September 28, 2026 · TRANSPORTATION · 16,389 words · 11 speakers · 160 segments
Good morning, everybody. I call the Joint Informational Meeting of the House Judiciary and Transportation Committees to order. This meeting is being broadcasted and recorded. I want to thank the members of both committees for coming together for today's meeting. Over the past few months, there's been growing public discussion about the use of automated license plate reader systems in Pennsylvania. These devices are cameras equipped with software to detect and record images of passing vehicles. These are used throughout the country for various purposes, including law enforcement. These devices are often manufactured and provided by private companies such as Fox Safety, Motorola, Axon, and many others. Many of us have been contacted by concerned residents who are alarmed on how these devices work, how they are being used, how the data is being collected, how the data is being shared, and what privacy protections exist for these devices for the public. The purpose of today's meeting is to answer some of the questions so that we as lawmakers can decide what actions need to be taken. Today, we will be hearing directly from multiple experts representing different groups who have actual experience with these types of devices. Each presenter participating today is here voluntarily, in good faith, in the hopes of having thoughtful discussion. We're also in receipt of written testimony and written presentations. All written presentations will be shared with the members and made available to the public on the committee's websites. some members may disagree. With some of the viewpoints expressed here today, I expect everyone within this meeting to be treated with respect and courtesy. In the interest of time, I will ask members and presenters to keep their questions and answers brief so that everyone has an opportunity to speak. Members who wish to make general comments on this issue may do so in writing, which will be included in the public record. Any questions that do not get answered today can also be submitted in writing to the committee staff after the meeting, and we'll get those answers for you. Members can also issue their own public statements on their own time. But during today's meeting in this room, with limited time, I ask members to keep the meeting moving and questions, not commentaries. now i will ask my fellow chairs if they have any opening comments
chairman briggs will be uh joining us in a little while chairman benninghoff very briefly thank you mr chairman i echo your comments i think this is an important issue unfortunately probably an issue a lot of people don't totally understand so we are here to be better informed about what's really the truth and what people know. I think the biggest concern most people have about any type of cameras or surveillance is what's being done with the data and how long it's being retained, and I'm looking forward to learning a little bit more about that. Thank you.
Chairman Kaufman.
Thank you, Mr. Chairman. I appreciate it. I do have a couple of members here, but please excuse if a few of my members are on leave and I'll be here for about an hour. But we did learn about this committee informational meeting by chance through the LDP on Wednesday So we did not have this prepared in our schedule in our calendar But this is an important issue nonetheless and so you know several of us wanted to make this a point to be here because there is a lot of conversation in our communities I think wherever you are in the Commonwealth over ALPRs and what place they have in our society.
Thank you very much Mr. Chairman. Thank you chairs. First panel, I would ask the first panel come up to the table. Our panelists include Kevin Kane, Director of Government Affairs for Flock Safety, Scott Bone, Executive Director of the PA Chiefs Association, and Alex Mohn, Secretary of the Executive Board of the Pennsylvania State Troopers Association. Each panelist will have a couple minutes to give each other brief remarks, then we'll jump into questions. Mr. Cain, we'll start with you. Make sure your button is pushed and your light is on, and please bring the microphone close to you so we can all hear you and make sure the people online, the members online that have joined us can see us here as well.
Good morning, distinguished members of the Judiciary and Transportation Committees. My name is Kevin Cain, and I serve as Director of Government Relations with FLOX Safety. I'm pleased to be before you today to discuss FLOX automated license plate readers, or ALPRs. As the committee is aware, ALPRs have become a vital tool for law enforcement investigations, but we also believe it must be used in concert with strong policy and guardrails. That is why we're calling on the legislature to pass a bill that would establish clear data retention standards, prohibit the selling of data, require regular audits, and require ALPR vendors to provide technology that can be used to better assist the audit process, require industry-leading cybersecurity practices and certifications, and require consequences for any misuse of ALPR data. Now, broadly, flock safety technology is used by law enforcement in more than 6,000 communities across the country, But most importantly, an average of 27 people per day are safely recovered and reunited with their families due to the hard work of men and women of law enforcement using FLOC ALPRs. Now, it is important to note that all customers, even in states that do not have laws governing ALPR use, own and control 100% of their data that is collected by the system, and we do not sell data to third parties. Additionally, Flock ALPRs do not use facial recognition. Customers have complete control over who they choose to share data with, and sharing relationships can be terminated at any time. Most sharing works like a LinkedIn request, and each party needs to issue a request and accept one. Whenever the Flock network is accessed, it requires a search reason. Flock will also now require all law enforcement agencies to include a case code as well. Every single search is preserved permanently in an audit trail available for oversight. For additional transparency and oversight, FLOC provides our customers with our audit assist tool to help further regard against misuse and strengthen accountability. The bottom line is that FLOC LPR data is simply images of vehicles used for legitimate law enforcement purposes and then deleted permanently. The vast majority of these images are never accessed, and when images are accessed, that access is controlled and monitored. Block Safety looks forward to working with both these committees and supporting legislation that delivers on these key priorities for the citizens of Pennsylvania. Thank you for the opportunity to appear today. I look forward to your questions.
Thanks, Kevin.
Good morning, Mr. Chairman and members of the Senate and Transportation and Judiciary Committees. On behalf of the Pennsylvania Chiefs of Police Association thank you for the opportunity to provide the law enforcement perspective regarding automated license plate reader technology and the legislative proposals presently being considered in Pennsylvania Again my name is Scott Bond I the Executive Director of the Pennsylvania Chiefs Association. The association recognizes both sides of the public policy discussion surrounding ALPRs, the automated license plate readers. These systems have become important investigative tools for law enforcement. They can assist police officers and investigators in locating stolen vehicles, identifying vehicles associated with serious criminal activity, locating missing or endangered persons, developing investigative leads, and enhancing officer and public safety. At the same time, the association recognizes legitimate concerns involving privacy, data retention, access, cybersecurity, information sharing, vendor practices, and the potential misuse of collected information. Our position, therefore, is straightforward. Pennsylvania should regulate the responsible use of automated license plate reader technology rather than eliminate an effective public safety and investigative tool. The PCPA supports reasonable statewide safeguards governing who may access ALPR information, the purpose for which information may be queried, how searches are documented and audited, how information is protected and retained, when information may be shared, and what consequences should apply when an individual intentionally misuses the system. What we believe should be avoided is legislation that attempts to address misuse by substantially eliminating legitimate law enforcement access to the technology itself. The distinction, we believe, is critical. The policy discussion should not be framed simply as a choice between unrestricted surveillance and prohibition. There is a responsible middle ground that protects individual privacy while preserving legitimate law enforcement capabilities. That approach is consistent with the position that the PCPA has previously articulated publicly. Finally, lawful ALPR use should be accomplished or accompanied by written policies, limited authorized access, audit trails, retention controls, cybersecurity safeguards, controlled information sharing, and consequences for misuse. ALPR technology, when paired with strict operational accountability, safeguards our communities without infringing upon constitutional rights. We urge the committees to advance a balanced framework that penalizes wrongdoing while keeping this vital asset in the hands of our officers. I want to thank you for your time and your leadership, and I'm certainly happy to answer any questions that you may have, and certainly we have supported our oral testimony with a more lengthy and detailed written response. Thank you. Thank you.
Alex, please proceed.
