Jan 152022
 

There are 32 agencies that submit license plate reader data to the Northern California Regional Intelligence Center (NCRIC), the regional fusion center for Northern California. However, many more agencies are able to access that data once it has been sent to the NCRIC.

According to records received in response to a public records request, 71 agencies queried the NCRIC license plate database between February 21 and March 21, 2021. While the agencies looking up license plates at the NCRIC are generally law enforcement agencies located in Northern California, a few of these agencies may stand out as somewhat unusual. The United States Department of Agriculture Office of Inspector General had the 11th highest number of queries to the license plate reader database. Other agencies included the National Park Service, the California Department of Motor Vehicles, and the US Postal Inspection Service.

Other agencies accessing NCRIC’s license plate reader database are to be expected, such as the police departments from the Bay Area’s three largest cities: San Francisco, San Jose, and Oakland. After the three biggest users of the NCRIC license plate reader database, the users vary from Fremont, with an estimated population of 240,000, to cities like Dixon and Atherton, with populations of less than 20,000.

Piedmont, with more than 39 automated license plate readers situated at the border with Oakland, has been one of the three largest submitters of license plate reader data to NCRIC, with 22 million images of vehicles of license plates and vehicles annually. However, during the period from February 21 to March 21, 2021, it didn’t use the NCRIC license plate reader database even once. Vallejo, which submits more than 15 million images of vehicles of license plates and vehicles to NCRIC annually, queried NCRIC’s database just four times in this one month period. Berkeley, which doesn’t submit any license plate reader data to NCRIC, queried the database 61 times during this one month period.

According to records for October 2021, Piedmont queried the NCRIC license plate reader database just once while Vallejo didn’t query the database at all.

A table showing the agencies and the number of queries to the NCRIC license plate reader database for 2/21/21 to 3/21/21 is shown below. Note that queries by a District Attorney’s office may be included for some of the agencies listed, like the San Mateo, Alameda and Solano County Sheriffs. In addition, Danville, which is listed below, is contracting out its policing to the Contra Costa County Sheriff.

AgencyCount
San Francisco PD650
Oakland PD277
San Jose PD230
Fremont PD88
San Mateo Co. Sheriff73
San Leandro PD66
FBI63
Berkeley PD61
California Highway Patrol69
East Bay Parks PD57
USDA OIG51
South San Francisco PD46
Hayward PD31
Newark PD30
Dixon PD30
Marina PD27
Alameda Co. Sheriff26
NCRIC26
Redwood City PD26
Palo Alto PD24
Milpitas PD19
National Park Service18
Chico PD26
CA DMV14
Sunnyvale DPS14
Belmont PD12
Napa PD12
Napa Co. Sheriff13
Monterey PD10
Santa Clara Co. Sheriff9
FBI IC9
Santa Rosa PD8
Daly City PD8
Menlo Park PD8
Hercules PD8
Atherton PD8
Colma PD7
Vacaville PD7
San Mateo PD8
Burlingame PD6
Novato PD6
Santa Clara District Attorney5
Antioch PD5
Morgan Hill PD5
Solano Co. Sheriff5
Union City PD4
Dept. of Homeland Security4
CA Dept. of Justice4
Santa Clara PD4
US Postal Inspection Service4
Conta Costa Co. Sheriff4
Benicia PD4
Vallejo PD4
Mountain View PD4
Stanislaus Co. Sheriff3
Hillsborough PD3
Pleasant Hill PD3
Livermore PD3
Santa Cruz Co. Sheriff3
Foster City PD2
Seaside PD2
Contra Costa Co. DA2
Rocklin PD2
US Dept. of Justice2
Pacifica PD2
Richmond PD1
Sacramento Co. Sheriff1
San Bruno PD1
Tracy PD1
Central Marin PD1
Danville PD1
Agencies using NCRIC License Plate Reader Database from February 21 to March 21, 2021
Mar 302020
 

The Vallejo Police Department cited ferry terrorism as part of its $30,000 grant application for license plate readers, calling the ferry “a viable threat for a terrorist act.”

