By Sandy Brundage

and Renee Batti

We are being watched. Surveillance programs operated by government agencies, from the National Security Agency and Department of Homeland Security to local police departments, are accumulating untold amounts of information on residents who, in the vast majority of cases, are law-abiding citizens.

As government agencies, in the name of public safety, step up the use of technology to follow our movements and collect personal information that once was off-limits, what safeguards are needed to protect our privacy and civil liberties? And who's asking that question?

Former state senator Joe Simitian, for one. Last year, when he was still in Sacramento and chair of the senate's Select Committee on Privacy, Mr. Simitian introduced a bill to regulate aspects of license plate data collection. The effort ended in defeat, but the defeat didn't end the former senator's concerns about the increasingly pervasive data-mining of American lives.

With the growing number of surveillance tools available to the government -- and to the commercial sector -- Mr. Simitian believes there's cause for concern. "Are the important privacy questions being asked and answered? My observation is that these are questions that are rarely if ever asked."

Individual civil liberties advocates and organizations such as the American Civil Liberties Union are also raising concerns. The ACLU released a report last July on the proliferation in the use of license plate readers across the country, stating that the trend "poses serious privacy and other civil liberties threats."

Local residents and motorists can expect a boost in the volume of information collected on their movement through public spaces as the city of Menlo Park buys and puts into use surveillance cameras and license plate scanners capable of reading hundreds of plates a minute from their roaming patrol car perches.

Balance needed

Steve Taffee, a Menlo Park resident who joined the police department's new citizens advisory group to talk about privacy issues, said that his primary concerns are data retention and data sharing, concerns echoed by two other groups he participates in.

"I've been a longtime member of both the American Civil Liberties Union and the Electronic Frontier Foundation. I'm particularly interested in privacy issues and balancing things that would allow companies to deliver products and services that we as citizens want, while protecting our rights and data," Mr. Taffee explained.

"It seems like there's always been a tension between these two things. Lately, the pendulum seems to be swinging more toward citizens giving up privacy rights or having privacy taken from them, without getting a lot in exchange."

Mr. Taffee, who has a background in software development, understands the utility of license plate readers, which in essence turn a manual task into an automated, faster one. "It's a logical extension, and an important law enforcement tool," he said.

"But 'big data' is not well understood by anyone, really not residents, law enforcement officials, legislators and so on. There are questions that should be addressed before we get too far down that slippery slope."

It's easier to maintain privacy rather than try to get it back once it's gone, Mr. Taffee maintains.

"My preference as a citizen is that we err on the side of being quite conservative as far as who shares the data and how long we keep the data."

Start with a retention of something like 30 days and see how that works, he suggested, and also start talking to other jurisdictions that have developed privacy policies and privacy rights experts as well as the community. "It's not an 'either or' kind of issue. It's a collaborative issue," he said.

Mr. Taffee lives on Willow Road, not far from Facebook's headquarters. The social media company's privacy policies "seem very difficult to track and never for the betterment of the individual. So I'm concerned about social networks and online retailers like Amazon. I appreciate those things, I use them, but I'm a little nervous about how they're protecting my data and what they're using it for."

As for the public sector, "that seems to get more alarming all the time, with regard to what the federal government is doing. All the way down to the local level, there's an impact. Let's just think this through a little bit. Let's not be contributing to this really large data set in the sky without thinking carefully about what we want to use it for," he said.

Some say that as long as a person isn't doing anything wrong, they shouldn't have a problem with being watched. Mr. Taffee's response?

"That's not very comforting. ... I get that, I understand that argument, but that's flipping things around in ways that are not what this country is about," he said. "This is one of those tradeoffs for living in a democratic society -- we should be free from unnecessary and unasked for surveillance because that's part of being an American," he said.

Menlo Park itself is grappling with those questions as the opportunity for the police department to expand its surveillance tools arises.

Menlo Park

The police department plans to buy up to three mobile automated license plate readers in the near future. In the meantime, it's testing readers borrowed from other agencies while developing a privacy and data retention policy in conjunction with city staff and council members.

