http://www.democratandchronicle.com/story/news/2014/11/01/license-plate-data-big-business/18342039/

Privately owned license-plate imaging systems are popping up around Rochester and upstate New York — in parking lots, shopping malls and, soon, on at least a few parts of the New York state Thruway.

Most surprisingly, the digital cameras are mounted on cars and trucks driven by a small army of repo men, including some in Rochester and Syracuse.

Shadowing a practice of U.S. law enforcement that some find objectionable, records collected by the repo companies are added to an ever-growing database of license-plate records that is made available to government and commercial buyers.

At present that database has 2.3 billion permanent records, including hundreds of thousands gathered locally. On average, the whereabouts of every vehicle in the United States — yours, mine, your mother's — appears in that database nine times.

Todd Hodnett, founder of the company that aggregates and sells that data, defends the activity as lawful and harmless. "We're just photographing things that are publicly visible," he said.

Many private-sector camera operators, like parking companies, say they do not know the names and addresses behind the plates they scan. Others, like universities, say they discard the records almost immediately.

But that doesn't satisfy critics. No matter how benign the intentions of camera system operators, they say, their data may prove irresistible to government or private parties bent on snooping.

"We think people are entitled to wander around this grand country without being concerned about being tracked," said Lee Tien, a senior staff attorney with the Electronic Frontier Foundation in San Francisco. "What they're doing ... is making it possible for someone to come back and check."

As often is the case with emerging technologies, license-plate reader use is outpacing government attempts at regulation. Only five states have adopted laws regulating or banning private use of license-plate readers, also known as LPRs, with legislative bodies in as many more states having considered such measures.

New York is not one of them. The Empire State has no laws on the books or legislation in the works to regulate the use of LPRs, as the cameras are known. Anyone who can obtain a camera — and there are websites that offer basic models online for less than $2,000 — is legally free to create databases of license-plate records on New York public streets or parking lots.

License-plate systems already are commonplace among police agencies, including in New York. A dozen agencies in Monroe County possess at least one camera system.

As the Democrat and Chronicle reported in July, local police have accumulated more than 3.8 million records, to be stored for as long as five years. Statewide, the number of archived law-enforcement license plate records numbers in the tens of millions.

The systems alert police instantly if the camera images the plate of a stolen car or a vehicle on the "hot list" for another reason. But police say they store records so they can go back and trace the whereabouts of a suspect or look for witnesses who might have driven past the scene of a crime.

Destiny USA mall in Syracuse tested a more unusual technique this summer. The owners reportedly had a security vehicle equipped with a license-plate reader cruise the parking lot to research where shoppers lived.

Crowded mall parking lots have been favored venues for plate readers, which are deployed for market studies, security purposes or to guide shoppers who have forgotten where they left their car.

The owner of the Rochester area's largest malls, Wilmorite Inc., is aware of the trend but has so far opted out.

"We have been approached by those companies. From our perspective … there's still some privacy issues. People feel you're using information they want to keep private," said Janice Sherman, Wilmorite's marketing director. "At this point we're not going to jump in something like that. We want to see how it pans out."

License plate scanners mounted on the roof of MCC parking enforcement vehicles show an image when it detects an illegal plate in the parking lot.(Photo: Jamie Germano/@jgermano1/, STAFF PHOTOGRAPHER)

Accessing records

Advanced Recovery, one of the auto-repo companies that scoops up license-plate records of passing motorists, is on Seneca Avenue in northeast Rochester, co-located with a towing company and a private investigative firm. It also has an office in Syracuse.

The firm's website makes no bones about the company's use of license-plate readers, and states it has accumulated more than 500,000 LPR records.

But they won't talk about it publicly. "We're bound by contract not to speak about it," said a man who answered the company's Rochester telephone. He said the contract also forbade him from providing his name.

Hodnett, whose Digital Recognition Network counts Advanced Recovery among its 400-plus "camera affiliates," isn't similarly constrained.

In a recent interview, Hodnett said he launched the service in 2007 to help repo companies find cars they'd been hired to repossess. If the vehicle wasn't at the last known address provided by the lender, the repo company could examine archived plate records to see where it might be.

A year later, the idea arose of repurposing all the records being collected. "We thought we could turn around and offer this for law-enforcement purposes," he said. "Why not provide free access to law enforcement and maybe save some lives because of it?"

In partnership with Vigilant Solutions, a California hardware-maker that provided cameras for DRN's system and now is DRN's corporate parent, Hodnett launched theNational Vehicle Location Service. The service incorporates the private-sector data collected by DRN with other plate records gathered by police and stored on Vigilant computer servers. Law enforcement agencies have limited free access to the database. Full access is available for a fee.

According to information from the company, more than 20,000 law enforcement officers have used the system. Vigilant credits the service with helping solve numerous crimes.

New York state paid Vigilant about $25,000 for a one-year subscription that ended in September, said Janine Kava, spokeswoman for the Division of Criminal Justice Services. The subscription allowed the DCJS-supported crime analysis centers in Rochester, Buffalo, Syracuse, Albany and Binghamton to access the data collected by Hodnett's company.

But it is not just police that can tap his company's ever-growing collection of LPR records. The company sells data to corporate and commercial customers that are allowed access to motor-vehicle records under federal law.

Customers include insurance companies and at least one data broker. Hodnett said DRN has a deal with TransUnion's TLO service, which makes a range of data available online to parties that meet the federal access standard.

