This time when I renewed my vehicle registration for one of my trucks, I didn’t get the registration sticker.
It turns out that Pennsylvania is claiming they have a new system that is going to save $1 million annually on the stickers, which, presumably, have to be printed with sequential serial numbers, get mangled in the mail, need to be replaced occasionally, fall off, etc. So to “save” the $1 million, Pennsylvania is going to expect local police departments to install automated license plate scanners that cost about $18,000 apiece.
Let’s review how the current system works: guy drives past a cop and the cop glances at the tag and – oops – it’s orange not green! Someone is driving on an expired tag! Cop hits the lights and pulls out to pull them over.
Let’s review how the new system works: 500 people drive past a cop and the license scanner scans 500 licenses, checking them against the vehicle database to see if it’s a car with an APB out on it, or doesn’t have insurance data, or is owned by someone who’s on a suspended license, or has an arrest warrant out on them, or – oh, yeah – has an expired tag. Cop hits the lights and pulls people over. Of course there’s no probable cause or warrant required because the state has decided that your license plate is public property and they’re not exactly investigating you, they’re merely querying to see if there are any outstanding red flags on your license.
There are a few silly things that leap out at one right away: first off, the cop still has to pull you over and call in to verify your plate, because the scanner may have mis-scanned it. So it’s not saving any cops any time.
Currently, Pennsylvania cops have allegedly deployed a whopping 30 plate readers state-wide. In a state a bit smaller than Texas. So there’s going to be one breaking-point, there. Cops are also raising concerns that, uh, it’s going to dramatically increase their work-load. It’s going to be interesting because now it’s going to be much more likely to flag white people – the cops won’t be able to just sit back and only look closely at cars being driven by brown people. So they’re complaining. Except they don’t put it in exactly those words.
And the story keeps changing. In one article the claim is that the scanners will check for expired tags. In another, it’s no insurance. In another, it’s for a stolen car… Etc. What it really says is that: they’re going to search for anything. Hey, if there’s a muslim registry, they’ll probably flag that, too. Police states are like that, you know?
Aside: You know what else? They’re going to afford $18,000 scanners but they still can’t afford cop-cams. Look at that lovely laptop. Look front center, blurred by depth of field: that’s the flash hider of an AR-15-style battle rifle (nice flashlight, officer Pork!) and next to it a pump action combat shotgun. You’re looking at $3,000 worth of weapons and a $1500 laptop and oh, my, you can’t afford a $200 camera, no way, no way.
The math is pretty ugly, Pennsylvania apparently has 1,300+ cop cars statewide, so by switching to scanners and discontinuing the tags, the state is going to save about negative $10 million. I did a little looking around and I don’t see any obvious tech-bid rigging like the backscatter scanners TSA recommended for every airport (which were manufactured by a company former DHS Secretary Chertoff happened to own a lot of stock in) but this is Pennsylvania: if the connection’s not visible it’s just because the Pennsylvania state rulers are good at hiding that kind of thing.
There’s another point that they’re not talking about, but they should: once the scan is complete and the query goes to the database, it’s now transactional data. They’re not going to throw that yummy stuff away. It means that if there are 4 or 5 cops driving around someplace and six months later they need to know if a particular car passed through that area, there’s a pretty good chance they’ll be able to pull back the date and time and location where that license plate was seen. This is not just a query-and-forget system, it’s a database of which car was where and when. Terrorists take note: Steal a license plate from some oldster at a church before you go on a mission.
Of course that’s been going on for some time. Every time a car goes past a toll road, they’re getting their plate scanned by the toll road operator, which is engaged in a regulated business with the state, and you can bet that they’re giving their transactional data to government agencies. I know for a fact that the databases go both ways (the toll company operators are able to query the state databases – all of them – because I’ve gotten tickets from SpeedPass in Maryland for driving my Pennsylvania truck where Google maps navigator told me to go, and I didn’t have a SpeedPass transponder. So they definitely had my license plate, and they were able to get my name and home address from (presumably) Pennsylvania Department of Transportation’s database. Part of the deal SpeedPass makes with the state is that the state gets the transactional data: after all it was gathered on public roads, right? SpeedPass is a private company, they can sell (or give) their transactional data to anyone they want to.*
Next comes the “big data” applications. Want to find who’s driving to Colorado to buy ‘legal’ weed and bring it back to Pennsylvania? Sure, you just search for all cars that have been in PA->COLO->PA within a short period of time, then see if the cops in Colorado have put scanners up across the street from the weed stores. Sound implausible? Sorry, that’s sort of already going on. This has been an old problem with toll-booth scanners: Oklahoma once proposed to match the scan databases from different tollbooths and compare the time it took a given car to pass between them with the speed limit, and ticket anyone whose average speed indicated they were going above 90 for more than a small amount of the trip. A certain amount of this is just greed: they want to be able to tax people in the guise of fines and surcharges. But there’s lots of opportunity for data integration. There always is.
The “data integration” bit ties into the infamous DHS Fusion Centers. So you’ve got NYPD’s secret program that monitored and tracked muslims, collecting data about “threats” and dumping that into the fusion center databases. If they don’t have the toll road data, they’re stupid and I’m very surprised. So, basically, it’d be a fairly straightforward query set to build a muslim tracker. Those sorts of “friend of a friend” applications are the kind of thing, applied to cell phone traffic, that results in weddings in Afghanistan getting hit with hellfire missiles: someone knew someone who called the wrong number and – blammo. And the police state is fielding that sort of stuff, here.
