In 2016 and 2017, U.S. law enforcement scanned 2.5 billion license plates, 99.5% of which belonged to vehicles unassociated with criminal activity.1 The first appellate court in the country to address whether use of automated license plate readers2 (ALPRs) constitutes a search under the Fourth Amendment,3 the Massachusetts Supreme Judicial Court (SJC) in Commonwealth v. McCarthy4 considered the surveillance’s duration, surreptitiousness, and categories of information in its analysis.5 The SJC held that while “widespread use” of ALPRs can constitute a search, the limited use thereof in this case did not.6 Given the case’s limited facts, McCarthy just scratched the surface of ALPRs’ use in Fourth Amendment search doctrine. This comment identifies practical realities of ALPRs that may merit greater constitutional scrutiny in future cases, owing to the potentially indefinite duration of ALPR data; the opaque, public-private nature of many ALPR databases; and the scale and categories of information revealed by ALPR surveillance.
In early 2017, Barnstable police began to suspect Jason McCarthy of supplying heroin to a co-conspiring distributor in Cape Cod.7 As part of their investigation, the police added McCarthy’s vehicle to an ALPR hot list on February 1, 2017, to observe when and how frequently the vehicle crossed the Bourne or Sagamore bridges onto the Cape.8 They additionally tracked — both retroactively and prospectively — every time the vehicle crossed the two bridges between December 1, 2016, and February 12, 2017.9 On February 8, 2017, Barnstable police received an ALPR alert that McCarthy’s vehicle was driven over the Sagamore Bridge onto the Cape; officers then tailed the defendant and the distributor to a meet-up point, where the two met and shortly departed, absent a physical exchange.10 The police observed a similar interaction on February 22, 2017.11 Suspecting a heroin transaction, Barnstable police arrested both the distributor — finding heroin on his person — and McCarthy.12 McCarthy filed motions to suppress, inter alia, the ALPR data, which a Superior Court judge denied.13 He then pursued an interlocutory appeal in the SJC, arguing that the police’s use of ALPRs constituted a search under the Fourth Amendment of the U.S. Constitution14 or article 14 of the Massachusetts Declaration of Rights.15
Writing for the court, Justice Gaziano16 applied the Katz v. United States17 test,18 concluding that though the defendant had a reasonable “expectation of privacy in the whole of his public movements, an interest which potentially could be implicated by the widespread use of ALPRs, that interest is not invaded by the limited extent and use of ALPR data in this case.”19 In assessing privacy expectations over time, the “overarching goal” is to preserve “that degree of privacy against government that existed when the Fourth Amendment [and article 14 were] adopted.”20 “[T]he underlying purposes” are “to ‘secure the privacies of life against arbitrary power,’ and to [curtail] ‘a too permeating police surveillance.’”21 On arbitrary power, the Framers sought to prevent British officials’ “warrantless rummaging” through the home; likewise, police’s use of “complex digital trails and location records” should be restricted today.22 Moreover, the traditional protections against “a too permeating police surveillance”23 — practical and logistical constraints24 — are no longer as salient with today’s advanced surveillance technologies. With these Founding-era principles in mind, the court identified three means by which modern surveillance might exceed historical limits. The court analyzed (1) the search’s duration, (2) its surreptitious nature, and (3) the access it may grant to otherwise unknowable categories of information,25 which includes the police’s newfound ability both to ascertain real-time location data and to “travel back in time to retrace a person’s whereabouts.”26
The court then analyzed whether ALPRs’ use may constitute a Fourth Amendment search under Katz, in conversation with United States v. Jones27 and Carpenter v. United States.28 Items “knowingly exposed” to the public, like license plates, are generally unprotected;29 and those traveling in vehicles “on public thoroughfares” lack protected privacy interests in their “movements from one place to another,” that is, “on a single journey.”30 Nonetheless, as Carpenter clarified, individuals have protected privacy interests “in the whole of their physical movements,”31 which, though “individually public, are not knowingly exposed in the aggregate.”32 In embracing this aggregation principle,33 the court explained that twenty-four-hour “dragnet-type” surveillance,34 if it occurred, may encroach upon protected privacy interests “because the whole reveals far more than the sum of the parts.”35
