We had a very interesting discussion on Twitter this morning about the practice of automatically photographing license plates to use for parking, tickets, etc…
[NOTE: Twitter limits messages to 140 characters, forcing you to be as succinct as possible, and often abbreviating and misspelling words to make a message fit.]
Dr. Christophe Veltsos (“DrInfoSec” on Twitter) tweeted, “Calgary parking system snaps pics of all parked vehicles, legal or not? http://tinyurl.com/d2bewp”
to which I responded, “@drinfosec Would be interesting to see demographics of Ponemon survey participants; also shows more public awareness of privacy is needed!” and then “@drinfosec Was notice given to customers, and oppt’y to decline consent, prior to their parking? Didn’t see that covered in the story.”
to which DrInfosec answered, “@PrivacyProf Good point, but notice may be hard to do on a parking meter.”
and I responded, “@drinfosec Oh, it’s for meters? I thought it was for a parking lot/ramp; I see now it is not http://tr.im/i9qN Interesting info on ther site.”
And Yan Kravchenko (“Yanick2k“) joined our conversation, “@PrivacyProf @drinfosec Would you consider license plates private? Why is taking a picture of a license plate an issue? Just Wondering…”
To which I responded, “@Yanick2k Not “private”, but link to specific individuals; a subtle but important different & much disussed by privacy groups…” then
“@Yanick2k …I recently blogged about mischief using others’ license plate images http://tr.im/i9te A great topic for indepth discussion!”
Yan, “@PrivacyProf I think that using fake license plates is already illegal… I agree, a very interesting topic for in-depth discussion.”
Me, “@Yanick2k Indeed; but good example of how using photos of them to apply penalties for speeding/parking/etc may not be a good idea :)”
Yan, “@PrivacyProf Agreed; but not as a matter of violation of privacy but rather poor accuracy. :)”
DrInfoSec, “@PrivacyProf @Yanick2k Photo-based speed-traps are common in several EU countries. They usually take plate+driver pic though.”
Hopefully this gives you a good idea for the types of engaging discussions that can take place on Twitter!
I wanted to pursue this topic a bit more. What are some of the advantages/pluses/pros and disadvantages/minuses/cons of using surveillance video and photos to perform various types of legal and policies compliance activities?
Some advantages:
- People are “caught” breaking the law or policy and cannot deny the action occurred.
- Such surveillance has successfully caught criminals (e.g., http://www.ajc.com/metro/content/metro/northfulton/stories/2009/03/20/license_plate_scanner.html and http://www.post-gazette.com/pg/09092/959914-56.stm)
- Various studies show that accidents and crimes are decreased in areas where notices are posted that such surveillance is being done (see previous links).
- It is much more cost efficient to use automated surveillance than hiring the number of personnel to cover the same amount of areas.
- Surveillance and video is arguably more reliable in court to use as evidence than just the word of a person (e.g., police officer).
Some disadvantages:
- The person in the car may not be the owner of the car, who is typically the person charged with breaking the law or policy, and subsequently fined.
- Number plate “spray” products are increasingly being sold and used to “beat traffic camera citations,” leaving those who are “more innocent” to pay fines while those using these devices to purposefully deceive the system to “get away” without paying a penalty.
- Without restrictions, such surveillance may be inappropriately used to identify where people are at (e.g., political rallies, clinics, etc.) and then negative impacts could occur as a result to those people.
- Currently there are no boundaries for how the surveillance data collected is used, or for how long it is retained.
- Some/most of the surveillance tools being used are not 100% accurate.
- Some surveillance is hidden, and can actually zoom in to see areas that would not otherwise be viewable from the public perspective.
Think of others? Let me know!
The commonly asked question is, “is this an invasion of privacy?”
If you’re on a public road, parked in a public area, or otherwise in public, probably not. However, the uses for linking just the license plate number with a particular person and then taking some type of legal action or civil penalty, perhaps days, weeks, months or years later, as a direct result is risky, to say the least.
Tags: awareness and training, Information Security, IT compliance, IT training, policies and procedures, privacy awareness, privacy training, risk management, security awareness, security training, surveillance, twitter