Heidi Swart is a journalist who reports on surveillance and data privacy. This report was commissioned by the Media Policy and Democracy Project, an initiative of the University of Johannesburg’s Department of Journalism, Film and TV and Unisa’s Department of Communication Science.

For a monthly fee, private security companies can access Vumacam’s footage. Vumacam’s camera network is connected to the internet, allowing it to send footage to security companies’ monitoring rooms. If something untoward comes up, security guards can respond.

By June this year, Vumacam said its network had 2,262 automatic licence plate recognition (ALPR) cameras continually scanning the licence plates of passing cars, looking for people connected to crime. All drivers’ licence plates are thus scanned and civil society has raised privacy concerns. But Vumacam has been clear that it’s “not in the business of tracking movements”.

Yet ALPR cameras are built for tracking. It’s one of the few things that the surveillance industry (SEE here AND here), law enforcement (here ) lawmakers AND here AND here ) and civil society (here AND here AND here ) seem to agree on. Usually, ALPR systems track cars entering and exiting parking lots, and government law enforcement uses them to track criminal suspects.

Potential criminal

ALPR policing works like this: You rob a bank. Someone writes down your plate number as you speed off and gives it to the police. Before ALPR, cops on the beat would be on the lookout for your number plate. ALPR automates this process: the cameras are on the lookout. As you escape, police type your registration number into a database for wanted vehicles. The ALPR cameras are connected (via the internet) to this database, which in turn connects to the police’s control room.

ALPR cameras scan your licence plate each time you drive by one, and the system instantly compares your registration number to thousands of numbers in the wanted vehicle database, looking for a match. If you’re innocent, it won’t find one. But, since you’re not, it will.

Almost immediately (aka in real-time), the system sends an alert to a police control room and cops can give chase as they know roughly where you are, based on the ALPR camera’s position. For the system to work, it must scan every single car’s plate, treating everyone as a potential criminal.

Vumacam’s system works similarly. You cannot drive past a Vumacam ALPR camera without having your licence plate scanned and your registration checked against databases of wanted vehicles. Vumcam’s system connects to a number of databases. One of these is the South African Police Service’s (SAPS) database of vehicles that were stolen or used in a crime. The other databases belong to Vumacam’s clients — private security companies, who receive alerts as soon as ALPR cameras within their patrol areas spot wanted vehicles (Vumacam refused to specify how many of these databases there were, citing security reasons and non-disclosure agreements).

The ‘map’

But ALPR cameras can do more than send alerts, thanks to yet another database. When a plate is scanned, the system generates metadata — data about that registration number scan. Police ALPR systems typically capture the exact date and time of the scan, the camera’s GPS coordinates and a photograph of the car. Police decide if they only retain data about wanted cars, or if they keep everyone’s data (for months or even years). Police can analyse this data with software to ascertain the movements of vehicles over time. This can aid investigations (by, for instance, giving police a clue about a suspect’s favourite hangouts). Cops can enter anyone’s plate number into such a system — criminal or not.

An example of data captured by a police ALPR system. (Source: International Association of Chiefs of Police, 2012)

This mass retention of location data faces opposition overseas.

The main concern for advocacy groups is summed up by attorney for the Electronic Freedom Foundation, Jennifer Lynch: “Location data like this, that’s collected on innocent drivers, reveals sensitive information about where they have been and when, whether that’s their home, their doctor’s office, or their house of worship.”

Like police ALPR systems, Vumacam’s also collects mass data. ALPRs scan number plates and the system runs them through “vehicle-of-interest” (ie wanted vehicle) databases. The system performs this function 6,728 times a minute — around 9.68 million times a day. Each scan includes the date, time and camera location — all stored for 30 days. Analytical software helps Vumacam’s clients interpret the data.

Vumacam’s marketing material demonstrates that its system can retrospectively reveal a car’s movements. This is possible even if the registration number isn’t in the databases of the SAPS or any other security company. Anyone’s licence plate number (wanted or not) can be fed into the system. Based on the ALPR camera locations, the analytical software can show a car’s movement over at least 30 days.

Marketing material from Vumacam shows a map with a vehicle’s movements for a 30-day period. (Source: Vumacam)

When confronted with the above maps and assertions that they were tracking people and cars, Vumacam responded as follows:

“This is a false statement and wholly untrue. Vumacam systems do not track people and do not have the ability to do so. They have the capability to plot the locations of the cameras that identified a number plate. They do not and cannot track a person. They also cannot identify a person via a number plate or tie any vehicle or individual to any personal data. Data is totally anonymised and is not of a personal nature. Vumacam systems cannot be used to track a vehicle — this is impossible. Vumacam does not provide any mapping. The ‘map’ you refer to is a security company screenshot of where a VOI (vehicle-of-interest) passed Vumacams. While security companies may be able to identify where a VOI went past cameras, our system will flag any unauthorised use of the system.”