If ALPR technology produces a detailed-enough picture to reveal a mosaic of one’s daily life, the court reasoned, its use may constitute a search under the Fourth Amendment and article 14.36 Justice Gaziano thus concluded that “[w]ith enough cameras in enough locations, the historic location data from an ALPR system in Massachusetts would invade a reasonable expectation of privacy.”37 The surveillance’s duration, surreptitiousness, and the categories of information it unveils to law enforcement all weigh in the analysis, as do ALPRs’ placement.38
In this case, however, only four cameras were deployed, at two fixed locations, on two discrete bridges, to surveil McCarthy’s movements over a two-and-a-half-month period.39 While the court declined to define the line at which ALPRs’ use “invoke[s] constitutional protections,” Justice Gaziano wrote, “it is not [this].”40 The surveillance was sufficiently limited to prevent the government from “monitor[ing] the whole of [McCarthy’s] public movements,” providing merely “a limited picture” thereof.41 The court held that while more extensive usage of ALPR technology might constitute a search, in this case the limited use thereof did not, affirming the order below.42
Chief Justice Gants concurred, agreeing that if the data had been obtained “from enough [ALPRs] in enough locations,” the resulting mosaic might have constituted a search; and he declined to promulgate a bright-line rule as to when that threshold might be passed.43 He instead proposed a Terry-like44 analytical framework for ALPR cases, with “two locational mosaic thresholds.”45 The first was a “lesser threshold” for ALPR uses revealing a lesser picture of one’s movements; it “may be permissibly crossed with a court order supported by an affidavit showing reasonable suspicion” (similar to a Terry stop).46 The second was “a greater threshold [requiring] a search warrant [and] probable cause.”47 He argued that this framework would benefit law enforcement and reviewing courts, which could determine whether the query revealed too much in the aggregate and, further, whether the affidavit could have supported probable cause — rendering the evidence admissible.48
In reviewing this case of first impression, the McCarthy court began the doctrinal conversation about whether use of ALPRs may constitute a search under the Katz privacy test, as informed by Jones and Carpenter. The court identified three relevant factors: duration, surreptitiousness, and access to new categories of information.49 A closer look at the technology’s practical realities, however, reveals that ALPRs pre-sent unique privacy concerns, beyond those analyzed in Jones and Carpenter in the GPS and cell-site location information (CSLI) contexts. In future cases, ALPR use may merit greater constitutional scrutiny, given the technology’s potentially indefinite duration; surreptitious, public-private nature; and facilitation of access to new categories of information, on an unprecedented scale.
First, ALPRs may threaten reasonable expectations of privacy in their potentially indefinite duration of data collection and retention. GPS and CSLI data are typically obtained by law enforcement post hoc,50 for relatively limited time periods,51 and, for CSLI, with a relatively short data retention period.52 ALPRs can send real-time alerts with contemporaneous location information, collected automatically and recurrently; and they can cover both prospective and retrospective periods, spanning back for potentially years, if not decades.53 The ALPR database in McCarthy was owned and operated by Massachusetts state agencies, with a one-year data retention policy for historical data.54 While the government’s own ALPR cameras may include procedural safeguards — including transparency requirements, data retention limitations, and other democratically approved policies — those of the private sector may not.55 Critically, when private-sector ALPR companies collect and store ALPR data indefinitely, that information may become available to contracting law enforcement agencies that subscribe to these less rights-protective databases.56 To the extent that courts have ruled it “objectively reasonable . . . to expect to be free from sustained elec-tronic monitoring” of the whole of one’s public movements,57 law enforcement’s access to indefinite (and theoretically infinite), retroactive, contemporaneous, and prospective location data may indeed represent the “dragnet-type” law enforcement that the McCarthy court feared.