The mobile automated license plate readers, used by East Palo Alto as well as the county and other local jurisdictions, scan and collect data from hundreds of plates a minute within a 360-degree arc.

Menlo Park Police Chief Bob Jonsen said that captured data is retained within a regional database in San Francisco.

Over the course of their summer meetings, council members discussed best practices for data retention, and asked that a representative of the Northern California Regional Intelligence Center (NCRIC), which will store the license plate data, give a presentation regarding its privacy policies before the city proceeds with drafting its own.

Councilman Ray Mueller emphasized the need to have a privacy policy in place before the police department buys its own automated license plate readers. Should an agency get sued over privacy violations, the courts may consider what the expectations of privacy were. Without a policy, that can be open to interpretation, he said.

Plate readers aren't the only new tools on the horizon. The police department is planning to install up to four surveillance cameras of its own, and is creating a database of existing, privately owned cameras and their locations.

Chief Jonsen said three cameras will be placed somewhere along Willow Road in the Belle Haven neighborhood, but the exact locations remain to be determined.

Like some members of the City Council, residents seem to want surveillance sooner rather than later in the wake of sporadic shootings in the Belle Haven neighborhood.

"After every shooting, residents in the area ask about the cameras, so I want to get a few up," Chief Jonsen said. "However, the locations are not set in stone, because if we determine there are a lot of independent cameras already in the area that we can enter into the (database), then we may place our cameras somewhere else."

Also, Menlo Park police officers are set to start wearing body cameras. The chief said all on-duty contact with citizens will be recorded. The cameras are activated manually and will be visible to everyone, he said.

The department's audio and video retention policy requires keeping all recordings for at least two and a half years, according to Chief Jonsen. The files are downloaded to a server owned by the city, with no access available to third parties. Parties involved in the recordings may view the files upon request.

The county and Atherton

The county's Narcotics Task Force has five license plate scanners, according to Lt. John Munsey of the task force. The Sheriff's Office makes them available for checkout to other agencies.

Earlier this year, the county attempted to add a drone aircraft to its tools for operations such as search-and-rescue, but that plan fizzled. (See separate story.)

The county Office of Emergency Services is hoping to place permanent license plate readers on freeway entrances to the county, and a grant was approved to pay for them. But because of logistical considerations, that plan may be delayed or suspended.

The town of Atherton doesn't use license plate scanners, and has no plans to do so "in the near future," according to Police Chief Ed Flint. "If we needed such technology for a specific purpose or investigation, we could borrow scanners from an allied law enforcement agency," he said.

The town has security cameras "employed for internal security measures" at the police department and Town Hall, he said. It's considering installing security cameras in Holbrook-Palmer Park as well. "No decision has been made as yet, and we would most likely seek council approval" before moving ahead with such plans, he said.

NCRIC

Representatives from NCRIC will make a presentation to the Menlo Park City Council on Tuesday, Sept. 24, to answer questions about data sharing and retention. According to NCRIC, data collected by Menlo Park may be shared with other agencies without first notifying the local police department.

The regional agency is one of more than 70 centers nationwide affiliated with the National Fusion Center, which is under the auspices of the Department of Homeland Security.

NCRIC Privacy Officer Hugh Cotton told the Almanac that license plate data stored by the center can be shared with authorized law enforcement or public safety officials with proper authority, for authorized purposes, or as otherwise authorized by source agencies. Menlo Park's data could be accessed without notification to the city, he said, but requests for data are logged in detail and audited to ensure the information is used appropriately.

NCRIC also partners with private-sector companies classified as part of "critical infrastructure." In situations where "reasonable evidence" suggests the companies are potential targets of terrorist attacks or criminal activity, license plate data may be shared with them, according to Mr. Cotton.

He said categories of companies considered as critical infrastructure include chemical, communications, commercial facilities, energy, defense, manufacturing and financial.

