Automatic License Plate Reader Report Raises Concerns About Expansion of Government Surveillance in Iowa

Iowa City and Des Moines, Iowa — The University of Iowa’s Technology Law Clinic and the ACLU of Iowa today released a report that surveyed 48 Iowa communities and their use of automated license plate readers (ALPRs), a growing form of government surveillance that is raising concerns with privacy, civil rights, and good governance advocates.

The report is a focused look at the growing use of ALPRs by selected law enforcement agencies across Iowa and demonstrates that ALPRs are a surveillance tool that poses serious risks to Iowan's privacy and civil liberties.

ALPRs are not speed cameras. They are not "red light" cameras. Instead, they are cameras used along roadways throughout Iowa that take thousands of snapshots of all the license plates of the vehicles that drive by. That information can then be fed into a network of nationally shared databases that has too few privacy protections and is subject to abuse.

More details about ALPRs generally can be found on the ACLU of Iowa web site.

"Unlike other traffic cameras, ALPRs aren't activated because you violated a law. They record you and every other person who drives by, simply to build a database of vehicle information. They can take hundreds of photos in a matter of minutes. And unlike ordinary surveillance cameras, where data is either not shared or shared in a more limited manner, the main purpose of ALPRs is to feed this information into a database," said Megan Graham, director of the Technology Law Clinic at the University of Iowa College of Law and the professor who supervised the project.

Law enforcement agencies can use ALPRs in different ways. Some communities don't have ALPR cameras in their locales, but have purchased access to an ALPR database. Some communities share data collected from their locales broadly; others less broadly. And some put them in a wide variety of locations, while others use them in a very limited way, like only for parking enforcement. But all are a problem because of the potential for broad and problematic sharing of that data.

To investigate how this technology is being used, the ACLU of Iowa engaged the Technology Law Clinic at the University of Iowa College of Law to conduct independent research on the use of ALPRs in Iowa.

The study was conducted by a group of University of Iowa law students, who sent open records requests to a broad cross-section of 48 law enforcement agencies across the state. They included cities, smaller towns, and some of Iowa's college towns. They also identified 62 Iowa communities that have accessed other Iowa cities’ or counties’ ALPR databases, whether they have their own ALPRs or not. The study was not comprehensive and reflects only those communities selectively studied.

Of the 48 agencies that were selected, 5 did not respond to the substance of our records request before publication. They are the Des Moines Police Department, the Clinton Police Department, the Fayette Police Department, the Fremont Police Department, and the Mills Police Department.

Graham said the survey was conducted because “When we initially started to look at ALPR use in Iowa, we found there was scattered information. Very little had been collected into a single source with in-depth analysis. The goal of the report is to take a systematic look at ALPR use in a wide array of Iowa communities to see what is happening on the ground in the state.”

The 61-page report goes into detail on how ALPRs work and shortcomings in how they are implemented and used. Key takeaways include:

• ALPRs have expanded rapidly in Iowa, building an enormous and powerful surveillance network, assisted by artificial intelligence. Together, the cameras and data in this network can track individuals' movements, habits, and associations, often without their knowledge or consent. ALPRs allow those with access to the network to build a detailed profile of people's lives with little oversight or transparency. But no state law, local ordinance, or policy that we reviewed required law enforcement to get a warrant to use these databases to target or track people in this way.
• The number of ALPR cameras in a community can vary widely. Of the communities reporting their number of ALPR cameras (some declined to share this information), Cedar Rapids had the most with 76. West Des Moines reported 64; Clinton County 58, Altoona 51, Council Bluffs 37, and Dubuque 22. (See page 21.)
• Some agencies were not transparent about the number and location of their ALPRs. Bettendorf and Oelwein claimed that a list of the number and location of their ALPRs was confidential under Iowa open records law and declined to provide them. Altoona and Davenport said the number and location were confidential, but an online search found an informational website provided by the ALPR vendor that publicly listed the number of cameras.

