Dozens of California police agencies are still sharing automated license plate reader (ALPR) data with out-of-state authorities without a warrant, the Electronic Frontier Foundation has revealed. This is occurring despite guidance issued by State Attorney General Rob Bonta last year.

Clarifying a state law that limits state public agencies to sharing ALPR data only with other public agencies, Bonta’s guidance pointed out that “importantly,” the law’s definition of “public agency” “does not include out-of-state or federal law enforcement agencies.”

Bonta’s guidance came after EFF uncovered more than 70 California law enforcement agencies sharing ALPR data with cops in other states, including anti-abortion states. After Bonta clarified the statute, approximately half of these agencies told EFF that they updated their practices to fall in line with Bonta’s reading of the law. Some states could not verify that the practice had ended yet, though.

In a letter to Bonta, EFF praised the guidance as protecting Californians’ privacy but also flagged more than 30 police agencies that either expressly rejected Bonta’s guidance or else refused to confirm that they’ve stopped sharing data with out-of-state authorities. EFF staff attorney Jennifer Pinsof told Ars that it’s likely that additional agencies are also failing to comply, such as agencies that EFF never contacted or that recently acquired ALPR technology.

“We think it is very likely other agencies in the state remain out of compliance with the law,” EFF’s letter said.

EFF is hoping that making Bonta aware of the ongoing non-compliance will end sharing of highly sensitive location data with police agencies in states that do not provide as many privacy protections as California does. If Bonta “takes initiative” to enforce compliance, Pinsof said that police may be more willing to consider the privacy risks involved, since Bonta can “communicate more easily with the law enforcement community” than privacy advocates can.

However, even Bonta may struggle, as some agencies “have dug their heels in,” Pinsof said.

Many state police agencies simply do not agree with Bonta’s interpretation of the law, which they claim does allow sharing ALPR data with cops in other states. In a November letter, a lawyer representing the California State Sheriffs’ Association, California Police Chiefs Association, and California Peace Officers’ Association urged Bonta to “revisit” his position that the law “precludes sharing ALPR data with out-of-state governmental entities for legitimate law enforcement purposes.”

The cops argued that sharing ALPR data with cops in other states assists “in the apprehension and prosecution of child abductors, narcotics traffickers, human traffickers, extremist hate groups, and other cross-state criminal enterprises.”

They told Bonta that the law “was not designed to block law enforcement from sharing ALPR data outside California where the information could be used to intercede with criminal offenders moving from state to state.” As they see it, cooperation between state authorities is “absolutely imperative to effective policing.”

Here’s where cops say the ambiguity lies. The law defines public agency as “the state, any city, county, or city and county, or any agency or political subdivision of the state or a city, county, or city and county, including, but not limited to, a law enforcement agency.” According to cops, because the law does not “specifically refer to the State of California” or “this state,” it could be referring to agencies in any state.

“Had the legislation referred to ‘a State’ rather than ‘the State,’ there would be no debate about whether sharing was prohibited,” the police associations’ letter said. “We see no basis to read such a limitation into the legislation based on the word ‘the’ rather than ‘a.'”

The police associations also reminded Bonta that the California Legislature considered passing a bill that would have explicitly “prohibited the out-of-state sharing of ALPR information” with states interfering with “the right to seek abortion services” but “rejected it.” They told Bonta that “the Legislature’s refusal to adopt a position consistent with the position” he is “advancing is troubling.”

EFF said that California police can still share ALPR data with out-of-state police in situations permitted by law, like when out-of-state cops have a “warrant for ALPR information based on probable cause and particularity.” Instead, EFF alleged that cops are “dragnet sharing through commercial cloud storage systems” without warrants, which could be violating Californians’ right to privacy, as well as First and Fourth Amendment rights.

EFF urged Bonta to reject the police associations’ “crabbed interpretation” of the statute, but it’s unclear if Bonta will ever respond. Pinsof told Ars that Bonta did not directly respond to EFF’s initial investigation, but the guidance he later issued seemed to suggest that he got EFF’s message.

Police associations and Bonta’s office did not respond to Ars’ request to comment.

https://arstechnica.com/?p=2002077