OAKLAND, Calif.—Weeks after Ars published a feature on the scope of license plate reader use, the Oakland Police Department unilaterally and quietly decided to impose a data retention limit of six months.

Prior to April 2015, there had been no formal limit, which meant that the police were keeping data going as far back as December 2010.

That puts the OPD in line with other jurisdictions, including the Drug Enforcement Administration, which decided in 2012 that it would reduce its license plate reader (LPR, or ALPR) retention period from two years to six months. The Silicon Valley city of Menlo Park only retains for 30 days, by comparison.

According to Sgt. Dave Burke, who is in charge of the city’s LPR system, this change was not in response to Ars’ article, but rather was made primarily because the LPR computer—a Windows XP computer with an 80GB hard drive—was full and apparently "kept crashing."

"We had no money in the budget to buy an additional server," he told Ars.

"Trying to do this outside of a budget cycle [is difficult]," he said. "The budget cycle doesn't start until July, which means it won’t happen until August, so you have to wait. Meanwhile our system is crashing—we went a few weeks when our system wasn't capturing anything."

While an internal 1TB hard drive costs just $50, the OPD and other public agencies have to go through a much more rigorous public procurement process.

"We don't just buy stuff from Amazon as you suggested," Burke added. "You have to go to a source, i.e., HP or any reputable source where the city has a contract. And there's a purchase order that has to be submitted, and there has to be money in the budget. Whatever we put on the system, has to be certified. You don't just put anything. I think in the beginning of the program, a desktop was appropriate, but now you start increasing the volume of the camera and vehicles, you have to change, otherwise you're going to drown in the amount of data that's being stored."

The police department also determined what many privacy advocates have been arguing for years.

"Looking back at a year doesn't help you solve a case," he added. "There is no plan to store the data beyond six months. The investigators are not looking for data beyond six months. It does us no good to have these datasets if we do not mine them for intelligence."

As Ars reported previously, specialized LPR cameras mounted in fixed locations or on police cars typically scan passing license plates using optical character recognition technology, checking each plate against a "hot list" of stolen or wanted vehicles. The devices can read up to 60 plates per second and typically record the date, time, and GPS location of any plates—hot or not. (There have been incidents where LPR misreads have led to dangerous confrontations.) Some cities have even mounted such cameras at their city borders, monitoring who comes in and out.

LPR collection began in Oakland back in 2006, and an early OPD analysis showed that the overwhelming majority of the data collected was not a “hit.” In April 2008, the department reported to the city council that after using just four LPR units for 16 months, it had read 793,273 plates and had 2,012 hits—a “hit rate” of 0.2 percent. In other words, nearly all of the data collected by an LPR system concerns people not currently under suspicion of a crime.

Despite that information, then-OPD Deputy Chief Dave Kozicki (who has since retired) dubbed the LPR setup an “overwhelming success.” Today, OPD's LPR hit rate has fallen slightly, to just 0.16 percent.

In late 2014, the OPD expanded its LPR-enabled fleet from 13 vehicles to 33, rapidly increasing the amount of LPR data collected: currently, 48,000 records are collected every day.

Burke said that the move did not need city approval but was approved at the highest levels, including Chief Sean Whent. And how was this length of time decided upon? Because it was "agreed" to in the 2008 report. However that report does not impose a mandatory deletion date, rather it merely states that the OPD's LPR data is typically kept for "six months to one year."

This data I hold

Matt Topic, a Chicago-based lawyer who has worked on a number of public records cases in Illinois, told Ars that such changes "should be made as part of an open and democratic process" rather than being made behind closed doors.

"Proper policies, especially on issues as important as the retention of official government records, should not be compromised because of minor administrative burdens like this," he added by e-mail. "The explanation doesn't make sense, and I would hope a government body would have the flexibility to buy a $50 hard drive when it needs one. Unfortunately this is a lot like the way government bodies all around the country handle other transparency issues. They go to great lengths to try to keep information secret so as to avoid criticism. Here we're talking quite literally about the ability to control history. There are important privacy issues to consider, but there should be a public debate about this."

Meanwhile, Brian Owsley, a former federal judge and current law professor at the University of North Texas, e-mailed Ars: "I am troubled, but not shocked by another governmental attempt to prevent the public from having a transparent view of how government is functioning."

Local privacy advocates also lauded the new retention limit, but noted that the Oakland Police Department did it for the wrong reasons.

"The price of a hard drive shouldn’t be driving what information they are retaining," Chris Conley, an attorney with the American Civil Liberties Union of Northern California, told Ars. "It’s not asking the right question: ‘how much can we hold?’ It’s: ‘what should we hold?’"

Jennifer Lynch, an attorney with the Electronic Frontier Foundation, agreed.

"Any time a law enforcement agency decides to reduce the amount of time it retains records on private citizens, that’s a good thing," she said by e-mail.

"When agencies aggregate this kind of location-based data over long periods of time (and share it with every other law enforcement agency in the Bay Area), they are accumulating sensitive information, not just about where people go but also, potentially, about their religious and political beliefs, medical issues, who they’re associating with, where they live and work, and when they deviate from their common path through life," she added.

Visualize this

In 2014 and 2015, through a public records request, we obtained the entire LPR dataset of the Oakland Police Department (OPD), including more than 4.6 million reads of over 1.1 million unique plates between December 23, 2010 and May 31, 2014. The dataset is likely one of the largest ever publicly released in the United States—perhaps in the world.

However, since our March 2015 article, other citizens have made public records requests, which even months later, remained unfulfilled. Ars did not publish the data we received. We brought up this issue with Mayor Libby Schaaf during our May 2015 interview with her—her special assistant, Michael Hunt, said the city would be releasing the whole dataset in short order.

But that seems not to have taken place, as Hunt came to Ars last week, asking us to hand over the millions of records to fulfill still pending records requests. When the city government recently tried to re-obtain the records from the police department, the agency informed the mayor’s office and the city attorney that it had a new retention policy of six months and thus had no records to provide. Hunt provided some July 2015 e-mails between the OPD, the city attorney, and records officials indicating that this retention policy had been significantly shortened—which the mayor's office was unaware of.

On Monday, Ars informed Hunt that we would decline to provide the data to the city.

However, on Tuesday, after consulting with another local journalist, John Osborn, Ars found out that the city had already publicly released this data in July 2015. As such, Hunt's request became moot.

The new dataset released by Oakland appears to match the dataset sent to Ars, but we need to run further analysis to be completely certain.

Such data is incredibly revelatory: anyone in possession can often—but not always—make educated guesses about a target’s home or workplace, particularly when someone’s movements are consistent (as with a regular commute). In fact, in under a minute, we were able to correctly guess the block that a city council member lives on with nothing else besides his plate number, the LPR dataset, and our custom-built data visualization tool.

With this data publicly released, anyone could make a more sophisticated tool that searched plates near public officials’ homes, or that showed associative relationships, or how often certain plates turned up near sex toy shops, marijuana dispensaries, or other locations that, while legal, might be embarrassing.