Good morning. Chairpersons, members of the House Transportation and Judiciary Committees, thank you for the opportunity to address automated license plate readers, including Flock cameras. My name is Alex Mohn. I am a member of the Pennsylvania State Police I currently serve as a Patrol Unit Supervisor in the Patrol Unit at Troop T Bowmansville in Lancaster County It is important to note that today I speaking to you as a member of the Executive Board of the Pennsylvania State Troopers Association I am the secretary of our organization that represents the 4,000-plus enlisted members of the Pennsylvania State Police. For troopers, a plate reader alert can help locate a stolen vehicle, find a missing or endangered person, or identify a vehicle associated with a dangerous offender. Earlier records can also provide a lead in criminal investigations. These examples make this technology an essential tool in the day-to-day operations of a police department. We also understand the need to properly regulate how this technology is utilized. The House is considering this issue through several distinct measures. House Bill 1125, Representative Joshua Siegel, remains before the Transportation Committee. House Bill 2771, Representative Jen O'Meara, was referenced to the Judiciary Committee on September 14, 2026, and contains proposed rules for use, storage, sharing, destruction, and penalties. Two additional co-sponsorship memos offer approaches that deserve the Committee's attention. Representatives Brenda Pugh and Jamie Walsh have circulated a proposal focused on vendor control of data. Their memo would prohibit an ALPR vendor from selling, disclosing, or providing access to data without the contracting law enforcement agency's express authorization. It also calls for security standards and expressly preserves legitimate information sharing between agencies, task forces, and fugitive apprehension efforts. The PSTA sees value in the memo's central principle. The agency that collects law enforcement data should control access to it. Representative Tariq Khan, joined by Representative Nathan Davidson, and other members have circulated a separate memo addressing misuse of flock and other plate reader data. It proposes documented reasons for searches, audit trails, retention standards, and transparency requirements. It also proposals civil penalties, a right of action for people harmed by misuse, and enforcement authority for the Attorney General and District Attorneys. These are proposals in a memo. The final bill language is not available yet for review. The PSTA supports safeguards against unauthorized access and personal use of this information. We ask the committees to make those safeguards practical and workable for day-to-day law enforcement use. Troopers must be able to act promptly on alerts, conduct documented searches of earlier records, preserve information for evidentiary purposes, and share relevant leads with authorized criminal justice partners. House Bill 2771 warrants careful examination on those points. It would assign the Pennsylvania State Police a role in determining secure data storage and would permit sharing with law enforcement and criminal justice agencies performing official duties. It also proposes training, documentation, destruction, rules, and criminal penalties for certain knowing violations. The committee should clarify how those provisions apply during urgent investigations and how agencies preserve records needed in active cases, long-term investigations, and court proceedings. We respectfully ask the Transportation Committee to examine deployment and vendor custody, including the approach outlined by Representatives Pugh and Walsh. We respectfully ask the Judiciary Committee to examine access, retention, sharing, and liability, including the concerns raised by Representatives Kahn and Davidson. The PSDA is prepared to provide operational testimony and work. with the sponsors on clear language that protects privacy and preserves legitimate investigative use. Thank you, and I welcome your questions. Thank you, gentlemen. And Mr. Mowen, I can assure
you this is why we're here today as together, judiciary and transportation, so we can work on one solid piece of legislation, hopefully push forward. Mr. Kane, driving down the street with My kids in the car the other day, my young men, they're not kids no more, and they say, oh, there's one of those flat cameras at the red light. Now, I know it wasn't a flat camera at the red light, and it was just a signal light. Where do your cameras usually go? Because there's a frenzy now across the country, not just here in Pennsylvania, but every time they see a camera, it's you.
Yes, sir. Thank you very much for that question. Typically, our cameras are deployed on the side of the road. in a fixed pole in a singular location. We may be attached to existing infrastructure, like a telephone pole, if there are appropriate permits. But a vast majority of the time, it's going to be on a standalone pole.
And what data do you collect? What do you collect the data for, and what is it used for? Because I always think of intersections. 100,000 cars go by this intersection, but I don't want to answer your question. I want you to.
If I can answer it by clarifying what it does not do first, and then I can get to what it does do. So, to be clear, there's no facial recognition technology. Second, there is nothing that is tied to any names, dates, social security numbers, addresses, any personal identifiable information. This is an image, a still image, of a vehicle in a public setting. This is not a speed camera. You are not going to get a speeding ticket from a Flock camera. Again, what Flock cameras focus on is objective evidence that you can see in plain view to include the license plate as well as information like the make and model of the vehicle.
Who do you partner with?
Yes, primarily law enforcement is our biggest customer. But we do also have some customers that have lesser capabilities in terms of what we provide to the private sector as well as HOAs. but it is very different than what law enforcement have.
Thank you, Mr. Cain. Chairman Kaufman.
Thank you. I was going to go somewhere else, and I may go there anyway, but for you, Mr. Cain, just in the questioning and the comments with the chairman, so, for instance, if there's a flock camera at a retailer, I mean, recently I've seen it in my local retailer. It was in the news Lowe's.
Yes, sir. Lowe's of Chambersburg.
The flock camera has been cut down a couple of times. At least I believe that's the case. You probably have seen that. How do they – what data can they access? Because they're a private entity. So, yes, I understand they may want to monitor what's on their premises, but I don't think Lowe's has any right to go and check all the other cameras in the FLOC system. That's my personal opinion, but that's where I'm at.
Yes, sir. I completely agree with your point, and thank you for the opportunity to clarify. So in this case, Lowe's may choose to share data with only their local law enforcement agency, their local police department, but nobody else is going to have access to that data other than just that local police department They do not have to share with that local police department They may only choose to share any data if say there was a crime or their loss prevention team is sharing other information to law enforcement. But I completely agree with you. No one else should have access to
that data except for that local police department. Now, does Lowe's, and I hate to be using them, I mean, it's a real-life example. Do they have access to the other data?
No, sir.
I hear what you're saying, but I want to make sure.
Lowe's only has access to the data on their property. Correct. Correct. Hard stop. Lowe's has access to their cameras, and they don't have access to the broader network.
Okay. All right. Thank you. I appreciate it. Can I? Yeah. Sorry. On that. So they take those pictures, and that's all they have access to is that picture. They can't go out and get license plate information. They can't get any of that information unless they partner with the local law enforcement agency or they turn that information over to the law enforcement agency to do whatever they have to do. Somebody robbed them. Somebody did something.
Yes, sir. Thank you for the opportunity. So, again, if there was an image. They have the data, but they don't have access to the information behind that data. That is correct. Yes, sir. So if they chose to share an image, you'll see an image of a vehicle as well as a license plate. That's the extent of the data. That is all they would have. And certainly existing security cameras have far and above more information than an image of a vehicle and a license plate in a public setting. But that is the extent of the data.
Okay, thank you. And for our law enforcement partners, we appreciate what you do on a daily basis and you do it well. I don't want to speak with authority, but I suspect the Pennsylvania State Police and your troopers have the longest standing relationship with ALPRs in the Commonwealth. They've had them in vehicles for quite a long time. Can you share that experience? How long it's been? And I'm assuming those devices are used far more than the stationary cameras, but the in-vehicle, is that correct? And can you share a little bit more about that?
Yes, certainly. I wouldn't say it's been an incredibly long amount of time. It's more recent that we've been equipped with the in-vehicle ALPRs. Those units are – it's an Axon product. The units are integrated in our MVR systems that are mounted in our vehicle. It's one single unit. So it's an MVR camera, and then there's an ALPR camera integrated in that.
Are we talking more than five years?
I don't believe it's been five years. All right.
And some local departments, the same, They have been working with different companies. I know locally, Motorola, I believe, and Chambersburg is who they work with. What is your experience with local departments? Are they utilizing the in-vehicle ALPRs more than the stationary ones?
Scott, they can't hear you.
As my colleague had stated, as he was mentioning various pieces of legislation, you know, I think it important for any legislative action as we move forward and I just like to repeat I think there some five guiding principles that need to take place I appreciate there is certainly a lot of public misinformation about the use of these cameras data retention and the purpose. But, you know, we believe strongly that, you know, affirming a legitimate, there has to be a public safety value to certainly what we do and in legislation, and that we should implement rigorous standard privacy protections. You know, establish absolute operational accountability. I think that is across the law enforcement network, whether it's federal, state, or local. Mandate that ALPR output is an investigative lead. It's not conclusive evidence. All of this stuff has to be corroborated at some point. And reject blanket prohibitions in favor of targeting misuse. And I think that can be accomplished. And we're hoping that both committees and the legislature it reach out to its law enforcement partners, you know, to seek that type of guidance and input as we move forward.
Okay, thank you. One last question. So warrant requirements, I want to understand where you are on that. So a law enforcement partner gets a hit on a single ALPR, a license plate. explain to me what would be the harm in then saying there's that individual hit, I need to go to the court and get a warrant to search the system wide. Could you articulate what the problem is with something like that in law here in the Commonwealth?
health. One problem I can anticipate would be if it's an active alert. So for an example, a colleague of mine not too long ago received an active alert regarding a person of interest in an attempted homicide case out of the central part of the state when he was on patrol. Because of that active alert, he was able to conduct a traffic stop, ultimately take the individual into custody. So that I have no issue obviously with the proper due diligence and proper privacy measures, but that could potentially be one. That active alert went through the proper
channels to become an alert though, correct? Oh yes, yeah. So like when we get an alert
through our system, we'll get an alert. It's again through the Axon system. It's based on data that's uploaded into that system. And then that actually has to be verified before we can take any enforcement action. So any alert we would get would be from information that goes to the proper
channels, as you said, to be uploaded into that system in the first place. Thank you. Representative
Helen Stein. Thank you, Chair. And I also just want to say, as a member of both of these committees, I thank all four chairs for conducting this meeting and appreciate all of you for coming. I have three different points, Mr. Cain.
Before you start, we want to talk questions, Joe. We addressed that in the beginning, Rep. Yes. Questions? No commentaries, please.
Yes, Chair. I understand. So the three different things that popped out to me in your written testimony, Mr. Cain, and you can speak to any of the three, but I'd like these three issues to be addressed, later if you can One is the concept of a search reason And I think for our law enforcement partners that will be an important thing in terms of probable cause warrants warrantless information that type of thing I think that getting a handle on that search reason concept that you used and putting it into the legal concepts of warrant requirements, probable cause, exigent circumstances, those types of things. Second, you referenced that in the chain of custody, the information from the device goes to Amazon Web Services in, I suppose, the cloud someplace. To me, that's greens of a private company having access to this data. and I don't see from what you've told us where that necessarily goes. And that is going to be really key. And maybe similar to that or sort of connected to that, and it sort of made me go back to my watching the expert witness in My Cousin Vinny, who gave you all the different details and everything, but your third to last paragraph you list going through FBI and regulatory sites and NSB lists and that and the other thing, and it felt like a whole bunch of jargon that I didn't know.