The argument that its system doesn’t perform tracking is in sharp contrast with a website message that states: “Licence Plate Recognition is built-in and runs automatically in the background, tracking every vehicle that passes an LPR camera both in your contracted area of interest and around the city…”

This snapshot from Vumacam’s website shows the information collected by its ALPR cameras. (Source: Vumacam)

The view that a licence plate number isn’t personal data is another complete turnaround for the company: Vumacam’s website actually used to say that registration numbers are personal information, although it appears they have since removed that section.

Vumacam’s website stated that licence plate numbers were personal information. (Source: Vumacam)

We asked the Information Regulator, the body that enforces the Protection of Personal Information Act (POPIA) (Protection of Personal Information Act 4 of 2013), to see if a vehicle registration number was personal information. (It’s not explicitly mentioned as such in the Act.) We await a reply.

Overseas, however, the debate around ALPR and personal information is an old one.

The Chiefs of Police

Back in 2009, the International Association of Chiefs of Police published a report about the impact of ALPR networks on privacy. They assessed if a licence plate number was personally identifiable information (ie “data that can be used to identify or locate a single person”) and decided it wasn’t.

First off, they reasoned, a plate number identifies a vehicle, not a person. They argued that the number can only be linked to a person “through a distinct, separate step (eg, an inquiry to a Secretary of State or Department of Motor Vehicles data system). Absent this extra step, the licence plate number and the time and location data attached to it are not personally identifying. Thus, even though ALPR systems automate the collection of licence plate numbers, it is the investigative process that identifies individuals.”

Second, the chiefs noted that there was a “strong argument that a person has a diminished expectation of privacy in public spaces”, and that every state in the US required motorists to have their licence plates on display at all times when in public. (The concept of a “reasonable expectation of privacy” originated in US case law. In short, an individual can only expect as much privacy as society deems reasonable, and no reasonable member of society would walk around in public and expect privacy.)

Similarly, Vumacam has argued in the High Court, Johannesburg that one cannot reasonably expect privacy when you leave your private premises, since any person can see you out on the street:

The company also told us that “…no personal data is being revealed and vehicle registration numbers exist for the purpose of making vehicles identifiable (and particularly to law enforcement) on public roads. This would also be no different to police creating any other ‘look out’ alert for a VOI (vehicle-of-interest) via any other channel.”

But by 2012 legal scrutiny of another technology had affected the Police Chiefs’ views on ALPR and privacy.

GPS vs ALPR

Back in 2005, US police placed a GPS tracker on a jeep driven by suspected drug smuggler Antoine Jones, tracking him for 28 days with an expired warrant. Thus, Jones took them to court to get GPS evidence scrapped. The judge ruled that the GPS data collected while the Jeep stood in Jones’s private garage was inadmissible without a valid warrant. However, he said Jones couldn’t have a reasonable expectation of privacy when he was driving in public, thus allowing that portion of the GPS evidence.

Jones then went to the US Supreme Court — and won. In 2011, all nine justices agreed the police acted unconstitutionally, ruling out all of the GPS evidence. Part of the reasoning was that advances in various tracking technologies enabled widespread and surreptitious government surveillance, and this would have an impact on society’s view on what constituted a reasonable expectation of privacy. Said Justice Sonia Sotomayor in her concurring opinion: “I would ask whether people reasonably expect that their movements will be recorded and aggregated in a manner that enables the government to ascertain, more or less at will, their political and religious beliefs, sexual habits, and so on.”

Thus, the Chiefs of Police’s 2012 ALPR policy states that even though Jones dealt with GPS tracking, the concurring opinions of five judges referenced several technologies enabling police to “track and record the movement of persons and vehicles” without installing something like a GPS tracker.

The policy acknowledged that ALPR systems quickly collected “a significant volume of data. Such expansive deployment and sharing of ALPR data retained for extended periods of time may well enable agencies to systematically track the movement of vehicles throughout a jurisdiction and beyond. Although there may be no reasonable expectation of privacy in any particular sighting of a vehicle traveling on a public roadway, the systematic capture, storage, and retrieval of ALPR data may nevertheless raise important privacy concerns.”

