OIA documents show police have been keen to look into widening the use of number plate recognition and storing the data for longer. Photo: RNZ / Alexander Robertson
This is the first of two stories about the surveillance camera web. The second will cover comments from Auror, SaferCities, the Office of the Privacy Commissioner and more input from police.
Surveillance camera networks that police used to track three Covid-infected women around Northland, are spreading widely around the country.
Police have positioned themselves at the centre of a web run by two private companies.
They can tap into footage from hundreds, if not thousands, of cameras that are continuously reading car number plates, though they do not own the cameras.
They issued new rules around these automated number plate recognition (ANPR) cameras yesterday.
In addition, police have spent years helping develop a second private platform of almost 5000 CCTV cameras owned by businesses, councils and government agencies, that 4000 officers can access on a smartphone app.
The approach integrates public law enforcement with privatised surveillance. This acts to shield police from liability for privacy breaches and makes it harder to get information: When RNZ asked police yesterday just how many ANPR cameras officers can access, they told us to check with the companies.
OIA documents show police have been keen to look into widening the use of number plate recognition and storing the data for longer.
In 2017 a police report said if ANPR "was to be used simply to detect stolen vehicles in real time, very short periods of retention would be expected".
"By extending the purpose and use of NPI [number plate information] to include detection of crime, longer periods of retention are potentially defensible."
Other documents show the Privacy Commissioner was worried last year by a police plan to expand ANPR.
"I am particularly concerned by the apparent low level of privacy knowledge and understanding at the frontline," the commissioner told police, telling them to buck up their ideas.
Footage stored for a lot longer
The new ANPR rules massively extend how long police can keep the number plate footage for.
In 2014, they said strict protocols meant "all information" would be deleted within 48 hours; the new upper limit is 12 months, with others set at 60 days and six months, depending on the type of investigation.
The new limits made for a better crime-fighting tool, police said.
Number plates count as personal information if they are used to identify someone; the Privacy Act says such information must not be kept available for a long time, and must be used for only for pre-defined purposes.
Two years ago, police told the public: "Our deployment of ANPR has not gone beyond a trial, and police use of CCTV is limited in scale."
Yet by that time, they had already been helping Auckland company SaferCities set up one platform since 2014 and working with Auror on the other platform since at least 2016.
OIA documents showed police garnered lessons from the UK. They looked at how police there set up and operated their own massive camera systems, only to run into years of major public pushback.
In New Zealand, the private-public camera network has spread with barely a murmur.
At one key juncture, in 2017, police said ANPR ought to be seen as a "forerunner" of facial recognition.
They added that one police district "is contemplating the opportunity provided by retailers who have deployed facial recognition software".
They told RNZ yesterday they had not taken that any further.
Avoiding liability
The number plate cameras are being used by retailers to spot shoplifters in carparks and by police to stop stolen cars and track vehicles - which requires high-level approval and sometimes a warrant.
In addition to these "real-time" responses, ANPR is also "providing evidential material for investigations and intelligence profiling".
Photo: RNZ / Cole Eastham-Farrelly
The new rules state the liability for any privacy breaches sits with the camera owners, not police.
"NZP [New Zealand Police] has clearly set expectations with Safer Cities and Auror about the need for them to ensure that their contracted third parties providing CCTV footage and ANPR data are doing so in accordance with the law," police told RNZ yesterday.
Some overseas research shows ANPR is better at crime detection than crime deterrence.
The cameras are most pervasive in Auckland, but have not stemmed a spate of ram raids there.
In Northland, in October 2021, police used ANPR at least nine times to track the rental car of three women they accused of breaching Covid-19 rules, an OIA response shows.
'At the push of a button'
The new rules cover how police ask others for footage, and how they have to give a legally defensible reason, and record what they do.
Elsewhere, the rules say "third parties can choose to share information".
In addition, once an ANPR camera is linked to either platform, it is engaged and police can access that database.
The volumes are such that Auror has set up a shortcut, saying: "ANPR retailers spend a significant amount of time processing police CCTV requests.
"Auror now automatically retrieves footage from ANPR sites at the push of a button."
The new rules state that Auror retains its own number plate data for 60 days, and SaferCities for six months.
But other documents are less clear.
A Waikato District Council report suggests the data on all vehicles is held indefinitely: "All plates are automatically written to a database that police are able to search at the Ngaruawahia police station during investigations," it said in February, while discussing installing two new VIBE ANPR cameras on the main road.
In 2016, police said: "Because we are being provided with ANPR data from outside agencies, we do not determine the length of retention of this information."
'Every single police officer' uses it
Police have worked since 2014 with SaferCities to develop its vGRID platform that now hosts 4947 cameras at 246 sites, accessible to 4000 police officers by smartphone.
In 2017, they engaged the company without running a tender to add an ANPR function to vGRID, called VIBE. This now has 217 cameras.
A police business case in 2016 said that VIBE's number plate data would be stored on SaferCities' servers.
This business case was approved even though police said at the time: "How NPI will be used and for what is unclear."
Police's second partner, Auror, majors in ANPR and has a lot more cameras - it did not tell RNZ how many - mostly around shops and carparks.
Auror told customers this year it covered 90 percent of retailers nationwide.
"Every single police officer uses the platform across the country," it said.
Officers get instructions how to use the two companies' apps on their phones.
A contract with Auror in 2018 committed the police to help promote it.
Auror told a presentation in London it had shared a stage in the UK this year with New Zealand police assistant commissioner Bruce O'Brien, who has oversight of the National Intelligence Centre.
Police initiated ANPR with cameras on their cars 10 years ago in a publicised trial; a decade later they themselves have only 18 mobile and 10 fixed ANPR cameras.