Triggered by the stolen vehicle alert that police fed into two privately owned camera networks, automated number plate recognition cameras pinged the women's cars at least 10 times. (File image) Photo: RNZ / Angus Dreaver
Just one month after the Privacy Commissioner warned police to do better when it comes to number plate cameras and privacy, a detective pretended a car was stolen so they could track it.
OIA documents show police made the false report while hunting three women who travelled to Northland last October, sparking a Covid-19 lockdown.
Triggered by the stolen vehicle alert that police fed into two privately owned camera networks, automated number plate recognition (ANPR) cameras pinged the women's cars at least 10 times.
Later, the detective "removed" the alert, he told a detective inspector.
A month before, in September 2021, the Privacy Commissioner sent a letter to police's high-tech boss deputy chief executive Mark Evans, who had outlined a plan to expand ANPR.
"It is critical that the ANPR proposal is not developed in isolation from the environment in which it will be used. Recent interactions between our organisations suggest that considerable work is necessary to strengthen Police's privacy culture, practice and management systems," the Privacy Commissioner wrote.
"I am particularly concerned by the apparent low level of privacy knowledge and understanding at the frontline."
Use of tracking was a "highly privacy invasive function", the Office of the Privacy Commissioner told police in July this year, separate from the Northland case.
"The use of this capability must be proportionate to the purpose of its use."
Police eventually caught up with the three women in Auckland later. The women's application to travel to Northland had been approved by a government agency.
The case has come to light at the same time as RNZ reporting on the spread of a privately owned web of surveillance cameras that police regularly tap into.
Their main source of number plate footage is the company Auror, which said on its website police were making so many requests it had introduced a push-button way for retailers to give police their ANPR footage.
The second company they use, SaferCities, told RNZ it had 217 ANPR cameras within a network of almost 5000 CCTV cameras.
A police report in 2017 on setting up a SaferCities ANPR platform, said three Northland towns, with 700 cameras between them, were "keen to supply" their number plate information.
"It is a safe assumption that nationally the potential ANPR platforms number in the many 1000s," it said.
The OIA on the Northland hunt shows police used both companies' networks.
"Get Intel to do an Auror check as well for these," an officer said on 10 October, adding: "These results are all ANPR cameras attached to VGRID."
VGRID is the SaferCities network.
An hour later, another officer emailed back: "Please see below transactions from Auror regarding the two vehicles. I would suggest that CCTV be uplifted from the various places."
In a statement, police said: "A vehicle should not be entered into a police database as stolen unless circumstances indicate it is stolen."
"While well intended, this was not the appropriate way to generate an automatic alert, which in the end, had the same outcome [lawfully locating the car]."
The spokesperson said staff were being reminded of their "clear" policy on ANPR, their training was being reviewed, and they might do an audit "to confirm that the platform - a highly valuable investigative tool - is being used appropriately".
They revealed police did almost a third of a million - 327,000 - checks on the ANPR network last year, and that more than 6000 staff could access it.
In the Northland case, they could have triggered an alert on health grounds, since they had a Covid-19 order from the Medical Officer of Health, or by labelling the car as "sought" rather than "stolen".
However, earlier police said a list of stolen vehicles, which was updated many times a day, was the only data that police automatically fed into the two private networks.
Privacy Commissioner's expectations around police use of ANPR
In September last year, the Privacy Commissioner, having been informed police wanted to install more ANPR in patrol cars (they own just 28 cameras at present), told Mark Evans they must do better.
"It is my expectation that Police will be working to strengthen its privacy culture and privacy management systems in parallel with the development of this proposal and I would certainly expect to see progress in these matters before the ANPR initiative was extended beyond the proposed pilot," then commissioner John Edwards wrote.
By July this year, an email shows the Office of the Privacy Commissioner (OPC) was happier - but also sounding further warnings.
"It's great to see Police develop comprehensive guidelines for this technology," the email reads.
"While number plate information (NPI) is not itself very sensitive, the ANPR system is a powerful intelligence and surveillance tool providing Police with information about vehicles and their drivers in real time, as well as the ability to review the location of vehicles and track vehicles."
As well as needing robust privacy mitigations, accountability and transparency, the "police should develop some more explicit operational guidance for staff applying this test in their day to day".
But the email also reveals a blind spot that existed just two months ago: Information on police use of SaferCities' ANPR was "somewhat limited and it is unclear how and to what extent the police use the technology provided by SaferCities".
It was unclear if they audited this use, the office of the Privacy Commissioner said.
Asked about this, police referred RNZ to their new policy and rules on ANPR use they put out last week.
These rules state they can only track a vehicle if there is a risk to someone's life or serious threat to safety; if they get a warrant under the Search and Surveillance Act; or operate under emergency provisions in that Act.
The rules require police to audit their use of ANPR, and report publicly on it - however, the two private camera networks will not be so visible.
Liability for privacy breaches rests with camera owners - most of them shops, or car park owners, or councils - and the office of the Privacy Commissioner told police to help them out with legal advice on what their obligations are.
Police told RNZ the best source of advice is the office of the Privacy Commissioner.