Speech

Speech to the national automatic number plate recognition conference

Tony Porter's speech to the national ANPR conference on 21 November 2016 in York.

• From: Surveillance Camera Commissioner and Tony Porter
• Published: 20 January 2017

• Delivered on: 21 November 2016 (Speaker's notes, may differ from delivered version)

Hello. It’s great to be invited back to address this meeting. This is my third year as Surveillance Camera Commissioner. So, what will I discuss today?

Firstly, my role, a brief resume. Secondly, where I see automatic number plate recognition (ANPR) currently with a slight look back at the past and peer into the future.

Lastly, I’d like to touch upon the national surveillance camera strategy for England and Wales; I have just published a draft for consultation.

My role

I thought it might be useful if I give you a little background about my role as Surveillance Camera Commissioner – sincere apologies to those of you who have heard me speak before and are au fait with what I do but this sets some useful context:

• it was created under the Protection of Freedoms Act 2012
• I was appointed by the Home Secretary but am independent from government
• the role covers England and Wales
• I’m entrusted to ensure that surveillance camera systems are used to support and protect communities – not spy on them
• the surveillance camera code of practice contains 12 guiding principles which (if followed) will mean cameras are only ever used proportionately, transparently and effectively (surveillance cameras include CCTV, ANPR, body worn video (BWV), drone mounted plus analytic systems, reference systems and so on)

My role is threefold, to:

• encourage compliance with the code
• review the operation of the code
• advise on any amendments to how the code should develop – review the impact of the code (recommendations made within that on ANPR)

My annual report was laid before Parliament last week.

How does it work?

Well, relevant authorities – police, local authorities, police and crime commissioners, National Crime Agency and non-designated police forces must show ‘a duty to have regard’ to the code. Non relevant authorities are encouraged to voluntarily adopt the code. This is really important and I will touch on it later.

The code also covers your obligations as data controller under the provisions of the Data Protection Act. As relevant authorities under the Protection of Freedoms Act, you must show the code due regard.

ANPR

ANPR in UK must surely be one of the largest data gatherers of its citizens in the world. Mining of meta-data – overlaying against other databases can be far more intrusive than communication intercept.

Drawing on my previous experience in the police, retiring as the commander in charge of nationally coordinating PURSUE for the police service throughout the Olympics, I get operating in a benign environment and also consequence management – policing by consent or, as my code refers to, surveillance by consent. This is shorthand for ‘get your system right, make it transparent, make it bullet proof in terms of integrity’.

Last year I gave a speech and received some rather grumpy feedback from various quarters – officials and others. My challenge was threefold.

Given we have legislation progressing through Parliament relating to other forms of surveillance – are you happy that you, the police, have done everything in your power to establish a governance structure that reflects the current public mood? Where do I go to understand the layers of responsibility?

Given that the surveillance camera code of practice transparency guiding principle 3 refers to ‘as much transparency in the use of a surveillance camera system as possible’ – are you, the police, happy that your consultation and engagement with the public is thorough, robust, informed and informative? Most areas of policing benefit from independent advisory groups – where are they in this important policy area?

Given the hugely successful ANPR operation are you, the police, happy that it should continue to operate outside of any legislative framework?

I said some people were grumpy – others were forward thinking, determined and open to development. Fortunately the most important person in the room, Deputy Chief Constable Paul Kennedy, the National Police Chiefs’ Council lead on ANPR and host today was that person.

It’s easy for people to default and blame the police for a host of issues – you have to operate around a host of emerging issues, new legislation, and new technology and so on. This is against a backdrop of 43 police services operating under separate command structures, with the triple complexity of providing national safety and security from a local governance position.

Mr. Kennedy engaged immediately. I think it would be fair to say that he was nothing short of open to change:

I want ANPR to match the needs and expectations of those it serves.

I’m sure many of the issues I raised were on his radar but his response was immediate and emphatic:

• he agreed that forces need to be more visible in their use of what is arguably the largest non military database in the UK – the world?
• he has supported the capacity and capability review
• he has also requested all forces complete my self assessment tool – the base line standard for demonstrating compliance with the 12 guiding principles (I anticipate this will achieve 100 % completion within the next 12 months - figures are already looking good)
• he ensured more detail and information is posted on the relevant website so it can be easily accessed by lay persons interested in the use of ANPR
• he established a privacy group that exposes him and the policy makers to challenge - this group comprises key individuals uniquely positioned to provide this support
• he has engaged in key discussions relating to the legislative framework and consequences and impact going forward

So, all good! Well, not really – the title of this talk is ‘past, present, perfect? And therein lies a clue!