And they say it’s to save money.
New York Times: New York Drops Unit That Spied on Muslims**
DHS: Fusion Center Gap Analysis (” Homeland Security Advisors, heads of state police and investigative agencies, major city police chiefs and major county sheriffs, state emergency management directors, and Special Agents in Charge at Federal Bureau of Investigation field offices rely on fusion center products and services.”)
Gizmodo: Feds are Spying on Millions of Cars with License Plate Readers
Wall Street Journal: US Spies on Millions of Drivers (“hundreds of millions of records a year”)
Observer Reporter: Police Raise Concerns and Pennsylvania Phases Out Registration Stickers
WNEP 16: License Plate Readers in Action
What chaps my butt about these systems is that they are so easy to defeat and interfere with. In fact, they’re already pretty much useless. They don’t actually provide any proactive warning some threat actor is going to do something naughty; they’re pretty good at determining who did a naughty thing after it’s too late. Given that one key strategy of insurgents is suicide attackers or attackers that are willing to die, all these systems do is guarantee that the first cop who pulls the wrong person over is going to get shot repeatedly in the head. Because what’s the alternative?
When you look at what’s been going on in counter-terrorism, read between the lines and there’s something very very disturbing: a lot of what is “halted in time” are attacks that the FBI instigated and groomed. There are a lot of “honey pots” out trying to find radicalized people who want to join action groups – and they catch them. In other words, they are only catching people with absolutely no tradecraft at all: useful idiots. That’s why a couple guys with some fireworks and a pressure cooker were able to carry out a devastating attack with zero advance warning: they weren’t talking to FBI online honey pots pretending to be jihadis. The police state’s game is that weak.
(* I am surprised Google hasn’t tied in their google maps navigation/GPS data into their ad-stream. Maybe it’s because they are stupid. “Hey Marcus, now that you’re in San Francisco, can we recommend a sushi place? We see you like sushi because in the last month you’ve spent 45+ minutes without moving, on 5 occasions, in locations our mapping database says are sushi bars. We were worried you were eating too much pizza for a while, there. Sushi is better for you. No. Wait. Please don’t smash your phone. We need it. How can we help you if you don’t have your phone?)
(** Yeah, right)
EigenSprocketUK says
In the UK we’ve installed, with no murmur at all from the public, loads and loads of these. Scattered around all the major trunk routes anywhere within a hundred miles of a big city. Which in the UK means nearly everywhere. Loads of Police patrol cars have the tech onboard now. It’s all done by the police: anyone doing traffic jam monitoring, parking lot enforcement, or toll-route charging is a separate system.
The end result is that the police have way way way more alerts to deal with than they have time available.
UnInsured / untaxed cars are a substantial proportion of cars on the road and they will get caught eventually but people get away with it for years. So the upshot is still that the police are driving round with the computer going ping dozens of times per shift, and the police are mostly ignoring it. But if your car looks unroadworthy, is driving erratically, or otherwise draws attention to itself* etc, then they will pull you over.
* the definition of “Draws attention” includes: the driver looks funny, looks nervous, looked at me funny, or looked a lot like that guy we’ve got a beef with. /s
Marcus Ranum says
EigenSprocketUK@#1:
the police have way way way more alerts to deal with than they have time available
Yes, the police have implemented a “channel stuffing” attack on themselves. It’s brilliant. There are ways it could be further weaponized, by doing things like calling certain cars in stolen, or performing activities with tape-over paper license plates that will set certain cars into the alert database. Then false flag some politicians’ cars (easy enough to get via photos of events)
AndrewD says
Just to add to1, many Petrol(filling) stations have ANPR (UK name for these things-automatic numberplate recognition) cameras to catch people who attempt to fill their car and then do a runner.
We also have average speed cameras ,often on motorway’s when an unusual speed restriction is in place for repair work, but they do occur on other roads. The are two sets of camera’s a known distance apart linked to some form of data analysis system, in many cases they are an improvement on spot cameras which have no lea way for road traffic conditions.
springa73 says
So the really short version is that all this license-plate reading technology is good for tracking the activities of ordinary citizens, but lousy at stopping actual crime.
Marcus Ranum says
spring73@#4:
It’s also good for the bottom line of companies selling tech to cops. That’s something!
Marcus Ranum says
AndrewD@#3:
many Petrol(filling) stations have ANPR (UK name for these things-automatic numberplate recognition) cameras to catch people who attempt to fill their car and then do a runner.
I’m sure they’re something that can be back-audited if the police come and say “can you check for a car with this plate on this day?” Where it gets interesting is when they do like the Pennsylvania systems are going to do, and automatically report everything to a central database.
EigenSprocketUK says
Old-fashioned beat cop to rookie: “go knock on all the doors and find out what the neighbours saw. When you’re finished, bring me some chips.”
Current beat cop to rookie: “knock on all the doors with CCTV, get the images. And bring some chips on your way back.”
Future ‘beat’ cop: “from here you can pull all the image sources no matter whose it is. Wow, looks cold out there today. Pass the chips.”
Joe says
This will be used to harass and intimidate people. Mark my words! Lots of false alarms too.