8 ms·

9M logs of Brits' road journeys spill from number-plate camera dashboard

109 points by linebug 7y ago

alexchamberlain 7y ago
There seems to be an assumption that this would come under GDPR, but that's not obvious to me (excluding the potential images of people). Putting aside ethical concerns , would there be any legal ramifications for capturing the presence of a car at a certain location and sharing it? The licence plate identifies the car, not the driver. (Similar schemes are in place for boats and airplanes of course)
- kwhitefoot 7y ago
  The driver of a private motor vehicle is almost invariably the registered keeper. In most of the case where it is not then it is a family member. Are you implying that the slightest doubt about the identity of the driver means that it is perfectly alright to collect the data? because if so that surely also applies to many other GDPR situations, where families share a single computer for instance.
  - alexchamberlain 7y ago
    I'm actually saying I don't know; where is the line? Licence plates seem like an interesting test case, given many registered keepers are companies (either company cars, work vehicles or hire cars).
blablajevic 7y ago
such a cool post. Upvote
dsfyu404ed 7y ago
I hope somebody combs through the data and uses it to publish embarrassing trip sequences for public officials and their families because that's the only way politicians and local officials are gonna even consider not supporting these kinds of boondoogle dragnet projects.
- dx034 7y ago
  Or just a public database where you can enter license plate and get all trips. I don't think many people would be happy with this. That's illegal though so nothing for white hats..
- zynkb0a 7y ago
  When I read your comment, I realized I intuitively view open access to surveillance systems like this as more desirable than limited access, and I don't know how to articulate that feeling. I'd consider myself privacy-conscious, however it is clear that this sort of open access further limits my "privacy." I wonder if privacy advocacy is more about aversion to certain power imbalances rather than privacy as an end itself for many folks.
  - ydlr 7y ago
    I am starting to think similarly. I am not bothered by lack of privacy nearly as much as I am about one-sided surveillance.
  - philjohn 7y ago
    The problem with "open" surveilance systems is they can be a useful tool for abusers to track down people who have escaped their clutches. Know your target number plate? Oh look, they go to such and such supermarket at around 8pm every Friday.
    - smichel17 7y ago
      To fix this, personally I lean towards something like, "Privacy for the weak, transparency for the powerful."
  - dsfyu404ed 7y ago
    It's a thorny problem. While having everything be open would probably reduce double standards along the "government and people with influence" vs "non-government and people without influence" lines I am not sure it would be a net positive, or at least not enough to prefer an open approach to dragnet systems over not having them in the first place. I would be very worried about "tyranny of the majority" type situation where a (large and or powerful enough) local majority uses the system to the detriment of some local (small enough or powerless enough) minority either under color of law or with a blind eye and/or tacit approval from the local powers that be. With a large enough majority vs a small enough minority government's hands may effectively be tied when it comes to preventing abuse and intervention from next higher level up level of government is not always forthcoming. We've all seen the way online communities engage in witch hunts. If the past is any example I don't think we can trust municipalities in possession of dragnets to not do the same if the contents of those dragnets are open to the public. I think we can all agree that gay bar patrons in rural Alabama and gun shop patrons in urban Massachusetts, to name a couple examples, might not do too well under an "all the location data the local government has out in the open" type of surveillance scheme.
kzrdude 7y ago
Super interesting data for researchers, I hope someone captured it.
- Jonnax 7y ago
  What would they be researching? Especially with this being a database of private data.
  - OJFord 7y ago
    Anything to do with traffic, road usage, or population movement I suppose?
- pjc50 7y ago
  Rather difficult to publish their results without admitting to a criminal offence..
  - celticninja 7y ago
    is it a criminal offense to access an open website? if you had to use even a default password you could imagine it being improperly accessed,but if it's just open to the internet how is a criminal offence committed?
    - danielbarla 7y ago
      I'm somewhat puzzled when this defense comes up, but I think it's worthwhile debating it. Does the condition of how you came upon the contents have any real bearing on the matter? I mean, nobody is really saying that accessing an open website itself is illegal. But it's not as if this circumstance will alleviate all future repercussions of your subsequent actions. I suspect I don't have to give analogies of what might be an inappropriate action - there are a number of things you could find on an open website that could be illegal to distribute. I suspect a much more interesting argument exactly is the issue with having this particular data - what laws are being broken by redistributing it (I don't have the answer). But that was not the point that you raised, hence my reply.
coldcode 7y ago
Some government official probably scoffed at the need for password protection as "no one will know how to find the site".
- robin_reala 7y ago
  Generally it’s oversight rather than malicious incompetence.
  - bennyelv 7y ago
    I’d probably go with gross or criminal negligence for a screw up of the magnitude and simplicity of this one.
- chedabob 7y ago
  More likely it was meant to be an internal service, or at least accessible only from a certain IP range, and someone ballsed up the config.
- nihil75 7y ago
  More like being sold "assurances" and "standards" by some corporation sales talkers that did a terrible job as always.
pjc50 7y ago
So who gets the 4% of turnover GDPR fine here? Or is it under the law enforcement exemption?
- kungato 7y ago
  In my country the government is exemp from fines for GDPR
  - celticninja 7y ago
    this is a local council (as opposed to central government) though so I'm not sure how it spies in this situation.
    - phatfish 7y ago
      It's still ultimately government fining its self. No point if it really is council run infrastructure. To punish them you need to vote out whoever commissioned this project (I realise that's unlikely to happen). I'd be surprised though if it is really run by the council or just contracted out to some outsourcer. In which case they should be fined.
- kuu 7y ago
  Honest question: Is UK still under GDPR after Brexit?
  - remus 7y ago
    Yes. GDPR was implemented in UK legislation and the government has confirmed this legislation will remain in place after brexit.
- globular-toast 7y ago
  Is it a GDPR issue? You can't identify the driver from the number plate.
  - 7y ago
asplake 7y ago
I live close enough to Sheffield to be caught by this. Hope that both South Yorkshire Police and the City council get some serious flak for this.
tcd 7y ago
> nobody came to any harm or suffered any detrimental effects as a result of this breach Who gets to decide what "harm" is or whether anyone suffered "detrimental effects"? Surveillance is so common and normalized they don't consider the act of collecting so much information itself as a "detrimental harm". What if that harm only presented itself years down the line? Maybe a creepy stalker who can synthesize mulitple data sets to reconstruct a person's movements or possibly use it against them some way (scammers and fraudsters are increasingly using all these leaked datasets to create a more accurate profile of an individual for more sophisticated attacks/targeting. Your name/address/mobile number must not and can not be considered PII since it's already been leaked probably ten's of times by now). That's an incredibly shortsighted comment to try and justify developing a system with not even the most basic of security considerations. I honestly just wish those same people were jailed for 50 years as a result, we'd see a LOT more consideration in the future if they were held personally liable.
m3nu 7y ago
For the Corona tracing, they were looking at the centralized system, right? Still the latest plan? Anyone seeing parallels? :-)
- asplake 7y ago
  Well of course there are parallels. But on the other hand, I have very high regard for UK government digital (having twice worked in that space) and would be much more inclined to trust them than a local authority, especially where the potential benefit might be enormous.
fnordfnordfnord 7y ago
License plates should be done away with. Replace them with RFID tags that log, and can alert the driver each time they're activated. Drivers could switch them off when they're at home or parked. Anyone, not just the government can operate an ALPR system and record this data for whatever purpose they wish.

