Speech: The long and winding road – the humble number plate

Hello, it’s great to be invited back to speak at this meeting.

This is my fourth year as Surveillance Camera Commissioner and third time back at this conference.

Many of you will recall that first conference when I challenged the police on three counts;

• what is your legislative mandate to conduct ANPR?
• what is your governance of 9000 cameras?
• why is your transparency so opaque?

In essence, where is your legitimacy? – a crucial ingredient for the public to have confidence in not just what you do, but why you do it, how you do it and how you protect the civil liberties of our citizens.

Last year I raised the issue of data quality and type approval cameras. This year I have decided to, yes – do it again. Let me first acknowledge that there has been progress made against those challenges under the leadership of Assistant Chief Constable Paul Kennedy and Chief Constable Hall.

For those not familiar with my role as Surveillance Camera Commissioner I will firstly provide a brief resume.

Secondly, I will explain where I see ANPR currently, with a brief reflection from where you have come and a look to the future;

Finally, I’d like to touch upon the National Surveillance Camera strategy which I launched in March 2017.

My role:

A little background about my role as Surveillance Camera Commissioner :

• it was created under the Protection of Freedoms Act 2012
• I was appointed by the Home Secretary but am independent from government. My commission was extended for a further term of 3 years last March
• the role covers England and Wales
• I’m entrusted to ensure that surveillance camera systems are used to support and protect communities – not spy on them
• the Surveillance Camera Code of Practice was issued by the Secretary of State and contains 12 guiding principles which if followed will mean cameras are only ever used proportionately, transparently and effectively
• surveillance camera systems which fall within my remit are those operated overtly in public spaces in England and Wales by ‘relevant authorities’ and include CCTV, ANPR. Body worn cameras, helicopter/drone- borne cameras, dash cams, indeed more. The surveillance camera system definition goes beyond simply the camera itself and extends to the analytic systems, monitoring and storage media, reference systems, automatic facial recognition systems and indeed any technology which is integrated with those systems

My primary role is three fold, to:

• encourage compliance with the code
• review the operation of the code
• advise on any amendments to how the code should develop- Review of Impact of Code ( recommendations made within that re ANPR)
• annual parliament report which was laid before parliament last week
• in addition chapter 5 of the SC code describes how I may regulate

How does it work

Well – ‘relevant authorities’-police, local authorities, PCCs, NCA and non-designated police forces – must be able to demonstrate that they have addressed their statutory ‘duty to have regard’ to the code. It is a requirement of the Protection of Freedoms Act 2012.

Organisations who are not ‘relevant authorities’ are encouraged to voluntarily adopt the code. The code also considers your obligations as data controller under the provisions of the Data Protection Act.

So ANPR

ANPR in the UK must surely be one of the largest data gatherers of its citizens in the world. Mining of meta-data – overlaying against other data bases can arguably be far more intrusive than communication intercept in some circumstances.

Drawing as my previous experience in the police, retiring as a Commander National Coordinator Pursue for the police service throughout the Olympics, I get operating in a benign environment and also consequence management – policing by consent or as the secretary of state’s code refers to it, surveillance by consent. This is shorthand for ‘get your system right, make it transparent, make it bullet proof in terms of integrity’ and above all be transparent in terms of your legitimacy – your basis in law for doing what you do, your case of necessity, your balance of proportionality and a demonstrable assessment of both intended and collateral intrusion risk.

Yes what you do is profoundly important to protecting the public from some of the most serious risks facing communities today. But what you do is also profoundly intrusive and in a proud and civilised western democracy the public also need protection from disproportionate and unjustified intrusion by the state.

The secretary of state’s code specifically states that I will be a source of advice as to the validation of such systems .

And so – lets start with the humble number plate!

The number plate is what this conference is all about.

In the language of the mnemonic – it puts the ‘NP’ in ANPR – without an accurate’ NP’ (number plate), you have no accurate’ R’ (recognition) – no matter how sophisticated your ‘A’ (automation) is!

When you distil it into its component parts – that’s largely it, isn’t it? If this bit isn’t right it is your first point of failure, the consequences of which may be significant. Do you agree? As a former firearm commander and Counter Terrorism commander I can assure you ladies and gentlemen that if I am deploying officers with a lethal force option on the basis of an intelligence case which may include ANPR data…..I certainly agree!

The stats

According to the NPCC fact sheet the national ANPR infrastructure grabs 25 to 40 million reads a day – 20 billion a year? 20 billion what – yes – you’re getting it – number plates.

