License to Spy

Accountant Arthur Ureche was heading to work in Hollywood Hills on January 30 last year when he turned his Enterprise rental onto Laurel Canyon Boulevard and noticed four LAPD squad cars following him.

He guessed that their presence involved another celebrity “S.W.A.T.-ing” incident: teen hackers had been sending police units to the homes of stars, including Ashton Kutcher, Justin Bieber and Miley Cyrus.

So Ureche, 40, pulled his white Chevy compact over and waited for them to pass. When he checked the rear-view mirror, he saw that they’d spread out across the road a good distance behind and were blocking traffic. He couldn’t imagine they’d have any interest in him, a union dues administrator in a button-down shirt whose last traffic ticket, at age 19, was for driving too slowly.

But something was definitely wrong. Five cops crouched behind car doors, their weapons aimed in his direction. “I started looking around for the maniac with the gun,” Ureche said in an interview with this reporter. “And I realized it was me.”

A cop with a bullhorn ordered him to reach through the window and unlatch his door from the outside. But the lock was stuck. How could he get it open without drawing suspicion — and possibly gunfire? Ureche took a deep breath. His pulse raced. A police chopper buzzed overhead.

“I’m trying to not look crazy, not to do anything sudden,’’ he said. “It’s hard as hell to hear them because you’ve got the helicopter hovering above, and they are screaming from 25 feet back, so I have to shout back through the open window, ‘I’ve got to use the inside handle! I’m not reaching for anything!!!’”

The standoff resulted from a potentially fatal mistake: an LAPD license-plate reader (LPR) had confused Ureche’s Colorado plates with identical tags of a wanted drug felon from California. Same numbers; different states. And though Ureche escaped without being shot, his terrifying encounter underscored the looming threat posed by LPRs, technology that is largely unregulated and, in cases such as Ureche’s, disturbingly unreliable.

Plate readers have become the most pervasive new crime-fighting tool in law enforcement, capable of providing instantaneous information on fugitives, suspects and missing persons. The technology helps investigators quickly pinpoint the whereabouts of a murderer, pick up the trail of a fleeing fugitive or locate your stolen Honda.

But the use of LPRs is nearly as invasive as the National Security Agency’s surveillance programs and the information far more vulnerable to abuse, according to privacy advocates and experts in LPR technology. While NSA data is highly restricted, scans of license plates, collected at police departments across the country, are highly susceptible to unauthorized access and official misuse. Equally troubling is that ordinary Americans are tapping into private LPR databases, including huge troves of plate hits housed by debt-collection firms, which are commonly shared with law-enforcement agencies. The average person can now track virtually anyone’s movements, sometimes with the immediacy depicted on cutting-edge dramas such as “Ray Donovan” and “Homeland.”

Critics envision nightmare scenarios: an abusive boyfriend trying to hunt down his ex could learn where she parks her car each night. A celebrity stalker could trace her victim from film shoot to grocery store to home. A criminal defendant could learn where the key witness is hiding. An employer could discover that his worker wasn’t really sick that day – LPR cameras show his green hatchback parked at the movie theater — or didn’t visit all the clients he said he did.

Got a neighbor with a grudge? For about $100 and the trouble of hiring a private investigator, he can download your daily itinerary: when and where you pick up your kids, the gym where you work out, the friends and family you visit, the doctors you see.

What would kidnappers, blackmailers or assassins do with such personal information?

Cops across the country have embraced the new technology. A five-year, $50 million grant by the Department of Homeland Security has fueled an acquisition frenzy. LPR cameras went from being used by 20 percent of all police departments nationwide in 2007 to 71 percent in 2012. Yet no significant studies have been conducted to evaluate their effectiveness, despite calls to do so by major police organizations and the American Civil Liberties Union, and there’s been scant examination of unintended results from the unregulated collecting of tracking data.