Second, the surreptitiousness of ALPR technology may likewise extend beyond that identified by the McCarthy court,58 again owing to ALPR databases’ mutually constitutive public-private nature. One illustrative example concerns Vaas International Holdings, Inc. (Vaas), a private corporation whose networks aggregate scans from ALPR cameras stationed across the country into extensive ALPR databases.59 Law enforcement agencies can subscribe to one of Vaas’s networks, Vigilant Solutions,60 which is among the nation’s largest ALPR vendors.61 Vigilant Solutions sells to police departments access to a database containing over five billion ALPR scans collected nationwide, about 1.5 billion of which originate from other law enforcement agencies.62 This “creates a revolving door of license plate scans from law enforcement to Vigilant Solutions back to law enforcement agencies.”63 Problems of surreptitiousness that arise from this contractual system extend beyond the public’s probable lack of knowledge as to its workings or its existence. First, transparency and procedural safeguards (e.g., data retention limitations) may be lacking altogether in private vendors’ ALPR databases.64 Second, vendor contracts with private ALPR companies may prohibit law enforcement from disclosing to the public their use of the ALPR surveillance systems’ private databases, even if they wanted to.65 ALPRs differ in this way from GPS devices, which must be physically placed onto targets’ persons, vehicles, or belongings, and CSLI, which generally must be obtained from targets’ cell phone companies via warrants.66 ALPRs, however, can surreptitiously collect and distribute an untold aggregation of individuals’ location data — not only over a potentially indefinite duration, but also across the country, in ways likely unknown to the general public. Traditional surveillance could not furtively obtain such a wide breadth of information, heightening constitutional privacy concerns further still.
Third, though unapparent from this case, ALPRs differ from their doctrinal predecessors in the scale and categories of information on which they can collect data. CSLI arguably invokes constitutionally protected categories of information insofar as cell phones are typically carried on the target’s person, thereby following her in and around traditionally protected spaces, such as the home, places of worship, and other places of association.67 GPS devices — affixed proximately to individuals’ vehicles, persons, or belongings — present analogous concerns.68 ALPRs, by contrast, may appear less intrusive at first blush: they are often stationary devices located on street poles, traffic lights, freeway exit ramps, and the like — that is, traditionally unprotected69 public streets.70 Semistationary ALPR cameras — which law enforcement may place in strategic locations, like monitored parking lots — are likewise essentially immobile during the specified period of surveillance; and mobile ALPR cameras are typically affixed to police patrol cars or surveillance vehicles, not to a target’s person.71 While mobile ALPRs can follow an individual to track her movements, this activity hardly differs from that of ordinary surveillance (no new categories of information here).72 In this sense, ALPRs may be unlikely to gather an unusually broad scale of information on one’s movements in the way that CSLI and other more target-proximate and mobile forms of location-based tracking may do.73 In this case, four stationary cameras affixed to two bridges on public highway overpasses did not impermissibly invade McCarthy’s reasonable privacy expectations.74 On McCarthy’s facts, ALPR technology may appear less invasive than other forms of tracking, as concerns the scale of the categories-of-information factor.
However, the integration of ALPR data across government agencies and the private sector underscores not only the unprecedented durational categories of information that ALPRs reveal, but also the tools’ cross-jurisdictional information-sharing consequences. In McCarthy, a state agency managed the ALPR databases for cameras owned and operated by the state police.75 But a major constitutional implication of the categories-of-information factor arises from the aforementioned practical integration of government agencies’ local ALPR systems with those of the national private sector.76 While one unique category of information exposed by ALPRs concerns law enforcement’s newfound ability to “travel back in time,” the public-private nature of ALPRs extends this duration to a potentially indefinite, nationwide, cross-jurisdictional scale. Recordation and aggregation on such a wide scale may enable the government “to ascertain, more or less at will, [individuals’] political and religious beliefs, sexual habits, and so on” — the exact “dragnet” surveillance feared by the McCarthy court.77 Of constitutional import, the scale of information uncovered by such sweeping surveillance may reveal “a highly detailed profile, not simply of where we go, but . . . of our associations — political, religious, amicable and amorous . . . — [and] the pattern of our professional and avocational pursuits.”78 Further, “the only way to opt out of [ALPR] surveillance is to avoid the impacted area, which may pose significant hardships and be . . . unrealistic.”79 Though this scaling consequence was not implicated by the facts of McCarthy, it is nonetheless germane when analyzing ALPRs under the Katz–Jones–Carpenter framework going forward.
Overall, in conducting its fact-specific analysis on ALPR use in this case, the McCarthy court just scratched the surface of the broader implications of ALPR technology in Fourth Amendment search doctrine. ALPRs’ practical realities raise concerns regarding these databases’ potentially indefinite duration, lack of transparency in their public-private nature, and facilitation of access to new categories of information on an unprecedented scale. ALPRs’ use therefore may merit greater constitutional scrutiny in future Fourth Amendment cases.