The Sacramento County’s Department of Human Assistance (DHA) is terminating its invasive automated license plate reader (ALPR) program, following an EFF investigation that found the agency was accessing driver data to investigate welfare recipients without enacting the basic civil liberties safeguards required by California law.
Over the last two years, DHA spent $10,000 to access a massive database of information about people’s driving patterns. Vigilant Solution’s LEARN system includes billions of license plate scans, with time stamps and geolocation, collected by law enforcement agencies and private contractors using high-speed ALPR cameras. In addition to serving as a cloud storage service, LEARN also functions as an analytical tool that can be used to track vehicle owners in near real-time, reveal their travel history (such as where they park their cars), and identify cars that visit targeted locations. DHA does not own its own ALPR cameras, but instead has relied upon data shared by other entities to conduct benefits fraud investigations.
EFF exposed this location surveillance of low-income people in July, and the Sacramento Bee followed up with a report about it. Meanwhile, the Coalition of California Welfare Rights Organizations (CCWRO) demanded accountability from the county through a direct meeting and a formal letter.
As of Nov. 1 the agency cut off investigators from accessing the LEARN system. A single DHA staff member will have access to the system for auditing purposes until the contract with Vigilant Solutions expires in May 2019. The DHA director disclosed this good news in a letter to the CCWRO executive director, Kevin Aslanian.
A California state law passed in 2015 requires any agency that accesses ALPR data to implement a privacy and usage policy that “is consistent with respect for individuals’ privacy and civil liberties.” The policy must describe a process for regular audits. Also, agencies must document the purpose for every search of the data they conduct. EFF found that DHA fulfilled none of these requirements, even as 22 staff members searched the system 1,100 times from 2016 to 2018.
DHA did publish a policy and begin conducting audits—after EFF began investigating the agency's ALPR surveillance earlier this year.
In the letter to Aslanian, DHA says that although it is ending the program, it still believes the “use of this data is legal and legitimate,” and they “reserve the right to resume use of this data.” However, they pledged not to re-initiate the program without giving CCWRO prior notice.
EFF will continue to monitor how DHA and other government agencies use ALPRs. To learn about 200 agencies across the United States that are collecting and accessing ALPR data, check out EFF and Muckrock’s new project Data Driven: Explore How Cops Are Collecting and Sharing Our Travel Patterns Using Automated License Plate Readers.