Vumacam disagrees with the Police Chiefs and the Supreme Court on this one. When presented with the assertion that their ALPR system was like a GPS tracking device they said: “This is an entirely false statement. Vumacam technology cannot track vehicles and does not function anything like a GPS device. Vumacam triggers an alert when a VOI (vehicle-of-interest) passes a camera location. The Global Positioning System is not a tracking system. By the same token, the ALPR cameras are not a tracking system but a mechanism to collect data regarding publicly visible licence plates to identify vehicles of interest with the purpose of combating crime.”

(As an aside, the Global Positioning System is a group of satellites owned by the US. China, Russia and Europe also have such systems. You can read more about how GPS is used for tracking by visiting the website of the US Department of Energy’s Office of Science. The Oxford Learner’s Dictionary also offers some insights on GPS tracking.)

eNatis

Vumacam has another reason for saying it cannot identify people through their vehicle registration numbers. Police ALPR systems are often linked to government databases with identifying details of vehicle owners.

In South Africa, this database is called eNatis (the electronic National Transportation Information System) and belongs to the government’s Department of Transport. Linking an ALPR network to a database such as eNatis lets police quickly look up a vehicle owner. Vumacam argues its ALPR network isn’t linked to eNatis and it cannot identify the vehicle owner. Thus the driver is anonymous and the registration number is not personal.

But, even if an ALPR system isn’t linked to a database like eNatis, the vehicle owner can still be identified through other methods of investigation, such as talking to witnesses or stakeouts.

In Britain, this was enough to convince authorities that a registration number is personal, even before an investigation occurs.

The British Information Commissioner views any information from which someone can be “indirectly” identified as personal. This includes licence plate numbers, since one could identify the owner through additional information that you either have on hand, or can obtain through some other means. These means aren’t limited to database queries. In the UK, the Data Protection Act implements the UK General Data Protection Regulation (UK GDPR), and determines what is and isn’t personal information.

The UK GDPR is very similar to Europe’s GDPR, which contains some of the strongest privacy regulations in the world. (SA’s POPIA was modelled on the EU GDPR.)

The British have been consistent in their views on licence plate numbers. As far back as 2015, the UK’s Information Commissioner’s Office ruled that all data — including licence plate numbers — from which an individual can be identified is personal under the Data Protection Act. Licence plate numbers were considered personal from the moment they were collected, “regardless of whether the organisation actually goes on to identify the owner of a vehicle or not.” (sic)

Vumacam has a different interpretation, stating it is only providing “anonymised data” to its clients and the police: “Vumacam DOES NOT use or analyse this non-personal and anonymised data — we provide the data to our clients and the police for use in fighting crime. Vumacam does not tie this data to any personal information. While the police or security companies may use our anonymised data alongside other investigative strategies or techniques, this is in line with any investigative activities that bring criminals to book. Our cameras are effectively reliable witnesses and can only record a number plate as much as an individual might write it down or take a picture of it with a cellphone camera.”

Which brings us back to the Chiefs of Police’s 2012 report, where they found that there was a difference between “any particular sighting of a vehicle traveling on a public roadway” and the large-scale retention of that data.

‘Neither a case number nor court order’

Even if Vumacam cannot access eNatis, the SAPS can. And the SAPS benefits from Vumacam’s ALPR data via Vumacam’s clients. In September 2020, the security company AI Surveillance reported on how police “requested assistance in tracking a number of vehicles believed to be involved in crimes in the area”. After police gave the company the registration numbers of the vehicles, AISurveillance put them into its vehicle-of-interest database. Because this database was linked to Vumacam’s ALPR camera network, AI Surveillance was able to spot the vehicles and alert the SAPS. (Daily Maverick approached AISurveillance for comment, but the company referred us to Vumacam.)

Vumacam’s surveillance policy states: “Any data requested by the South African Police Services will only be released upon presentation of the appropriate subpoena.” Yet Vumacam informed us that no subpoena was needed from police submitting a licence plate number to private security company databases. Vumacam stated: “Neither a case number nor court order is required to search for a vehicle of interest as licence plates exist to identify vehicles in the public domain. Further, SAPS does not need a court order to enter a VOI (vehicle-of-interest) in Unicode.” (Unicode refers to the SAPS’s own database of wanted vehicles, which you’ll recall is also connected to Vumacam’s ALPR system.)

But it’s not quite as easy for police officers to add registration numbers to the SAPS database of wanted vehicles. Known as the “Crime Administration System Circulation System (Vehicles)”, the police database is a national database, containing registration numbers of stolen vehicles and vehicles related to the commissioning of a crime. But getting a registration number into that database takes work. SAPS documentation states: “…a case or enquiry docket must be registered on the Crime Administration System, implicating such vehicles”.

Adding registration numbers to private security companies’ databases lets the SAPS obtain location data on cars without a court order. Location data (i.e. data about where you are or were) is considered personal information in terms of POPIA.

