A LiDAR sensor from technology company Ouster, shown in an intersection in Colorado, uses a laser to create anonymous 3-D models of the people and vehicles at street level. (Photo courtesy of Ouster)
After nearly a week of searching for a suspect in the hit-and-run death of an 81-year-old St. Helena, California woman this summer, police found and arrested a man with the help of license plate reading cameras that registered him near the scene.
The police department used information from FLOCK’s automatic license plate reading camera system, which monitors and records license plate data in a cloud-based database. The company makes cameras, drones, audio detection and software tools used by cities, law enforcement and school systems with the goal of crime detection and faster solve times.
Using a license plate number to find a suspect isn’t new to crime solving, but finding that license plate in an autonomously-captured and organized data log, rather than by humans looking through security footage or searching in-person, is more novel.
It’s part of a growing system of “Internet of Things” (IoT) technologies — networks of physical objects that are connected to the internet and can exchange data with other devices or software. These IoT devices are often called “smart cities” devices, because they’re used by states and cities that are aiming to improve services, including making their roads safer and more efficient for drivers and pedestrians.
People on the roads are likely used to red light and security cameras at intersections, but advancements in cloud technology and artificial intelligence allow transit agencies and cities to collect far more data than ever before, and to use that data in more strategic ways.
But with increased monitoring, data collection and analysis comes ethical and privacy concerns.
There’s never been a problem with checking a license plate to see if a car is stolen or otherwise wanted, said Jay Stanley, a senior policy analyst with the American Civil Liberties Union’s Speech, Privacy, and Technology Project said. But when that license plate data is retained for an unknown amount of time and for an undetermined purpose, it could infringe on privacy and civil liberties.
“As this technology becomes increasingly denser in our communities, and at a certain point you have like three of them on every block, it becomes the equivalent to tracking everybody by using GPS,” Stanley said. “That raises not only policy issues, but also constitutional issues.”
The residents of St. Helena, in Napa Valley, likely aren’t upset that the technology was used for its intended purpose to help find the perpetrator of a crime, Hari Balakrishnan, a computer science and AI researcher and professor at Massachusetts Institute of Technology, said of the August arrest.
“I might posit that we should move from what is the data being collected to what is being done with the data?” he said. “By whom and for what purpose?”
What are smart cities technologies?
In recent years, cities have begun to use hardware, like cameras and sensors, that record and sort information into databases with the help of AI. They usually do so with a specific objective in mind, like tracking the safety of a pedestrian crosswalk, monitoring speeding in an area or to help traffic flow better through intersections during rush hour.
The hardware devices can signal to the city’s software to take action, like turn the light green, or record data in a stored area for people to analyze later on. Many of these interconnected systems are called intelligent transportation systems (ITS), said Nathan Kautz, a senior transportation safety engineer based in Tampa, Florida. Some can even detect traffic accidents and trigger an EMS response, and then help that EMS vehicle get to the scene of an accident faster by greenlighting it through traffic signals.
Florida’s Strategic Highway Safety Plan from 2021 identifies monitoring speed as a proven way to reduce traffic fatalities, and outlines that it will use ITS infrastructure as a countermeasure. The technical systems allow for monitoring without the use of police officers stationed throughout the roadways.
“It allows you to get coverage of that corridor and try to keep speeds at an appropriate level when nobody’s watching, to improve the safety and the survivability at outcomes for say, like for a pedestrian or bicyclist,” Kautz said.
Balakrishnan has been working in IoT and mobile computing for the last two decades, and founded Cambridge Mobile Telematics about 15 years ago. The Cambridge, Massachusetts-based company gathers data from IoT devices like smartphones, connected vehicles, dash cameras and third-party devices to detect driving behavior.
The company works with insurance and auto companies, as well as rideshare companies, to promote safe driving by using data obtained by driving behavior to assess risk, safety, claims, and driver improvement programs. Balakrishnan said the company estimates it helped prevent about 80,000 crashes and about 40,000 serious injuries.
Another form of technology some cities are using is LiDAR, which uses lasers to bounce light off of objects to measure distance. It’s the foundational technology of Ouster, which makes hardware and software, and works with cities on traffic concerns as well as with clients in the security, industrial and automotive industries. The traffic sensors are currently posted at about 250 intersections in California, Florida, Tennessee, Utah and Colorado.
The technology’s lasers bounce heat off objects, and reflect distance back to the sensor. It uses that data to create 3-D anonymous models of the people and vehicles at street level, the Bay Area company’s VP of Smart Infrastructure Itai Dadon said.
“You understand depth, you understand scale, you understand position in space. You don’t have to infer all that like we do with cameras,” he said. “And on top of that, you can do it without invading the privacy of either your employees or the community that you’re servicing.”