Minnesotans got an idea when the Minneapolis Star Tribune made a records request in 2012 and was handed plate hits on the motorcade of then-mayor R.T. Rybak. The file detailed dozens of stops Rybak made around town, with scanners capturing his vehicles 41 times during the course of a year.

“Now that we see someone’s patterns in a graphic on a map in a newspaper, you realize that person really does have a right to be secure from people who might be trying to stalk them or follow them or interfere with them,” said concerned city official Robert Sykora at a public hearing on the issue. Added state legislator Tony Cornish, a former police chief: “Even though technology is great and it helps catch the bad guys, I don’t want the good guys being kept in a database.”

The Obama administration is attempting to get a better understanding of LPR use. In May, the Department of Justice created a task force to study guidelines for law enforcement, and in September, the U.S. Department of Transportation sent out a request for proposals to examine the pros, cons and legal challenges of these devices automatically capturing massive amounts of vehicle data.

The first major study, released by the Rand Corporation on July 2nd, focused on how police employ plate-reading systems. It found that “while there is general concern about privacy, there is great uncertainty about privacy expectations and the acceptable limits of LPR use. Consequently, departments noted that they had little information or guidance about how to incorporate privacy protections and were essentially improvising on their own.”

The report provides insights into the industry, which once operated in almost total secrecy. For years, Vigilant Solutions, one of the nation’s largest LPR manufacturers, forced its law-enforcement clients to sign non-disclosure agreements preventing them from speaking to the press about LPR cameras without Vigilant’s consent. But the company has changed that policy, according to spokesman Brian Shockley, who says that Vigilant now encourages its law enforcement clients to talk about its cameras.

Few Americans are aware just how pervasive LPRs have become.

Every day tens of thousands of high-speed optical recognition cameras silently snap digital photos of plates, capturing in milliseconds an image of each tag and sometimes the driver as well. They are difficult to see if you’re not looking for them, but the sleek devices can be found clamped to patrol cars and the vehicles of debt chasers as well as mounted along streets and highways and in parking garages and shopping centers. A single reader, once activated, works furiously without assistance, capturing thousands of plate scans per shift.

Official and private databases are packed with hits, including 3.7 million alone in western New York’s Monroe County and 7.9 million amassed in Vermont over 18 months in 2011 and 2012. The nationwide total is in the billions. And the information is not just collected and discarded. It gets put to immediate use.

“Few Americans are aware just how pervasive LPRs have become.”

After a police reader gathers a plate number, a computer marks it with a time, date and location stamp, then fires off the hit to federal and local “hot lists,” which contain tags from vehicles owned by people who are wanted or missing. Any match triggers an alert.

But there are bugs. The Rand study highlighted the mix-up that Ureche encountered, namely that LPRs do not distinguish between plates from different states. “The cameras also can false-read structures as license plates,” researchers noted, explaining that one department’s cameras “kept reading wrought-iron fences around homes as ‘111–1111’…plates.”

Despite such errors, LPRs play a leading role among new spying technologies, which include surveillance drones, biometric scanners and stingray trackers (which trick your phone into connecting with them by acting like wireless cell towers). Investigators say they are indispensable to police work. Cops have been barred by the courts from placing GPS trackers on vehicles without a subpoena, but LPR systems are filling that need. They help crack cold case killings, take down drug traffickers, locate kidnapped kids and nail scofflaw drivers. Federal statistics from 2011 show that law-enforcement agencies had used scanners to locate 818 wanted criminals, arrest an additional 2,611 suspects, find 19 missing people and recover 1,102 stolen vehicles since the technology’s inception.

Police in every state have claimed successes. Officers in Hollywood, Florida, told this reporter that they busted Matthew and Gina Stevens, husband-and-wife grifters, after the two allegedly defrauded an 89-year-old man out of nearly $300,000 in 2012 and vanished. Detective Daniel Justus ran Gina Stevens’ license plate through an LPR database and found the couple in Las Vegas.

