Massive ANPR camera data breach reveals millions of private journeys

A vast data breach caused by deficient online security has seen the details of almost nine million private journeys released onto the internet. The breach happened after a major automatic number plate recognition (ANPR) network was left completely unprotected and accessible simply by entering its IP address into an internet browser, with no login details or passwords required to see details of 8.6 million journeys.

The breach concerns Sheffield City Council's ANPR network, and was uncovered by IT publication The Register, who alerted the council, which subsequently patched up the gaping holes in its system.

• London Congestion Charge explained

Sheffield's ANPR network, The Register says, has been built in preparation for the city's clean-air zone, due next year. But while the proposed zone wouldn’t affect private cars - only HGVs, buses, vans and taxis that fail to meet emissions standards - all vehicles' number plates are scanned by the cameras.

The breach means that anyone with a computer and internet connection could have viewed details of millions of journeys. The Register says hackers could also have tracked individual vehicles through the city using their number plates, putting vulnerable people at risk. The cameras could also have been renamed or had the locations that network operators believed they were in changed - potentially leaving the system open to individuals wanting to make someone else look guilty of a crime, for example.

Eugene Walker, from Sheffield City Council's, and Assistant Chief Constable David Hartley from South Yorkshire Police, told The Register:

"We take joint responsibility for working to address this data breach. It is not an acceptable thing to have occurred. However, it is important to be very clear that, to the best of our knowledge, nobody came to any harm or suffered any detrimental effects as a result of this breach."

Last year, we exclusively revealed how the UK's automatic number plate recognition (ANPR) cameras scanned billions of number plates a year and generated hundreds of millions of pounds worth of fines for authorities, while privacy campaigners warned the network had “no clear legal basis” and consisted of the “constant monitoring of innocent motorists.”

Exclusive: the UK’s ANPR camera network exposed

In 2018 alone, automatic number plate recognition (ANPR) cameras carried out 10.1 billion number plate scans across the length and breadth of the country, generating 203 million ‘hits’ on vehicles of interest in the process.

While the police use ANPR cameras to track and trace criminals, local councils in England, Scotland and Wales are adopting the technology for traffic and parking infractions, issuing 6.96 million penalty tickets over the past five years, generating fines equivalent to around £472million.

• Best speed camera detectors to buy

Privacy campaigners are concerned that the widespread use of ANPR technology amounts to the mass surveillance of innocent citizens. Silkie Carlo, director of privacy campaign group Big Brother Watch, said our figures, uncovered following freedom of information requests, “reveal the astonishing scale of secretive ANPR surveillance in the UK”. Carlo added “there is no clear legal basis” for the UK’s ANPR network, and that it represents “constant monitoring of innocent motorists”.

Carlo isn’t alone in having misgivings, either. At the start of the year, Tony Porter, the Government’s surveillance camera commissioner, warned that the UK’s ANPR network operates with “limited democratic oversight” and the system “must surely be one of the largest data gatherers of its citizens in the world” – although he recognised the vital crime-fighting role the camera network plays.

How do ANPR cameras work?

ANPR cameras use optical character recognition to convert number plates to digital text, which can then be cross-checked against national police and driver databases. While early devices were expensive and hard to configure, modern systems can be integrated into CCTV cameras, and run on a PC. ANPR cameras are available for less than £200 online, although pro systems are pricier.

The number of ANPR cameras operated is modest compared with the number of plates they scan. Highways England, the police forces and councils that responded to our Freedom of Information requests told us 8,768 ANPR cams are active nationally.

Police ANPR cameras 

The police’s ANPR cameras are certainly busy: constabularies are required by national guidelines to erase ANPR data after storing it for 12 months, and the 6,094 cameras operated by the 31 police forces that provided data following our requests (some declined on security grounds) carried out 10.1 billion number-plate scans in 2018, with those scans resulting in 201 million hits on vehicles of interest.

Of those ‘hits’, Dorset Police told us roughly 85 per cent were for cars with no registered keeper or no road tax when cross-checked against DVLA records, and Wiltshire Police put the figure at 91 per cent. But officers say a single vehicle would generate a series of hits on one journey. 

Top 10 ANPR-scanning police forces

Council ANPR cameras

Of the 114 local councils that told us they use ANPR tech, 65 said they did so to issue penalties to motorists for offences ranging from bus lane and parking contraventions to turning left or right at prohibited junctions and stopping in yellow boxes.

There are different levels of council penalty charge notices, which typically range from £40 to £130 depending on the type of offence, and wherein the UK the infraction took place. With 6.9 million penalties being issued over the past five years thanks to ANPR cameras, and the average PCN costing £68.50, authorities using the tech sent out fines equivalent to around £472million from 2014-2018 – although the income generated may reflect discounts offered for early payment.

ANPR-generated council fines over five years

What the authorities say

Councillor Martin Tett from the Local Government Association said councils “make no apologies for enforcing the law” with ANPR cameras, and that surplus revenue generated from fines is spent on transport improvements. Tett added that over 99 per cent of parking and bus lane fines are not appealed, demonstrating “the overwhelming majority of people who are ticketed accept that they have broken the rules”.

A spokesperson from the National Police Chiefs’ Council told us ANPR is necessary to “better protect the public from harm and reduce crime”. The NPCC admitted this had to be balanced against “our responsibility to be as transparent as possible and protect individuals’ privacy”, and that “police will only get involved if there is a criminal issue arising as part of an automatic check”.

Do you think that ANPR cameras are a good idea? Let us know in the comments below...