Update August 28, 2019: The California Commission on Peace Officer Standards and Training has opened an investigation into the ALPR training program and will "take appropriate action," according to a letter responding to EFF's research.

A single surveillance vendor has garnered a monopoly on training law enforcement in California on the use of automated license plate readers (ALPRs)—a mass surveillance technology used to track the movements of drivers. After examining the course materials, EFF is now calling on the state body that oversees police standards to revoke the training certification. 

In a letter to the California Commission on Peace Officer Standards and Training (POST) sent today, EFF raises a variety of concerns related to factual accuracy of its ALPR training on legal matters. Additionally, we are concerned about the apparent conflict of interest and threat to civil liberties that occurs when a sales-driven company also provides instruction on “best practices” to police.

ALPRs are camera systems that capture license plates and character-recognition software to document the travel patterns of vehicles. The cameras are often attached to fixed locations, such as streetlights and overpasses, and to police cars, which collect data while patrolling neighborhoods. This data is uploaded to a central database that investigators can use to analyze a driver’s travel patterns, identify visitors to particular destinations, predict individuals’ locations, and track targeted vehicles in real-time. ALPR is a mass surveillance technology in the sense that the systems collect information on every driver—regardless of whether the vehicles have a nexus to a criminal investigation. 

In California, Vigilant Solutions offers ALPR training through a program it calls the “Vigilant Solutions Law Enforcement Academy,” which advertises training courses that come with free trial accounts for the company’s ALPR and face recognition platforms. Vigilant has garnered controversy due to its data-sharing contracts with ICE and its business model, which includes selling data collected with its own ALPR cameras to the private sector in addition to law enforcement. The company also has a history of requiring government agencies to sign agreements prohibiting them from talking publicly without the company’s sign-off in an effort to control media messaging. 

Vigilant claims to be the sole entity capable of providing POST-certified training on ALPR to law enforcement agencies. Through the California Public Records Act, EFF obtained copies of the training, as well as the submission materials seeking certification. These records triggered several concerns.

Most notably, the training presentation instructs police that there are no laws in California regulating the use of ALPR. While that may have been true in 2014, it has not been the case for nearly four years. In 2015, California passed a law, S.B. 34, regulating the use of ALPR systems and data collected by ALPR. These regulations include developing policies that protect civil liberties and privacy, as well as a long list of requirements related to cybersecurity and transparency. The training also does not touch on the California Values Act, a law passed in 2017 to protect California resources and data from being used in immigration enforcement. Additionally, the training module includes outdated information on case law, such as claims EFF and the ACLU lost a lawsuit over public access to ALPR data. The California Supreme Court ultimately reversed the lower court rulings outlined in the presentation. 

In emails to EFF, Vigilant has indicated that it may have updated the presentation. But if so, that version was not resubmitted for certification, as required by POST regulations, according to records obtained by EFF. POST should investigate whether Vigilant is providing its own interpretation of recent developments in law, and if so, whether that instruction serves the public interest. When a surveillance vendor offers cloud storage and sharing services, it has a profit incentive when police collect more data and share it widely. 

Troublingly, Vigilant Solutions uses the ALPR training as a platform to sell its products. The training materials are filled with promotion, such as a pitch for its ALPR databases consisting of law enforcement and commercial data, and its mobile software that comes with face recognition capabilities. By having a monopoly on ALPR trainings, Vigilant is able to promote its products and its version of the law surrounding ALPR at the expense of protecting civil liberties and privacy. 

Over the last few years, EFF has filed public records requests with hundreds of agencies throughout California and found widespread failure to comply with state law for regulating ALPR technology. These failures necessitate an examination of whether agencies are being properly trained on the use of ALPR. So far, EFF’s research has led the legislature to order the California State Auditor to initiate a statewide investigation into the use of ALPR, including deep audits of entities using Vigilant’s products. In this case, EFF urges POST to initiate the decertification proceeding for the Vigilant course and encourages law enforcement agencies to seek alternatives to Vigilant’s training.