In Cobb County, Georgia detectives searching for a missing elderly resident got a hit on his plate near a store where video surveillance showed two suspects getting out of the man’s car. The missing person, whom they declined to name, had been killed. One suspect was later convicted in the slaying and the other is on trial, police said.

More stories were told last month at a honoring of cops organized by 3M, a leading manufacturer of LPR equipment. A Georgia cop revealed that a plate hit helped him rescue a kidnapped mother and daughter and arrest two suspects who had abducted them. An officer in Michigan found a vehicle involved in the 2013 murder of state trooper Paul Butterfield, which led to the apprehension and conviction of his killer, Eric John Knysz.

It’s not surprising that so many police departments have invested in LPR technology. The cameras, which cost about $500 a piece, are paired with systems that can be expensive to buy and maintain. But for departments like the one in Nassau County, Long Island, an LPR network is well worth the money.

Detectives there were stumped by a series of burglaries in northern New Hyde Park in 2010, when 22 homes were hit in three months, NCPD Detective Sergeant Patrick Ryder told this reporter.

“We put more and more bodies in that area and we just couldn’t pick the [burglars] off. So we decided to surround the neighborhood with license plate readers. In 30 days, we scanned 20,000 plates.” All the burglaries were taking place in the early evening on Friday and Saturday nights, Ryder said. “People were saying, ‘We just went out to dinner.’”

So he limited the search to those times and eliminated drivers who lived in the neighborhood, bringing the plate pool down to 2,000. Soon cops were down to four plates – “a kid who was visiting his friend, a plumber [working in the neighborhood] and two Queens cabs.”

They placed both cabs on a hot list. Two days later, one of the vehicles was pulled over in nearby Floral Park. Four male Hispanics were inside, along with proceeds from the burglaries, cash and a receipt for jewelry they’d stolen from one home.

“The investigator from the tech side never left his desk,” said Ryder.

Often there’s a direct financial benefit as well.

One month after installing LPR cameras authorities in Boulder, Colorado caught more than 100 scofflaws who collectively owed the city approximately $20,000 in fines. A system run by police in New Haven, Connecticut needed just 12 hours to identify 119 vehicles with parking violations, resulting in $40,000 in summons revenue for the city.

But most police departments bought and built their LPR systems without first researching — let alone addressing — potential legal and privacy implications of the new technology, including the specter of cops misusing the data. This issue was addressed in the Rand study. “Since the technology spread so quickly and so many agencies lack policies and laws governing its use…an atmosphere has been created where abuse is possible,” it said.

The impact of minimal regulation is being felt in Minnesota, where the plight of officer Anne Marie Rasmusson sparked a statewide uproar over unauthorized access to official motor vehicle records and set off alarms about the safety of LPR information.

Rasmusson, a striking blond once nicknamed “Bubbles” because of her ebullient personality, got started in law enforcement soon after graduating from high school in 1993, becoming the youngest cop in Eden Prarie, a city of 60,000 just outside Minneapolis.

But, as she told the City Pages newspaper, Rasmusson struggled with obesity, so she joined an office-pool challenge to see which officer could lose the most weight. She began dieting and exercising and in three months had shed 15 pounds. During the next year another 70 pounds came off. By the time she joined the St. Paul Police Department in 2001, Rasmusson was running six miles a day and had the toned body of a trainer.

Her career came to an end in 2007 due to a spinal injury she suffered on the job while aiding a heart attack victim. She retired, got divorced and moved to Lakeville, Minn, where she worked out regularly at a gym popular with police officers. In 2009 she began competing in body sculpting contests.

That’s when she suddenly found herself the object of unwanted male attention, mostly from cops.

Some knew details about her personal life, including her failed marriage and names of past boyfriends. One former colleague revealed that he and his partner had looked her up on their patrol-car computer.

Feeling hounded, Rasmusson moved away and in 2011 requested a state audit to find out what had occurred. She was driving when an official called with the results of the inquiry: Her private data had been accessed repeatedly by cops all across the state, going back to 2007.

“Can you tell me how many agencies there were?” Rasmusson asked. The finally tally was 18. She pulled over, opened the car door and got sick to her stomach.

Over years, in turned out, 104 cops had gained access to her data, conducting more than 400 unauthorized searches, including 30 from one female officer in St. Paul. Many simply wanted to look at her driver’s license photo, which shows Rasmusson’s beaming smile and platinum blond hair.

The breach prompted a state auditor’s probe, which discovered that dozens of Minnesotans were similarly compromised, many of them prominent women such as Hilary DeVary, a high-profile PI known for busting cheating spouses. DeVary learned that her driving records were illegally accessed 166 times since 2003 by officers in 11 different law-enforcement agencies, two state departments and a U.S. Postal Inspector’s office.

“They want to know where you live, and that is what scares me,” DeVary told the “America Tonight” show. “You know, I’ve got kids now. It’s frightening.”

The state audit concluded that half of all law-enforcement personnel in Minnesota had misused driving records. Often the breaches involved men targeting women.

John Hunt, an administrator for the state’s Department of Natural Resources, had illegally accessed files on more than 5,000 people, virtually all of them women, including cops, prosecutors and local celebrities. Hunt had tapped into the records of the female prosecutor assigned to his case and the wife of the judge. Both recused themselves.

The scandal is still playing out in Minnesota. Rasmusson filed several lawsuits, citing violations of the federal Driver’s Privacy Protection Act, a law passed in 1994 after actress Rebecca Schaeffer was killed by a stalker who got her home address from state motor vehicle records. Rasmusson was awarded more than $1 million, along with reforms to the system. Several others filed suits. Hunt pleaded guilty to official misconduct and was sentenced to probation.

But a number of complaints have been tossed out “on the theory that just having somebody look up your record isn’t enough of an injury,” said Bill McGeveran, an associate professor at the University of Minnesota Law School who specializes in data privacy. And no police officers have lost their jobs.

“For a lot, it’s been a letter-in-your file kind of thing,” he said. McGeveran believes the scandal in his state is unlikely to be an isolated instance. “I don’t think the Minnesota systems were uniquely vulnerable. As always with privacy violations, you don’t know if someone has looked you up until something like [the Rasmusson case] happens.”

While the revelations in Minnesota make clear that your plate information is hardly secure in law-enforcement hands, another worrying situation exists in the private sector, where an unlocked back door allows just about anyone to find out where you’ve been.

“They want to know where you live, and that is what scares me. You know, I’ve got kids now. It’s frightening.”

When you default on a car loan, stop making credit card payments or duck alimony or other civil judgments, you become the target of private debt collectors such as auto repossession agents – repo men. They spend their days looking for deadbeats. And their search commonly begins with your car because if they can find it, they can seize it. A typical day for them involves driving around areas near your home or office. While they look for your vehicle, their LPR scanners capture the plate numbers of everyone else’s.

The auto repossession industry is the single largest source of private LPR cameras and the owners of the biggest storehouse of data. Their devices, clicking away on the hoods of agents’ cars and tow trucks as they troll the nation’s streets, have captured billions of vehicle tags. Repo men rely on equipment made by security firms such as Vigilant and Digital Recognition Network — and a vast database that’s openly shared among police and private investigators.

Vigilant, for example, offers its law-enforcement customers access to its National Vehicle Location Service (NVLS) private database, which contains 2.2 billion scans. Conversely, if a PI wants plate information from a police department, a written request is often all it takes. That arrangement is what unlocks the data to the public. For a private citizen to tap in, he simply hires a licensed investigator to make the request. The cost? About $100.

This means that anyone with enough cash can track your car’s movements without you knowing about it – or being able to stop it.

The technology is becoming more sophisticated, making data access much easier.

