As drivers zip through the Monterey and Curtner intersection, they may or may not notice the presence of four new black security cameras, each equipped with an individual solar panel. Regardless, those cameras will certainly notice them, or at least their car’s license plate, color, and any bumper stickers it may have. These are automatic license plate readers, or ALPRs, from Flock Safety, a startup flush with venture capital cash out of Atlanta, Georgia, that has raised more than an eyebrow from organizations like the American Civil Liberties Union. But more on that below.
The four cameras cost the city just under $10,000 and are part of a pilot test approved by the San Jose City Council this past September. However, as previously reported by Metro, in November the council unanimously approved a motion to spend $250,000 in federal COVID relief funds to expand the deployment. Any further acquisitions beyond these four Flock cameras will “go out to competitive bid,” according to the city.
After the November motion allocating the ALPR funds, city staff was directed to “return to Council or the appropriate Council committee” in the first quarter of 2022 to review city policies regarding the collection, use and retention of ALPR data. Data Privacy Officer Albert Gehami, who came on last fall, met with the Digital Privacy Advisory Taskforce.
The meeting took place March 3, coincidentally the same day the ACLU released a 13-page report that outlined its issue with Flock.
“We have long had concerns about the dangers posed by hybrid public-private surveillance practices—but Flock threatens to take that to a new level,” the ACLU states in the report.
ALPRs scan video footage of cars for license plate numbers along with data on the time and place the images are captured. Flock claims that its tech also can “search by vehicle make, color, type, license plate, state of the license plate, missing plate, covered plate, paper plate, and unique vehicle details like roof racks, bumper stickers, and more.”
The ACLU worries this could potentially “allow searches for all vehicles that include a particular political bumper sticker, enabling people to be targeted based on the exercise of their First Amendment-protected free expression rights.”
The March 3 meeting was the first time the taskforce was informed of any contract with any ALPR vendor. The minutes indicate that concerns were raised by taskforce members in attendance, who represented the ACLU of Northern California, Santa Clara University, San Jose/Silicon Valley NAACP, and Cisco Systems.
One major concern from the taskforce was the lack of clarity around sharing ALPR data with law enforcement. The original motion explicitly stated the data could not be shared with immigration authorities, a point that San Jose reiterated in a statement to Metro.
After the March 3 meeting, however, some members of the taskforce became worried that their concerns were not carried forward to a March 17 meeting of the city’s Public Safety, Finance, & Strategic Support Committee two days before their review of the ALPR policy and consideration of changes. In that meeting, Gehami stated the ALPR effort “has been supported by a variety of stakeholders, especially from the Digital Privacy Advisory Taskforce.”
One such stakeholder, the ACLU of Northern California, stated “the ACLU broadly opposes the deployment of ALPR,” a sentiment expressed in a letter to the committee before the March 17 meeting.
Another member of the taskforce, Dr. Roxana Marachi, expressed her concerns at the committee meeting. “There have been a number of critical questions raised. There has not been enough public engagement on this issue,” she said. “Members of the Digital Privacy Advisory Taskforce asked very serious questions that were not covered in this report.”
She also told the committee that the taskforce “had not been informed about the ALPR rollout until after it had been approved by the City Council [in November]. It seemed to have been a rushed decision.”
Marachi has been a member of the taskforce since its inception. The city extended an invitation to the local NAACP to participate, and since she was the education chair at the time and had written about privacy questions raised by San Jose’s “smart city” technologies, the group’s president asked her to fill the role.
“It sounded as though they wanted to get some feedback from privacy experts on data use policies or the ways that they would safeguard the people’s data,” she said in an interview, recalling her first impressions of the taskforce. She explained that she looked forward to “raising the concerns to the people making the policies, and now I realize that’s not at all the case.”
After the taskforce brought the ACLU report to the attention of Gehami and officers from SJPD present at the March 3 meeting, “the concerns were just dismissed. It was as if they hadn’t been shared,” she said. “The fact that there could be such a dismissiveness around the concerns in this report, to me, is a major red flag.”
She says she wonders “if the invitation to have critical members like myself might be to try and silence our public critique. It keeps that critique within those committee meetings and not in the public.”
Marachi’s colleague on the board of the San Jose/Silicon Valley NAACP shares her concerns. In an interview, Bob Nunez, a former Milpitas councilmember and current board president, says “there needs to be a much better sharing of information, a much better understanding by the community—especially the Black and Brown community—about what’s being done, why it’s being done, and who owns this information so that we’re not lulled into allowing the cities to haphazardly put up cameras and then use this information to criminalize us.”
In a statement to Metro, the city said it values the input from the privacy taskforce.
“Outreach is a part of the City’s Digital Privacy Policy,” the city’s statement reads. “Among outreach will include specific signage in the areas of ALPR usage, online public comment, and direct outreach with communities.”
San Jose’s contract with Flock, obtained via a public records request, not only shows an agreement to use Flock’s ALPR cameras, but also Flock’s “Wing” product. Wing gives the city the ability to integrate footage from cameras and other ALPRs already deployed with Flock’s technology.
SJPD has had ALPRs mounted on the patrol cars for several years now. There are cameras at many major intersections throughout the city. Just this week, Mayor Sam Liccardo testified in support of AB 2336, which would allow San Jose and other California cities to test the efficacy of using cameras to catch speeding vehicles. Footage from all these sources could potentially be uploaded to Flock. However, the city says it is “not engaging in these activities during this pilot project.”
An article written by Motherboard last year presages the ACLU’s concerns. The article quotes an email from a police officer that calls Flock “the Ring doorbell of [ALPR].” Video-enabled Ring doorbells allow owners to keep an eye on their property even when they’re not home by storing the footage on Ring’s cloud infrastructure. That footage can then be leveraged by law enforcement, sometimes circumventing the warrant process.
The emails released by Motherboard also revealed the popularity of Flock not only among police departments, but also homeowner associations and businesses. With Flock’s cloud model, the footage is uploaded to Flock’s systems and other Flock customers can share their data with a law enforcement agency.
The city stated that there are 30 private Flock customers in San Jose who have requested to share their ALPR data.
According to Flock’s website, “customers own 100% of the data and footage collected through our cameras.” This is made clear in San Jose’s contract, with one caveat: “[San Jose] hereby grants to Flock a limited, non-exclusive, royalty-free, worldwide license” to use the data, including the right to include it with Flock’s “aggregated data.”
When asked for clarification, the city explained that “other communities do not have access to San José’s data. Flock can use anonymized, aggregated performance and use metadata. For example, Flock may count the number of total pictures San Jose takes but does not have access to the pictures or information on the vehicles or plates in the pictures.”
What is not clear is Flock’s process to achieve anonymization. Anonymized data has been shown easily re-identifiable. Flock can also keep the aggregated data indefinitely, should they choose while the rest of San Jose data will be deleted after one year, in line with SJPD’s current ALPR policy in their duty manual.
According to San Jose, the year-long retention is required of them by California law. However, a state bill passed in September 2015 specifies that, when it comes to ALPR data, jurisdictions can set their own retention policy. The ACLU report suggests following New Hampshire’s example with a three-minute retention period. They argue that “allows the devices to be used to search for wanted vehicles but prevents the creation of dragnet location tracking databases.”
The city says it has read the ACLU’s report and is looking at several of its recommendations.
