[HN Gopher] Data brokers selling license plate location and anal...
___________________________________________________________________
Data brokers selling license plate location and analytics data
Author : JohnMakin
Score : 81 points
Date : 2023-07-26 17:09 UTC (5 hours ago)
(HTM) web link (www.tlo.com)
(TXT) w3m dump (www.tlo.com)
| TechBro8615 wrote:
| My instinctual reaction to this has always been "well, you drive
| around in public, and your license plate is on the back of your
| car, so of course you can't expect privacy of it any more than
| you can stop someone from following you and taking photos of it."
|
| And generally I feel it's a valid argument, but it exposes two
| root problems:
|
| 1) Scale: There is a clear difference between a single person
| photographing license plates in a parking lot, or even a single
| person following one car, compared to an enterprise
| industrializing that tracking process through wholesale procuring
| of security camera footage or similar.
|
| 2) Linkage: Even if your license plate can be tracked, why should
| it be linked to your identity? The answer is that it really
| shouldn't. Of course you can register your vehicle to an LLC, but
| even if you don't do that, you shouldn't expect anyone on the
| road to map your license plate to your address. But again we
| return to the problem of scale, because ultimately someone could
| see your car in your driveway, then see it on the road, and
| therefore know your starting location and current location.
|
| The first problem of scale, while clearly exposing an obvious
| difference, doesn't seem easily resolvable to me, because at what
| point is a process "industrialized?" How do you legislate against
| this without imposing on constitutionally protected activity, or
| at least basic pseudo-freedoms like freedom of commerce? And how
| do you avoid regulatory capture granting carve outs to a few
| anointed large corporations to continue the practice, especially
| if they're the same corporations that "contract" with the
| government? [One side-problem/solution here is the lack of
| transparency of, or restrictions on, government purchasing
| "public" data.]
|
| The second problem of linkage, seems more easily addressable (no
| pun intended). States should put more protections on license
| plate databases, and make it easier for people to register their
| vehicle through a proxy, even without needing to create an LLC.
| But you still have the problem of "manual" linkage using photos
| of driveways.
|
| But the larger, perhaps root issue, is that modern technology is
| exposing a middle ground between "private" and "public"
| (meta)data - we see this with enterprise-scale tracking of public
| information, and also with "personal data" shared with limited
| audiences on social media sites, where it's obviously not
| _private_ because you intend to share it with people, but you
| also don 't intend to share it with _everyone_.
| CPLX wrote:
| We can just make it illegal if we want. We can pass a law and
| then enforce that law.
|
| There's plenty of precedent for similar laws. Credit reports
| are another form of aggregating information about you that
| comes from other people's reporting and it's extremely
| circumscribed.
|
| You can't keep files on what people think of my credit history
| without following very very detailed rules, as well as being
| strictly liable in private action for breaking any of the rules
| even by small technicalities.
|
| We can outlaw this if we want. Or restrict it heavily.
|
| I'm tired of listening to arguments that we can't regulate
| commerce. It's just learned helplessness after listening to
| generations of corporate lobbying.
| zen_1 wrote:
| This comes down to the difference between certain people around
| town recognizing your car if they happen to see it pass by, vs
| them hiring dedicated car-watchers all around town to keep
| track of your comings and goings and selling the data to anyone
| who comes asking. One is acceptable, the other is simply not.
| phantom784 wrote:
| Privacy could be a use case for those e ink license plates that
| have started showing up in California.
|
| Instead of the "real" number, change the plate every 5 minutes
| using some sort of OTP algorithm. Makes it impossible for
| anyone with a camera to put together a location database, but
| the car is still identifiable by law enforcement if necessary.
| cryptonector wrote:
| An OTP license plate scheme is a very interesting idea. The
| license plate would probably have to get larger to
| accommodate more characters.
|
| EDIT: I wonder why you got downvoted. I've recently been
| seeing a lot of downvoted comments that there's little
| conceivable reason to downvote, so I wonder if downvoting is
| a new way of trolling.
| floren wrote:
| Well, for starters, if you witness a hit and run and don't
| note the EXACT time along with the plate number, you're
| outta luck.
