Arizona police agencies gather & share license plate data, but few ensure rules are being followed

Every shift in Chandler, police officers in cars equipped with special cameras can be seen driving up and down every street in a neighborhood, gathering data on every vehicle in the area. 

The cameras, known as automated license plate readers, or ALPRs, scan license plates of nearby cars, capturing images not only of the license plate number, but also recording where the vehicle is located and the time of day, among other things. 

As part of the training for the ALPR systems, Chandler officers are taught to “grid” neighborhoods during their downtime – systematically driving up and down every street in an area, indiscriminately scooping up information on vehicles – not because of any suspected criminal activity, but because the information might be useful in future criminal investigations.

The practice is worrisome for civil liberties advocates, who view the sweeping data collection as too expansive.

“Historically, police officers could go out and look for license plate numbers, walk or drive up and down the streets in the whole neighborhood to do that, but until you had this technologies, there were physical limitations to that,” said Jared Keenan, Criminal Justice Staff Attorney at ACLU of Arizona. “You had to have officers go out and do it, and it naturally limited how much information they could gather.”

Automated readers, on the other hand, can gather thousands of records a second, which Keenan says is scary. 

Chandler Police Department’s Commander Ed Upshaw said that ALPRs do not capture individuals, and that collecting data on what cars are where at specific times can create investigative leads.

“If your vehicle is parked in a public place or visible from a publicly accessible place, it can be recorded by anyone. Is there a reason a YouTuber can record but police cannot?” he told the Mirror in a written statement. Chandler Police Department officials would not agree to an interview.

But critics say there is a difference.

“When the government is indiscriminately gathering massive amounts of data like this, it can provide very intimate insight into people’s lives,” Keenan said. 

For instance, law enforcement can use ALPR data to determine the places people frequent, with whom they associate, what doctors they go to and what religious services they attend.

Additionally, Keenan said, when these types of technologies are deployed without reasonable suspicion, implicit and explicit bias can mean that police deploy this technology more heavily in poor neighborhoods and communities of color. For example, police could grid low-income or minority neighborhoods more often, which could lead to over-policing of those neighborhoods—even if there are just as many crimes in rich, white areas.

This has played out in Oakland, where police disproportionately captured ALPR data in low-income communities and communities of color, according to a week’s worth of 2014 data analyzed by the Electronic Frontier Foundation. And in 2016, a BuzzFeed investigation found that ALPRs in Port Arthur, Texas, were primarily used to track down unpaid traffic citation arrests, leading to the incarceration of mostly black residents.

ALPR devices are marketed as ways for police to “develop more leads and solve more cases” for a variety of crimes, ranging from murders to kidnappings, and organized crime to terrorism. But some Arizona contracts for automated license plate readers, including those in Mesa and Chandler, were  provided through a grant from the Arizona Automobile Theft Authority, because one of the primary uses of ALPR is to identify and recover stolen vehicles. In Chandler, where the first two 3M PIPS LPR systems and Vigilant Solutions subscription came from these grants, police officers were instructed to send one-sentence emails with report numbers and how Vigilant Solutions helped their investigation, not just for arrests but also for locating stolen vehicles.  

The expansion of the license plate reader program and maintenance of the systems in Chandler has come from Federal Justice Assistance Grants, according to Commander Upshaw.

The longer ALPR  data is retained, the more likely it is to be misused or exposed in a data breach. While some cities have policies to retain license plate data for only six or 12 months, some police departments don’t appear to have retention policies at all. And though police departments with retention schedules all indicated that records are purged automatically, public records indicate that only a single department has ever conducted an audit – and the last one was conducted in 2015.

Arizona Mirror filed public records requests with the Arizona Department of Public Safety and police departments in Phoenix, Chandler, Glendale, Mesa, Paradise Valley, Scottsdale and Tempe to shed light on how Valley law enforcement agencies use ALPRs. Records were provided between February 2018 and March 2019.

All of those agencies use ALPR systems to some degree, and all share and receive data with other law enforcement agencies, both in Arizona and across the country. 

Both stationary and mobile cameras are used in the state. Paradise Valley has focused on 11 locations for stationary cameras, for example, while Chandler’s goal was to have one vehicle per shift per substation patrolling the streets with an active ALPR.