Yes, sir.
So those elements, and for our law enforcement partners, I appreciate if you can dive into these issues as well. Mr. Bone in particular, I appreciate your laying out those five principles for us of public safety, accountability, making sure that it's investigative, not conclusory. And then the one issue that I would want to just raise up that I have concern with is avoiding a blanket prohibition versus targeting misuse. that's a very nuanced thing, even though it doesn't seem like it is. And I think that's a concept that I think we're going to have to be very careful of. But thank you. And Mr. Cain, if you can answer any of those.
Yes, sir. I'd be happy to address every single one of those. When an officer signs in to FLOC, after utilizing two-factor authentication, and that police officer wants to conduct a query on FLOC, the first thing that you're going to see is a drop-down menu of what is the reason you're here. And this is based off of NIBRS codes, National Incident-Based Reporting System codes, effectively listing out every type of crime that you could be investigating. You have to select one. Next to that field is a case number field. Moving forward, this is something that's going to be mandatory utilizing FLOC to input a case field that's specifically tied to that investigation. If in the event there is an exigent circumstance and maybe a case isn't available, then that would automatically be flagged for review. This is something that we're working on. But we have two distinct fields to clarify exactly what the crime that's being investigated, what the case number is, as well as any other information that may be related to that case. All of that information is saved permanently in our audit logs. And you cannot conduct a query until you have that case number and that National Instance-Based Reporting System code clarified. We want to understand exactly what this search is. Second, with regard to your concerns about the cloud, sir, I absolutely understand how big tech has abused the trust of the public. I will be more than happy today to follow up with a detailed document that we have from our cloud provider that discusses specifically How this data is encrypted, how we guarantee it is deleted after a set time period, and how there is no unauthorized access. I'll be more than happy to provide that for the committee today.
Yes, please do that, Mr. Cain, and get that to Kyle.
Thank you. Absolutely, Kyle. I will get that today. Finally, with regard to the security standards, as I indicated in my opening statement, We believe that all vendors should be held to the highest standard in terms of protecting security, and that's what I was outlining there.
Thank you, Representative Pugh.
Thank you, Chair. Thank you, Chairman, and this is a really important hearing, and I'm glad we're able to address it. I do have a couple of questions, so I'll get them out real quick. I don't know if everybody realizes, but these ALPRs started way back when Pennsylvania stopped doing registration stickers. It was a way for law enforcement and the Turnpike and everybody to make sure that we are registering our cars and they're remaining on the road safely. That's when this beginning premises started. So a couple questions I have. The criteria, Mr. Cain, that you're talking about, is that new?
Why is everybody seeing all the news reports across the country of abuse? Is the criteria new and something that you're putting into place? No, ma'am. The criteria itself is not new. I can't speak to specifically why we're seeing what we're seeing on the news take place. I would note, though, that we do have our audit logs. Those have been working as intended in terms of conducting regular audits. And I'd also note that Flock is the only vendor that I'm aware of that not only does provide these audit logs, but provides an audit assist tool to better identify that needle in the haystack of where specifically might there be misuse. We've invested significantly to make sure that this technology is used appropriately, and we're going to keep doing that.
Okay, great. And then there is, just for clarity, Lowe's can't search backward into law enforcement state of base.
Correct. Yes, ma'am. I just wanted to make sure we got that on the record. That is 100% correct, yes.
Okay. And then at this point, Flock or anybody else that you know of is not using the new technology that's coming our way. A lot of people may not know about it. searching the IEMs and searching the technology in our phones and our watches every time we pass a camera system.
That is not a flock technology. I think whomever is the vendor should be held accountable publicly to discuss why they're working on it.
I just wanted to do some clarity here.
That's not flock.
Okay. Thank you, and I appreciate that. And I don't think anybody from what I'm hearing on this testified today has any problems with a stage of the game, putting a warrant requirement in, with a stage of the game making sure that the Fourth Amendment, and we're not actually going out and we're not actually surveilling our communities, correct? Everybody's good with stuff like that. And locking that back end down, would FLOC be okay? I call it shutting the back door. And then even if FLOC needs to go in and do licensing and do something, that they would get approval from the local department to go in and access what we call their system because that back door is locked.
I want to make sure I understand your question correctly. So if you're saying if we would be okay, if there's a way that we could provide technical support, without accessing any data, absolutely we would be in support of something like that. We're a vendor. We provide technology for the government, and we will build to what the government needs.
Okay. I truly appreciate that, and I appreciate the work that everybody's doing to keep our communities safe. So thank you for some of the clarifications on that.
Thank you. Representative Powell?
Thank you so much for your testimony today I had a question about cybersecurity and hacking So as I understand it flat cameras are tied to LTE cellular communications networks, right, that are largely dependent networks. We're seeing a lot of cyber hacking across the country, whether it's municipality, water data being hacked and released. Can you talk a little bit about what you're doing to prepare inevitable cyber attacks and particularly foreign attacks?
Yes, ma'am. Absolutely. Thank you very much for that question. We actually just recently released a Bishop Fox report discussing the specific steps that we are taking to make sure that our systems are using the absolute best industry practices. I'll be more than happy to share that with the committee for review. But we've addressed all major issues that we've seen come up. We will continue to make sure that the services that we provide use the absolute best standards possible. But I'll be happy to share that report for very specific details of actions that we've taken to date.
I appreciate that. And I would just push the question a little bit further. I know that Wired, I believe, did an article recently about how hackers were able to very easily get into internal flock information. Could you talk about what happened there, where were the missteps, and what you're doing to remedy that?
Well, it was very unfortunate, again, to see the theft and the hacking and the dissemination of stolen, hacked material permeate online on many social media sites that allegedly have policies that prohibited doing that. But I want to be very clear that there was no cloud data accessed in that alleged theft and attack of a flock camera. So the system was never accessed. Furthermore, I believe that article proved that Flock does not use facial recognition, and the only times that images of persons were even captured was because they were riding a motorcycle or something to that effect. So, again, the system, the network itself has never been hacked. We know that there are bad actors that work every single day to attack systems. I myself have been the victim of the OPM attack where I had all of my information stolen. I know what this means to have this type of information out there. And, again, FLOC takes this very seriously. We've invested very heavily, but I want to be very clear that the network itself was not hacked.
Could you clarify that if the network wasn't hacked, they were still able to pull images. So what were they actually taking then?
The images of vehicles in a public setting were taken on the camera itself before it was sent via secure network to the cloud. And so effectively, it's my understanding that those hackers obtained as much information as if they set up an iPhone on a tripod and captured pictures of cars as it drove by.
Thank you. Representative Kupra.
Thank you. Thank you all for being here. Mr. Kane, my questions are directed primarily to you. I'm a firm believer that America should not be a surveillance state. There's a lot of information going on right now. One piece of information I heard is that there's a major push to keep these types, the locations of these cameras, secret. Why would that be?
it's my understanding that on December on Tuesday September 22nd a malicious actor published a website with location data of customer devices and that was stolen information And so again I think this comes down to hacked information that was stolen that would be the cause for our concern.
Okay, so if that answered my question, I missed it, I apologize. Why, if we're going to have these cameras across America, which I object to, why should those locations of each individual camera? And I get that we all should have the right to surveil privately owned property. If I want to put a camera up on my farm because there's been some kind of a bad actor, I should be able to do that. But why, if you're talking particularly about a place like Lowe's, where it's probably not just getting their private parking lot, it could potentially be getting public spaces too, or your municipalities, your law enforcement. If these are cameras that are going to be surveilling public spaces, why should the public not have, particularly if it's being paid by public funds. Why should they not know exactly where those cameras are?
I think that's an excellent question for the legislature, not a private company. We think that's the kind of thing that should be addressed in legislation.
Thank you. So how long is the data stored for in the cloud?
So we have historically had a 30-day data retention policy by default, and we've moved that to seven-day by default for new customers, and that's going to be applicable to all customers, I believe, beginning next year. But historically, it's been 30 days.
And you're talking about around-the-clock video surveillance?
Well, this is not video, to be clear. These are still images.
Okay. So it blows my mind. No wonder we need more AI data centers.
Ralph, I'm going to ask you to pull it in a little bit, please. Thank you, Chairman.
All right, we're not data centers. Thank you.
So you said that the seven-day default, your consumer, your customers, they can change that seven-day default?
Any elected, democratically elected body can change that. So a local government can change that to 21 days, 30 days, whatever they vote on. Again, we are a company that provides a service, and we want to be responsive to the communities that we serve.
Okay, so and then you're not just your government agencies, then your private consumers as well. What's the max that they can keep this information?
I'm not aware of anything beyond 30 days for private customers.
So is the consumer able to download the information and privately store it on whatever technology outside of the cloud?
Again, it's their data, but I think you're bringing up an important point. This speaks to the fact that there should be regulations as to how this technology is used for all services.
Okay, so please answer my specific question. They're able to download and keep.