Now – I hear figures being quoted of ANPR accuracy of more than 97 percent, now that doesn’t sound bad does it. But that is still, if the NPCC figures are to be believed, between 750,000 and 1.2 million misreads per day – so what actually is your tolerance for inaccuracy? What about the operational commanders in the room?.

Now some of the causational factors of misreads and missed reads of number plates are arguably beyond your control, particularly where the qualitative standards which govern number plate production and use are concerned. I know you are working hard on the issues which you can improve on….and I am determined to work hard on those you cannot.

I asked these questions last year!

1. If this database is to be acceptable how important is it that its accurate?

2. Has there ever been any adequate and deeply meaningful programme of sampling of information held in NADC or in local force servers?

3. And if there has, why is it that I have had to work so hard to unearth any form of meaningful empirical ANPR generated evidence that I can put under the noses of those who regulate the manufacture and testing of number plates and convince them that there is a problem here beyond the wherewithal of the police – which they DVLA/DVSA are not yet effectively contributing to a solution.

If this data is to be accurate what are the key determinants for that to happen – quality of camera (type approval), quality of installation? Quality of number plates being recorded?

A bit on cyber

Here is a challenge – how comprehensive and meaningful is your strategy to ensure that your national surveillance system is resilient to cyber attacks now, and in the future resilient to individual and state actors to access and manipulate or steal?

Under the umbrella of my strategy I am setting standards which will hopefully prevent the manufacture and sale of camera hardware and software with a proven past cyber vulnerability. I am advocating regular cyber intrusion testing of systems, to make sure cyber defences are up to speed and if not, are suitably patched, I am advocating appropriate cyber awareness and disciplines amongst camera operators to make sure a busy dedicated operative does not stick a pen drive in to a system and infect it, to make sure that operators know a cyber attack when they see one, and what to do about it. I could go on – you get the message.

So – is ANPR working properly ….legitimately?

ANPR is hot wired across society – it was previously a traffic management device that had a parallel use to support criminal intelligence operations. Its utility was recognised.

Now HMG raises vehicle revenue from it, enforces MOT and insurance enforcement and supports the private parking industry. (still I might add – no democratic oversight from Parliament)

Turning to the Surveillance Camera Code of Practice and the guiding principles within it; principle 8 – Surveillance camera system operators should consider any approved operational, technical and competency standards relevant to a system and its purpose and work to meet and maintain standards.

Principle 12 – any information used to support a surveillance camera system which compares against a reference database for matching purposes should be accurate and kept up to date.

Now I know that all forces must comply with Standards 1 and 2 (data standards and infrastructure standards) respectively to connect to the NAI.

Last year I said, and I will reiterate here, that I understand currently NADC accept all data fed into their system when there must be some doubt that some forces cameras are not set up correctly. Such cameras should be excluded but who polices this? Perhaps the NASP standard is more a site acceptance test and does not constitute a product standard. I know industry believes NASP should have gone further and be developed into a performance standard that ANPR equipment should be tested and certified to meet prior to purchase.

In the current economic climate, there is significant pressure on organisations like the police and LEAs to purchase economically, and there is a risk that they will be offered equipment at an attractive price with claims that it is fit for their purposes where in reality is may not be. Once equipment has been purchased however, it is in the interests of both the vendor and the purchaser to get the equipment through the NASP test in order to bring it into service.

It is industry’s view that the lack of rigour in the NASP test (it might be described as a “quick look see” test) enables it to be passed by equipment that does not necessarily meet all of the purchaser’s requirements. As a result, the quality of the data delivered may be lower than required, with the consequential detriment to the purchaser’s operations and to the protection of the public.

I am delighted to hear at this conference that the new national standards are still being worked upon and will further strengthen the operation – I look forward to seeing the details.

So therefore the importance of compliance with those standards and in particular the need for regular performance monitoring / evaluation and annual testing is imperative but the question lurks – is this enough? And how is it policed?

The police must robustly rebut the contention from industry about a lack of ‘rigour’. Equally they should be in a position to rebut similar concerns from the public.They must evidence policing of the system is robust.

What performance monitoring – qualitative and quantitative – is carried out during the day and at night as required under the standard?

How do forces check for poor performing ANPR systems?

A key concern for me – is do we / you, fully understand the volume of misreads or missed reads on the database and the key underlying causes – ‘ in my experience these are not quantified to the extent that the public or indeed regulators..would expect’.

In my opinion in the interests of legitimacy – in the interests of transparency – I said last year that this is a key and urgent piece of work for the police to undertake. Extract data from the NADC to help explain the picture relating to accuracy? But it’s costly to do that!!

