More than 100 cameras used by police forces across America may be streaming everything they capture online after insecurities were uncovered by privacy researchers this week. Motorola license plate scanners deployed in the U.S. have been found to be sharing vehicle details like make, color and registration online for all to see.
The insecurities were highlighted by researcher Matt Brown, who found that some Motorola automated license plate readers were live-streaming video and car data to the internet, reports 404 Media.
After Brown bought a used Motorola Reaper HD ALPR on eBay, which is the same model used by some forces across America, he found that logging into the private network that the device was connected to meant he could easily stream everything it captured. This allowed him to monitor vehicle movements that were observed by the cameras.
The security issues ran much deeper, though, as Brown found that if the cameras weren’t set up correctly then they may be streaming everything they capture to the unsecured internet, rather than a private server. As 404 Media reports:
“My initial videos were showing that if you’re on the same network, you can access the video stream without authentication,” Brown told 404 Media in a video chat. “But then I asked the question: What if somebody misconfigured this and instead of it being on a private network, some of these found their way onto the public internet?”
In his most recent video, Brown shows that many of these cameras are indeed misconfigured to stream both video as well as the data they are collecting to the open internet and whose IP addresses can be found using the Internet of Things search engine Censys. The streams can be watched without any sort of login.
In many cases, they are streaming color video as well as infrared black-and-white video of the streets they are surveilling, and are broadcasting that data, including license plate information, onto the internet in real time.
With easy access to all this police data, Will Freeman, who launched a platform that tracks the location of ALPRs across America, took things a step further. He wrote a piece of code that could extract data from unencrypted Motorola ALPR streams, decode the data and add information about vehicle movements to a spreadsheet.
The researchers have so far found 170 unencrypted ALPR streams from cameras that could be accessed in this way. With access to data like this, they warned that anyone could use the cameras to track specific vehicles and monitor “regular movements of people,” adds 404:
Freeman told 404 Media that this fact is more evidence that the proliferation of ALPRs around the United States and the world represents a significant privacy risk, and Freeman has been a strong advocate against the widespread adoption of ALPRs.
“I’ve always thought these things were concerning, but this just goes to show that law enforcement agencies and the companies that provide ALPRs are no different than any other data company and can’t be trusted with this information,” Freeman told 404 Media. “So when a police department says there’s nothing to worry about unless you’re a criminal, there definitely is. Here’s evidence of a ton of cameras operated by law enforcement freely streaming sensitive data they’re collecting on us. My hometown is mostly Motorola [ALPRs], so someone could simply write a script that maps vehicles to times and precise locations.”
Now that the weakness has been identified, Motorola told 404 Media that it’s working on a firmware patch that should seal up the problem. In a statement shared with the outlet, Motorola said it was working with customers to implement additional security measures.
The lapse security in license plate cameras was identified just a few months after traffic cameras in New York were used in a dystopian art project. It also follows a ruling last year that found that a rival license plate camera manufacturer broke the law while trying to reduce crime.
