License Plate Readers Throw Wrench in Data Privacy Crack Down

By Casey Smith

State lawmakers are prioritizing multiple bills in the current legislative session that seek to increase data privacy and give Hoosiers more say over how their personal information is stored. But Republican legislators remain reluctant to enact policy around increasingly common surveillance technology like license plate readers used by law enforcement.

The Indiana State Police (ISP) have been using such technology for more than decade — scanning a million plates a month — to find habitual traffic violators, stolen vehicles, missing persons and people driving with suspended licenses.

Lawmakers have previously commended the state agency for its policy surrounding automatic license plate readers. But currently, Indiana has no laws on the books regulating the technology or requiring the dozens of other Hoosier law enforcement agencies that use the cameras to follow the same rules.

A previous attempt to establish statewide standards for the readers didn’t advance in the legislature. And it doesn’t appear that lawmakers have an appetite to join the other 16 states with regulations on the books now.

At the same time, GOP legislators have continually resisted efforts to use camera technology for highway speed violations or passing of school buses.

Although police contend that the license plate readers are a valuable tool for investigators, the American Civil Liberties Union (ACLU) of Indiana raised concerns that the information collected can be stored indefinitely in databases and shared without restrictions.

There also aren’t laws in place to prevent data from being used in ways that could infringe on Hoosiers’ privacy.

“This is technology that collects data about all of us, and there’s very little transparency, there’s very little accountability, and that has concerns for us in multiple ways,” said Jane Henegar, executive director of the ACLU of Indiana. “This information can be collected, it can be pulled across wide swaths, geographically. It can be stored and kept for long periods of time. It can be used for reasons beyond its initial justification.”

How the readers work

The high-speed cameras used by ISP take pictures of license plates and turn them into searchable data.

While the agency previously used vehicle-mounted cameras, ISP Maj. Bryan Harper, who commands the Special Investigations Division, said state police stopped using those more than a year ago.

“It’s easier for us to have five cameras placed strategically than to have five cameras on vehicles that might have the day off, or might be down for maintenance,” he said. “It’s much more efficient to put those in areas where they can be employed the full day, the full week, rather than being down for some type of maintenance or other reasons.”

State police now contract with California-based Vigilant Solutions, a subsidiary of Motorola Solutions. The new system — up and running since August — has so far cost upwards of $250,000, according to the Indiana Department of Administration.

Currently, state police have 47 cameras employed, Harper said. Most of those are in or around Indianapolis, but others are located elsewhere in the state, too.

Harper emphasized that the license plate readers “are really nothing more than cameras” that are set up to scan license plates, not individuals.

Cameras are set up in public domains along roadways and affixed to traffic poles.

“We don’t really have anything to hide when it comes to this. This technology is out there. It’s not a secret,” Harper told the Indiana Capital Chronicle.

Officers also cannot review live camera footage, he said. State police internal rules require an officer to have “reasonable suspicion” that a crime has occurred before an investigator can log into the license plate system with a plate query.

Harper said the cloud-based storage system is “strongly” encrypted to prevent information breaches. Data can be shared with other law enforcement agencies, though, “as long as they’re providing us reasonable suspicion of a crime.”

There were more than 1.1 million license plate reads from Dec. 13 to Jan. 11, according to state police. During that time, plate hits led to 44 “apprehensions” — almost all of which were for stolen vehicles or warrant arrests.

In the last three months, ISP has additionally made three “large” seizures of money or drugs, thanks in part to the license plate readers system, Harper said.

Police generally check the license plate information against a “hot list” of people wanted on criminal arrest warrants or those with suspended licenses. Harper said they also look for people reported kidnapped or missing.

The lists are compiled by cross-referencing records from the Indiana Bureau of Motor Vehicle with criminal databases.

Indiana lacks statewide guidelines

Other law enforcement agencies around the state are adopting the technology, too, including in Columbus, Gary, Jeffersonville, Muncie, West Lafayette and more than a dozen jurisdictions in central Indiana.

The Indianapolis Metropolitan Police Department (IMPD) has in recent years purchased dozens of license plate cameras from Atlanta-based Flock Safety, for example. Those are now installed around the metro area.

Still, each agency crafts its own policies for license plate readers. Harper said the ISP policy — which dates back to 2015 — is similar to most others around Indiana.

Specifically, ISP’s operating procedure requires license plate image data to be retained for 30 days before being purged from the system.

That “extremely short window” can be prohibitive to investigators, Harper said, “but the Indiana State Police want to make sure that we are covering both ends — we understand people’s civil liberties, and we also understand the need to mitigate or apprehend suspects.”

The policy differs somewhat from what’s previously been in place at IMPD, which still uses mobile license plate readers that are attached to marked police vehicles. The police department said data is now stored for up to 30 days — a change from up to six months in years prior.

After adding 200 new license plate readers last fall as part of a high-tech plan to help cutdown on crime, IMPD now has more than 250 readers in operation, including more than 200 stationary cameras inside and outside of downtown Indianapolis, and more than a dozen mobile license plate readers attached to patrol cars.

Harper maintained that local law enforcement agencies across Indiana are actively meeting to discuss policy. ISP is also in the process of updating its own guidelines, he noted.

“For the most part, everybody’s pretty much in agreement that we’ve got to make sure we’re handling this the right way, or it will go away as fast as it came,” Harper said, referring to the license plate reader technology. “That would be a complete disservice to our victims and our role as law enforcement, to mitigate crime.”

Previous legislative effort was unsuccessful

Lawmakers commended the ISP policy but have been hesitant to make it a statewide standard for all Indiana law enforcement agencies.