Usually, if police want your location data (from, for instance, your cellphone), they need the court’s permission. That’s thanks to the Regulation of Interception of Communications and Provision of Communication-Related Information Act.

For example, the SAPS may be searching for an unidentified suspect. An informant provides them with a cellphone number and nickname, but that’s all. They find out that the sim card is registered under a false identity. Fortunately, police can get information from the cellphone company about the suspect’s movements. That’s because, even when one isn’t talking on the phone, it still frequently emits signals “searching” for the cellphone tower with the strongest signal. The mobile provider keeps track of which towers a phone connected to and when, thus providing an approximation of the suspect’s movements.

Even if the locations are approximate, the SAPS needs a court order in terms of section 205 of the Criminal Procedures Act to get them. Police officers have to convince a judge that they have absolutely no option but cellphone tracking for an investigation to succeed, and must present a case docket with some evidence. If satisfied, the judge subpoenas the mobile operator to testify or provide the data.

The operator cannot simply release data to police without a court order, since it has a legal contract with its customers — even if they are wanted suspects — to keep their information private. The only way the company can break that contract, legally, is if a court forces it to do so. The court will only do that if it is convinced the criminal investigation takes precedence over the suspect’s privacy and that the invasion of such privacy is a last resort. Unfortunately, police can and have misused this process by adding numbers that have nothing to do with their case to their subpoena applications.

We asked Vumacam how they ensured registration numbers added to private security databases were really involved in a crime, and how Vumacam prevented misuse.

Their response: “Vumacam cannot control how or what happens on private security databases. Our vetted clients are however all PSIRA registered and once using Vumacam systems, must provide validated reasons and/or case numbers for conducting searches. They are subject to our usage policy and must use two-factor authentication. In other words, if a private security company was conducting a search without a valid reason or a case number, this would be flagged and the individual conducting this search would be identified. We do not manage these databases and cannot guarantee that they are absolutely correct. We do, however, believe that companies that manage these databases hold themselves to high standards of ethics and data credibility. Nonetheless, Vumacam requires all security companies to adhere to our protocols (mentioned earlier) to conduct a search if a vehicle is in a VOI database.”

We asked Vumacam why, given the accuracy with which ALPR systems record driver movements, it does not require the police to have a court order to receive ALPR data.

Vumacam said: “The claim that LPR cameras are much more accurate than tracking via cellphone towers is entirely incorrect. The cellular networks’ ability to triangulate the location of a device in real-time is incomparable to a vehicle being flagged when it passes static cameras in various locations.”

Here, Vumacam is entirely incorrect. The caller location data applied for in terms of section 205 of the CPA includes cell tower locations only. No triangulation takes place. It’s not that fancy. (See, for example, the State vs Hasane and Others and the State vs Miller and Others.

Vumacam might not agree, but the similarity between ALPR location data and cellphone location data isn’t lost on everyone. In a February 2020 report on ALPR’s impact on privacy, the California State Auditor noted a 2018 US Supreme Court ruling about cellphone data.

The court reiterated an earlier majority finding that “individuals have a reasonable expectation of privacy in the whole of their physical movements”, adding that giving “government access to cell-site records contravenes that expectation”. The court further recognised that “historical cell-site records … give the government near perfect surveillance and allow it to travel back in time to retrace a person’s whereabouts…”

Referring to this case, the California State Auditor concluded that “even though case law on electronic data that enable tracking of individuals’ movements over an extended period of time is still evolving, the court has recognised that privacy implications exist for such data, which can include ALPR images”.

‘Not limited’

While in other countries ALPR laws are still evolving, these ALPR systems are primarily operated by government police agencies who are accountable to the public. Increasingly, these systems are being scrutinised and limited. But Vumacam has in the past made it clear that it doesn’t fall into this bracket:

“Vumacam… is not a state actor. It is accordingly not limited by the same principles that limit the exercise of power by state organs. There is no requirement that the activities of a private party be empowered by law. On the contrary, private actors are generally able to act freely, unless the law imposes a constraint on them.”

In answering our questions, Vumacam stated repeatedly that it does not track people or cars. But these are the facts:

1. Its ALPR cameras scan the plates of all cars that come within range.
2. It retains all registration numbers and metadata thus obtained for 30 days.
3. Your vehicle’s movement can be plotted with this data, even if you are innocent.
4. Your name can be linked to your vehicle registration number by police or security companies.

Vumacam may not consider this “tracking”, but that’s what it’s called in the real world. Feel free to choose your own reality. DM

You can read Vumacam’s full response here.