Counselor, we're not in court here. Relax.
No, but we are in hearing.
This is it. I'm going to rule you out. I'm not going to debate it with you. You're going to treat them with respect. We're not treating them. This is not a witness here. These are testifying for us. They're doing us a favor. Came in under good faith. That was my opening statement. We're not going to attack anybody here. All right, nice, easy questions. Here's the last one. I apologize if my questions seem aggressive. That's not my intent. You've indicated that your company has taken great steps to preserving the confidentiality of this information. How many times in the last year has your information or your private security measures, how many times in last year have you guys been hacked?
I'm not aware of any times that the Flock network has been hacked.
So there's not been any confidential information that's been accessed by a non-authorized person?
Well, again, to be clear, we don't capture personally identifiable information. Flock cameras are images of vehicles in public settings So in the last year there been
Next panel up. Next panel will be Craig Shuey, the Chief of Operations Officer for the Pennsylvania Turnpike, and Ron Grutza, Senior Director of Government Affairs for Pennsylvania Association of Boroughs. Thank you gentlemen. Mr. Schuhe, could you please start us off?
You bet. Thank you sir. Good morning Chair Nielsen, Chairs Nielsen, Benninghoff, Briggs, Kauffman and members of the House Transportation and Judiciary Committee. Thank you for the opportunity to provide information about how the Pennsylvania Turnpike Commission uses automated license plate recognition or ALPR technology as a part of our tolling operations. As the Pennsylvania Turnpike continues to transition to a modern highway speed, tolling technology plays an important role in ensuring transactions are processed accurately, efficiently, and securely. ALPR cameras work alongside EZPass readers and vehicle classification equipment to identify vehicles and accurately process toll transactions while customers travel safely at highway speeds or exit through an existing tolling point. The information collected through this technology has a specific operational purpose. Transaction and image data is transferred from roadside tolling equipment to our tolling systems in near real time and is used for authorized purposes including billing, transaction validation and toll enforcement. Images and supporting toll information are ultimately transferred to our back office system for proper identification and billing. We recognize that collecting this information comes with an important responsibility to protect customer and vehicle data. Access is limited to appropriate Turnpike Commission personnel and Transcor, our tolling support vendor and is only accessed when it's necessary to support the tolling system and process transactions. Individual access must have appropriate credentials and the systems are protected by security measures including firewalls, password protection, and to prevent unauthorized access. There are several stages of image storage within the tolling process, each serving a different operational purpose. The roadside camera equipment retains images for a few weeks. Application servers maintain images for a few months. Once images and associated information are transferred from the roadside system into the back office environment, they are maintained within a database to move to longer-term storage in accordance with applicable data retention practices. Access outside of the Commission is similarly limited. TransCore has only access necessary to provide tolling system support, and electronic tolling collection information is not maintained for general public access. Importantly, Pennsylvania law already provides for specific protections for electronic toll collection information, account holder information, including names, addresses, account numbers, account balances, and personal financial information, vehicle movement records, and other data collected by the Turnpike's electronic toll system is statutorily protected from disclosure. Law enforcement must obtain a warrant based on probable cause before acquiring electronic toll information. The Turnpike Commission reviews each warrant to confirm that it was properly issued by a court of competent jurisdiction and that the requested information relates exclusively to an ongoing criminal law enforcement investigation. Currently the tolling system is primarily used to capture and retain toll by plate images. As we modernize our back office system, we are evaluating retention of tolling images associated with valid EZPass transactions and toll by plate transactions. This will provide additional information to help validate transactions, resolve discrepancies and ensure that correct vehicle and customers are charged the correct toll. As a part of this transition, the Commission is also reviewing appropriate retention requirements that would apply to images and associated information. Any changes would continue to incorporate appropriate access controls, cybersecurity safeguards and data management practices. Ultimately, the Commission's objective is very straightforward. Collect and use the information necessary to operate an accurate and reliable tolling system, protect the information that is statutorily confidential, restrict access to those with an authorized business or legal need, safeguard that information from unauthorized access, and responsibly manage how long it's retained. Thank you.
Good morning, Chairman Nielsen, Chairman Kaufman, Chairman Briggs, and members of the House Transportation and Judiciary Committees. My name is Ron Grutza. I'm Senior Director of Government Affairs for the Pennsylvania State Association of boroughs. We represent over 900 borough governments throughout the Commonwealth and thousands of elected and appointed borough officials throughout the state. Just happy to be here today. Just going to give you a little summary. You have my written testimony. Boroughs throughout the state do have a lot, have their own police departments, small to mid-size police departments. We are here today just to support the local decision to have the technology necessary to keep communities safe. And particularly, you know, in my testimony, I did point out some of the success rates that, especially given vehicle theft, vehicle theft spiked after the pandemic. It has come down a lot, but some of the things that I noted in the testimony were that having the ALPRs in your community can decrease vehicle theft and increase completion rates of those crimes. So that's something that our members, of course, we want to be able to, of course, have the option to keep this technology. You know, certainly they are helpful in locating missing persons, identifying stolen vehicles or vehicles involved in violent crimes and providing real time alerts. But most importantly and it was touched on by Representative Pugh is the Act 89 from 2013 when Act 89 got rid of the license plate sticker to visually identify properly registered vehicles So my members, when that happened, they weren't too happy because now it was going to take a long time. It's very labor intensive to run that search. So when the ALPR technologies came out, they're on the cruisers, they can really catch a lot of those unregistered vehicles. So we want to make sure that the motor license fund is fully getting the amount of money that should be up there. So we want to make sure that those vehicles are registered. Secondly, with code enforcement, our members have junk vehicle ordinances. So that's something that our code enforcement officers, when they had the vehicle registration sticker, they could always see whether it's a junk vehicle or it's a properly registered vehicle. Now they have to call in these things, so they need that technology to be there. Also, parking enforcement as well. I know parking enforcement, if you have the opportunity to park here in the city of Harrisburg, you'll see those parking enforcement vehicles do have ALPRs on them. So, also, one real-world success story I just want to point out. In 2020, Whitehall Borough, in all points or beyond the lookout, bulletin was put for a potential domestic terrorist for that vehicle. The ALPR in a neighboring community picked that up. That person was – they found explosives and other weapons on them, and they had been making threats to officials in Harrisburg and Washington. Thankfully, the ALPR system allowed the law enforcement to quickly get that criminal off the street, and we were glad to see that that saved lives in that instance. Of course, as was mentioned already, this technology does not come without some concern. There are, of course, data retention issues. There's the bad actors who are accessing data, transparency issues. But I think that they are really solvable. And we are supporting certainly reasonable guardrails, strict retention limits, audit logs for every search, prohibitions on certain queries and public reporting, the prohibition of the sale of data. So that's something that we'd be happy to work with the General Assembly on, but we just want the General Assembly to know that we are opposed to the prohibition of this technology because our members have already made the investments to have this technology working in their communities. We're happy to work with you on the guardrails, on the guidelines to use it responsibly and effectively. So thank you very much for your time and attention to our testimony Be happy to answer any questions at this time Thank you gentlemen You see there not a whole lot of questions from the committee members up here because of your constant contact with all of us all the time
I've got to say that and compliment you on that one. Mr. Shui, I'll start with you real quick. Yeah, you're doing a new system throughout the turnpike. We're seeing gantries all over the place. How many other states use those gantries? Because they're all capture our license plate. If I don't have an E-ZPass, it grabs my plate, correct?
Anywhere that is using an E-ZPass system or an electronic toll system nationwide is using a system very similar to what we are. There's a few states that are still managing a cash part of the business as well. Those places still have the same cameras, though, because they've got an E-ZPass system. Often transponders aren't read correctly for a variety of reasons. and sometimes it's the transponder, and sometimes it's where it's mounted and how it's maintained. But they all have to retain that information so that they can get a valid toll and direct it the right way. So every system nationwide has something similar to what Pennsylvania does.
And that brings me to the next point, because I may or may not have a kid that does not like keeping the E-ZPass in his window because it's not cool. And when he drives out to West Virginia, you've gotten these calls.
We have gotten those calls.
Because we pick them up off the plate. Yeah. And that's how you, and then you align that with the transponder. So that's a whole lot of data points that the turnpike collects just for that turnpike, right?
We do. If the tag is read in the vehicle, the image is taken, but it is not saved and not transmitted. If we can, at the lane side, validate a transponder, it shows up in the tag file, meaning the other agencies from New York to Florida have sent us that information and we know it's valid. That image is not captured and kept, or not kept. It is captured, but not kept. If we get a plate, we take it to our processing side and move it towards identifying the actual vehicle. If we can match it to an EZPass account, it gets posted that way. If not, it goes out as a toll-by-plate invoice.
Thank you, and thank you for saying the thing that had to be said. We are opposed to the prohibition because we see other people from cities, from towns, from little counties even saying we're outlawing these. And that's – there's a lot of law enforcement that put – they're out there all day long for us, and this could put their lives in jeopardy. So I appreciate you putting that on the record. Rep. Pugh.
