EL CAJONEL CAJON—The day the El Cajon Police Department turned on dozens of cameras that scan the license plates of passing vehicles, the new system started getting hits.
One alert led law enforcement agencies to a vehicle that had been stolen in a Lemon Grove carjacking the week before. Two suspects were arrested.
Later that night, the system zeroed in on a vehicle that had been stolen in Winterhaven, Calif., in Imperial County. An El Cajon police officer located the vehicle — and a suspect — in a gas station parking lot.
The cameras, affixed to light and traffic poles, were turned on at the end of July. In less than a month, they led to the recovery of about a dozen stolen cars and multiple arrests, police officials said.
But the new surveillance tool also shares local data with out-of-state agencies — a too-common practice among many law enforcement departments across the state and one that some lawyers, privacy advocates and legislators say is illegal.
The issue exposes the ongoing challenge of bringing meaningful oversight to the technologies police say help them solve crimes. In May, civil rights organizations sent letters to more than 70 police departments, warning them that sharing the data with other states violates a 2015 state law.
El Cajon’s system wasn’t up and running when the letters were sent out.
“El Cajon is using this system to combat vehicle related crime, and to keep our communities safer,” police Lt. Jeremiah Larson said. “We are sharing the information for those purposes as well.… We always have the ability to turn it off immediately if we discover, or suspect, another agency to be using the information in a way that would violate (California) law.”
Privacy advocates have long sounded the alarm when surveillance tools are improperly used or abused. Critics of license plate readers are quick to argue that most of the data collected — information that can reveal where people shop, worship or protest — isn’t used for crime fighting. In fewer than 30 days, El Cajon’s system scanned more than 12 million license plates, police officials said.
Less than one percent of those scans — about 3,000 — activated a crime alert. And advocates caution that even when rules govern how the tools should be used, law enforcement agencies don’t always follow them.
“License plate data is very revealing about how we live our lives,” said Adam Schwartz, senior staff attorney with the Electronic Frontier Foundation, a digital rights organization. “Did we go to work late? Did we go to a church or a bar? Did we go to a protest? Did we go to a clinic and get medical care that we’d rather keep private?
“What we want California police to do is to be the data sanctuary that California law requires them to be.”
How automated license plate readers work
License plate readers use cameras to scan the plates of passing vehicles, noting when and where they were seen, and then uses that data to create searchable databases.
The technology regularly runs the information it collects against a variety of other law enforcement databases — everything from missing person lists to stolen car rosters — creating real-time alerts if a wanted vehicle is detected. The city can also build its own watch lists as crimes and other incidents occur.
El Cajon City Council members approved use of the technology in March. The three-year pilot program, which includes 40 cameras, will cost $300,000. The service is provided by Flock, one of the nation’s largest license plate reader providers.
The department did not disclose where the cameras are located, but Larson said they were placed at most high-traffic intersections. Currently, only 37 are operational.
According to the department’s website, data collected is kept for 30 days before anything that’s not related to an active investigation is purged. Police officials must be trained to use the system before they access it for “official law enforcement business,” according to the department’s policy. Only investigators and supervisors can create their own watch lists.
The system can’t be used for immigration enforcement, traffic enforcement, harassment or intimidation, the department’s policy says. As required by law, the agency plans to keep a log of all who access the system and perform regular audits.
The East County city joins other local municipalities that have installed license plate readers in their communities including Chula Vista, Carlsbad, Oceanside and soon San Diego.
Since the department’s system went live, police officials have sent out a half a dozen news releases highlighting how the cameras have assisted officers. As recently as Wednesday, an alert led police to a man suspected of stealing a U-Haul pickup.
“The El Cajon Police Department will continue to use every tool available to us to hold criminals accountable who victimize our community,” police Chief Mike Moulton stated in a Thursday release. “If you drive a stolen vehicle in the City of El Cajon we will locate you, arrest you, and put you in jail.”
Although the data is owned by the department, the agency can grant access to other departments that work with Flock. That network includes thousands of agencies across the country. El Cajon is currently sharing data with dozens of agencies, including the Houston Police Department in Texas.
At least one other San Diego County agency — the Escondido Police Department — was found to be sharing data with out-of-state agencies when civil rights organizations took their statewide inventory in May.
It’s a practice that lawyers, privacy advocates and the co-author of the 2015 bill in question say is illegal.
What does the law say?
In 2015, the state passed Senate Bill 34, the Automated License Plate Recognition Act, and —among other things — it makes it illegal to share collected data across state lines.