Instructional videos by Vigilant Solutions, one of the nation’s largest ALPR vendors, and Chandler Police Department’s training materials provide some insight into how law enforcement agencies in Arizona use ALPR. 

It’s not just about patrolling an area and happening across license plates that might be linked to criminal activity. The software also allows officers the ability to enter plate information and date ranges to see photographs of license plates by date and time and create maps and reports of the data found. 

Officers can also use wildcards to enter partial plate numbers. They can look for specific locations where a license plate has been scanned often in order to find likely hangouts or residences of the vehicle’s owner. And they can use a “stakeout” function to find what plates were located in a specific area.

 And, as mentioned, Chandler police officers were encouraged to “grid” a neighborhood or business area “to help us gather intel to solve future cases.” Gridding an area was described as “driving up and down every street in an area to capture all license plates.”

Data sharing

Law enforcement agencies can preload a “hotlist” of license plates that the ALPR system is looking for (such as stolen vehicles of those with unpaid traffic tickets). The agencies can also create their own hotlists. If a license plate on the list is scanned, the agency (or officer, if they’re in a vehicle equipped with ALPR) will receive an alert. Law enforcement officers can then use databases to connect license plate numbers with names.

Sharing agreements in Arizona vary widely. Scottsdale and Tempe’s police departments only share detection data and hot-list records with each other. (Detection data is a list of license plates scanned, while hotlist records are a watch list of plates the departments are looking for.)

Scottsdale requires a signed agreement before sharing data with other agencies, and explained this policy in response to email requests for data sent between 2016 to 2018 from Casa Grande Police Department, Burr Ridge (Illinois) Police Department and the Bexar County (Texas) Sheriff’s Office.

Scottsdale, however, receives detection data from nearly 100 agencies. 

Like Scottsdale, Tempe doesn’t readily share what it collects, but it gets a lot of information: It receives detection data from more than 100 agencies, as well as shared National Vehicle Location Service (NVLS) data coming from 521 agencies. NVLS is a nationwide LPR repository managed by Vigilant Video.

Mesa and Phoenix sit on the other end of the spectrum.

According to public records the Mesa Police Department provided, it shares its detection data with close to 800 agencies across the country, as well as a shared NVLS database accessed by 523 agencies. However, its media relations detective, Nik Rasheta, stated in an email that the data was only shared via NVLS.

Mesa PD receives information from more than 100 agencies (and also has access to the NVLS database), in addition to receiving shared hot list records from Montgomery Police Department.

Phoenix, too, receives ALPR data from hundreds of agencies, in addition to detection data from more than 100 agencies and hot list records from the Beaumont (California) Police Department, Montgomery Police Department and the Richmond County (Georgia) Sheriff’s Office. 

The list of agencies with which Phoenix Police shares the data it collects on Phoenix vehicles is several pages long and includes agencies ranging from the FBI to the small police department in Colquitt, Georgia, according to public records. 

Glendale and Paradise Valley all told the Mirror they only receive hotlist data from the Arizona Department of Public Safety. However, public records obtained from Mesa and Phoenix both list the Glendale and Paradise Valley police departments as organizations with which they share detection data. 

Some police departments seem unclear about whether they are receiving data, as described in public reports that they and other police departments provided. Many were unaware of or denied sharing or receiving data from other cities, even when public records from those cities listed them as recipients. Some believed that they were only sharing with NVLS though the reports seemed to indicate otherwise.

For example, public records from Mesa and Phoenix list Glendale as organizations they share detection data with, but Phoenix says it only shares and receives data from Vigilant’s NVLS system, which is then made available to other organizations.

And although public records indicate that “Montgomery Police Department: HSI Master” is sharing hotlist data with DPS, spokesperson Trooper Kameron Lee wrote in an email that DPS does not receive hotlist information from that department and was unsure why the report generated the way it did. Lee stated  that DPS did not know the location of “Montgomery Police Department” or whether or not “HSI Master” stands for “Homeland Security Investigations” or not. 

When asked about police departments that state they do not receive data from organizations they are listed as receiving data from in LEARN reports, and whether there’s a possibility that the reports are inaccurate, Vigilant Solutions spokesperson Mary Alice Johnson wrote in an email that settings cannot be modified by Vigilant Solutions per Criminal Justice Information Services policy, though law enforcement agencies may change their data sharing settings at any time.