Hi. Yes, thank you. I do have a question on the Turnpike and the ALPRs that you're using up there. Are they just an ALPR? Like, are they the Flock ALPRs? Are they the Motorola ALPRs? Or are you using something different?
So the tolling system is made and manufactured by a company called Transcor. It's specific for tolling purposes. What's on the gantries, what you see now, is exclusively a Pennsylvania Turnpike product.
We get the access and the information. It doesn't pass out of us, again, unless a court order or a subpoena has been issued. Okay, so it stays in-house. And I'm curious, on your cameras, how many misreads are there? And is there a human verification? Because I'm sure there's a lot of us that are here that have gotten the misreads and say, that's not my license plate nor my vehicle.
It's certainly one of our customer service issues that we deal with frequently. we run a confidence level on the plate when it's read as a plate only. If it doesn mean I think it a 75 threshold it runs through a manual process where somebody is putting eyes on it and matching it to matching the numbers on that plate So that would be after the challenge came back That's right.
Yeah. Okay. Yeah, that's something I think should be changed even though we're doing with the flocks and the land enforcement. Well, it's not always. That happens before it gets to a customer in most cases.
In most cases, we're seeing that confidence level, we're reviewing it manually and then ensuring it before it goes out. There are certainly some that get through, no doubt about it, but it is a very small percentage.
I think that's a big problem. We just want to make sure verification is correct on the read of the plate. Thank you.
We do too.
That's the last question. Thank you, gentlemen. Thank you for presenting in front of us this evening.
Thank you, Chair.
This morning. Appreciate you. We will call our next panel up. Panel three. Here we go. Oh, it's in there. It's bigger, huh? We have Elizabeth Randall, Legislative Director for the ACLU. Tad Marlow, Senior Policy Counsel for the ACLU. Dina Dyer, President of the Women's Law Project. Lisa Femia, Staff Attorney for the Electronic Frontier Foundation, who is joining us virtually. Mitchell Smith, Legislative Counsel for the Institute of Justice. I think that's all we got, right? Oh, Chad Marlow is also joining us online. We'll start with you, Elizabeth.
Good morning. Thank you very much. Good to see you. Good morning. Good morning, Chairman Nielsen, Chairman Briggs, and Chairman Kaufman, and members of the House Judiciary and Transportation Committees. My name is Elizabeth Randall. I'm the Legislative Director at the ACLU of Pennsylvania, and I am here today on behalf of over 100,000 ACLUPA supporters and members throughout the Commonwealth. Thank you for the opportunity to testify this morning on automatic license plate readers. I'd like to note that my remarks this morning are based on my submitted written testimony, which is more detailed and offers additional resources, including links to model ALPR legislation. I want to begin by distinguishing between ALPR cameras and automated traffic enforcement cameras, or ATEs, such as speed cameras, toll cameras, school bus, or red light cameras. ATEs are triggered by traffic violations only snapping a photo or video when a driver breaks a law, such as speeding or running a red light. In contrast, ALPR cameras continuously record every single vehicle in view of a camera. That data is then entered into a database where it is run against hot lists to identify potential criminal suspects. ALPRs capture the movement of every driver who passes, regardless of whether they are suspected of any crime. Creating patterns of behavior, ALPR data can reconstruct where people have been, when and how often, all without a warrant. Over time, this data can reveal personal details about our lives, our religious practices, medical visits, political activities, personal relationships and daily routines. This dragnet surveillance threatens the freedoms the Fourth Amendment was adopted to protect. ALPRs have been in use in America since the late 1990s. So why then in the last several years have we seen an explosion in ALPR use and its tracking of innocent people? The answer is twofold. The first is the entry of venture capitalist funding into the mass surveillance industry. Scaling up ALPR use through greater camera deployment, tracking, data retention, and data sharing is the only way to produce the massive profits investors expect. In other words, ALPR companies are in the business of trading our privacy for profits. The second cause of the spike in ALPR use is the advent of artificial intelligence. The massive deployment of ALPRs generates an unimaginable amount of location data, and AI has made it possible to go through billions of ALPR scans and use them to identify drivers' intimate patterns of life. This inescapable national network of surveillance, of course, includes Pennsylvania, which has the ninth largest documented number of ALPR cameras in the United States. Additionally, every day, innocent people are harmed by abuse and misuse of ALPR data. For example, people being erroneously arrested due to AI misreading a license plate, ICE using ALPR data to track immigrants, protesters being tracked by over 50 federal, state, and local agencies, gun show attendees being tracked by the DEA and ATF, abortion care seekers being tracked by state and local law enforcement, and police officers stalking their ex-partners or current romantic interests. All tools of surveillance must be carefully constrained to prevent misuse, abuse, and overreach. And here is where you, as legislators, have two options. I would be remiss if I did not forcefully mention option one, which is a ban. This is the most surefire way to protect our privacy rights by banning the use of ALPRs by all government entities in Pennsylvania. Incredibly, widespread public aversion to mass government surveillance coupled with outrage over ALPR abuses has united a divided America. Taking cues from their constituents, some states have decided that the paltry benefits of ALPRs do not outweigh the threats to their residents' privacy rights. Vermont will ban the use of ALPRs effective July 1, 2027. The governors of Texas and Florida have taken strong executive action to prevent the funding and deployment of ALPRs in their states. And on the local level, more than 200 municipalities have terminated their relationships with Flock and other ALPR companies. If the data exists, someone will eventually want it. ALPR data is shared widely and can be accessed by other agencies in other states, demanded by federal authorities, or disclosed to third parties or private actors. The safest data is data that was never collected. Option two, if a ban is not feasible, the next best option is to strictly regulate government use of ALPRs. As with any data collection legislation, the ACLU always prioritizes three crucial guardrails to protect people's privacy. First is limiting how long data is retained. Second, restricting how that data is used by the government and or law enforcement. And third, restricting who the data is shared with. Privacy is not a partisan issue. It is a constitutional value. We don't have to hold the same political views to agree that the government shouldn't track people just in case they might someday be suspected of something. The ACLUPA has a long history of bipartisan work on privacy-related legislation, such as opposition to Real ID, prescription surveillance databases, and pre-conviction DNA collection. We look forward to working with you to advance privacy-protective legislation that ensures every Pennsylvanian has the right to move freely without being surveilled, to associate where and with whom they choose, and to be protected against unreasonable searches. At this point I like to invite my colleague from our ACLU national office Chad Marlow who serves Maybe you should be the chair then That my job Oh I sorry That okay If you want to run against me come on All right How to do it Chad How to do it
That's why they don't give me a microphone too often. Please, Chad. All right. He hung up on us. All right. We're trying to mute you now somehow. Oh, there we go. Did that work?
There you go. Hit your mute button. Yeah, it's amazing that the power button on my microphone seems to do a lot, Mr. Chairman.
See, we have a camera on you right now. We can see that. That's why we knew you hit the button.