“SB 34 places a number of limits on (license) plate data, which California’s legislature can impose on California governments but cannot impose in the other 49 states,” said Schwartz, of the Electronic Frontier Foundation. “And, therefore, in order to make sure that this plate data stays subject to the privacy rules created by the California Legislature, they chose wisely to keep that data in California.”
El Cajon police officials did not detail why they disagreed with this interpretation. Instead they reiterated the department does not permit data sharing for the purpose of federal immigration enforcement or for prosecuting or investigating a person seeking reproductive health care in California.
Former Assemblymen Mike Gatto, who co-authored the law, said the Police Department has it wrong. The bill prohibits sharing data unless it’s with a “public agency,” a classification reserved for agencies inside the state, he said.
“People should understand that when the California legislature uses any similar term or terminology, we are always referring to that term within the state,” he said in an email last week. “If we say ‘any recreation and parks department may apply for water-bond funding to clean a stream bed,’ we of course mean ‘any parks department in California.’
“It would be absurd for a parks department in South Carolina to apply for such funding.”
He added that even if the wording is unclear, the spirit of the law is not. The bill was passed to regulate the collection, storage and use of license plate reader data collected by state agencies.
“The Legislature would not authorize the release of such data to agencies that are out of reach of the state, its agencies and our laws and values,” Gatto said.
At least one court case appears to set that precedent, as well.
In 2021, three Marin County residents, represented by the American Civil Liberties Union of Northern California, sued the Marin County Sheriff’s Department and others alleging, in part, that the department’s practice of sharing license plate reader data with other states violated SB 34. The department was also sharing the data with federal immigration authorities, which violates another law, SB 54.
As part of a settlement reached in May 2022, the Sheriff’s Department committed to stop those practices, although the agency did not admit any wrongdoing.
Schwartz says the Police Department is violating a second law when it shares license plate reader data across state lines. After the U.S. Supreme Court overturned Roe v. Wade, which eliminated the constitutional right to an abortion, California passed more than a dozen laws protecting reproductive rights. One such law, AB 1242, forbids police departments from sharing information for the purposes of enforcing anti-choice laws.
Schwartz and others have argued that law enforcement agencies in anti-abortion jurisdictions could use California-based license plate data to monitor abortion clinics and the vehicles seen around them to track the movements of those seeking abortions.
El Cajon shares data with the Houston Police Department. Abortions are illegal in Texas unless a patient faces death or substantial impairment to major bodily functions.
What about privacy?
Although police leaders stress that technologies like license plate readers are collecting anonymous data — meaning it does not contain personally identifiable information — privacy advocates argue that what’s actually being gathered is location data.
And that’s personal stuff.
“Your location data can provide clues about who you’re dating, what your medical conditions are, how you worship and if you’re engaged in civil protest or city politics,” said Dave Maass, director of investigations for the Electronic Frontier Foundation, earlier this year. “It’s personal information that can reveal intimate details about your life — information that’s really nobody’s business but your own.”
And the system can make mistakes, which can prompt officers to stop and arrest innocent people. In 2020, police in Aurora, Colo., pulled over a Black mother and her children at gunpoint, thinking her SUV was stolen. Police mistook her license plate number for one belonging to a stolen motorcycle from a different state.
El Cajon officials said their network has already sent out incorrect alerts, but none have resulted in erroneous stops because notifications are vetted by dispatchers or officers.
“In the event that it does happen — I hope it doesn’t — I would expect our officers to be professional and send somebody after the stop with a solid explanation, and hopefully try to get some understanding,” Larson said. “But we are doing everything we can to make sure that it doesn’t, because we don’t want people to be stopped who don’t need to be stopped.”
Lawmakers and advocates have worked to enact policies and laws to limit how agencies can use license plate readers. But there have been occasions when departments have used the systems illegally.
In 2018, the Union-Tribune uncovered that the Chula Vista Police Department was sharing data with federal authorities, a practice that is prohibited by state law.
It’s these kinds of violations that underscore the importance of rigorous oversight, said Seth Hall, the co-founder of San Diego Privacy, a community group that seeks to boost the public’s understanding of privacy issues.
“We need to be thinking about ways that we can interrogate these systems, audit these systems, or make it more visible when they succeed and fail,” Hall said. “If (these tools) are so important, so critical, then we need to find ways to operate them more transparently, more sustainably, more acceptably to society and residents.”