109 points by linebug 7y ago

There seems to be an assumption that this would come under GDPR, but that's not obvious to me (excluding the potential images of people). Putting aside ethical concerns , would there be any legal ramifications for capturing the presence of a car at a certain location and sharing it? The licence plate identifies the car, not the driver. (Similar schemes are in place for boats and airplanes of course)

kwhitefoot 7y ago
The driver of a private motor vehicle is almost invariably the registered keeper. In most of the case where it is not then it is a family member. Are you implying that the slightest doubt about the identity of the driver means that it is perfectly alright to collect the data? because if so that surely also applies to many other GDPR situations, where families share a single computer for instance.
- alexchamberlain 7y ago
  I'm actually saying I don't know; where is the line? Licence plates seem like an interesting test case, given many registered keepers are companies (either company cars, work vehicles or hire cars).

blablajevic 7y ago

such a cool post. Upvote

dsfyu404ed 7y ago

I hope somebody combs through the data and uses it to publish embarrassing trip sequences for public officials and their families because that's the only way politicians and local officials are gonna even consider not supporting these kinds of boondoogle dragnet projects.

dx034 7y ago
Or just a public database where you can enter license plate and get all trips. I don't think many people would be happy with this. That's illegal though so nothing for white hats..
zynkb0a 7y ago
When I read your comment, I realized I intuitively view open access to surveillance systems like this as more desirable than limited access, and I don't know how to articulate that feeling. I'd consider myself privacy-conscious, however it is clear that this sort of open access further limits my "privacy." I wonder if privacy advocacy is more about aversion to certain power imbalances rather than privacy as an end itself for many folks.
- ydlr 7y ago
  I am starting to think similarly. I am not bothered by lack of privacy nearly as much as I am about one-sided surveillance.
- philjohn 7y ago
  The problem with "open" surveilance systems is they can be a useful tool for abusers to track down people who have escaped their clutches. Know your target number plate? Oh look, they go to such and such supermarket at around 8pm every Friday.
  - smichel17 7y ago
    To fix this, personally I lean towards something like, "Privacy for the weak, transparency for the powerful."
- dsfyu404ed 7y ago
  It's a thorny problem. While having everything be open would probably reduce double standards along the "government and people with influence" vs "non-government and people without influence" lines I am not sure it would be a net positive, or at least not enough to prefer an open approach to dragnet systems over not having them in the first place. I would be very worried about "tyranny of the majority" type situation where a (large and or powerful enough) local majority uses the system to the detriment of some local (small enough or powerless enough) minority either under color of law or with a blind eye and/or tacit approval from the local powers that be. With a large enough majority vs a small enough minority government's hands may effectively be tied when it comes to preventing abuse and intervention from next higher level up level of government is not always forthcoming. We've all seen the way online communities engage in witch hunts. If the past is any example I don't think we can trust municipalities in possession of dragnets to not do the same if the contents of those dragnets are open to the public. I think we can all agree that gay bar patrons in rural Alabama and gun shop patrons in urban Massachusetts, to name a couple examples, might not do too well under an "all the location data the local government has out in the open" type of surveillance scheme.