Well, thank you so much to everyone for having me before you today. My name is Chad Marlow. I'm a senior policy counsel at the National ACLU, where for the past 12 years I've focused on surveillance, privacy, and technology issues. I also run the ACLU's national Get the Flock Out campaign. I know one of the keys for successful testimony is listening to the chair. So the chair said to go quickly. So that is what I will attempt to do. What I'd like to do with my testimony today is actually do what I can to provide true and accurate information to this committee upon which it can then do its work. So I want to quickly go over some of the comments that have already been made to this committee to, let's say, clarify them for the benefit of the decision makers. The first thing we've heard today repeatedly is that ALPRs are a vital tool for law enforcement. We've heard it talked about the fact that they have caught a certain number of wanted cars as proof of their value. Let me clarify two things. The first is mass surveillance technologies like automatic license plate readers have been studied for decades, and it has been shown time and time again that they do not deter crime outside of car thefts and public parking lots and on public transportation. So ALPRs do not help there. As for catching wanted cars, ALPRs do do that. But a recent study of data, FBI crime data for the city of Atlanta, Georgia, was really illuminating on that point. They studied the city both before and after the city deployed over 5,000 flock license plate readers. And what they found was no change in case closure rates. What that indicates is that when an ALPR finds a vehicle because it's stolen or wanted, that vehicle or wanted person would have been found anyway, even without the ALPRs. ALPRs. So what ALPRs ask us to do essentially is to give up our privacy because they scan everyone, even if they're not suspected of a crime, in order to just gain marginally faster vehicle identification times. That's all we're getting for the trade-off there. We've also heard it testified today that local police departments own their data, and therefore that is a protective measure. But I would remind people that the standard FLOC contract gives FLOC a worldwide, royalty-free, perpetual license to use that data even after a contract is canceled. So the ownership statement is a bit of a red herring, because just like if you are a renter of an apartment or a house, you have substantial rights to use that apartment or house, even though you do not technically own it. They have also said, Flock has also said that it does not sell data. And I have always said that Flock saying it doesn't sell data would be like the Ford Motor Company saying it doesn't sell steering wheels Well that may not be the actual way that they package their product but Flock goes out and it advertises as part of its system nationwide tracking nationwide data sharing So the data is their product It is the most important part of their product. So in fact, Flock doesn't sell data like you might buy a banana or an orange off the shelf at a supermarket, but it is part of their product the same way steering wheels are part of a car. They have also said that they have never been hacked. I thought it was interesting. There was a question, have you ever been hacked? They said no. And a follow-up question was asked about them trying to suppress a map with the locations of all of Flock's cameras. And they said, oh, that information was only obtained because it was hacked from us. So even within their testimony, they've been inconsistent about their data protection. When I testified before the U.S. Senate last week on this issue, I sat right next to a technologist who himself was identified, he identified himself as a hacker, who said he had hacked Flock's product. So I would be careful about the no hacking. They have also told this committee that its system is safe because they require case codes and search reasons before someone looks into their system. What they did not mention is codes that have been accepted for search reasons have included search, hee hee hee, and LOL. They then transitioned to a drop-down window, which they testified about today, but essentially that just provides a list of things that if you click any one of them, you know for certain your search will go through. So they have had a very, very hard time using safeguards in their system to protect against improper uses, even though they've said otherwise. They've also told this committee that they just take pictures of cars. That's all they do. Well, that's not all they do. In addition to taking a picture of a car, it tracks the vehicle's location, when it was there, what time it was there. Also, the make, model, and color of the car, whether the car has distinguishing features like a bumper sticker or a gun rack or a ski rack or scratches on it. They even have a product you can buy as an add-on that will allow you to search what the bumper sticker said. So you can figure out if they're a Trump supporter or they're against ICE or whatever reason they'd be on their car. So they go far more than taking just pictures. And I would also remind people that these pictures and data stitched together can reveal very intimate patterns of life, especially using AI, which is the driver of their system now. They can ask AI to find out and to say where, based on Chad Merle is driving, what church or synagogue or mosque does he go to? What doctor's office does he go to? So a lot can be revealed here. So in conclusion, there are a lot of risks of using this system, but Americans are not fooled. There is a nonpartisan movement in this country against these systems because Americans value their privacy as a core constitutional right, and I hope you all will
help us to protect that. Thank you, Chad. Deanna, please. Deanna, I'm sorry. Deanna, no problem. Deanna, I'm sorry. Thank you, Chairman. Thanks for having me here this morning. Good morning, Chairman Briggs. Better? I've never been accused of being too quiet. I haven't either.
I don't even turn it off. Thanks for having me here today, Chairman Nielsen, Chairman Briggs. My name is Deanna Dyer. I'm here to represent Women's Law Project, which is a state-based public interest legal organization that works to advance gender equity and justice throughout Pennsylvania and beyond While I would love to say that I president of Women Law Project I actually working with him as a contract lobbyist I president of Dyer Strategies working in partnership with Women Law Project So thank you for having them here today
For the purpose of this year and you're president of everything, you're good.
Of everything. Okay, well, you know, I'll take it where I can get it. Thank you. We've heard a lot of information here today, but I think one thing that is evidenced in all the questions from the committee members is that Americans are deeply concerned about this issue, right? Public opinion appears to be moving rapidly against network license plate surveillance. In fact, in a national study just in August, opposition to ALPR cameras exceeded support 46 percent to 38 percent, which reverses that balance from just a year ago. These concerns about ALPRs are not in a vacuum, though. They're rising in tandem with concern about what private individuals, corporate entities, and the government are doing with increasing surveillance technologies and excessive data troves that these entities have on us, our personal lives, and our locations. However, Americans are not categorically opposed to law enforcement technology. Rather, polling suggests that they thoughtfully distinguish between targeted surveillance of someone who's suspected of a crime, on the one hand, and systems that just continuously collect information about everyone all the time. In a 2023 survey, 71% of Americans were found to be concerned about how the government uses the data that it collects about them, which is up from 64% just back in 2019. The increase was particularly pronounced among Republicans, whose concern rose from 63% up to 77%. Privacy may actually be one of the rare issues that now crosses Pennsylvania's political divide. This bipartisan support is reflected, of course, in the broad range of legislation that's recently been considered and contemplated in this General Assembly that's seeking to restrict or prohibit ALPRs. And Women's Law Project shares this concern about privacy, particularly around the unrestricted use of ALPRs. As an organization that's focused on gender equality and justice that works to support people experiencing gender-based violence and reproductive autonomy, Women's Law Project is especially concerned about the well-documented use of ALPRs to stalk and track ex-intimate partners, romantic partners, co-workers, women that law enforcement officers encounter. Women's Law Project has actually done a significant amount of work to hold police accountable for discriminatory practices that disproportionately endanger women and girls. We're especially concerned about the growing number of police officers and sheriff's deputies who are accused of using these license plate reader databases to track people in their personal lives rather than part of a legitimate criminal investigation. In August 2026, Washington Post investigation, which was based off of a variety of different police and court records, identified at least 50 police officers were accused or charged or convicted of misusing ALPR systems, often to track women in their personal lives. And out of those 50 documented cases, 46 of them were implicated FLOC's safety security system. Just last week, actually, in Indiana, prosecutors charged five current or former police officers following an investigation into alleged misuse of the department's FLOC system. The alleged searches involved ex-partners and other people with whom these law enforcement officers had a personal interest. It's worth note as well that there have been convictions right here in our own home state of Pennsylvania where law enforcement officers law enforcement officer, was actually convicted and served a lengthy jail sentence for misusing his police department's ALPR system to track his ex-wife. Physical assault was involved in the ability for him to be able to access that data, and her safety and the safety of her children were significantly jeopardized. Additionally, police officers in Florida were used to track not only his ex, but also her entire family. Wisconsin, Kansas, every day more stories about law enforcement's dangerous misuse of ALPR's surface. We must acknowledge and urgently address how unrestricted ALPR use is enabling surveillance as actually a tool of intimate partner violence. Officer-perpetrated intimate partner violence opposes acute risks, and it creates a distinct power imbalance and safety issues for victims of domestic violence. Women's Law Project is also especially concerned about the role that ALPRs play in the reproductive police state and reproductive surveillance. There's a notorious example, which I'm sure my colleague will discuss, in 2025, a Texas case where a Texas police searched 83,345 block cameras for a woman because they suspected her of self-managing an abortion, which, by the way, is not a crime. Just repeat that. One officer was able to make one inquiry about one person regarding suspected personal action that's not a crime and successfully collected interstate surveillance data on this person from 83,345 cameras across over 6,800 camera networks, flock networks to be specific. According to later reporting, the woman who sought the self-managed abortion said that she had fled her home with her child after her partner had threatened to kill her. So the facts of this particular case demonstrate both the threat that unrestricted use of LPRs have on both intimate partner violence cases and also an increasing reproductive police state in which many Americans are living under. So I think that just as the General Assembly is considering how to grapple with this issue, Women's Law Project urges members of this committee and the General Assembly as a whole to consider the issue through the lens of gender equality and justice and also consider the
impact that, again, this increasing reproductive police state under which many Americans are now living impacts the most vulnerable women and girls in our communities. Thank you. Thank you. We're going to change it up a little bit and go online. We have Lisa Femia, staff attorney for Electronic Frontier. Please, Lisa, let's see if you can find the unmute button. All right.
Can you hear me?
Yes, we can.
