the person um in a standard license plate reader just because that's a lot more infrastructure because if you're just gonna actually have two cameras you know often um but I think where you see that kind of technology more commonly is in uh like red light cameras and speed cameras but I'm not sure that those speed cameras all day while they are capturing people's faces I'm not sure I've seen them using face recognition on those those photos yeah to to add a little bit I mean that that is a real concern um one really interesting thing was when um Dave mentioned this breach that happened at the I believe is the U.S. Canada border a couple of years ago um and it was where license plates were just kind of disclosed um by a subcontractor to Customs and Border Protection called Perceptix and during that breach about 50,000 people's license plate information was revealed but at the same time that same checkpoint was also collecting face prints of people so facial imaging and that was also revealed um and it was unclear it seems to be that you know one technology was collecting the license plate the other technology was collecting face prints and so it is possible to identify it may be possible to identify who was driving when um but that is a real concern um we've seen um as the proliferation of technology has exploded um at the particularly the southern border but also at the at the northern border we have seen um this issue of all kinds of surveillance technologies that are operating in perpetuity and and and in conjunction with one another um so you have to worry about ALPRs at the same time it's like these huge sort of like CBP substations and blimps and facial imaging and it really does sort of paint um a very um a detailed picture of who may be going through that at what time cool thank you guys and thank you David for asking the question um one question another question in the chat that I thought was uh interesting is um from Grady have you seen any stories on the news of police departments making the case for their ALPR systems such as like the data that we got from ALPRs was crucial for solving this case is this something you see often or so I see it pretty often but it's often not coming from law enforcement it's coming from the vendor like vendors really love to find examples where their technology was effective and then trumpet it through press releases through trying to feed the media stuff um and I don't doubt that there's that there's um you know times where this this technology helps them find somebody I think that the technology was um used to find some of the the people who you know involved in the January 6th events um but I don't I I'm not of the position that you know a few you know stolen cars recovered or a few people they tracked down is worth sacrificing the privacy of every driver in the United States I just think that is not um what we would call um a necessary and proportionate use of the technology it you know I think that probably for the most part they're using these to solve um you know car thefts um and you know I certainly don't want my car stolen but I also think my privacy is super important as well cool I think we have a few more minutes for a couple more questions remember if you want to raise your hand to ask your question you totally can uh but we'll go with another question from the chat from George Vasquez um given that ALPRs are being used regardless of various concerns are there any best practices that can be adopted by law enforcement that were that would reduce future discrimination and other risks associated with ALPRs sorry you want to start with that one I mean you know I I think I think it is sort of repeating what I've said before about you know um whether these should be in use at all um and to the extent that they are actually in use allowing the community to have some sort of say about you know what what the community's values are so um these CCOTS ordinances do allow um communities to do that it allows people to weigh in before law enforcement agencies start procuring various surveillance technologies and even if they possess them now to have a say in how they are used and so um they're about 18 CCOTS ordinances that have passed across the country mostly at the local level but um as in the city level but also someone at the county level um and what it requires is before a law enforcement agency is able to acquire or use um such a system um they first have to seek permission from their governing bodies so either a board of supervisors or a city council um and it also sort of goes through each of the technologies and limits the ways in which the technologies may be used and so you know um one of the things I think that can really help um would be reducing retention periods making sure that um these law enforcement agencies aren't able to basically you know track all the information um and collect all the information and then keep it forever you know I'm thinking about certain communities um we've seen in Marin County for example where um there are only two one or two ways into the town itself and so what the police do is mount um a license plate reader at the entrance slash exit um of the town and so it captures every single person that is driving through um that is incredibly invasive and so um given that law enforcement agencies are sort of figuring out and and deciding where they want to position these technologies um I think one one way of doing it is to say you know if you don't have a hit immediately you need to purge um the license plate from your record so that uh you're not just keeping it and I you know using it in the future to piece together people's movements or identify people for whatever future crime may be taking place because as Dave mentioned you know this really um gets us into sort of like dystopic realities um that could very well be the future breast yeah I would I would add that I mean like I'm not really in the it's not really my job to write policies for for law enforcement but I would say that if they have a policy that says that anybody in the