The stats

1. ANPR grabs 35 to 40 million ‘reads’ a day – 30 billion a year.
2. Data is retained for 2 years – with various layers of increasing authority as the time ticks on and relative seriousness of offence in question is considered.
3. ANPR has an expanding role in society (insurance, national security and so on).

Question: if this database is to be acceptable to its public how important is it that it is accurate?

Has there ever been any adequate data sampling of information held in National ANPR Data Centre (NADC) or in local force servers? Can the journalist from the Guardian or the Times access this type of information? Not the specifics – that is largely restricted – but the generalities that allow people to make informed opinion?

If the data is to be accurate what are the key determinants for that to happen – quality of camera (type approval)? Quality of installation? Quality of number plates being recorded?

Is ANPR working properly?

So this leads me inexorably to the question – is ANPR working?

I think, given the very existence of the system we are all keen to see the continual improvement of ANPR performance (in terms of both detection rate and read accuracy) for the benefit of the end users and also the public. Data accuracy is key both to the effective operation of organisations like the police and to the protection of the public from the consequences of data errors.

Let me read to you principle 8 and 12 of the code of practice.

Principle 8: surveillance camera system operators should consider any approved operational, technical and competency standards relevant to a system – a role Parliament has specifically asked me to fulfil and its purpose and work with organisations to meet and maintain those standards.

Principle 12: any information used to support a surveillance camera system which compares against a reference database for matching purposes should be accurate and kept up to date.

Well, as I begin to understand more and more about the complexities of this system it highlights more than ever increasing transparency is the key – one of the themes of this meeting?

Does the argument that nationally ANPR meets performance standards set and detailed in the National ANPR Standards for Policing (NASP) hold water?

Part 1 deals with data standards – setting a high standard for accuracy and data in terms of time, location and mandates perforce evaluation with a requirement that if errors are not corrected within 30 days of identification of performance below standards, the use of those components must cease.

Part 2 deals with infrastructure standards – it sets the requirements for capture of vehicle registration marks and then accuracy in reading that registration for different types of system. Performance against standards must be tested on installation and thereafter subject to regular reviews with at least an annual compliance test. Is non-compliance with the standard by forces and/or police ANPR systems permissible?

The standard states that all forces must comply with the standard to be allowed to connect to the NAI.

I understand NADC accept all data fed into their system when there must be doubt that some forces do not have correctly set up cameras? Such cameras are expected to be excluded from supplying data under NASP but who polices this?

So NASP standard is more a site acceptance test, and does not constitute a product standard. I know Industry believes NASP should have gone further and been developed into a performance standard that ANPR equipment should be tested against and certified to meet prior to purchase.

In the current economic climate, there is significant pressure on organisations like the police and law enforcement agencies to purchase economically, and there is a risk that they will be offered equipment at an attractive price with claims that it is fit for their purposes where in reality is may not be. Once equipment has been purchased however, it is in the interests of both the vendor and the purchaser to get the equipment through the NASP test in order to bring it into service.

It is industry’s view that the lack of rigour in the NASP test (it might be described as a ‘quick look-see’ test) enables it to be passed by equipment that does not necessarily meet all of the purchaser’s requirements. As a result, the quality of the data delivered may be lower than required, with the consequential detriment to the purchaser’s operations and to the protection of the public.

So therefore the importance of compliance with those standards and in particular the need for regular performance monitoring/evaluation and annual testing is imperative but the question lurks – is this enough? And how is it policed?

The police must robustly rebut the contention from Industry about a lack of ‘rigour’. They must evidence policing of the system is robust. What performance monitoring is carried out during the day and at night as required under the standard? How do forces check for poor performing ANPR systems?

Herein lies another issue – Mr Kennedy has supported my office by requesting all forces to complete the self assessment tool. A key component of that approach is annual review, which, for the purposes of ANPR, will incorporate ‘regular performance monitoring/evaluation and annual testing’.

From what I understand, this approach is likely to expose some areas where performance is poorer and could be improved. So, a key concern for me is: do we understand the volume of misreads or missed reads on the database – ‘these are not quantified’. To my knowledge we have no stats and don’t properly understand how big a problem misreads are or the broader accuracy picture?

So, in my opinion – in the interests of transparency – I think this is a key and urgent piece of work for the police to undertake. Extract data from the NADC to help explain the picture relating to accuracy? But its very costly to do that!

