Just when you though the USA might not be going down the same kind of vehicle tracking route that the UK, Japan and Brazil are following, former Congressman, longtime privacy advocate and erstwhile scourge of ECHELON, Bob Barr, reports in his Atlanta Journal and Constitution blog, that increasing numbers of jurisdications in the States are indeed investing in license plate reading systems. California seems to be leading the way, but there’s plenty of others states following, and no doubt this will be another way of wasting (sorry, investing) Obama’s massive recession-busting boost for security…
Back in February, I reported from Brazil about the progress of a proposed RFID-based vehicle tracking system, SINIAV. Of course RFID is not at all necessary for tracking. In the UK, the police have used Automatic Numberplate Recognition (ANPR) systems based on roadside cameras since 1993 in London – following the Provisional IRA bombings of the City and Docklands (see the account in my erstwhile collaborator, Jon Coaffee‘s book, Terrorism, Risk and the City – and since 2005, this has been in the process of being expanded into a nationwide network (see also the official Press Release from the Association of Chief Police Officers concerning the launch here).
What is rather less well-known to the outside world is that Japan developed such an automated camera system far earlier, from the early 1980s. The so-called N-system thereafter was gradually expanded to cover almost all major expressways and strategic urban locations in Tokyo and Osaka. Kabukicho, the entertainment district in Shinjuku, which I have spent some time studying over the last few years and will write about more tomorrow, is surrounded by N-system cameras and it is, I estimate, impossible to drive into this area without your license plate being recorded. These cameras are in addition to the 50 CCTV cameras that cover just about every street within the district. N-system is supposed to have played a major role on snaring suspects from the apocaylptic cult, Aum Shinrikyo, which carried out the Sarin gas attacks on the Tokyo underground in 1995, and who also assassinated top policemen and judges. Aum, now renamed ‘Aleph’, has been under official state surveillance ever since.
The Japanese police are not very forthcoming about N-system, let alone the details of how long data is kept and what it is used for. However one particular lawyer’s office in Tokyo did a very good investigation of the constitutional, legal and practical aspects of N-system back in the late 90s, and the updated pages are available here, including a nice little animation explaining how the system works.
We will hopefully be talking to them before we leave Tokyo. We still have time for a few more interviews here including the East Japan Railways security research lab, the Japanese consumers’ association, the organisation for the welfare of foreign workers, and the Suginami ward community safety people. And I will also just about have time to shoot down to Kobe to talk to Professor Kiyoshi Abe, a friend and collaborator, who is also one of the leading surveillance researchers here.
One of the items reported on in Privacy International´s assessment of privacy in Brazil was that ¨in November 2006, the Brazilian National Road Traffic Council approved a Resolution adopting a Radio Frequency Identification (RFID) tags in all licensed vehicles across the country.¨ The Conselho Nacional de Trânsito (CONTRAN) is part of the Departemento Nacional de Trânsito (DENATRAN), itself part of the massive new Ministério das Cidades (Ministry of Cities), the product of Lula´s major ministerial reforms designed to shift emphasis and power away from the large rural landowners to the growing numbers of increasingly populous cities.
The new scheme is called the Sistema Nacional de Identificação Automática de Veículos (SINIAV, or National System for the Automatic Identification of Vehicles). Basically it will put an RFID-tag in every vehicle license plate, in a gradual process. Much like the new ID scheme for people, SINIAV is based on a unique number. In Annex II, Paragraph 3, the resolution provides a breakdown of exactly what will be contained in the tiny 1024-bit chip as follows. The unique serial number (64), and a manufacturer´s code (32), will be programmed in at the factory, leaving a total of 928 programmable bits. The programmable area contains two main sections. The first contains all the personal and vehicular information: place of registration (32), registration number of seller (32) application ate (16), license plate number (88), chassis number (128), vehicle tax number (RENAVAM) (36), vehicle make and model code (16) and finally 164 bits for ´governmental applications´. The remaining 384 bits are split into 6 blocks for unamed ´private initiatives.´
Privacy International note that there is no more than a mention of conformity to constitutional rules on privacy (of which more later). However there is much more that is of concern here. The resolution claims that the data will be encrypted between plate and reader, but the technical specifications are not given to any level of detail (*though there is more information from the Interministerial Working Group on SINIAV, which I haven´t examined in any detail yet). We all know already how easy it is to clone RFID chips. This scheme is supposed to be about security for drivers, but it could easily result in the same kind of identity fraud and consequent necessity of disproving the assumption of guilt created by automated detection systems for car-drivers as for credit cardholders. Could you always prove that it wasn´t your car which was the gettaway vehicle in a robbery in Saõ Paulo, or you driving it, when your actual car was in a car park in Curitiba? Widespread cloning of chips would also render the whole system valueless to government.
Then there is the question of function creep. The chip has spare capacity, and assigned space for unamed functions, state and private. Brazil already has a system of state toll roads (pay-for-use highways), and these chips could certainly be used as part of an automated charging system. That might be very convenient. However what other functions could be thought up, and how might safeguards be built in? As I have already noted, Brazil has no body for protecting privacy or data/information rights so it would be very easy for new more intrusive functionality to be added.
Combining the problems of a movement towards automated fines or changes, and criminality, another major issue would be the one recently revealed in Italy, where a automated red-light camera system was found to have been fixed in order to generate income from fines for corrupt police and a multitude of others.
The final question of course is whether this will all happen as planned or at all. The system would supposedly be complete by 2011. I know of a trial scheme in Saõ Paulo, but on a quick (and very unscientific) straw poll of people who I encountered today at the university here in Curitiba, there is to be no-one who has an RFID license plate or knows someone who does, and there is practically zero awareness even amongst educated professionals. Like the National ID-card scheme, people just don´t think it will go to plan or timetable. That may however, just reflect a (middle-class) Brazilian view of the abilities of the state.
Still, as the Frost and Sullivan market assessment states, all of this turns Brazil into a ‘highly attractive market for RFID suppliers’ which was probably the main motivation and will be the only real outcome.