In June, data broker TLO offered free trials of its new “vehicle sighting” feature to customers, which include banks, insurance firms, private investigators and major news organizations. Vigilant recently began bundling LPR with facial recognition technology into a hand-held device called a Mobile Companion, and the response from cops who’ve tried it has been “overwhelmingly positive,” said Shockley, the company spokesman. “They’ve been asking for these things for years and years,” he said. “They say it’s just a game changer for law enforcement, that it just really makes their jobs easier.”

That worries critics who protest the use of LPR data on privacy grounds. “One of the strongest arguments for the constitutionality of LPR is that it is similar to manual license plate checks, but this argument becomes more and more difficult to sustain as additional technologies and capabilities are used synergistically,” said George Mason University associate professor Linda Merola.

Absent federal legislation or any semblance of national guidelines, many law enforcement agencies keep LPR data for years, or indefinitely, with often lax or limited guidelines. Some states and municipalities have stepped in, passing measures aimed at protecting the public from unwarranted access to private information.

New Hampshire has one of the strictest laws in the country — it prohibited all license plate readers (except for E-Z Pass) back in 2007. Other states have imposed limits on how long police can keep the data, but the time periods vary widely, even in neighboring jurisdictions. In Raleigh, North Carolina, for example, cops are allowed to retain LPR scans for six months while in High Point, just 50 miles west, it’s a year. New Jersey cops can keep plate hits for five years. Those across the Hudson River in Yonkers, New York, are allowed to hold on to them indefinitely.

And while legal and privacy matters are being hashed out, the effectiveness of LPRs as a crime-fighting tool is being called into question.

In September, Vermont Public Radio broadcast a story about statewide plate reading. The report said that for 18 months ending on Jan. 1, 2013, the 7.9 million scans collected by local, state and federal agencies directly helped solve just three crimes. And a 2013 study by the American Civil Liberties Union, “You Are Being Tracked,” claims that law enforcement LPR cameras locate suspect vehicles at hit rates as low as 0.01 percent.

*“We need to look and see how many times do [police conduct a] search, for what reasons, how many matches are they actually getting?” said David Roberts, a police technology expert. “When police get a match, are they able to make an arrest, close a case, locate someone? The last issue is most crucial: how old is that data? There hasn’t been any detailed [study] on that. We don’t want to retain data beyond when it’s going to be useful.” .

In some cases, though, plate data benefits defendants.

“If you’re charged with a heinous crime, you can prove that you were spotted a hundred miles away,” Massachusetts private eye Jay Groob. “LPR data – tied in with a credit card purchase near the vehicle sighting – proves beyond the shadow of a doubt where [a client] was.”

Among the victims of LPR error, Ureche’s case stands out. He knows he could have been killed.

“The time that I was really worried was in between exiting the vehicle and getting on the street. I’ve got four, maybe six guns pointed at me and a helicopter hovering above,” he recalled.

After he was cuffed, Ureche overheard the officers. They were convinced there was a passenger hiding in his vehicle. One cop approached and asked, “Is your name Raul Sandoval?”

“Do I look like I’m Raul Sandoval?” Ureche replied. “Whoever you think I am, I can pretty much guarantee you are wrong.”

Twenty minutes later, he was released with an apology, though no one bothered to explain that they’d apparently mistaken him for Raul Sandoval Jr, one of three men allegedly involved in a 2011 robbery of a Monterey, California Taco Bell, in which an employee’s throat was slit. (Sandoval was arrested a month later at the Arizona border.)

“They admitted they had the wrong car, vaguely mentioning that there was a violent felony criminal warrant associated with the plate, but not much more,” he said. “As soon as they figured out their mistake, they were all in real hurry to get out of there.”

Ureche stopped them.

“So…we’re cool now?” he asked a supervisor. “I’m OK to drive this car?”

“Well, actually,” he said, “if a [patrol] car with a plate reader gets behind you, the same thing is going to happen again.”

Despite being “S.W.A.T.-ed,” Ureche said he does not plan to sue the LAPD.

“I was glad I didn’t get shot,” he said. “I’m all for better policing and using technology, but we have to have some sort of checks and balances.”