Well could somebody please tell me the totality of the cost of the ANPR system, cameras, officers to deploy, buildings to house back office, cost of NADC development, electricity, storage of data, installation, performance measurement of 8500 cameras – and then please tell me it isn’t worth doing?

Help me out – how does the cost of success stack up against the cost of failure?

Quality of number plates

ANPR depends more or less absolutely on the quality of number plates it captures. The whole infrastructure, I would argue, is predicated against the fact that number plates does what it says on the plate – allows you to read the number! If they are frustrated by their design or people easily circumventing capture by screwing a deceptive screw between a 1 and a 1 making an H – then who should be concerned? Arguments have been advanced that the number of people manufacturing number plates should be limited. I think there is an argument to say that, production of number plates is so integral to the system – that even stricter controls need to be applied – akin to production of driving licences and passports – thereby providing the authorities with powers of examination and seizure.

So – we all know dodgy number plates can defeat the system, I understand their are 1000s of number plate suppliers in the UK. This, in an unregulated environment which seems tailor made to defeat the system. But the first imperative is understanding the position and the impact of manipulation of number plates. This is where an open and transparent review needs to be conducted-without which how can change be promoted. Intrinsically I am not naturally born to more and more regulation!

It was Winston Churchill who once said, “If you make ten thousand regulations you destroy all respect for the law” – House of Commons, 3 February 1949.

And who would argue with his wisdom?

However my concern around ANPR, its size and scale, its impact on the citizen, demands greater control to prevent inaccurate data reads – I don’t think the police can do this, I don’t think that the police should be expected to do this. I do think placing ANPR on a statutory footing can easily bring about this type of regulation. I will support any reasonable effort by the police to exert this pressure.

So what have I done?

I have convened a work group of Industry specialists, NMA representatives, DVSA, DVLA, Home Office Cast , Home office policy – ANPR.

Why – because it’s important this system has integrity and they have key responsibilities which play in to the problem and the solution.

I have asked Home Office ANPR Policy team to research the misreads and missed reads issue to get an evidential, rather than anecdotal foundation on which to address the problem.

I have gleaned from Home Office research with police forces, there could be as much as a 3 percent error rate attributable to poor, delaminated, poorly constructed, difficult to read, ill-fitted plates. 3 percent of 20 to 25 million captures a day could equate to 75000 to 1.25 million misreads a day. I am very bothered by this. Very bothered indeed, because I know that errors on the hot list could negatively impact on the citizen.

Next who is responsible for this error rate continuing police for on road enforcement? DVSA for MOT standards when considering the quality of a number plate? DVLA for non introduction of a 3rd party certification process to better regulate manufacturers of number plates? – Industry standards? Manufacturers? Procurers? Installers?

Consultants to ensure cyber resilient and cyber savvy infrastructure and disciplines? The answer of course is ‘all of the above’. This isn’t a silo issue – it’s a system issue and has to be addressed as such.

I have my fifth meeting this year to achieve my first objective of this whole system approach – that is to deal with the MOT issue and seek support to amend the wording of the MOT test standard where number plates are concerned to strengthen the test.

Running alongside this I am keen to explore stronger standards re certification (BS 145 has been introduced but is not mandatory).

So baby steps. Next term I look at type approval and related issues.

But it is appropriate that I acknowledge what you the police are doing. You have very determined and talented people working this problem on your behalf (as well as those in the Home Office). In Chief Constable Hall, his predecessor Paul Kennedy, and John Dwyer, to name but a few there has been tangible and demonstrable commitment to rise to the challenges which I have set.

I know that a defining characteristic of policing is that you always make things happen for good despite sometimes monumental challenges, and of course I acknowledge the overwhelming sense of determination in you to get things right. You have other challenges down the line with new data protection laws and GDPR, but a recent development in resolving a fundamental question of data retention periods, something which has inexplicably rumbled on for years, I think is an encouraging symptom of progress and one which I hope will stand you in good stead for the challenges to come.

In conclusion therefore:

The National Surveillance Camera strategy is working with police to drive up standards. A survey of all police forces in England and Wales has delivered a 100 percent response – the compliance by police forces with their PoFA responsibilities to ANPR is 95 percent.

ANPR has greater capacity to move towards integrated platforms – indeed it was considered as such for the LEDS Home Office approach which I now understand is on hold.

Compliance with PoFA, DPA and new legislation coming in in 2018 is key and central to my regulatory approach.

Engagement with fellow regulators – ICO, IPCO and HMIC will continue to strengthen.

Thank you, and I look forward to seeing great progress over the course of the coming year in terms of transparency, compliance and engagement with the public on the use of ANPR.