According to the grant application, the “Grant Funds will be utilized to establish an ALPR [Automated License Plate Reader] camera system for eastbound and westbound traffic lanes approaching the Ferry Terminal, Ferry Terminal Parking Structure and waterfront.”

Two 3M ALPRs on Glen Cove Road in VallejoThe Vallejo Police Department already has a network of license plate readers in locations around the city. Two of Vallejo’s ALPRs can be found on a pole on the west side of Glen Cove Road, at the Vallejo city line just south of Interstate 780. Two ALPRs are located in front of 4325 Sonoma Boulevard and two ALPRs are located on southbound Fairgrounds Drive at Gateway Drive. The six stationary ALPRs were installed in 2015, along with ALPRs on five police vehicles.

According to information provided to the California State Auditor, 102 of the police department’s 150 employees have access to license plate reader data. The Vallejo Police Department’s ALPRs send the collected images and data to the Northern California Regional Intelligence Center (NCRIC), which retains them for one year and makes it available to dozens of other agencies. In the six months from July 2019 to December 2019, Vallejo sent more than 5 million images collected from its ALPRs to NCRIC.

Vallejo Detective Lieutenant Fabian Rodriguez was listed as the applicant for the grant for the project, which was expected to begin on November 1, 2020 and completed by May 1, 2021.

The regional benefit was described as:

ALPR Cameras to Strengthen Information Sharing and Collaboration of data from Vallejo Ferry Terminal. The Ferry Terminal provides daily commuter transportation from Solano County to San Francisco, with commuters from Napa utilizing the ferry for daily transportation to the Bay Area.

The terrorism nexus was described as:

With thousands of commuters utilizing the Vallejo Ferry system each day to travel to San Francisco, the Ferry is a viable threat for a terrorist act. Installing an ALPR camera system in the area of the Ferry Terminal will assist with identifying potentially wanted terrorist suspect vehicles.

On March 12, 2020, the Bay Area UASI Approval Authority approved a $30,000 grant to the Vallejo Police Department for its “Vallejo PD ALPR” project. When we requested a copy of the grant application, the Vallejo Police Department responded that it has “no responsive documents.” The grant application was disclosed pursuant to a public records request to the Bay Area UASI.

Documents:

Mar 212020
 

On the consent agenda for the March 24, 2020, Vallejo City Council meeting is $766,018 to purchase a KeyW cell site simulator.Vallejo Police Department logo

If approved, Vallejo Police would become the fourth local Bay Area law enforcement agency with this device, after the San Francisco Police Department, San Jose Police Department, and the Alameda County District Attorney (which shares its device with the Oakland Police Department and Fremont Police Department). These other agencies own cell site simulators manufactured by Harris Corporation.

The agenda item includes implementation of a usage and privacy policy, but no policy was provided as part of the background material because the policy will be created at the direction of the Chief of Police, and not by the City Council. California’s Electronic Communications Privacy Act, which went into effect on January 1, 2016, requires that a search warrant be obtained before using a cell site simulator.

Policies in the City of Oakland and Alameda County require annual reporting on the usage of their shared cell site simulator. In 2017, the cell site simulator was used three times, in 2018, it was used four times, and it was used once in 2019. Without public input and city council oversight, Vallejo’s policy is unlikely to require any annual reporting.

A cell site simulator pretends to be a cell phone tower, to which cell phones connect in order to initiate a phone call. Once a cell phone connects to the cell site simulator, the cell phone’s IMSI number can be obtained and used to track the location of the cell phone.

According to the staff report, the cell site simulator will be used by the Crime Reduction Team, which is “tasked with the tracking and apprehension of serious violent offenders, covert surveillance during criminal investigations, human trafficking, and other plain clothes investigative operations…” The desire to obtain a cell site simulator appears to be motivated by an unnamed agency assisting Vallejo by using its own cell site simulator. “In November of 2019, an outside agency used a cellular site simulator for the Vallejo Police Department on several occasions.”