police department can search ALPR for any reason that's a no go they shouldn't be doing that if they are not keeping a log of every time somebody searches the system or adds a new like license plate to a hot list they're doing it terribly if they do not have somebody whose job is to review you know all the searches and to make sure that the searches were legitimate and not some cops stalking his ex they're doing it wrong uh uh I would say when it comes to retention yeah I don't think that police in general need to retain the data uh if it's not somebody who's already known to them or that's already part of their investigation but it's worth asking police departments to look at their use of ALPR and see how far they actually are going back if the data is not useful to them beyond a week they shouldn't be storing data beyond a week but I have a feeling that in most cases data is not useful to them more than a day and it's the question is why do you hold it for two years or more if it's most of the use cases are known vehicles and in a very short period of time uh and then this question comes from uh Nate B which is since there's already precedent for homeowners homeowners associations and other private entities running ALPR networks uh I was wondering how the police feel to find uh every police vehicle tracked by a network of citizens um is that a concern you guys have heard about um so I go to a lot of police conferences and so I end up getting in conversations with cops and one of the things that I tell them is that every surveillance technology you're promoting now uh is going to turn on you like you might find you very excited about face recognition now down the road it's going to be impossible for you to do undercover investigations because of face recognition you're worried about your privacy as an officer now and so you want to make sure that you're you know you pass laws in like places like California and other states that you know allow you to withhold your drive you know your address from various public forms that's great I can go to license plate reader system and I can find out where you live like I do try to impress upon cops that everything that is a privacy violation to all of us police are part of all of us they don't they're not like separate like these master amounts technologies capture information on everybody regardless of whether you're a cop or an immigrant and they really need to keep in mind that violating our privacy is violating their own privacy now I don't know that that that there's really any good way for a community to really track police using their own license plate reader systems and I'm not going to advocate for that either because again I I I really don't I mean just personally to me I don't think like tracking police is worth sacrificing al birdie else's privacy either I will add there's also sort of an sort of an unequal power right not all people are going to be able to access al pr whereas a lot you know many law enforcement agencies said it so that anybody in their system can can access al pr and so you know the privacy concerns while they should be concerning to them as Dave has mentioned you know it's not like the average person for the most part is able to just access any al pr system and get information to it cool thank you it looks like we're at the hour so I was wondering if Dave and Cyra if you guys had any closing thoughts before we end the speakeasy I just want to thank everybody for coming out it's great to see so much interest and participation and so many great questions that we unfortunately were not able to get to in the chat if you like you know this topic please check out our future speakeasies you can see more about our work on al pr on our street level surveillance page at eff.org and you know just basically keep keep pushing for this keep fighting for your privacy keep pushing Seacops ordinances in your local towns keep talking about it with other people because I think that we don't have to accept that this technology is inevitable and that we have no control over it I think one way that we really do we are able to get control over this and really impress our values upon others is to talk about it often and with people who care about these issues and you'll find that there are more people than you expect out there who will also be similarly concerned it's just a matter of education and making sure people are aware of what types of surveillance technologies are being used in their communities. Yeah I'm just you know echoing everything that Cyra just said you know I'm really really grateful that you all have this interest I would just plug that you check out atlasandsurveillance.org to learn about surveillance technology near you if you're in California we have a data center or website called data driven to that will covers I think like 90 90 police departments across California and we'll tell you who they're sharing data with how much data they're collecting and how much of that is useful to an investigation and then also we have a virtual reality game called spot the surveillance for those of you with various headsets that will place you into a street corner in San Francisco and challenge you to spot the surveillance technology in your environment and spoiler there are multiple forms of license plate readers in that environment um you can also there's also a desktop version so you don't have to have a headset you can you know click around your browser but it's uh it's a really fun time um if a little bit scary cool well thank you again uh Dave and Cyra uh and thank you everyone who joined the speak easy um it's been really cool to see people with uh their cameras on wearing EFF gear and stuff uh thank you so much for all of the support uh I saw one question that was like how can we support EFF further um and I would just say spreading the word about our work and engaging with our work is really helpful and like pretty much all we can ask for so that's really helpful but um thank you again everyone for joining um and I hope you have a good rest of your night