Return to the
Watching Them, Watching Us
UK Public CCTV Regulation Campaign
Home Page
email: [email protected]
On February 17th 2003, London started a very large scale experiment in road pricing with the introduction of the Central London Congestion Charge by Transport for London, under the control of the Mayor of London, Ken Livingstone, under the policy of the Department for Transport..
The enforcement of the £5 charge and the £40 or £80 or £120 Penalty Notices is being undertaken by making use of a massive CCTV monitoring system also using Automatic Number Plate Recognition technology.
We are not so much concerned with the actual congestion charge itself, but rather with the Privacy implications of the particular way in which this scheme has been implemented.
If this scheme is deemed to be a success, then it will surely spread to many other areas of London and other cities and towns in the UK and elsewhere.
The scheme relies on about 700 CCTV cameras covering around 203 entrances/exits to the 21 square kilometre central zone. Each lane of traffic either entering or leaving the boundary of the zone is covered by a monochrome camera linked to a Automatic Number Plate Recgonition system. Each entry/exit road has at least one colour CCTV camera which streams real time pictures back to the central "Hubsite" (according to the Daily Mail, located just outside the charging zone, near Brick Lane), with links to the Call Centres in Coventry and Glasgow. There are also about 10 white vans with mobile camera systems, and some 64 other cameras outside of the zone.
It is obvious that the Congestion Charging systems are an extremely attractive target for terrorists, computer criminals, thieves, stalkers etc, given that they include the home addresses, mobile phone, credit card/bank account details, vehicle details and the movement patterns of VIPs and their families, such as the Royal Family, members of the Government, media celebrities and ordinary members of the public. We are not convinced that there are adequate privacy policies and safeguards in place to protect these.
"Congestion Charging for London" are extremely difficult and evasive when it comes to answering any privacy related questions. Despite repeated phone calls to their relatively efficient call centre (whose front line staff do not, unfortunately have any answers to our questions), emails and recorded delivery letters, they have failed to answer any questions regarding privacy since early September 2002.
We are therefore prepared to believe the worst of them, unless you know different !
Not even Transport for London and Ken Livingstone are happy with Capita's customer service - they have fined them £1 million in "liquidated damages and service credits". The London Assembly Budget Committee is very critical of TfL's contract(s) with Capita. Capita now get £4.90 per paid Penalty Charge Notice (up from £2.06 originally) and were given an extra one off payment of £3.5 million for the IT system they installed, which the Budget Committee feels they should have been mey by Capita not by TfL. The London Assembly Budget Committee also criticises the difficulty which even they, with a statutory duty to examine the spending by the Mayor of London, have had when dealing with TfL and capita.
We would welcome any feedback that would dispell our worries about this scheme as set out below.
Some details about the scheme can be found on the Congestion Charging for London website www.cclondon.com which includes a link to the Transport for London Privacy Policy and a vague assurance on Data Retention, in line with the Data Protection Register entry for Transport for London i.e.
1. Who else has access to the CCTV and ANPR data ?
We are especially worried by media reports quoting the Mayor of London Ken Livingstone about his eagerness to keep the CTTV cameras in operation even if the Congestion Charging scheme fails.
e.g "London charge zone is security cordon too, says mayor" http://www.theregister.co.uk/content/6/29355.html
This may be seen by some an admirable secondary use of the massive CCTV and ANPR infrastructure, but shouldn't money for this be available from other central government policing budgets ? Should there not be proper consultation and transparency about such uses, rather than secret function creep on a local public transport project ?
2. Why does the system record the details of those who have paid or are exempt ?
The system could easily have been designed to distribute the central list of vehicles which have pre-paid to each CCTV/ANPR monitoring point. There is no legitimate reason to record the colour "scene" image and Number Plate image and decoded textual number plate details, camera position and time and date stamp for the vast majority of drivers who have already paid or who are exempt. Such a design would reduce the amount of data needed to be sent to the central system for manual checking and to fine those who have not paid by the appropriate cut off time.
Under the actual scheme, what happens instead is that every vehicle is videoed and has its number plate read, not just those which have not paid (the minority).
3. Who authorised the creation of a centralised tracking database ?This database could be a target for terrorists, criminals and stalkers, since it records the vehicle movements of say the Police or of VIPs like Cabinet Ministers or the Royal Family (whose private vehicles are not exempt)
It is to be hoped that this situation will be remedied in new versions of the software and that a more privacy friendly design is built into any other such Congestion Charging schemes which may try to emulate the London one.
4. Shouldn't the cameras be switched off outside of the charging time period ?
If the purpose of the colour and ANPR cameras is as "Traffic Management, Control & Enforcement CCTV" (as stated in the Data Protection Register), what is the justification for having these cameras switched on outside of the Congestion Charge period i.e on Bank Holidays, at weekends or between 7pm and 6.30am at night/early morning ?
We have had no clear statement from TfL or Capita about wether they keep spying on people obviously not for the purpose of enforcing the Congestion Charge for 49.4% of the time during a year, so we currently assume that they are therefore in breach of the Data Protection Act.
We have evidence of the fact that the Infra Red floodlights used by the cameras are not switched off after 6.30pm, indeed we have evidence of them actually interfereing with the infra red door locking mechanisms of some makes of car! If the IR floodlights are still on (which consume the most electrical power) then it is hard to believe that the CCTV and ANPR systems have been switched off outside of the charging time periods.
5. Data Retention of Congestion Charging image data ?
The Congestion Charging for London website www.cclondon.com states that the camera pictures or images will not be retained for more than 24 hours, unless, of course, an unpaid congestion charge penalty needs to be issued.
During the 24 hours image retention period, and the ANPR data retention period, is this data available to the Police or to other bodies ? It seems that the answer to this is yes, if an application has been made under the Data Protection Act
6. Does 24 hours actually mean 24 hours ?
Will images from a 6.30am Friday be deleted no later than 6.30am Saturday, or does this in practice actually mean the end of the working day on Monday, or even longer if it is a Bank Holiday weekend ?
7. Who has access to the colour video streams ?
Is there a real time analog feed from the colour CCTV "scene" cameras and/or the black & white Automatic Number Plate Recognition cameras from which the "event" snapshots are taken ? If so, who has access to these video streams and what are the Privacy safeguards in place e.g. are the Local Authority Codes of Practice for CCTV Operations beeing complied with ?
Such Codes of Conduct demand consultation with the local people about the siting of any such cameras so that they do not intrude into bedrooms windows etc, especially bearing in mind the "night vision" and zoom capabilities of the Congestion Charge cameras.There has been no such detailed consultation.
Given the report in the Observer newspaper it looks as if there is a backdoor, secret, unaccountable policy of passing CCTV and ANPR data to the Police and to others in contravention of the Data Protection Act. These cameras have not been installed and registered as general crime fighting tools, only as part of the Congestion Charge enforcement system.
"Security role for traffic cameras "
London's new charging zone helps to form 'ring of steel' guarding capital against al-Qaeda bombers" by Mark Townsend and Paul Harris, Sunday February 9, 2003 The Observer
http://www.observer.co.uk/politics/story/0,6903,892001,00.html
N.B. we cannot see how this facial recognition technology, which has singularly failed to catch any petty criminals in the London Borough of Newham, would not result in severe consequences for the thousands of "false positives" who would be matched against a terrorist suspect database.
Even if the facial images were clear, which is unlikely for systems sighted to look at car number plates, the Facial Recognition Vendor Test 2002 results show that even the best Facial Recognition software is pretty hopeless at the task of matching up suspects against a watchlist.
Even if only as many people are misidentified as "terrorists" as there are incorrect or disputed £80 fines as the hundreds/thousands of false postives currently generated by the Congestion Charge system, this will either overwhelm the security forces, or else innocent people will be killed in firefights or high speed chases.
We hope that we are wrong in our assumptions, but , as stated before, Congestion Charging for London/Transport for London/Capita's silence on these privacy issues is deafening.
8. What about the Automatic Number Plate Recognition system data and logfiles ?
What is the data retention policy for the ANPR system data ? Does this also get destroyed after 24 hours like the colour camera images for those who have paid or who are exempt ? Once a penalty notice has been paid, how long is the image and ANPR data associated with it retained ?
Remember that the "image" of your car number plate is essentially redundant the moment that the Automatic Number Plate Recognition System has "read" it and converted it into a text or database record containing the Vehicle License Plate number, the camera identity/location and the time and date stamp. Claiming that the "image" is deleted after 24 hours is not a sufficient assurance that the privacy of the law abiding people who have paid or who are exempt from the congestion charge is not being violated.
9. Backup systems - a privacy loophole ?
Presumably the computer systems will have multiple levels of backup. If the naming convention for individual images files and ANPR records includes the actual (or easily guessed or decoded) Vehicle Licence Plate Number, then there is a danger that the Privacy of normal paid/exempt vehicle movements could be compromised by Tape Backup logs, Database snapshots, Database Transaction rollback logs, Message logfiles, emails etc, even when the original images have been deleted after 24 hours.