The staff report fails to note that cell site simulators can disrupt “the target cellular device (e.g., cell phone) and other cellular devices in the area might experience a temporary disruption of service from the service provider,” according to guidance from the US Department of Justice. In other words, it could interfere with normal operation of other cellular phones and devices near the cell site simulator, including emergency calls.

The staff report claims that “The equipment does not retain data and is not capable of intercepting and listening to calls, text messages, dialed numbers or any other such content.” However, other cell site simulators are able to eavesdrop on calls and messages and are limited only by the installed software, not the hardware’s capabilities.

The $766,018 price includes the following:

  • $415,000 for the base station
  • $1,400 for two Shark Fin antennas
  • $40,000 for five-day on-site training
  • $60,000 for additional two-year warranty
  • $120,000 for standard vehicle integration (a 2020 Chevrolet Suburban)
  • $32,000 for a Trachea 2 device, a stand alone direction finding system
  • $15,000 for two Jugular 4 devices, a handheld direction finding system
  • $17,760 for two Jugular 4 field kits

The vehicle containing the cell-site simulator (a 2020 Suburban) will drive around to track a cell phone to a building or similar area. Then the handheld Jugular 4 or Trachea 2 devices can be used to track a cell phone to a specific apartment of room. Although little is known about these devices, an earlier version of the Jugular was detailed in a document obtained the Intercept. The Jugular 2 was capable of tracking GSM, CDMA, and UMTS cellular signals. The Jugular 4 and Trachea 2 are likely capable of tracking 4G cellular signals.

The Vallejo City Council meeting takes place on March 24, 2020, at 7pm via teleconference. Since there is no physical access for the public to the meeting, members of the public who wish to comment on the item are required to register to use Open Town Hall at http://www.opentownhall.com/8413.

Documents:

UPDATE: On March 24, 2020, the Vallejo City Council unanimously approved the cell site simulator purchase without discussing potential privacy issues or interruption of cell phone service. Oakland Privacy and the EFF have urged that the cell site simulator purchase be nullified because the Vallejo City Council failed to comply with California state law that requires approval of a privacy and usage policy by the local governing body.

Jun 112019
 

According to information released in response to a public records request, the Northern California Regional Intelligence Center collected more than 79.2 million license plate reader records from 32 local law enforcement agencies from June 2018 to May 2019.

Piedmont, a city with about 11,000 people, sent the most data to NCRIC, with more than 22.4 million license plate reader records, which include license plate numbers and photographs of vehicles and their surroundings. Piedmont has more than 30 stationary license plate readers that capture nearly all traffic coming into and out of Piedmont.

In calendar year 2018, Piedmont collected 21.6 million records from its license plate readers and reported 8,120 hits, when a record from a license plate reader matched a list of license plates that includes stolen vehicles, stolen license plates, wanted persons, etc. Using that information, 99.96% of the data collected by Piedmont’s license plate readers is from people who are not suspected of are charged with any crime. That closely matches a similar analysis in 2014 that showed 99.97% of the data collected from Piedmont’s license plate readers did not generate a hit.

Fremont, a city with about 230,000 people, sent 17.7 million records to NCRIC and Vallejo, a city of 120,000 people, sent 15.8 million records to NCRIC.

Other agencies sending more than a million records to the NCRIC each year include the Central Marin Police Authority (Larkspur, San Anselmo and Corte Madera), Daly City, San Francisco, Modesto, Alameda County Sheriff, San Leandro, and South San Francisco.

Other law enforcement agencies use license plate readers from Vigilant Solutions, a private company that collects data from law enforcement agencies and private companies. Data from 2017 indicates that Bay Area agencies in Danville sent 33.4 million license plate records to Vigilant, Pittsburg sent 31.4 million records, Brentwood sent 12.9 million records, and Alameda and Novato each sent 1.6 million records.

Sources: