Guest blog by Keith Mitchell, ACLU-IN Volunteer
Compared to even a decade ago, technology-enabled monitoring of the movements and everyday lives of Hoosiers has grown massively. Many will be aware of tracking by cell phone towers, social media apps, and website advertising. An entire industry has been built upon this by insurers, ad-tech providers, data brokers, private security, robo-callers, spammers, and scammers. Tracking technologies being added to this include drones, doorbell cameras, car telemetry, and even smart TVs.
Most urgently, the use of AI models and agents now enables consolidation of data from different sources to build a picture of anyone’s entire life. We have unwittingly become the subjects of a private Alternate State, fueled by the business imperatives of surveillance capitalism, which sidesteps Fourth Amendment protections against government intrusion into the affairs of law-abiding citizens and immigrants alike.
The currently newsworthy manifestation of this industry is automated license plate readers (ALPRs), visible as an expanding network deployed by companies like Flock, Axon, and others. This has grown to some 135,000 cameras nationwide, with over 3,000 in Indiana alone.
Traffic cameras are not a new technology, and have been around for several decades for such things as tolls, parking, and congestion charging. They can also be used for traffic safety enforcement via speeding and red light cameras. Indiana however is a slightly unusual jurisdiction, one of a dozen US states which prohibit their safety use (though with an exemption for construction sites added in 2024).
These cameras record the number plates of every vehicle that passes them together with such details as vehicle make, model, color, time, speed and direction of travel, any distinguishing marks, and even occupancy. They can be deployed statically on poles and gantries, but also on patrol cars as they drive around communities. Some federal agencies such as US Customs and Border Patrol (CBP) and the Drug Enforcement Administration (DEA) operate their own networks of cameras, usually close to the borders and often disguised within road signs and traffic cones.
What is new, and causing significant backlash in communities, is the business model of ALPR companies like Flock. They are in a coverage race to contract security solutions with local law enforcement, using “AI” models to integrate this data nationwide, selling the consolidated datasets to the private data broker industry and to over 6,000 government agencies.
While the marketing is about public safety, there are significant privacy issues and risks of abuse. Access to these systems does not require a warrant, probable cause, or even reasonable suspicion, and inadequate security can lead to misuse and data breaches. There have been a string of reports of wrongful arrests, stalking, and domestic violence committed by law enforcement officers with access to the system, including a recent case where an Indianapolis Police Officer has been suspended. They can also extend the extra-territorial reach of one jurisdiction into another.
The potential for misuse includes tracking associations of individuals engaged in First Amendment protected activities, chilling gatherings, organizing, and protests that administrations do not agree with. The limited benefits of these systems in their current unregulated state do not appear to outweigh the significant dangers.
Monroe County, Bloomington, and other communities in Indiana are leading the way in tackling the problems ALPRs create, part of a wider “techlash” against data centers and AI. Crowd-sourced apps such as DeFLock and HaveIBeenFlocked? allow individuals to report and verify the existence of cameras, together with work to spread awareness of their pervasiveness. Lobbying local governments to not contract these systems or to put strong safeguards over their use is something everyone can get involved in.
Ideally, ALPR mass surveillance - the indiscriminate, continuous collection and retention of location data on every driver, regardless of suspicion - should not exist. Given that it does, courts and state legislatures must ensure that such systems can only be used by law enforcement, who should not be able to resell the data commercially or share it out of state. Data gathered must only be held for a limited time – currently this could be as long as 5-10 years.
In response to the backlash, Flock have recently announced an advisory-only reduction of retention to 7 days, but unless part of an ongoing investigation, it should be mandated to be at most 48 hours. Operators should publish transparency reports on their use of their data, access protections must be externally audited, and individuals should be able to submit subject access and deletion requests for data held on them.
Ultimately, the US should follow the lead of other jurisdictions such as the EU and California, and enact much stronger federal data protection legislation across all technology operators and platforms. Until this is done the tech industry will continue to erode everyone’s privacy with many negative consequences. The Indiana legislature is joining the debate about regulating private ALPR cameras in the state, and it’s time to make your representatives aware of the need for regulation of this technology.