Mar 302020
 

The Vallejo Police Department cited ferry terrorism as part of its $30,000 grant application for license plate readers, calling the ferry “a viable threat for a terrorist act.”

According to the grant application, the “Grant Funds will be utilized to establish an ALPR [Automated License Plate Reader] camera system for eastbound and westbound traffic lanes approaching the Ferry Terminal, Ferry Terminal Parking Structure and waterfront.”

Two 3M ALPRs on Glen Cove Road in VallejoThe Vallejo Police Department already has a network of license plate readers in locations around the city. Two of Vallejo’s ALPRs can be found on a pole on the west side of Glen Cove Road, at the Vallejo city line just south of Interstate 780. Two ALPRs are located in front of 4325 Sonoma Boulevard and two ALPRs are located on southbound Fairgrounds Drive at Gateway Drive. The six stationary ALPRs were installed in 2015, along with ALPRs on five police vehicles.

According to information provided to the California State Auditor, 102 of the police department’s 150 employees have access to license plate reader data. The Vallejo Police Department’s ALPRs send the collected images and data to the Northern California Regional Intelligence Center (NCRIC), which retains them for one year and makes it available to dozens of other agencies. In the six months from July 2019 to December 2019, Vallejo sent more than 5 million images collected from its ALPRs to NCRIC.

Vallejo Detective Lieutenant Fabian Rodriguez was listed as the applicant for the grant for the project, which was expected to begin on November 1, 2020 and completed by May 1, 2021.

The regional benefit was described as:

ALPR Cameras to Strengthen Information Sharing and Collaboration of data from Vallejo Ferry Terminal. The Ferry Terminal provides daily commuter transportation from Solano County to San Francisco, with commuters from Napa utilizing the ferry for daily transportation to the Bay Area.

The terrorism nexus was described as:

With thousands of commuters utilizing the Vallejo Ferry system each day to travel to San Francisco, the Ferry is a viable threat for a terrorist act. Installing an ALPR camera system in the area of the Ferry Terminal will assist with identifying potentially wanted terrorist suspect vehicles.

On March 12, 2020, the Bay Area UASI Approval Authority approved a $30,000 grant to the Vallejo Police Department for its “Vallejo PD ALPR” project. When we requested a copy of the grant application, the Vallejo Police Department responded that it has “no responsive documents.” The grant application was disclosed pursuant to a public records request to the Bay Area UASI.

Documents:

Mar 212020
 

On the consent agenda for the March 24, 2020, Vallejo City Council meeting is $766,018 to purchase a KeyW cell site simulator.Vallejo Police Department logo

If approved, Vallejo Police would become the fourth local Bay Area law enforcement agency with this device, after the San Francisco Police Department, San Jose Police Department, and the Alameda County District Attorney (which shares its device with the Oakland Police Department and Fremont Police Department). These other agencies own cell site simulators manufactured by Harris Corporation.

The agenda item includes implementation of a usage and privacy policy, but no policy was provided as part of the background material because the policy will be created at the direction of the Chief of Police, and not by the City Council. California’s Electronic Communications Privacy Act, which went into effect on January 1, 2016, requires that a search warrant be obtained before using a cell site simulator.

Policies in the City of Oakland and Alameda County require annual reporting on the usage of their shared cell site simulator. In 2017, the cell site simulator was used three times, in 2018, it was used four times, and it was used once in 2019. Without public input and city council oversight, Vallejo’s policy is unlikely to require any annual reporting.

A cell site simulator pretends to be a cell phone tower, to which cell phones connect in order to initiate a phone call. Once a cell phone connects to the cell site simulator, the cell phone’s IMSI number can be obtained and used to track the location of the cell phone.

According to the staff report, the cell site simulator will be used by the Crime Reduction Team, which is “tasked with the tracking and apprehension of serious violent offenders, covert surveillance during criminal investigations, human trafficking, and other plain clothes investigative operations…” The desire to obtain a cell site simulator appears to be motivated by an unnamed agency assisting Vallejo by using its own cell site simulator. “In November of 2019, an outside agency used a cellular site simulator for the Vallejo Police Department on several occasions.”

