Members of the Senate Judiciary Subcommittee on Crime and Counterterrorism on Wednesday criticized the use of automatic license plate readers, or ALPRs, saying that the tools enable warrantless searches that could target certain groups and also lack necessary cybersecurity guardrails.

Senators considered potential data privacy safeguards as some witnesses urged Congress to pass a law protecting citizens’ data from ALPRs during the hearing. Sen. Katie Britt, R-Ala., said she and Sen. Raphael Warnock, D-Ga., sent the Justice Department a letter urging it to create guidance for state and local agencies on how they can prevent the misuse of ALPRs.

The congressional scrutiny builds on the mounting criticism of companies offering state and local agencies ALPRs following recent Washington Post investigations into police officers’ abuse of Flock’s ALPRs. ALPRs, which have existed for decades, allow agencies to read license plates and, with the help of artificial intelligence, analyze billions of images and videos nationwide.

“Practically every state in the union now has [ALPRs],” Sen. Josh Hawley, R-Mo., said. “Hundreds of thousands of them, recording billions of images every single month. And the question is, where are all of these images going? Who is using them? What are the privacy protections for them? How do we make sure that this kind of surveillance is consonant with the Constitution of the United States?” 

The CEOs of ALPR companies Flock, Axon, Motorola and Verkada were invited to speak to the Senate subcommittee but declined, according to Hawley.

Hawley criticized ALPR firms for relying on agency customers to self-police and claiming their systems do not use facial recognition even though they do. He also challenged Flock’s claim that it has never been hacked.

“I would say that’s inaccurate … in the general definition of accessing unauthorized data, yes, I would say they’ve been hacked,” said Benn Jordan, a cybersecurity engineer who sounded the alarm on Flock last year, in response to a question from Hawley.

Democratic lawmakers echoed many of Hawley’s data privacy concerns with ALPRs and expressed additional worries that the systems could be abused to support immigration enforcement.

Chad Marlow, senior policy counsel at the American Civil Liberties Union, said that Immigration and Customs Enforcement could use ALPRs to conduct immigration enforcement through formal 287(g) agreements with local agencies. But ICE could also field the informal help of a single officer, Marlow said.

“How do you close that loophole?” Sen. Alex Padilla, D-Calif., asked Marlow.

“You ban them, sir, you ban them,” Marlow said.

Marlow also said ALPRs could be used to track and eventually prosecute women seeking reproductive care across state lines. Hawley similarly expressed concern that the technology could also be used to surveil gun stores and pregnancy care centers.

Several witnesses offered lawmakers potential solutions. 

Jordan, the cybersecurity engineer, said there should be independent security testing and inspections of ALPR vendors. That should coincide with a comprehensive federal data privacy law on par with the European Union’s General Data Protection Regulation, he added.

Congress could also require federal agencies to obtain warrants before searching historical location data and place tight limits on how long ALPR data is kept, Alasdair Whitney, legislative counsel at the Institute for Justice, said.

Flock sent Hawley a letter outlining new ALPR guardrails, according to a Wednesday Wall Street Journal report. The company has now added a dropdown menu for users to justify ALPR database searches and will require a case number for law enforcement officials to conduct a search, the report said.