California Shopping Centers Are Spying for an ICE Contractor

A company that operates 46 shopping centers up and down California has been providing sensitive information collected by automated license plate readers (ALPRs) to Vigilant Solutions, a surveillance technology vendor that in turn sells location data to Immigrations & Customs Enforcement. 

The Irvine Company—a real estate company that operates malls in Irvine, La Jolla, Newport Beach, Redwood City, San Jose, Santa Clara and Sunnyvale—has been conducting the ALPR surveillance since just before Christmas 2016, according to an ALPR Usage and Privacy Policy published on its website (archived version). The policy does not say which of its malls use the technology, only disclosing that the company and its contractors operates ALPRs at “one or more” of its locations. 

Automated license plate recognition is a form of mass surveillance in which cameras capture images of license plates, convert the plate into plaintext characters, and append a time, date, and GPS location. This data is usually fed into a database, allowing the operator to search for a particular vehicle’s travel patterns or identify visitors to a particular location. By adding certain vehicles to a “hot list,” an ALPR operator can receive near-real time alerts on a person’s whereabouts.

EFF contacted the Irvine Company with a series of questions about the surveillance program, including which malls deploy ALPRs and how much data has been collected and shared about its customers and employees. After accepting the questions via phone, Irvine Company did not provide further response or answer questions.

The Irvine Company’s Shopping Centers in California: 

mytubethumbplay

%3Ciframe%20width%3D%22600%22%20height%3D%22500%22%20scrolling%3D%22no%22%20frameborder%3D%22no%22%20src%3D%22https%3A%2F%2Ffusiontables.google.com%2Fembedviz%3Fq%3Dselect%2Bcol1%2Bfrom%2B1rD4SnEV0A5H8Omp5gVauQe7_oBVrJLMNp6buenLN%26amp%3Bviz%3DMAP%26amp%3Bh%3Dfalse%26amp%3Blat%3D34.871845934180776%26amp%3Blng%3D-119.24998871540208%26amp%3Bt%3D1%26amp%3Bz%3D6%26amp%3Bl%3Dcol1%26amp%3By%3D2%26amp%3Btmplt%3D2%26amp%3Bhml%3DONE_COL_LAT_LNG%22%3E%3C%2Fiframe%3E

Privacy info. This embed will serve content from google.com

The Irvine Company’s policy describes a troubling relationship between the retail world and the surveillance state. The cooperation between the two companies allows the government to examine the travel patterns of consumers on private property with little transparency and no consent from those being tracked. As private businesses, Vigilant Solutions and the Irvine Company are generally shielded from transparency measures such as the California Public Records Act. The information only came to light due to a 2015 law passed in California that requires ALPR operators—both public and private aliketo post their ALPR policies online. Malls in other states where no such law exists could well be engaged in similar violations of customer privacy without any public accountability.  

In December 2017, ICE signed a contract with Vigilant Solutions to access its license-plate reader database. Data from Irvine Company’s malls directly feeds into Vigilant Solutions’ database system. This means that ICE can spy on mall visitors without their knowledge and receive near-real-time alerts when a targeted vehicle is spotted in a shopping center’s parking lot. 

Vigilant Solutions’ dealings with ICE have come under growing scrutiny in California as the Trump administration accelerates its immigrant enforcement. The City of Alameda rejected a contract with Vigilant Solutions following community outcry over its contracts with ICE. The City of San Pablo put an expansion of its surveillance network on hold due to the same concerns.

But ICE isn’t the only agency accessing the data. Vigilant Solutions shares data with as many as  1,000 law enforcement agencies nationwide. Through its sister company, Digital Recognition Network, Vigilant Solutions also sells ALPR data to financial lenders, insurance companies, and debt collectors.

“Irvine is committed to limiting the access and use of ALPR Information in a manner that is consistent with respect for individuals’ privacy and civil liberties,” the Irvine Company writes in its policy. “Accordingly, contractors used to collect ALPR Information on Irvine’s behalf and Irvine employees are not authorized to access or use the ALPR Information or ALPR System.” And the Irvine Company says it deletes the data once it has been transmitted to Vigilant Solutions.

Although the Irvine Company pays lip service to civil liberties, the company undermines that position by allowing Vigilant Solutions to apply its own policy to the data. Vigilant Solutions does not purge data on a regular basis and instead “retains LPR data as long as it has commercial value.”

The Irvine Company must shut down its ALPR system immediately. By conducting this location surveillance and working with Vigilant Solutions, the company is putting not only immigrants at risk, but invading the privacy of its customers by allowing a third-party to hold onto their data indefinitely.

We will update this post if and when the Irvine Company decides to respond to our questions.

Special thanks to Zoe Wheatcroft, the EFF volunteer who first spotted The Irvine Company’s ALPR policy. 


VISIT THE SOURCE ARTICLE
Author: Dave Maass

Author:

Just a figment of your imagination.