“Vigilant Solutions does not confirm or comment on specific customers, so I am not able to discuss the cases you referenced,” she wrote.

The Arizona Department of Public Safety shares its detection data with more than 250 agencies, receives detection data from 185, and receives hot list data from the Montgomery Police Department.

Guidelines

Police departments issue guidelines on the deployment of ALPR systems to prohibit misuse of the equipment and databases. 

Typically, they require formal investigations to link vehicle plates to individuals. For example, Paradise Valley PD’s guidelines warn officers to visually verify plate numbers before initiating vehicle stops, to verify the status of plates through MVD queries “when circumstances allow,” and to verify physical characteristics of individuals that are identified in arrest warrants. 

Scottsdale, too, advise its officers to verify stolen vehicle activations through an MVD records check before taking action.

Chandler’s training material warns that digits in license plates that trigger alerts do not distinguish between different states. 

“So, just because the computer is telling you that the digits your LPR camera just captured are ‘Hot,’ it doesn’t mean that the plate you ran is ‘Hot,’” says one training slide.  “The digits that are ‘Hot’ might be related to a different plate in a different state. Also, the camera can misread a license plate.” 

 Tempe’s training material says that “hotlists should be updated as often as practicable, and/or at the beginning of each shift,” and requires officers to visually confirm plates numbers and states, confirm that alerts are still active – and that they pertain to the vehicle occupants and not just the registrant – before taking action.

Retention Schedules

Retention schedules varied from one agency to the next. Phoenix retains data for two to five years. Chandler retains its ALPR data for two years, Scottsdale, Paradise Valley, Mesa and DPS for one year, and Tempe PD retains data for six months. 

If license plate records are believed to be pertinent to criminal investigations, they can be downloaded and impounded as evidence, and in some cities, extensions can be granted in response to formal requests. 

Although data can be automatically purged from the system in accordance with a retention schedule, some users get automatic emails containing ALPR data advising of hits, and they must delete these emails manually in order to comply with retention guidelines. Additionally, if there aren’t periodic updates (both on the police departments’ end and Vigilant’s end), there’s no way to know for sure that data was purged in according to the schedule.

Audits

Whether police department guidelines are followed is difficult to know without an ALPR system audit, but no city other than Tempe provided evidence of such – and even Tempe has not conducted an audit since 2015.

Tempe provided audits conducted in 2014 and 2015 in response to a public records request. The audits are meant to ensure that users of the equipment have completed training, that terminated/retired employees are removed from the system, that retained ALPR data is purged after six months, and that ALPR queries by law enforcement include corresponding identification numbers or case numbers.

In 2015, 120 auditable queries didn’t have an identifying number, but rather “generic identifying information such as the type of crime being investigated or type of warrant.” Three quarters of those queries were the result of six employees, one of which was responsible for 61 of them.

“Administration may want to consider inactivating employees’ status if violations of policy continue after remedial training is provided. Internal audits may be helpful in monitoring employee behavior between ACU audits,” a 2015 memo on the audit inspection, written by Sergeant Karin Betz of the Audit and Compliance Unit, reads.

It is not known whether these employees have improved because there has never been a follow-up audit.

In other Arizona cities, even less is known about whether ALPR procedures are followed, since no external audits have ever been conducted. 

In response to a public records request, a city administrator for Glendale Police Departments’ ALPR program wrote that he is “unaware of any audits conducted by or for Glendale.” Scottsdale’s police records supervisor told the Mirror that audits are not required by department policy. 

Although Chandler is required to have “periodic audits,” in an emailed response to a public records request, a spokesperson wrote that “the system automatically conducts internal checks.” There is no known documentation for these automatic checks. 

Upshaw, the Chandler PD commander who provided a written statement, said outside audits aren’t needed because anyone in the department who accesses information gathered by ALPR “needs a report number and must articulate why they are searching the database before they can access it.” That means there is already an explanation of why any particular license plate was searched, he said. 

However, Upshaw acknowledged that an internal audit found that data was being stored for four years rather than the two years allowed by department policy, and that a request to correct the matter was made. He wrote that he would continue to conduct audits on storage lengths to verify that data older than two years is removed.  

The Mirror has made all the documents obtained for this story publicly accessible here.