Citing privacy concerns and a desire to get all law enforcement agencies across the state on the same page, a former Indiana senator introduced a bill that would have set parameters for license plate reader use and limited the timeframe for stored camera information.

Former Sen. Jim Smith, R-Clarksville, sought to require that records be purged after 30 days unless police have a warrant or can cite an ongoing investigation, mirroring the ISP policy that was already in place.

Smith argued that internal policies aren’t enough, though. He called for “standardization” in Indiana to address what should be done with “this accumulation of unwanted license plate tracking” and to ensure that law enforcement agencies can’t share data or “track” Hoosiers.

“There are no rules in Indiana, it’s simply the policy of the individual department. This bill puts guard rails on this equipment, on a statewide basis. If there are no guidelines, how do we know it is not being abused?” Smith said in 2015 while discussing the bill in committee.

“The good guys today – the people that use this system and say, ‘Trust me on this’ — those people eventually leave office, and there will be somebody else,” he continued.

But the proposal was met with opposition from prosecutors and the state chiefs of police association.

The Indiana Prosecuting Attorneys Council (IPAC) testified that statutory time limits on license plate reader data could prohibit law enforcement efforts — leading to fewer crimes being solved and prosecuted. IPAC instead proposed restrictions on non-law enforcement access to license plate information.

The bill was never voted on and died in committee. Smith opined to have “more support from liberal Democrats on this than from those in my own party.”

State police said they could not comment on current or potential legislation in 2023. An IPAC representative said the group could not speak to license plate reader legislation unless relevant language is written into an active bill.

Policies in other states

At least 16 states have passed laws regulating the use of license plate readers or the use of data collected by the devices, according to the National Conference of State Legislatures.

Several of those laws place restrictions on how long data can be stored. Timelines range from 21 days to three years before information has to be deleted. Other states’ provisions ban the license plate readers completely with few exceptions, while other statutes establish strict guidelines for secure data sharing.

Other law enforcement departments across the country — including in states without specific laws — keep the information in storage for varying amounts of time, from a couple days to five years.

Model policy from the International Association of Chiefs of Police (IACP) National Law Enforcement Policy Center recommends that collected license plate data only be “shared for legitimate law enforcement purposes” and under certain circumstances.

The IACP also suggests that rules be put in place to address access, collection, storage and retention of license plate reader data. The organization doesn’t make a specific recommendation on timelines for storage or purging, citing benefits to both shorter and longer retention times, but it does advocate for some sort of window to be established, regardless.

Critics of license plate readers hold that Indiana lacks oversight for the technology.

Henegar, with the ACLU of Indiana, said that without proper guidelines, “inevitably, despite everybody’s best intentions, this can and does get misused.” She pointed to data breaches, for example, that could put information about “where we are over time and our habits” into the wrong hands.

Henegar also cited concern about smaller law enforcement agencies using the license plate readers: “If they don’t have the infrastructure or the fiscal ability to maintain that data security, then that puts everybody’s data at risk of getting hacked or being used for other purposes.”

She also condemned local Indiana law enforcement agencies for using license plate reader data to “to profile drivers … and violate their rights through unreasonable searches,” as well as for sharing data with U.S. Immigration and Customs Enforcement (ICE) officials to affect deportation efforts.

“We’re being tracked by our government,” she said. “Government should be a guiding light about privacy and physical liberty. Not this.”

Future data privacy legislation on the horizon?

Sen. Mike Crider, R-Greenfield, who chairs the senate Homeland Security and Transportation committee, said the issue of license plate readers “[is] not a topic that concerns me personally.”

Crider, who sat on the same committee in 2015 when Smith attempted to move legislation, said that bill failed because it “had no support from the committee – and that included me.”

“The reason some of those bills didn’t advance is the systems would be run by third parties who were not necessarily a law enforcement agency,” Crider said. “I personally support cameras for law enforcement use and have supported them for work zone enforcement and other legitimate uses. I’m not sure why anyone cares other than criminals but I was a law enforcement officer for 30 years so perhaps I trust them more than some.”

He told the Indiana Capital Chronicle that a study on the topic “might be an idea worth discussing,” but no such proposals have been introduced at the statehouse.

Multiple bills under consideration in the General Assembly do address other data privacy concerns, however.

Sen. Liz Brown, R-Fort Wayne, filed Senate Bill 5, which creates a “bill of rights” for Hoosier data privacy that would allow consumers to monitor how their data is being used and have it deleted if they wish. The proposal is among the Senate GOP caucus’ top priorities for the 2023 session.

The measure also includes a requirement for businesses to have annual data protection assessments and security checks.

Businesses collecting sensitive data — like medical and biometric information or details about religious beliefs, race and ethnicity — would have a heightened requirement for receiving prior consent from the consumer before they process any of that information.

The bill unanimously advanced from committee on Monday and is now up for consideration by the full Senate.

Harper, with the state police, said having a policy for license plate readers, too, helps maintain internal standards, but also ensures privacy for data being collected about Hoosiers.

“We understand that it does cause some concern, especially in this day and age, on maybe how law enforcement is utilizing it. I think there are also some misconceptions about what it actually can do and what it does,” Harper said. “Having a policy in place just ensures that we’re meeting those expectations of the public, both privacy concerns, as well as those victims of crimes who want to see justice. And this is one tool we’re able to bring them.”

Indiana Capital Chronicle is part of States Newsroom, a network of news bureaus supported by grants and a coalition of donors as a 501c(3) public charity. Indiana Capital Chronicle maintains editorial independence. Follow Indiana Capital Chronicle on facebook.com/IndianaCapitalChronicle and twitter.com/INCapChronicle