Rita Bettis Austen, ACLU of Iowa Legal Director, said, "The ACLU of Iowa maintains that such records should indeed be public. It’s ironic that our interest in these public records is to ensure the privacy of Iowans. In comparison, police are saying that they want to ensure the privacy of surveillance technology. They want to watch us, and they want to do so in secrecy. This is fundamentally at odds with our democracy and the way most Americans want to live."

• There are vast inconsistencies in the use and regulation of ALPR data in Iowa, including how data is retained, deleted, what information is publicly available, and who can access the data.

This is detailed in a large chart of ALPR policies and transparency, by law enforcement agency on page 32.

• Iowa has no meaningful laws that limit the collection and use of ALPRs and a person's access to the data being collected on them.

That's in part because the court process is slow and has not kept up with the fast rise of the technology. With the exception of a few early cases, all outside of Iowa, the courts have not had time yet to even consider cases where ALPR tracking was used and weigh if and how constitutional protections at the state and federal level should apply to protect us.

Various structural barriers to getting into court, like qualified immunity for police, means the courts are not likely to be able to provide residents with timely, robust safeguards of our rights against the technology, which is here and being used right now.

• Government officials are often not well-informed about ALPRs. City councils and county boards of supervisors, who should be overseeing the implementation of ALPRs in their communities, often are not well informed on what they are, how they work, and what the privacy implications for their constituents are.

The study cites a recent situation in Coralville where residents demanded the city council collect more information on the impact of ALPRs in their community. (See page 12).

• ALPRs can be inaccurate. The report cites incidents reported nationwide in which ordinary people going about their daily lives, even with children in the car, were flagged as dangerous and stopped and detained by police—sometimes at gunpoint—due to ALPR errors. A separate study found that 1 in 10 ALPR readings contain an error.
• Access to ALPR databases has been abused. With so little oversight, ALPR access can be grossly misused. There are recurring national media accounts of law enforcement officers using them to stalk an ex-girlfriend or ex-wife. Texas police used their access to ALPR networks to search 83,000 cameras nationwide to track down a woman who had an abortion in Illinois, where abortion care remains legal.

The clinic found that some Iowa law enforcement agencies possessed records related to unauthorized access to ALPR data or erroneous hotlist hits. Unfortunately, with the sole exception of Story County, which provided a record of erroneous hotlist hits, law enforcement claimed that records relating to unauthorized access of ALPR data and erroneous hotlist hits were confidential and refused to provide them.

• The price of local government surveilling Iowans in their communities is steep. Communities spend anywhere from a few to several thousand dollars each month for these cameras. Cedar Rapids, for example, spends an average of $20,000 a month on ALPRs.
• Vendors that offer ALPRs have not always been forthcoming on who they share the data with and their business practices. Flock Safety, the largest vendor of ALPRs in Iowa, has specifically said that it has not given access to Immigration and Customs Enforcement (ICE) or U.S. Border Patrol. But nationally, local police have been found to regularly run searches on ICE’s and Border Patrol’s behalf. After finding this out, some communities around the country have terminated their contracts with Flock Safety.

Bettis Austen said that there are non-objectionable uses for ALPRs, such as checking license plates against lists of stolen cars, to assist in AMBER Alerts, or collecting tolls.

"But even then they must be deployed and used fairly. They must also be subject to proper checks and balances, even when used in those legitimate ways," she said. For example, ALPR devices should not be disproportionately deployed in low-income communities and communities of color. Data shouldn’t be stored longer than reasonably necessary or shared broadly without good reason. The hot lists that are run must be legitimate and up to date. But either way, that all describes a universe that is not the one we’re living in. Instead, law enforcement and vendors are not limiting themselves to those legitimate uses, restricted to cases where people are suspected of violating the law.

"ALPRs are being used to create comprehensive records of everybody’s comings and goings," Bettis Austen said. "In our country, the government should not be tracking us without individualized suspicion that we are actually breaking the law, and warrants should be required in many circumstances."