Ethical and data privacy concerns
There are primarily two ways that IoT technologies work — infrastructure or mobile devices. And the factor of whether a user has control over the device is where privacy considerations come into play, Balakrishnan said.
Cambridge Mobile Telematics’ device, which users voluntarily place in their car and communicate with other IoT devices to track their driving, is an example of a mobile device. It’s similar to a wearable fitness tracker that collects data as you workout or sleep, Balakrishnan said.
“You’re using it for yourself. And I don’t think anyone reasonably would apply the word ‘surveillance’ to that,” Balakrishnan said. “If you don’t want it, don’t use it.”
But IoT devices embedded into infrastructure, like cameras or sensors on stop light poles, inductive loops under pavement that detect vehicles at stoplights, or automatic license plate readers, are not something that people opt into.
“If somebody puts a bunch of cameras on the road and they say that this is for measuring your speeding and sending tickets, okay, there’s warnings, and that’s the law, or that’s the way the rules are,” Balakrishnan said. “But now, if somebody took that data and used it for purposes that was not explicitly intended, then one could say, ‘hey, there’s some surveillance happening.’”
The use of these connected cameras and traffic monitoring systems are being applied across the country on a case-by-case basis. Some states, like Maine, prohibit traffic cameras from enforcing traffic violations except on toll roads. Others, like Missouri, allow them by law, but the state supreme court ruled it is unconstitutional to issue traffic violations unless the state can prove the identity of the driver at the time of citation.
It often comes down to the county or municipality, since there is no federal legislation on data privacy in traffic enforcement.
“All cities and municipalities are very different and have slightly different problems, but they all want, at the end of the day … the benefits for the community,” Dadon said. “However, sometimes they lack the understanding of what the technology can actually do, and by wanting to do good, sometimes run a little bit fast.”
That was the case in San Diego, starting in 2016. The city installed 3,200 “smart streetlights” to deter crime and to log data from license plate readers, but citizens grew concerned with privacy, saying the city wouldn’t tell them how the data could be used, and it would be shared with third parties, CBS8 reported last year.
The police department eventually began using the cameras as a crime-fighting surveillance tool, which led community members to allege that the program was violating their privacy and targeting people of color. The city ended the program shortly after also due to budget concerns, but it began installing cameras again in 2024.
A perceived benefit of camera traffic surveillance is that fewer traffic stops or direct interactions with police officers could decrease the number of arrests made of people of color. But the technology hasn’t proven to eliminate racial factors. A ProPublica investigation in 2022 found that traffic surveillance programs in New York, Miami, Washington D.C. and Chicago still ticketed people of color and people from lower-income neighborhoods more than white drivers.
And the systems can’t work toward the benefit of the community if they’re not being used properly. A woman in Detroit is suing the police department after she was wrongfully arrested for a drive-by shooting in 2023 where police incorrectly used data from the city’s automatic license plate reader.
Instead of searching for a reported license plate number in the system, police searched for any plates that belong to white Dodge Chargers, and found one on a camera two miles from the crime scene. The woman they arrested had been recorded driving just blocks from her home, and had no connection to the crime other than the similar make and model of her car.
IoT and privacy legislation
Because there’s no federal direction on data privacy of smart cities systems, it will continue to be up to cities, or even municipalities, to make their own rules, said Daniel Weitzner, the founding director of the Internet Policy Research Initiative at MIT.
Cities often work with private technology companies to establish these intelligent transportation systems, and have a procurement bid process. It’s why Balakrishnan said cities or states looking to install these technologies have to clearly outline what data is being collected and who has access to it.
Balakrishnan and Dadon warn that cities looking to enter contracts with smart city systems companies have to ask the right questions about how and where their data is being stored. There have not been any major cases of data collected by these traffic cameras ending up in third-party systems, they say, but there’s always the possibility that it could if companies and their public sector counterparts are not following the same standards for data storage.
The way we assess surveillance and privacy in the digital age is “under stress,” Weitzner said. Evolving technologies have made lawmakers have to constantly assess what data privacy rights look like at any given time. Supreme Court decisions, like Carpenter v. United States, which refined what access to location data from cell phones is allowed without a search warrant, and Riley v. California, which ruled that the warrantless search and seizure of the digital contents of a cell phone during an arrest is unconstitutional, shows how this field has evolved.
“What all this translates into is that digital information can be subject to a lot more uses and can be a lot more revealing than the kind of equivalent … analog information, or information that’s available on paper,” Weitzner said.
So, it may not be concerning to collect license plate data for speeding or traffic violations, but using that data across the board for any other purpose, for an unlimited amount of time, is a lot more sensitive, he added. And until Congress passes a standardization law for the industry, states will have to determine what works best for them, and what actions may be over the line.
“The underlying conundrum that we have is just that you can string together a lot of innocent, innocuous pieces of data,” Weitzner said. “And get something very valuable and very revealing.”
GET THE MORNING HEADLINES.