Perfect. Good morning and thank you to the chairpersons in the committee for having me here today. My name is Lisa Femia and I'm a senior staff attorney at the Electronic Frontier Foundation or EFF working on digital rights and civil liberties issues, including, especially in substantial part lately, ALPR surveillance. For many years, EFF has been sounding the alarm on the harms of ALPRs through legislative and policy advocacy, investigations and public outreach and legal advocacy, including a currently pending lawsuit against the city of San Jose, California, challenging the practice of searching their massive ALPR database without first getting a warrant. ALPRs are frequently marketed as a narrow tool to be used for specific purposes such as recovering stolen vehicles but in practice they are an advanced mass surveillance technology used for reasons far beyond what their marketing suggests They effortlessly and indiscriminately collect photos, exact location information, and much more about every passing vehicle 24-7, 365, regardless of whether a driver has done anything wrong or is under any criminal suspicion. The cameras are networked to each other and usually to cameras in other jurisdictions, creating a unified surveillance system capable of tracking drivers across city, county, and even state lines. ALPIR data is then stored in massive central searchable databases that can be searched not only by the local law enforcement agency, but also by agencies with whom the local law enforcement chooses to share. Often hundreds or even thousands of other agencies, both inside and outside the state. All of this is done with very little oversight and no requirement that law enforcement go to a judge, prove probable cause, and get a warrant. Because there are so few restraints, ALPR databases are searched a staggering amount. We have seen in numerous investigations, often even millions of times a year, once you factor in the searches run by external sharing partner agencies. At this scale, it is nearly impossible for most agencies to meaningfully police or review how their ALPR data is being searched and used. This is a serious invasion of privacy. As my colleagues on this panel have noted, our vehicles take us to sensitive and private places like our homes, doctor's offices, places of worship, and even protests, political gatherings. Tracking where our cars go can show our associations, daily patterns, where we spend our nights, who we're dating, where our kids go to school. This is why EFF believes that ALPR mass surveillance should not exist and is incompatible with a free society. It's why we ultimately urge governments to ban ALPRs and cease use of this technology altogether. No system configuration or set of legislative guardrails can eliminate the risks inherent in this mass surveillance. But if and when cities do use ALPR surveillance, state legislatures must then impose strict enforceable limitations. Without this, mission creep is inevitable. ALPRs can and have been weaponized against political dissidents, immigrants, and other targeted communities. One agency earlier this year used an ALPR system, for example, to track a person in the community that had written a critical op-ed of the police department. And officers across the country have used this technology to stalk romantic partners and personal connections, surveil protesters, and track everyday citizens for extremely low-level issues, like verifying whether a student lives in a specific school zone or following up on a car playing loud music. So these guardrails. First and foremost, this means imposing an ironclad warrant requirement before any officer is allowed to search an ALPR database. And this should be limited to only the most serious crimes. Second, we must have rigid data deletion deadlines. Retention periods should be modeled in minutes or at most a few days. We recommend looking at New Hampshire's model, which requires data deletion after just three minutes that a vehicle's license plate is not already on a hot list. Even Flock Safety recently lowered its default retention period from 30 days to seven days, in line with the nationwide trend towards shorter retention periods. Pennsylvania should go even further to protect its residents. Third, there must be rigor at audit trail for every search and annual external audits. Officers must provide a valid documented reason and a warrant number for every search. And an auditor must assess the validity of these reasons and identify officers who are conducting invalid searches. Crucially Pennsylvania must also protect the ability of citizens journalists and investigators to access these audit logs through public records requests subject to appropriate privacy redactions Public records have often proved the best way to expose the harms and privacy violations of these systems, including a number of the harms that we have already discussed today. And Pennsylvania lawmakers should not cut off access to that vital tool for public transparency and oversight. And then finally, ALPR data should stay within the state and not be shared with federal and out-of-state agencies. Pennsylvania has its own laws and values. It should not allow its residents sensitive data to be accessed and searched based on the laws, policies, or whims of out-of-state and federal agencies. So we strongly urge you to consider state legislation forbidding ALPR mass surveillance in Pennsylvania, as well as state legislation imposing strict enforceable constraints on ALPRs. And thank you so much for your time. Happy to answer any questions.
Thank you. Mitchell, save your best for last. You're going to be the shortest, fastest that we've ever seen today, right? And I'm not the president either. Thank you for your testimony, Mitchell. We've read it. All right. Not even close. Any other questions? No? All right. I'll be very brief. No, please. Take your time.
Chair Nielsen, Briggs, Benninghoff, Kauffman, members of the Joint Committee, thank you so much for the opportunity to testify. My name is Mitchell Smith, and I'm a legislative counsel at the Institute for Justice, IJ. IJ is a nonprofit public interest law firm that works through litigation and legislation to protect our constitutional rights. We're here, and I think we all know why we're here, because modern AI-driven automatic license plate reader technology allows the government to do something now that it has never been able to do before, and that is to travel back in time and reconstruct where people traveled, whom they saw, and what they did. And all of this information is now available at the click of a button and does not require law enforcement to first obtain a warrant. So as you consider reforms to rein in the spread of ALPRs, I encourage you to consider two very brief points. First, we do not surrender our constitutional rights when we leave our houses and go out in public. The Supreme Court has already ruled that police need to obtain a warrant before they attach a GPS tracker to your car, pull your cell site location information, or obtain even a brief window of a person's location data from a private company. Because modern ALPRs allow mass warrantless surveillance, IJ has filed constitutional challenges in federal courts that have revealed the dangers of this technology. In San Jose alone, in one of IJ's cases, we found that ALPRs captured 360 million photos in 2024. Thousands of government employees search that data over 15,000 times every day. That is mass surveillance. My second point is that regardless of how IJ's cases turn out, legislators should step in today to ensure the government is using ALPRs in a constitutional way. At the very least, the Commonwealth should require a warrant before the government can access ALPR data. Probable cause, which is required to get a warrant, is a familiar and relatively low standard for law enforcement, and this requirement would not affect law enforcement using the technology to find missing children or stolen cars like we heard today. However, if the Commonwealth continues to allow warrantless access to these cameras and their databases, then there is no way the government can continue to use this technology. The General Assembly should act today to prevent more abuse, and I welcome your questions. Thank you. Thank you. Yes, I do have questions. All right, so
we use this for our tolling we use this for our parking we use this for a lot of violations And that comes so you saying thinking I should just cut all that off I mean, because the opinion here is like, okay, we're not, in my opinion, we can't ban them. We have to use them. We're responsible. But that's something that we use daily. Why would I get a warrant to toll a car? I mean, they have to send me my tolls, right? I mean, we heard from the term fight earlier. So that picks up my tag. I sent a warrant for that? Or just in certain cases, certain uses? What are we talking about?
Yeah, absolutely, Chair Nielsen. I appreciate the question. So in IJ's Model Peeps Act, which is a model piece of legislation on our website, and I'll make sure we submit it to the committee for the record, we include an exception for traffic enforcement, which I think would cover the kind of tolling that Pennsylvania uses ALPRs for. So, you know, we really view the concern here through a constitutional lens and one that, you know, doesn't necessarily extend to the day-to-day traffic enforcement that you're describing.
Yeah, because, I mean, coming from the city of Philadelphia, I mean, I have them on my SEPTA buses. I know that was mentioned as well, to keep traffic flowing, people out of bus lane, from people parking in that. Right. I mean, just to keep the city moving. I mean, we depend, the city of Philadelphia depends on this technology to keep us rolling.
So I just wanted to clarify that in my testimony, I sort of started with the basic distinction between an ALPR and an ATE, an automated traffic enforcement camera. those cameras that you're referring to for like school buses, toll collection, speeding, et cetera, are triggered by violation. So if you run a red light, if you're speeding, that's when the image is captured. ALPRs, very differently, are continuously capturing all of the data, right?
So that is not – so as far as, you know, speaking for the ACLU, we would be fine. I think I was talking with Kyle the other day about all of the different ways that Pennsylvania statute identifies those particular kinds of cameras. Those would be, to us, those are not the concern that we're talking about here today. Those could be excluded and still continue to be used. Thank you.
I just want to make sure that was on the record.
Absolutely.
That's important. Understood. Representative Holenstein.
Thank you, Chair. I'm going to focus on the same three issues I focused on with the flock, and that is the three things that popped up in their written testimony and statement. One is the use of the phrase search reason and what that actually means from anything from a warrant all the way back down to a warrantless search with exigent circumstances or just a flat-out warrantless search. The second is the idea that they provide their data from their devices to Amazon Web Services. And then I think you all have pointed out there's a high degree of interstate and interagency sharing as well. So just how closely held is the information? And I think that's the second issue. The third issue is what is the effectiveness of the current regulatory scheme on a federal level in particular with respect to these devices? It seems like the states are being left to themselves. But is there any effective rule in place at the federal level, whether it be statutory or otherwise, that helps us to get a handle on what we ought to be doing at the state level.
Can I defer to Chad? And actually, if you wanted to go. Chad does have his hand up over there. Okay, Chad, you want to grab this one?
Yes, Mr. Chairman, thank you so much. And I'll try to answer each of those questions quickly and in order. So in terms of the question about the search reason, right, saying that certain things are a legitimate thing to search the ALPR database and other issues are not. It could be, we don't want immigration searches. We don't want searches of gun owners. We don't want that sort of thing. The problem is, is companies like Flock and the other ALPR companies have never been able to actually institute a feature on their system that can actually implement those reasons, search reasons reliably, which is why we have searches like LOL going through. So it's not really so much the issue of whether or not we can limit the reasons it can be searched legislatively. It's whether technically they're actually able to enforce those rules, and up till now they have not been able to. In terms of the data sharing with Amazon Web Services, one thing that could be required on the state level is end-to-end encryption of all ALPR data. And that doesn't just mean protection from hackers. That would mean protection from the companies like Flock and Axon who collect it, from Amazon who stores it. That's a kind of a simple requirement that could be put into place. But shockingly, it's not in a lot of locations. And I've actually, in places like Oregon, actually been opposed legislatively in trying to get them implemented. In terms of federal level regulations, I can tell you I testified before the U.S. Senate last week. Right now, there are essentially no federal regulations on ALPR use. They are considering right now both complete bans on the federal level where they would say no state or local entity that gets any federal dollars can use them. And then the other option is a guardrails approach, but none of which are part of federal law right now. And if I could just add briefly, I agree with
everything Chad said. The only thing I'll add is that even if the federal government acts tomorrow to ban or restrict the use of ALPR data by federal law enforcement, state law enforcement is still governed by state law. And so that's why we think it's so imperative that the General Assembly act soon to put guardrails on this technology. Joe, it looks like – or Representative Holstein, it looks like you hit a nerve.
Lisa would like to get on here as well. This is a great question.