These private-sector companies don't have direct access to or contribute to the license plate data. "Except as noted above with regard to critical infrastructure, NCRIC will not share NCRIC or partner agency (license plate data) with commercial or other private entities or individuals," he said.

Participating agencies can set their own retention period, up to a maximum of one year. Once the retention period expires, Mr. Cotton said the data is deleted in such a way that it cannot be retrieved at a later date.

A false choice

Now a Santa Clara County supervisor, Joe Simitian said in an interview with the Almanac that all too often "we're presented with a false choice between privacy and public safety, and that's simply not the case. Unfortunately, with public safety advocates, privacy is too often an afterthought."

Although his 2012 bill tried to put boundaries on some of the free-for-all data collecting now possible with license plate scanners, he's never been opposed to the scanners, he said. "They can be a valuable function. But if you need to use the technology, you need to ask the questions ... such as: Who has access (to the information)? Who is monitoring to make sure it's not abused? How long is the information retained?"

What about the argument that one should have no expectation of privacy in a public space? It's one thing to believe that, Mr. Simitian said, "but it's another thing to have so much data about you accumulated over time (that is) revealing so much more than anyone should expect (to be revealed)."

Abuse of the data collected by license plate readers is also a concern. "No matter how good an organization it is (that's in charge of the program) ... there'll always be a few bad apples," he said. "You've got to design your system around that."

He gave an example of a person with access to the data tracking the moves of an estranged spouse or other potentially vulnerable person. "Your daily movements do provide a road map to your personal life," he said, adding that abuse of the system could result in stalking, safety threats, and just plain embarrassment.

Mr. Simitian said there's a need to look at not just individual programs like license plate readers, but at the bigger picture. At this point in our country, he said, our emails can be read by government, "every single piece of mail you pop in the mailbox is photographed on both sides" and the information can be accessed by a government agency without a warrant, the use of radio frequency identification is proliferating, and there's a "growing use of surveillance cameras both public and private.

"You have to look at the totality of the data to appreciate why the argument that there (can be) no expectation of privacy doesn't hold together. You connect enough of the dots and that's a line."

ACLU

Many of Mr. Simitian's concerns are echoed by the ACLU. The organization has taken a strong stance on privacy issues derived from automated license plate readers, saying that the systems create concerns that don't exist with manual procedures: The system can keep all of the captured information on file, and since information about thousands of vehicles is captured each day, that can produce detailed records of the movements of far more people than a manual method could.

In its July report, "You Are Being Tracked," the ACLU notes that "federal funding has fueled the spread of license plate readers among state and local law enforcement agencies." Some federal agencies also maintain networks of license plate readers, and "engage in data-sharing on a national level," it says.

"Unfortunately too little is known about how the federal government uses license plate data."

Its requests filed under the Freedom of Information Act seeking that information from federal agencies have largely been met with silence, and the ACLU has filed a federal lawsuit to force the agencies to respond, it reports.

Attorney Chris Conley, whose work with ACLU Northern California focuses on privacy and technology, said the systems pose a risk because they can allow law enforcement to build a comprehensive record of an individual's location that can reveal sensitive information, such as health issues or political or religious activities.

"These issues are exacerbated if information from (license plate readers) is shared with other agencies or combined with other data sources to build an even more detailed record of innocent Californians' legitimate and even constitutionally protected activities," he told the Almanac.

From the ACLU's perspective, the best practice is to keep the data for as short a period as possible. Tiburon, for example, retains it for only 30 days unless the data is relevant to an active criminal investigation. "In many cases, (the) data does not need to be retained at all; (a license plate reader) system can be used to watch for vehicles listed as stolen or subject to an Amber Alert without retaining any information about other cars," Mr. Conley said. The law enforcement value of old records is "extremely low," while keeping that information presents an ongoing privacy risk to individuals.

In addition, policies need to clearly and strictly limit access to the data to the context of a specific criminal investigation, he said.

Click here to read the ACLU's report on license plate readers, "You Are Being Tracked."

Dave Boyce contributed to this report.