| tzs wrote:
| Assuming that the function that generates the plate
| numbers from the current time and a per plate seed is
| deterministic this shouldn't be a problem.
|
| You tell the police you saw the car with plate 2XYZ345 do
| a hit on run and give a time range. The state would have
| the seeds in its plate owner database and could generate
| a list of all cars that had 2XYZ345 sometime in that time
| range.
| Johnny555 wrote:
| Presumably such a system would keep a history of expired
| identifiers, so law enforcement could still look it up
| after it's been expired and replaced with a new one.
| mike_d wrote:
| It is being downvoted because it is a silly idea. These
| systems are ran in cooperation with the state, who in turn
| would just un-OTP your plate at the time of scan. That
| means average citizens are the only ones who would end up
| with less data.
| Johnny555 wrote:
| _That means average citizens are the only ones who would
| end up with less data_
|
| That doesn't sound like a drawback, I can understand the
| public benefit of the police being able to look me up by
| license plate number but not for the average citizen
| being able to do the same. This is separate from the
| issue that there should be stricter limits on law
| enforcement use of the data.
| brightlancer wrote:
| I can understand the public benefit of the government
| being able to stalk me but not for the average citizen
| being able to do the same. When the government does it,
| it's obviously for The Greater Good(tm).
| mike_d wrote:
| Average citizens are not the ones operating bulk
| collection systems. They are simply writing down a plate
| number of the car parked next to them when they find a
| giant door scratch in a parking lot.
| baby_souffle wrote:
| > Makes it impossible for anyone with a camera to put
| together a location database, but the car is still
| identifiable by law enforcement if necessary.
|
| Isn't it LEO that's deploying most of these systems? At least
| around here, *MOST* of the motorola cameras I see are on
| public roads / traffic signals. Bit of google shows EFF and
| other orgs FOIA-ing various counties in CA and a lot of them
| got federal money for their police to install them...
| darkclouds wrote:
| Privacy is a luxury only the rich can buy.
| brightlancer wrote:
| > Makes it impossible for anyone with a camera to put
| together a location database, but the car is still
| identifiable by law enforcement if necessary.
|
| First, let me laugh at the idea that state and local LE could
| technologically do anything that the public is unable to do.
|
| Second, let me cringe at the idea that it's OK for the
| government to stalk individuals.
| confounded wrote:
| Had never heard of these plates. At least the current models
| may well make the problem worse:
|
| > _" In addition to the flexibility of the display, the
| digital plates also sport a tracking device that will alert
| the police to the location of a stolen vehicle and allow for
| general vehicle tracking. While a lot of people can get
| behind the idea of never going to the DMV again, not a lot of
| people are thrilled about the whole "license plate as
| tracking device" angle"_
|
| From: https://www.reviewgeek.com/4225/california-unveils-new-
| e-ink...
| ssss11 wrote:
| Scale, Linkage and Permanency. If I drive around, people seeing
| that don't permanently record it but a data broker will.
|
| These have long been things overlooked by the "who needs
| privacy" crowd but they're what's most important.
| b1gbr0ther wrote:
| There is a third concern besides scale and linkage -- errors
| and accountability. Sometimes these services are _wrong_.
|
| When they are wrong, and people get arrested, go to jail, or
| pay thousands in legal fees to clear themselves...there is no
| accountability. Sometimes, the law enforcement who use the
| systems rely _ONLY_ on these systems, not on the underlyer data
| (e.g. images) to validate an arrest.
|
| Minimally, the services should have to produce an original
| image/video when surfacing information that will be used for
| legal action. Secondly, the services should be held financially
| responsible for legal costs when mistakes are made.
|
| https://www.nytimes.com/2020/12/29/technology/facial-recogni...
| notquitehuman wrote:
| I'll add a fourth: these services will inevitably be hacked,
| their data added to multiple darkweb data dumps, and
| circulated among nation states, hackers, and advertisers for
| the rest of time.
| bippihippi1 wrote:
| would you really not expect that people shouldn't follow you
| around? if i drive around the city taking pictures of you in
| your car, that's harassment. why can a company do it? it's one
| thing for it to be available for polling if there's a crime,
| it's another thing to sell that data to anyone
| brightlancer wrote:
| > if i drive around the city taking pictures of you in your
| car, that's harassment.
|
| Not if you have a government provided license, i.e. for
| private investigators.
|
| It looks like harassment, quacks like harassment, but the
| government got their money so they've said it's not
| harassment.
| JohnFen wrote:
| It's still harassment, it's just legally permissible
| harassment.
| Modified3019 wrote:
| If we want thus to stop, we'll need to set up an open source
| project that likewise tracks politicians, CEOs and judges.
| yegle wrote:
| I always had the idea of building something similar to this for
| my own use: have a dashcam recording while I was driving, and
| every night taking those videos and extract the
| timestamp/GPS/plate number and a short video clip of all cars I
| encountered on that day.
|
| I haven't thought too much about why documenting these would be
| useful, but on top of my mind I could get answer of these
| questions: - have I seen this fancy/unique looking car in the
| past? - is this the same douche bag that I saw last week who
| can't drive? - what's the last CA plate number starts with now?
| Is it 9G or 9H? - are there more people driving w/ a 9[A-Z] plate
| in my town? (As a proxy of knowing how many people are still
| buying new cars in my town)
| alsodumb wrote:
| I believe this is illegal in many states.
| loeg wrote:
| It is sometimes illegal for cops/parking enforcement to do
| this, which might be what you are thinking of.
| CameronNemo wrote:
| Why would it be illegal? You are just filming things you see
| in public.
| rahimnathwani wrote:
| Ring should make a dashcam.
| greyface- wrote:
| They do. https://ring.com/products/car-cam
| rahimnathwani wrote:
| Wow, a network of these with ANPR would be better than
| fixed cameras.
| xnx wrote:
| Why get the data piecemeal from license plates, when you can get
| it straight from the cars themselves? /s
|
| "New Tool Shows if Your Car Might Be Tracking You, Selling Your
| Data": https://www.vice.com/en/article/n7enex/tool-shows-if-car-
| sel...
| throwbadubadu wrote:
| Related and recent: Autoenshittification!
|
| https://pluralistic.net/2023/07/24/rent-to-pwn/#kitt-is-a-de...
| dpiers wrote:
| Is this news? I'm genuinely asking - TLO and other skip tracing
| tools have been around for a while, and have been offering
| license plate location data for years.
|
| The ACLU issued a report on how ALPR devices are used to track
| people in July 2013 (1).
|
| Flock Safety (2) was founded in 2017 and has raised $381M from
| name-brand VCs like Tiger Global and A16Z. The ACLU raised
| concerns about them a year ago in a report. (3)
|
| No one has been keeping it secret.
|
| 1: https://www.aclu.org/documents/you-are-being-tracked-how-
| lic...
|
| 2: https://www.crunchbase.com/organization/flock-safety
|
| 3: https://www.aclu.org/report/fast-growing-company-flock-
| build...
| olyjohn wrote:
| No, people do not know these services exist.
| brightlancer wrote:
| I think people know these exist. As this thread shows, I
| think lots of people don't _care_ that it exists, or only
| object to the data being sold to Amazon rather than DHS.
| JohnMakin wrote:
| No, I don't think people realize it. Also, these brokers are
| basically the sole gatekeepers for this type of information -
| as AI recognition software becomes more potent, I think this
| kind of data becomes much more dangerous.
| mylons wrote:
| how do these services work? is it something on the car giving
| away info about the vehicle?
| vector_spaces wrote:
| It's crowdsourced from PIs and other entities that install
| plate readers in parking lots, highways, and on their own
| vehicles
|
| [1] https://slate.com/technology/2020/07/customs-border-
| protecti...
|
| [2] https://www.vice.com/en/article/ne879z/i-tracked-someone-
| wit...
| mike_d wrote:
| Even better, they lease the camera systems to police
| departments to put on traffic lights at major intersections
| and along highways.
|
| When doing a search very few of the hits I've seen have been
| from vehicle mounted cameras.
| brightlancer wrote:
| I can't speak to the ratio, but I know many local law
| enforcement agencies which mount these on patrol cars --
| the LE agency benefits from access to the databases and in
| return provides data to the databases.
|
| There are tons of private collectors, but lots of LE
| agencies are doing it too.
| JohnFen wrote:
| It's all about the databases. Reading license plates isn't, all
| by itself, a very serious privacy problem. It becomes a
| problem, though, when that data is combined with hundreds or
| thousands of other data points (each of which also aren't a
| huge deal in isolation).
|
| The privacy violation isn't really in the camera, or the
| telemetry, or any other data point you generate that is
| collected. It's in the combining of all of these things into a
| profile.
| timewasterthrow wrote:
| I know someone that caught their wife cheating by using the
| ChargePoint app the wife used to charge their Chevy Bolt.
|
| The wife charged their Chevy Bolt at work, which had a paid
| 'public' charger at her work site. The wife charged everyday and
| left it there so it could maintain battery and AC if she wanted.
| The chargepoint app shows the last vehicle that charged there,
| and a history of the last few days.
|
| He checked her works charger histories, and noticed over a few
| weeks that on days she said she was still at work, the car wasn't
| showing on ChargePoint. He knew she was a charging fanatic. He
| drove to the work once. Verified she wasnt there. Called her and
| talked to her about how her work day is going. She pretended like
| she was at the actual office. She wasnt. At that point he knew,
| but took a few more days to fully get proof.
| manzanarama wrote:
| Can you register cars under a company or other shell entity? I
| feel like the only way to get around this kind of stuff is to
| have layers of abstraction above your identity.
| wmf wrote:
| From what I read, the problem is that you need to have the
| driver's name on the insurance policy even if the car is owned
| by a corporation.
| mindslight wrote:
| Sure! Enjoy your higher taxes and fees, extra parking
| restrictions, and possibly being unable to represent yourself
| in court.
| davidkellis wrote:
| My tin-hat alter ego says the three letter agencies are creating
| these companies for the sole purpose of then purchasing the data
| and skirting the law. But that guy is crazy. ha ha.
| brightlancer wrote:
| Why would the three letter agencies need to do that? There's
| plenty of money to be made by private businesses doing it with
| fewer risks of violating the law.
|
| And the TLAs aren't interested in selling this info to state
| and local agencies, while that's probably the bigger dollar for
| private businesses.
| colechristensen wrote:
| Because sometimes there are laws that prevent governments
| from doing things which don't prevent them from buying the
| results.
| johnea wrote:
| In the US it's illegal for anyone to do it.
|
| This is just as clear a violation of the 4th amendment as
| the multi-billion dollar goggle empire.
|
| But nobody really cares about that do they? Laws are
| routinely enforced or ignored based on which option allows
| the largest profits for incumbents.
| jonathankoren wrote:
| The 4th amendment only applies to the government, and has
| only ever applied to actual tangible property. This is
| being in public where there is no expectation of privacy.
| JohnFen wrote:
| This. The Bill of Rights doesn't protect us here. We need
| plain old lawmaking.
| singleshot_ wrote:
| The fourth amendment, of course, also applies to private
| actors when they become essentially agents of the state,
| by taking in a role traditionally within the purview of
| the state, so long as the state knows of the activity,
| more or less. If you would like a more accurate
| definition, you can search for "state actor doctrine" and
| you will find some cases about railroads drug testing
| employees and parcel carriers searching packages for
| contraband.
| singleshot_ wrote:
| Wait, what? The fourth amendment only applies to tangible
| property? So for instance, is cell site location
| information "tangible property?"
| TechBro8615 wrote:
| It doesn't even need to be nefarious or direct. Companies
| founded by an "ex TLA employee" have increased credibility,
| and might even procure investment from openly CIA-affiliated
| venture capital firms like In-Q-Tel. And since the founder
| has a security clearance (they're "in the club"), the company
| will have no issues procuring government contracts.
|
| The revolving door works in both directions.
| jonathankoren wrote:
| They don't need to create the companies. They just buy from
| them.
|
| Anyway, license plate info isn't considered a search because
| it's in public, and the SCOTUS doesn't care about how scale
| makes what used to be tolerable, a very different beast.
|
| https://www.eff.org/deeplinks/2022/08/how-law-enforcement-ar...
|
| https://www.brennancenter.org/our-work/research-reports/auto...
___________________________________________________________________
(page generated 2023-07-26 23:00 UTC)