This is the second of two stories about the public-private web of surveillance cameras. The first ran on Friday.
Police have admitted to a second case of their misusing number plate-reading cameras, at the same time as they have revealed they are expanding the cameras' use.
They already check the cameras almost a thousand times a day within a surveillance web that has quietly expanded, that provides lots of footage - mostly of New Zealanders going about their lawful business, but also of crime.
Police now say they flagged a car as stolen though the car was not stolen, to trigger camera tracking in a Counties Manukau homicide investigation in 2020.
This case was before the courts so they could not comment further, police told RNZ.
Earlier, an OIA response showed police similarly raised a false "stolen car" flag to track three women in a Covid-related hunt in Northland a year ago.
Including the cars in the stolen vehicles list that they submit to two private camera networks three times each day triggered automatic number plate recognition (ANPR).
Senior police have said two things: That this was not appropriate and they would be reminding officers of the rules - but also that in Northland, during the Covid-19 emergency, it was the only means they had to activate both camera networks, and was done with "really good intentions" to locate the women who posed a health risk.
At the same time, police have revealed they have new powers within one of the camera networks.
And they have signalled they may want to go further and introduce extra ways to trigger alerts about someone's vehicle.
"It may be desirable in the future for police to be able to share a wider range" of triggers with third parties, a new police ANPR policy document said.
New power
The new power was enabled in June, when Auckland company SaferCities introduced "active detection capability" for ANPR cameras, police told RNZ yesterday.
This means police can, for the first time, tap cameras on SaferCities' vGRID/VIBE platform to locate any vehicle in real-time.
SaferCities chief executive Scott Bain said by email to RNZ that the new mechanism "allows police to individually track a vehicle of interest, whilst maintaining full compliance with legislation through requiring officers to enter the relevant Police File numbers, Offence codes and warrant numbers etc as necessary and as per Police ANPR policy".
Tracking is only meant to be done in an emergency or under a warrant - and with a 48-hour cut-off, which does not appear to have been followed in the Northland case.
Police already do "active detection" on the very large private Auror ANPR network and on the small number of ANPR cameras police themselves own - 28 in total.
Auror has not told RNZ how many cameras are on its platform.
The new policies show police can ask the system to ping any plate, say of a disqualified driver or a known drink-driver, as long as officers are sure they have lawful power to stop the vehicle, and they get higher-up approval. Other agencies, like Waka Kotahi, can also ask them to ping a plate, if they have a written agreement.
The second existing use of ANPR is for police to ask for historical footage of where a vehicle has been; they get a map of it. SaferCities has six months of footage to draw on, Auror has 60 days.
Widening the alert triggers
Active detection is mostly triggered at the moment by cars on the "stolen" list.
As it stands, this is the only list police are allowed to give the two companies.
But the policy document shows they are inclined to go further.
To widen the alert triggers beyond the stolen list would require governance-level approval, the policy document shows.
The aim would be "to generate more real time alerts for serious offending and life-threatening situations", it said.
In a third prong of possible expansion, police have briefed the Office of the Privacy Commissioner (OPC) about wanting to add more ANPR cameras to patrol cars to help keep officers safe.
Tech creep
Tech "creep" under which law enforcement keeps on stretching the purposes that high-tech tools are used for, has provoked controversy overseas, including around use of number plate recognition.
In the UK, the number plate debate extends back a decade, from warnings that had the Thatcher government had ANPR, it would have used it to track "all known miners' cars" during the flying pickets of 1984-85, to controversy over expansion in present-day London.
In the US, it has been asked whether ANPR could be used to track women crossing borders to get an abortion.
Researchers have looked into how authorities often justify the public's lack of access to information about ANPR under the guise of making citizens "safe'', and how the likes of privacy impact assessments "fail to safeguard the public against broad public surveillance".
Police here say the "vast majority" of number plate information was of "no interest" to them as it would not match a "vehicle of interest" (VOI).
"Even so, it is data collected about individuals that requires appropriate secure storage, access restrictions and deletion of data in a timeframe commensurate with the purposes of its use," their policy document said.
"Storage, access, and review of such information may generally be considered to be an intrusion of privacy and can only be justified if the law enforcement purpose for conducting this analysis outweighs the right to privacy."
It immediately goes on to say police can keep their own ANPR footage for up to 12 months.
In 2014, they said "all information" from ANPR would be deleted within 48 hours.
'Worst-case scenario'
Other documents show the OPC wants expiry dates put on any active detection trigger alerts.
It sketched a "worst-case scenario" to police in an email in July, of unauthorised access to a number plate information database and "then leaking this information".
ANPR was "powerful" and tracking was "highly privacy invasive", the OPC told police.
The new policies introduce new requirements for auditing ANPR use and reporting back to the public. The auditing appears to be in-house, not independent, but the OPC told police in July it was "encouraged to see a focus on access procedures and audit trails ... critical to ensuring ANPR is not misused".
The OPC told RNZ if police misrepresented ANPR information in the Northland case, this raised issued of fairness.
One official principle is that information must be collected in a lawful, fair and reasonable way. Misusing the stolen car trigger may have bypassed the privacy protections agreed with the private companies, the OPC said.
The OPC told RNZ it had clear expectations how police would use the tech, with a "clear purpose", and had told them so.
"Collection of personal information should not be driven by the technological ability to do, but a clear need ... to carry out the agency's lawful functions."
Police reports show they have not always been certain why they were introducing ANPR, or about data retention. An expansion project's "current thinking about retention periods ... is arbitrary at best", a 2017 report said.
The OPC is leaving the decision on retention time up to police.
"Police should consider whether they still need the information in light of the purpose it was collected for, and reflect this in their retention policy," it told RNZ.
Wider CCTV network
The ANPR cameras are part of wider CCTV platforms.
Police public technology capability briefings give general information about these - CCTV was "not used to maintain surveillance on individuals or groups" - without many specifics, such as usage figures.
"Use of the platform is governed by the same rules as accessing any other police system," police told RNZ.
A 2021 user manual for vGRID said SaferCities had designed many police district command centres, and was "supporting us with bringing in additional CCTV systems from various agencies to some of our Video Viewing Centres."
The police Eagle helicopter in Auckland also sends its live video to vGRID. This footage is also stored in Australia in the databases of US tasermaker Axon, RNZ has previously reported.
Auror, which is expanding overseas, told RNZ it was dedicated to reducing crime. Its software platform services let police "collaborate with victims and obtain evidence that assists with investigating and preventing crime across the country".
It did not install cameras, and did not provide live facial recognition (FR) systems or services, or send any FR content to police, though its retail partners might use FR, it said.
SaferCities said it was proud of its "collaboration with law enforcement, local government and other community-focused organisations" to keep people safe.
The CCTV and ANPR assets were owned and "shared" by the community, not the company, it said, adding it did not provide any FR services.
RNZ