kzrdude 7y ago

Super interesting data for researchers, I hope someone captured it.

Jonnax 7y ago
What would they be researching? Especially with this being a database of private data.
- OJFord 7y ago
  Anything to do with traffic, road usage, or population movement I suppose?
pjc50 7y ago
Rather difficult to publish their results without admitting to a criminal offence..
- celticninja 7y ago
  is it a criminal offense to access an open website? if you had to use even a default password you could imagine it being improperly accessed,but if it's just open to the internet how is a criminal offence committed?
  - danielbarla 7y ago
    I'm somewhat puzzled when this defense comes up, but I think it's worthwhile debating it. Does the condition of how you came upon the contents have any real bearing on the matter? I mean, nobody is really saying that accessing an open website itself is illegal. But it's not as if this circumstance will alleviate all future repercussions of your subsequent actions. I suspect I don't have to give analogies of what might be an inappropriate action - there are a number of things you could find on an open website that could be illegal to distribute. I suspect a much more interesting argument exactly is the issue with having this particular data - what laws are being broken by redistributing it (I don't have the answer). But that was not the point that you raised, hence my reply.

coldcode 7y ago

Some government official probably scoffed at the need for password protection as "no one will know how to find the site".

robin_reala 7y ago
Generally it’s oversight rather than malicious incompetence.
- bennyelv 7y ago
  I’d probably go with gross or criminal negligence for a screw up of the magnitude and simplicity of this one.
chedabob 7y ago
More likely it was meant to be an internal service, or at least accessible only from a certain IP range, and someone ballsed up the config.
nihil75 7y ago
More like being sold "assurances" and "standards" by some corporation sales talkers that did a terrible job as always.

pjc50 7y ago

So who gets the 4% of turnover GDPR fine here? Or is it under the law enforcement exemption?

kungato 7y ago
In my country the government is exemp from fines for GDPR
- celticninja 7y ago
  this is a local council (as opposed to central government) though so I'm not sure how it spies in this situation.
  - phatfish 7y ago
    It's still ultimately government fining its self. No point if it really is council run infrastructure. To punish them you need to vote out whoever commissioned this project (I realise that's unlikely to happen). I'd be surprised though if it is really run by the council or just contracted out to some outsourcer. In which case they should be fined.
kuu 7y ago
Honest question: Is UK still under GDPR after Brexit?
- remus 7y ago
  Yes. GDPR was implemented in UK legislation and the government has confirmed this legislation will remain in place after brexit.
globular-toast 7y ago
Is it a GDPR issue? You can't identify the driver from the number plate.
- 7y ago

asplake 7y ago

I live close enough to Sheffield to be caught by this. Hope that both South Yorkshire Police and the City council get some serious flak for this.

tcd 7y ago

> nobody came to any harm or suffered any detrimental effects as a result of this breach Who gets to decide what "harm" is or whether anyone suffered "detrimental effects"? Surveillance is so common and normalized they don't consider the act of collecting so much information itself as a "detrimental harm". What if that harm only presented itself years down the line? Maybe a creepy stalker who can synthesize mulitple data sets to reconstruct a person's movements or possibly use it against them some way (scammers and fraudsters are increasingly using all these leaked datasets to create a more accurate profile of an individual for more sophisticated attacks/targeting. Your name/address/mobile number must not and can not be considered PII since it's already been leaked probably ten's of times by now). That's an incredibly shortsighted comment to try and justify developing a system with not even the most basic of security considerations. I honestly just wish those same people were jailed for 50 years as a result, we'd see a LOT more consideration in the future if they were held personally liable.

m3nu 7y ago

For the Corona tracing, they were looking at the centralized system, right? Still the latest plan? Anyone seeing parallels? :-)

asplake 7y ago
Well of course there are parallels. But on the other hand, I have very high regard for UK government digital (having twice worked in that space) and would be much more inclined to trust them than a local authority, especially where the potential benefit might be enormous.

fnordfnordfnord 7y ago

License plates should be done away with. Replace them with RFID tags that log, and can alert the driver each time they're activated. Drivers could switch them off when they're at home or parked. Anyone, not just the government can operate an ALPR system and record this data for whatever purpose they wish.