"We do not make it available to any individuals," Hodnett said. He also noted that DRN's database "does not contain any personally identifiable information whatsoever."

Those statements may be true. But any number of companies and agencies have the ability to match a plate number to a name, and anyone with the money and a plausible reason can hire a private investigator to surf through DRN's 2.3 billion records via a service like TLO.

Tien of EFF, a leading digital privacy group, said advocates have been trying without success to get a clear picture of who is getting access to DRN's data. But they know state and federal regulations leave room for a wide range of clients.

"As a general matter, the limit is what they're currently willing and able to do to monetize the data," he said.

Cars drive into a secure parking lot at the MCC Brighton campus. MCC uses license plate readers to operated the gate.(Photo: Jamie Germano/@jgermano1/ STAFF PHOTOGRAPHER)

Other uses

For at least a time this past summer, a security vehicle at Destiny USA mall in Syracuse made its rounds with a license-plate reader attached to its trunk.

Plate numbers gathered by the roving camera were given to a consultant that used motor-vehicle data to determine the ZIP code in which shoppers lived, according to astory in the Syracuse Post-Standard.

The market study at Destiny USA, owned by Pyramid Cos., was billed as a trial. Two mall spokeswomen did not return calls and emails seeking comment, and it is not known whether the practice continues.

The state Thruway Authority, meanwhile, will begin to make use of this same motor-vehicle data when the first portion of the new Hudson River bridge at Tappan Zee opens in 2016.

Motorists will be able to cross the toll bridge without slowing to make payments, passing under high-speed E-ZPass scanners and license-plate cameras. The cameras will capture the plates of motorists who do not have an E-ZPass, and they'll be billed by mail.

The Thruway will test the technology at two other locations in the lower Hudson Valley, and "use the information we gain from these pilot programs to guide our decisions regarding all-electronic tolling in other parts of the Thruway system," executive director Tom Madison said.

Other use of LPRs isn't dependent on DMV data. Instead, motorists provide personal data themselves.

At Monroe Community College, employees, students and frequent visitors register their plate numbers with the college. Employees gain access to gated lots when cameras match their plate with a number in the college database.

The system replaces the traditional parking stickers in side or rear windows.

Campus security patrols student and visitor lots with license plate cameras, making sure everyone's parked in the right place. If they're not, tickets follow. The number of tickets is down, spokeswoman Cynthia Cooper said, perhaps because students no longer misplace their window stickers.

The system was implemented in June 2013 and has won plaudits for both MCC and its vendor, Genetec, she said.

Plate scan records are discarded after 30 days, she said.

Rochester Institute of Technology implemented a similar system in August and has had no complaints, spokeswoman Ellen Rosen said. RIT keeps LPR records only seven days.

The University of Rochester will begin use of LPRs for parking control early next year, mostly on the River Campus, spokeswoman Sara Miller said.

Mapco Auto Parks, which operates parking at Rochester's airport, is installing a camera system that will provide a double-check on motorists' honesty.

At present, people who park in long-term or short-term lots take a time-stamped ticket that they present to an attendant when they leave. Mapco co-owner Richard Goldstein said a small number of customers finagle the system by substituting one ticket for another.

They might have been parked for days but present a ticket that they've been there only a short time. An hour in the long-term garage costs $3.50. A full week costs as much as $98.

"Some people are dishonest," Goldstein said with a verbal shrug.

Starting next summer, that no longer will work. Drivers will still take paper tickets, but a new system will scan plates when a car enters the lot and again when it queues up to leave, and calculate the interval.

If the LPR calculation doesn't match the ticket time, the attendant will be alerted to possible fraud.

Mapco also has been experimenting with an LPR system at the Civic Center Garage, though Goldstein said no decision has been made about permanent use. Neither system will tap into driver's personal data.

"It's not about gathering anybody's information," Goldstein said. "We're not snooping on people. Honestly, we don't care."

[email protected]

Twitter.com/SOrr1

What New York's DMV does

Some uses of license-plate readers are aided by cross-referencing records to data compiled by state motor vehicle offices in New York and other states. While federal law restricts public access to this data, government agencies and private companies are allowed to see it. Here's how it works in New York, according to the DMV:

• Every two years, the New York DMV sells access to its database of registered vehicles. That database includes the registrant's name and address plus the make, model and year of the vehicle. Under the current contract, Experian Information Solutions and R.L. Polk and Co. are expected to pay New York about $3 million over two years for this data.

• Those two companies are free to use and to re-sell the data, but it can only be employed for "statistical compilations" and research. They cannot contact an individual or make use of their personal information except in connection with a vehicle manufacturer's recall. Federal law contains a provision allowing registrants to "opt-in" to use of this data for marketing purposes, but New York DMV officials assume no one would want to be targeted for marketing in this way and thus the agency has no opt-in program.

• New York does not conduct bulks sales of its licensed driver database, which has information on motorists' license status, tickets and accidents.

• But the DMV does allow a variety of parties to query that database one record at a time. Federal law specifies who can access this data; the list includes government agencies, private investigators, toll collectors, insurance companies and businesses verifying information supplied by a driver. Government agencies, including police, can access the data for free. Others pay $7 per record. (Journalists, including those at theDemocrat and Chronicle, traditionally were allowed to access this database. But New York's DMV, citing a change in interpretation of the federal law, withdrew that privilege several years ago.)

Court case pending

A hearing is scheduled for Nov. 19 in the Democrat and Chronicle's lawsuit against Monroe County over access to certain license plate reader records.