Yes, I actually just want to – yes, thank you. Great question. I agree, and I agree with what others have said. I just wanted to speak to the point also that you made about how data sharing factors into how the data gets out. And to point out that these systems encourage jurisdictions to data share across jurisdictions, across the cities, across state lines. And that makes the data inherently more leaky. Because now you have to trust not only that each local law enforcement agency is using the system correctly and in line with the law, but that every single agency they share with, and sometimes this is out of the state across the country, is also doing that and using the system in the way that Pennsylvania would like them to. And this becomes especially risky once you have things like Flox National Lookup, where you just opt into a sharing network of thousands of agencies across the country with laws and policies that might be very different from your own. And it makes it incredibly hard to police the system incredibly hard to make sure that the data is being used in a way that you want it to be Thank you Acting Chairwoman Pugh
Wow, what an upgrade during the meeting. Thank you very much. I appreciate that. I'm coming here more often. This is transportation. This is what we do. Thank you. Thank you. You advance rapidly, apparently. Thank you for coming here today. And I think it's so important. And I want to make it very, very, very clear. I am 100% against mass surveillance. But I don't know if it would surprise any of you that are testifying in this panel to realize that the law enforcement that I've spoken to are also 100% against mass surveillance. And the legislation that you've heard referenced onto mine that will be out, I'd be glad to share it with you and have you take a look at it. because I believe we cover 95% of what your concerns are between encryption, between being surveilled, health care, political events, anything like that. We are covering inside of this. I think that hearings like this are so important to come together because I think you can use a valuable tool to protect the public. Public safety is incredibly important to me. And I also think it's very important that our rights are protected as citizens and residents. So would you be supportive of, and there's three points here that I'm going to make. One state agency to write the rules for the entire state of Pennsylvania so that there was strict guidance across the state that will provide on the access. That requires warrants into the system for data. And also that prevents and has strict penalties to anybody, whether it be a manufacturer, anybody that would misuse this from law enforcement right down to that. Is there a pathway that you guys can see to retain the tool that law enforcement needs to keep our public safe? And that includes everything that you're concerned. But putting the encryptions and putting everything else in place here in the state of Pennsylvania. Just out of curiosity, what would the date of retention policy be on that? We just started that, right? So there's an option there. And I have to always go back on to a murder that happened in my area and the body wasn't found for 25 days. So if that was your daughter or your granddaughter and you wanted law enforcement to have the tools they had, would you want them to have that tool? So that's the discussion that we're just having right now is to try to put that date on. It will come out with a date, but everything is always open to negotiation in my world. And let's be clear. Today we're here for informational, to get a good, solid, bipartisan bill across the threshold. That's what we're here to do. So you're not locked into any opinion, any anything. We're just here to collect information. Thank you. Anybody can jump in if you want. Chad likes to talk a lot. Look at him.
I take after you, Mr. Chair.
Ah, that's easy. Good. We're members of the same club.
I just wanted to point out, and thank you for your question. You know, all of these rules have to work together. It's why my colleague at the ACU of Pennsylvania talked about data retention. So, for example, you could establish the most steadfast rules for Pennsylvania. And if let say for example a federal agency like ICE or another federal agency were to come to Pennsylvania with a federal judicial warrant or an administrative subpoena which is an even lower standard than a warrant and demand your data you have to turn it over You would have it doesn matter what Pennsylvania law says Now if you're only keeping that data for three minutes like New Hampshire or 48 hours, like we suggest, you could say, I'm sorry, we don't have it anymore. But, but that's why each one of these guardrails in and of themselves isn't good enough. Sometimes if you do every single one of them, you can make it a lot safer, never safe, but a lot safer. So the devil's in the details, not surprisingly.
I'm going to add two points. Thank you, Chairman. Two points for consideration as the General Assembly is grappling with these issues. One is it relates to sort of protecting reproductive health care for Pennsylvanians, ensuring that if, for example, the General Assembly were to enlist an enumerated set of crimes by which this data could be searched, ensuring that things that are legal, safe, free access to abortion care, for example, is not sort of – I've seen some definitions that say it could be used to investigate, like state law enforcement used to investigate state crimes, ensuring that we're talking about what's a crime in the Commonwealth of Pennsylvania, not what's a crime in Texas.
Exactly.
We're not talking about searching SBA sort of surveillance here. So that's sort of one thing to consider. And then another thing to consider, I think, as it relates specifically to misusing the technology as a tactic of abuse in intimate partner violence cases, is ensuring that there's a system by which the searches that are conducted on those systems can be audited and audited by the public as well. If a domestic violence victim needs to be able to utilize that as evidence in a case that they may be building, it's important to have the public access to any sort of audit that is put in place. Thank you.
Rep. Kincaid.
Thank you, Mr. Chairman. I think this is incredibly important because even before flat cameras and AFP devices, became something that we were talking about in common parlance. The Allegheny County District Attorney deployed a basically a web of surveillance cameras across Allegheny County and there is no accountability as to who has access to that, how long they're maintaining that, you know, what kinds of, you know, access, how it's being monitored. And we have had issues where people who are high-ranking officials in the district attorney's office have actually been charged with crimes for stalking and, you know, intimate partner violence. And so having this kind of access in-house with no oversight is, has been something that Allegheny County has been grappling with because there is no accountability from the district attorney's office. Nobody knows what's going on or how it's being used or who has access to it. And so I think this is really important that we're able to again have this conversation about whether or not Allegheny County is actively acting as a surveillance state right now. It was very helpful to my district office director whose car was able to be found. But how do we sort of unring this bell of these systems that are already in place and kind of putting the guardrails on that because there are systems that have existed for longer than we been talking about FLOC.
Well, I can – I'll just briefly offer – I really appreciate the question. I think the important thing to think about is that enacting legislation can be imposed on systems that already exist. These requirements, I think all of the requirements that we've talked about today, could very easily map onto pre-existing systems. The warrant requirement, like I discussed in my original testimony, is the most important piece for IJ. But I think all of what Representative Pugh, what my colleagues on the panel have discussed in terms of limiting data sharing, in terms of a data retention limit, all of those pieces can be imposed onto systems that already exist. And I think the premise of your question also adds some urgency, right, because as you said, these systems have been collecting data already for so long, and I think that should just add urgency to the need to act soon.
Thank you.
Mr. Chairman, can I just a quick follow-up? Sorry.
Go ahead.
How do we enforce a warrant requirement when it's the government that has these, like the district attorney's office?
So I think it would work very similarly to how law enforcement obtains a warrant right now. And one of the, I think, important things to note is that warrants have almost gotten easier with electronic warrant systems. the probable cause requirement is one that's already very familiar for police to meet. And so I think it would work very much like the existing warrant requirement does.
I'd also just underscore, I mean, I think what's become clear with a lot of these questions is how complicated and layered any kind of effective or attempt at effective regulation would be. And I just want to push back to sort of, you know, I think that there is huge bipartisan, certainly public support for an outright ban to prohibit these entirely. I think unringing a bell, trying to roll back some of these provisions piecemeal is incredibly difficult, very complicated, involves a lot of technical knowledge and expertise that not all departments have. and you know so I just I don't think the to be looking at this as a binary in terms of we you know that bipartisan has to be something where it's a negotiated bill somewhere in between I don't know that that's necessarily I think it's certainly possible we would be more than happy to participate in any conversations and negotiations on a bill with guardrails and regulations that being said I think the public I mean just speaking personally from the ACLU the amount of calls that we get from members, media inquiries, etc. Like people are furious. They hate this stuff. And I just think that banning this, I think that this sort of, as I said in my testimony, the sort of paltry benefits that are obtained from this kind of pervasive continuous surveillance really does not outweigh the kinds of risks that we're talking about in the kind of out-of-control spiraling of, you know, mass data on our personal intimate lives. And some of us would agree to that, But I just want to put something in perspective.
Sure. This is a legislature. This is a magic number, 102, 26 and one. It took 12 years to ban texting and driving and watching a video or a movie while you drive. So I think what we're looking for is, is there something we can do now, put the guardrails until we can get a comprehensive piece of legislation? And I would ask all our testifiers here today, if you think, and the band sounds real good until somebody, it costs somebody their life. Because we heard from our law enforcement that they've actually saved lives by using this technology. So that's kind of what we're doing here today to try and get this information out. But if there's something here that you think we can put on something in a short period of time, because we're running out of legislation. We're running out of legislative session days, and everybody in this room, anybody in Pennsylvania knows that. And we're talking about getting into two chambers, two committees. So that's why we did this together. And Chairman Briggs, if you want closing remarks, please.
Yeah, I mean, I just want to thank you, Chairman, for convening this and for Kyle for working so hard over the last few days on coming up with really great panels. This is a challenging issue, and I think doing it jointly with judiciary and transportation was really wise, so thank you for pushing for that. But I also want to thank all the panelists for being such valuable voices in this conversation This is what we have six seven eight session days left this year and a bunch of different bills Some are still being drafted. I'm looking forward to continue to work on trying to get something to protect our Commonwealth and also find that balance. Thank you.
Thank you all again. This meeting is adjourned. Thank you. Thank you.