10. Software Development Outsourced abroad ?
What assurance is there that no "insider" can use such indirect means in order to track the movements of paid/exempt vehicles ?
Given that such "insiders" with priviliged access are likely to be software developers in India, using unproven Microsoft .NET technology what assurance is there that this mass surveillance infrastructure is not wide open to abuse or monitoring from abroad ?
N.B. there have never been any extraditions to the UK for computer misuse from India, or anywhere else overseas.11. Anonymity of Statistical Survey Data ?
Transport for London are employing third party consultants to monitor the success/failure of the scheme, so presumably they will be handing over lots of data for analysis.
What steps are being taken to anonymise any data about paid/exempt vehicle movements and penalty charged vehicle movements from these statistical analyses ?
The temptation will be very great to attempt to match entry/exit locations and times for individual vehicles, and to correlate these with the home addresses of those who have registered for prepayment or for exemptions or with the DVLA registred Vehicle Keeper addresses. Access to such data would be useful for analysis, but it could also be abused.
What privacy safeguards are in place ?
12. CCTV monitoring signs and Mobile cameras ?
There has been a recent trend for Local Authorities and Police Forces to use Home Office funds to purchase Mobile CCTV and ANPR systems.
Transport for London seem to claim that they are working according to an as yet undefined Code of Conduct. Local Authority CCTV scheme Codes of Conduct require that "overt surveillance " requires some street or building signs that the area is under CCTV surveillance.
There are plenty of big "C" signs on the boundary of the zone, but these are not the only cameras being used . There is a fleet of 10 or more anonymous white Mercedes vans , equipped with CCTV and offline ANPR to cover fixed camera breakdowns and to patrol within the zone to catch residents and others who have parked overnight and have not crossed the zone boundary.
Why do these vans have to be anonymous and why do they not put up temporary signs ? The whole point of such signs is their deterrent value.
Anonymous white vans operated by Transport for Londona, rather than by a legal Police force are definately "covert surveillance" which should be illegal except where specifically authorised for targeted serious crime investigations under the Regulation of Investigatory Powers Act.
Does an "overt surveillance" scheme with signs which are visible in the daytime to people with normal eyesight, become a "covert surveillance" scheme at night if CCTV technology which can see in the dark and can zoom in beyond human visual range, is deployed, as in this case of the Congestion Charge Cameras ?
c.f. "Implications for Public Space Surveillance in the light of
the Data Protection Act 1998"
http://www.crimereduction.gov.uk/cctv7.htm
Given the Evening Standard's undercover report about these vans, it would seem that the staff are underpaid and undertrained and that the technology is not reliable. The vans also seem to spend their time illegally parked, with the cramped occupants terrified of passing motorists and journalists. The report also gives evidence of "celebrity spotting", in this case of broadcaster David Dimbleby by the van crew.
"Exposed: Ken's camera spies" By Chris Millar, Evening Standard, 20 February 2003
http://www.standard.co.uk/news/articles/3488836?source=Evening%20Standard
13. Where is the Privacy Audit policy ?
Transport for London / Capita have not disclosed if anybody independently checks or audits the policies that should ensure the destruction or anonoymisation of data once the Congestion Charge has been paid, and which should prevent the disclosure of private data to third parties -a documented problem with many other systems.
Remembering that this is a public scheme, it is up to Central Government and the Mayor Ken Livingstone to reassure the public that the Congestion Charging scheme is not being run as a "Big Brother" mass surveillance scheme and is proportionate with respect to our fundamental human right of privacy.
http://www.dpr.gov.uk/cgi-bin/dpr98-fetch.pl?source=DPR&docid=3601
N.B. there is no mention of using the CCTV and ANPR infrastructure as a general crime fighting tool. Any use of it for such a purpose contravenes the Data Protection Act, especially if this is done outside of the Congestion Charging time period i.e. at night or at weekends or Bank Holidays
PURPOSE 28
Data Controllers further description of Purpose:
Data subjects are:
Data classes are:
Sources (S) and Disclosures (D) (1984 Act). Recipients (1998 Act):
Sources (S) and Disclosures (D) (1984 Act). Recipients (1998 Act):
Transfers:
Return to the
Watching Them, Watching Us
UK Public CCTV Regulation Campaign
Home Page
email: [email protected]