Found: Secret location of Minneapolis police license plate readers Data analysis shows that Minneapolis police took 2.1 million records in 90 days.

http://arstechnica.com/tech-policy/2012/12/found-secret-location-of-minneapolis-police-license-plate-readers/              

Found: Secret location of Minneapolis police license plate readers

Data analysis shows that Minneapolis police took 2.1 million records in 90 days.

by Cyrus Farivar - Dec 18 2012, 2:34pm EST

Mark Pitts' data analysis shows that "of the 2.1 million [license plate] reads, almost 1.3 million came from the two stationary cameras."

Taber Andrew Bain

A Minneapolis-based data scientist has taken the discussion of the potential misuse of license plate reader data to an entirely new level—he claims that he has determined the location of the city’s two stationary license plate readers simply by studying a 90-day data set.
“Within three minutes of sending the e-mail to my contact at the Minneapolis Police Department Records Information Unit, my phone was ringing,” Mark Pitts, who runs a local firm called Datalytics LLC, wrote Sunday on his company’s blog. “And as long as the locations of the cameras remain confidential, I plan to keep them that way.”
He detailed the technique to Ars, and as far as we can tell, it seems quite plausible. The Minneapolis Police Department (MPD) declined to confirm or deny that the department had been in contact with Pitts, and it would not say whether the locations he found are accurate.
“We don't discuss security matters,” Sgt. William Palmer, the department’s public information officer, told Ars.
As we reported earlier this year, license plate readers are rapidly growingly around the country. High-speed optical character recognition can compare observed plates against a "hot list" of wanted vehicles at 60 plates per second, and these tools are creating millions of records nationwide every single day. Each record includes what plate was spotted, where and when. In some cases, such records are stored indefinitely.
In Minnesota, a rather liberal open records state law known as the Data Practices Act makes all government data public by default, which includes any license plate data. That means (for now) that anyone, from anywhere, can request the entire data set from any law enforcement agency.
Just last week, Minneapolis mayor R.T. Rybak, requested to a state committee that the data be immediately re-classified as “non-public.” So far, Sgt. Palmer of the MPD did tell Ars that they have fulfilled nine requests for a 90-day LPR data set, sent by postal mail on a 4GB flash drive. In this case, the data covers August 30, 2012 through November 29, 2012.

2.1 million records in 90 days

Pitts requested and received the entire 90-day data set in late November. On Sunday, he posted animated videos of behavioral patterns that could be gleaned from the data and found some astonishing information about what an armada of just 10 LPRs can do over a 90-day period.
“In three months with just eight mobile readers and two stationary readers, the MPD collected over 2.1 million license plate reads,” he noted. “Before releasing the data, the MPD deleted the GPS coordinates of data collected by the stationary hidden cameras to protect their locations. Of the 2.1 million reads, almost 1.3 million came from the two stationary cameras.”
The Minneapolis data scientist also suggests that it would be difficult to track any one individual plate over time.
“Of the 2.1 million reads, there are just over 621,000 unique plate numbers in this data,” he wrote.
“The majority of those, 360,000, were read only once. In fact, 530,000 were read four times or less in the three-month period. If we exclude the reads by the stationary cameras, which are not located any place you should worry about being seen or stalked, and we exclude police and other government plates, there are only about 8,000 unique plate numbers that have been tagged ten times or more in the three-month period. To track someone, you would typically need more hits to establish a pattern (unless you really got lucky). Only 75 plates have been hit 40 times or more by a mobile reader. While you could certainly use these data and a little luck to track and find a vehicle, I would estimate the risk to any single individual is very low.”

Are your movements private?

Privacy experts have been impressed by the scope of Pitts’ analysis.
“This study is a good demonstration not only of how much information is collected, but also how much additional information can be extracted through data analysis,” Woodrow Hartzog, a law professor at the Cumberland School of Law at Samford University, told Ars.
He and other privacy experts have consistently expressed concern over the use and potential misuse of such LPR data.
“How is this data being used internally?” Hartzog added. “Does the MPD plan to aggregate, store, and potentially release this data indefinitely? Is there any way for individuals to correct false positives? This study shows the utility of data transparency, which is one of the established fair information practices and allows individuals to verify and challenge data collection by the government.”
Kade Crockford, the director of the Technology for Liberty program at the American Civil Liberties Union (ACLU) of Massachusetts, who has been following LPR deployments in her home state and nationwide for some time now, said that Pitts downplays the individual privacy implications.
“It's true that law enforcement will likely find all sorts of heretofore undiscovered uses for databases chock full of our travel history information, and this kind of long-term location tracking raises significant privacy and Fourth Amendment issues,” she told Ars.
“Ultimately, the only way to prevent abuse against ordinary people or the police is to stop storing non-hit license plate data in the first place. Police should use it immediately (to find stolen cars, for example) or chuck it, and if they do that all of these problems go away—those that threaten the secrecy of police movements and the privacy of ordinary motorists alike.”