The staff report fails to note that cell site simulators can disrupt “the target cellular device (e.g., cell phone) and other cellular devices in the area might experience a temporary disruption of service from the service provider,” according to guidance from the US Department of Justice. In other words, it could interfere with normal operation of other cellular phones and devices near the cell site simulator, including emergency calls.

The staff report claims that “The equipment does not retain data and is not capable of intercepting and listening to calls, text messages, dialed numbers or any other such content.” However, other cell site simulators are able to eavesdrop on calls and messages and are limited only by the installed software, not the hardware’s capabilities.

The $766,018 price includes the following:

  • $415,000 for the base station
  • $1,400 for two Shark Fin antennas
  • $40,000 for five-day on-site training
  • $60,000 for additional two-year warranty
  • $120,000 for standard vehicle integration (a 2020 Chevrolet Suburban)
  • $32,000 for a Trachea 2 device, a stand alone direction finding system
  • $15,000 for two Jugular 4 devices, a handheld direction finding system
  • $17,760 for two Jugular 4 field kits

The vehicle containing the cell-site simulator (a 2020 Suburban) will drive around to track a cell phone to a building or similar area. Then the handheld Jugular 4 or Trachea 2 devices can be used to track a cell phone to a specific apartment of room. Although little is known about these devices, an earlier version of the Jugular was detailed in a document obtained the Intercept. The Jugular 2 was capable of tracking GSM, CDMA, and UMTS cellular signals. The Jugular 4 and Trachea 2 are likely capable of tracking 4G cellular signals.

The Vallejo City Council meeting takes place on March 24, 2020, at 7pm via teleconference. Since there is no physical access for the public to the meeting, members of the public who wish to comment on the item are required to register to use Open Town Hall at http://www.opentownhall.com/8413.

Documents:

UPDATE: On March 24, 2020, the Vallejo City Council unanimously approved the cell site simulator purchase without discussing potential privacy issues or interruption of cell phone service. Oakland Privacy and the EFF have urged that the cell site simulator purchase be nullified because the Vallejo City Council failed to comply with California state law that requires approval of a privacy and usage policy by the local governing body.

Jun 112019
 

According to information released in response to a public records request, the Northern California Regional Intelligence Center collected more than 79.2 million license plate reader records from 32 local law enforcement agencies from June 2018 to May 2019.

Piedmont, a city with about 11,000 people, sent the most data to NCRIC, with more than 22.4 million license plate reader records, which include license plate numbers and photographs of vehicles and their surroundings. Piedmont has more than 30 stationary license plate readers that capture nearly all traffic coming into and out of Piedmont.

In calendar year 2018, Piedmont collected 21.6 million records from its license plate readers and reported 8,120 hits, when a record from a license plate reader matched a list of license plates that includes stolen vehicles, stolen license plates, wanted persons, etc. Using that information, 99.96% of the data collected by Piedmont’s license plate readers is from people who are not suspected of are charged with any crime. That closely matches a similar analysis in 2014 that showed 99.97% of the data collected from Piedmont’s license plate readers did not generate a hit.

Fremont, a city with about 230,000 people, sent 17.7 million records to NCRIC and Vallejo, a city of 120,000 people, sent 15.8 million records to NCRIC.

Other agencies sending more than a million records to the NCRIC each year include the Central Marin Police Authority (Larkspur, San Anselmo and Corte Madera), Daly City, San Francisco, Modesto, Alameda County Sheriff, San Leandro, and South San Francisco.

Other law enforcement agencies use license plate readers from Vigilant Solutions, a private company that collects data from law enforcement agencies and private companies. Data from 2017 indicates that Bay Area agencies in Danville sent 33.4 million license plate records to Vigilant, Pittsburg sent 31.4 million records, Brentwood sent 12.9 million records, and Alameda and Novato each sent 1.6 million records.

Sources: