The NYPD has tapped into a private company's national database of license plate readers at the cost of more than $400,000 over three years, giving it the ability to casually track car owners far beyond the five boroughs. A $442,5000 contract (PDF) between the city and the company Vigilant Solutions, obtained through a public records request by the NYCLU, lays out how it works.

The NYPD already has some 500 license plate readers of its own that combine with feeds from surveillance cameras, 911 calls, gunshot and radiation detectors, criminal database information, and other sources as part of the department's Domain Awareness System. The Vigilant contract dramatically expands the agency's capabilities by providing access to real-time and historical license plate records from around the country, meaning the NYPD can now monitor one's movements from Staten Island to Seattle. The database is populated by privately operated license plate readers installed—unlike police scanners that are placed at major intersections—in strip malls, apartment complexes, on residential streets, and in office parks, as well as scanners mounted to "scout vehicles."

Vigilant's partner company, Digital Recognition Network, is the one that actually compiles the plate data. DRN packages and sells the information to repossession firms and financial services and insurance companies to help them investigate fraud and seize cars.

Vigilant touts its system as containing more than 2.2 billion pieces of data connecting specific cars to specific addresses at specific times, and growing by 80 million pieces per month. The company exists to serve law enforcement agencies and stresses that its information only goes one way, as in its employees don't get access to all the personally identifying and investigative information cops attach to license plate numbers. Its software, though, allows for a wide range of tracking techniques that the NYCLU says are ripe for abuse.

For instance, a "stakeout" option allows police to track which cars are commonly seen at a given location, while another option can list cars commonly seen near one another at various locations, and another can spit out a list of likely locations for a given car.

NYCLU senior staff attorney Mariko Hirose writes for the Huffington Post:

With this volume of private data and these types of tools, Vigilant enables the NYPD to learn intimate details about people's lives with a click of a mouse. Through the "stakeout" feature, the NYPD may learn who was at a political rally, at an abortion clinic, or at a gay bar. Through the predictive analysis, the NYPD may learn that a person is likely to be near a mosque at prayer time or at home during certain hours of the day. Through the "associate analysis," the NYPD may come to suspect someone of being a "possible associate" of a criminal when the person is simply a family member, a friend, or a lover.

NYPD guidelines for the Domain Awareness System bar this sort of use. They also dictate that license plate data should be retained for five years (PDF), whether or not it's been deemed relevant to a criminal investigation. The NYCLU wants to see more explicit safeguards against misuse of data collected by the department, and says that five years is far too long to hang onto bulk data collection.

The for-profit Vigilant and DNR are different animals altogether, Hirose said.

A graphic in Vigilant Solutions' NYPD contract shows the reach of the company's scanners. (NYCLU)

"The private companies have more incentive to store data, because that's what they are selling to law enforcement," she said in a phone interview. "And also that means that these companies don't have an incentive to delete any of the data."

No retention policy is specified in Vigilant's contract. A spokesman for the company with a public relations firm said that it sets software to limit law enforcement agencies' access according to their own policy, but that DRN holds onto its commercially collected information indefinitely.

In her article, Hirose cites past abuses as reasons people should be concerned about the growth of license-plate tracking to a national industry, and every county in the state of New York embracing the technology. In one case predating the trackers, a Washington, D.C. police lieutenant pleaded guilty to extortion after looking up the plates of vehicles near a gay bar and blackmailing their owners. In another, DEA and Alcohol Tobacco and Firearms agents contemplated using the readers to log attendees at a gun show, then thought better of it. In a third case, a SWAT team raided a Kansas family's home after recording their license plate at a gardening store and finding loose-leaf tea police thought was marijuana in their trash.

In an ill-advised instance not cited by the civil liberties group, a Los Angeles councilwoman proposed sending scolding letters to presumed patrons of sex workers based on their license plates appearing at night in areas known for prostitution.

The Vigilant spokesman noted that after former TV news reporter Vester Lee Flanagan murdered two former colleague on live television in Virginia last year, his plate number was added to a police "hot list," then flagged by a state trooper's license-plate reader, leading to his arrest. The use of hot lists to apprehend suspects is totally reasonable, Hirose said—it's the long-term retention of the plates not associated with any investigation that irks the NYCLU.

The company says that long-term data can have expansive uses, such as finding plate numbers commonly appearing near a known suspect. According to the work proposal, "These could be possible associates of the suspect, or conversely could be used to establish pre-meditation or stalking of a victim."

Hirose likened the tracking enabled by plate readers to placing a GPS on a car. She said the law around un-warranted monitoring based on the scanners is not settled, but that a case in Buffalo where a judge found that police placing a GPS tracker on a man's car for 65 days without a warrant was improper.

The Vigilant spokesman said the software includes built-in protections to prevent improper use of data, and investigate it if it happens. The NYPD, he said, can create custom permissions so that beat cops could, for instance, only look at recent data, while homicide detectives on cold cases could look much further back in time. As far as private contractors viewing personally identifying information, the only people who might see the NYPD's side of the monitor are IT workers called in to troubleshoot, and federal laws prevent illicit access to DMV and other law enforcement databases. All activity within the system is logged, he said, so that anyone in charge can conduct an audit at any time.

Vigilant vice president of marketing Bryan Shockley maintained that license plate data is "anonymous" because it doesn't say who was in a car at the time it was logged—that would require actual investigation. He added that he doesn't understand the criticisms of license-plate readers, saying, "It’s unfair to categorize LPR as a surveillance technology."

"I think if [the NYCLU looks] at the facts and look at logic, LPR is not ubiquitous," he said. "LPR is not on every corner. It’s not a GPS tracking device."

When asked if he wouldn't like to see cameras everywhere because it would be good for business, Shockley adjusted course:

I can’t say it wouldn’t be a worthy goal. It’s not practical. It’s not going to happen. But, yeah, I don’t see an issue with that. Again, with the fact that it's anonymous data and the protections in place, it wouldn’t concern me if there were a camera on every corner.