Well, could somebody please tell me the totality of the cost of the ANPR system, cameras, officers to deploy, buildings to house back office, cost of NADC development, electricity, storage of data, installation, performance measurement of 8500 cameras - and then please tell me it isn’t worth doing?

Quality of number plates, quality of camera (type approval), quality of installation

First: quality of number plates

ANPR depends more or less absolutely on the quality of number plates it captures. The whole infrastructure, I would argue, is predicated against the fact that number plates do what it says on the plate – allows you to read the number! If they are frustrated by their design or people easily circumvent capture by screwing a deceptive screw between a 1 and a 1 making an H – then who should be concerned?

Arguments have been advanced that the number of people manufacturing number plates should be limited. I think there is an argument to say that production of number plates is so integral to the system that even stricter controls need to be applied – akin to production of driving licenses and passports – thereby providing the authorities with powers of examination and seizure.

So, we all know ‘dodgy’ number plates can defeat the system. I understand there are 80,000 number plate suppliers in the UK. This, in an unregulated environment, which seems to me tailor made to defeat the system.

But the first imperative is understanding the position and the impact of manipulation of number plates. This is where an open and transparent review needs to be conducted, without which, how change can be promoted?

Intrinsically I am not naturally attracted to more and more regulation! However my concern around ANPR (its size and scale, its impact on the citizen) demands greater control to prevent inaccurate data reads. I don’t think the police can do this – I do think placing ANPR on a statutory footing can easily bring about this type of regulation. I will support any effort by the police to exert this pressure.

Second: installation

There are issues with inaccurate location of ANPR cameras or ANPR cameras failing to report their correct location. My enquiries reveal that it is not unknown for a latitude and longitude of 0.0 placing them somewhere between the Atlantic Ocean and Ghana – I think this might have a negative impact on future prosecutions.

I think these are important questions. I think the challenge facing the service is to ensure a feedback process is developed to help eradicate these errors. They potentially damage the integrity of the system.

The correct installation of ANPR cameras is essential for their good management and good governance. Part of my role, within guiding principle 8, is to signpost good practice and standards. To date we have had significant impact on British Standard 7958 (this is to do with CCTV control rooms), worked alongside police on body worn video, introduced certification and self assessment - I am happy to engage on this as a piece of work - an installation standard. Perhaps a requirement in any future legislation?

Within the national surveillance camera strategy we are addressing issues of certified installation – should this apply to ANPR?

Third – type approval

I am sympathetic to the argument that agreeing a ‘type approval’ for ANPR is a good way forward.

If ANPR cameras are developed without built in security: it is entirely possible that a cyber attack could be targeted against the camera – changing, altering, adding or amending data.

I don’t need to tell you that any attack on such equipment, database or server damages the evidential integrity of the kit. Type approval could protect from that eventuality.

With type approval suppliers of ANPR would need to demonstrate continuous improvement to match changing needs.

I think there are a 101 arguments for type approval but instinctively I guess that unless and until the issue of number plate legitimacy is addressed this is a secondary issue. Again, this is something that could easily be regulated for within legislation. I guess the question is ‘is ANPR important enough for this type of consideration – 30 billion reads a year?’ Yes, I think so.

Why is data accuracy a concern?

Data accuracy is a concern because:

• accuracy and security of data are essential
• it avoids introduction of evidential doubt in high profile prosecution
• it supports the infrastructure, engenders confidence in the integrity of the system
• the effect of inaccurate/misreads of data on its citizens could lead to embarrassment
• it minimises the potential for false arrest, prosecution, financial difficulties or embarrassment

So, a very clear distinction can be drawn between a standard and operational compliance. The standard is what it says and it doesn’t mean that ANPR systems behave that way and compliance is someone else’s problem. If this is the position it shouldn’t be.

So, the challenges for the police continue. And I haven’t really touched upon the private sector use of ANPR and the potential impact of its use on that of law enforcement in terms of credibility.

National surveillance camera strategy

A brief mention of this exciting new approach to surveillance camera regulation and oversight. So, we have had some good successes and you may be thinking ‘I know he’s consulting on a national strategy’ (I hope you know I am!) - things seem to be improving without one.

Well, the surveillance camera sector is massive and is an industry that will continue to grow – there was a £2,120 million turnover in the UK in 2015 on video and CCTV surveillance. That’s virtually enough to buy Manchester City Football Club!

Think about the surveillance camera industry and all the organisations and people that have a vested interest:

• local authorities
• police forces
• installers, manufacturers, consultants and designers
• government and regulators
• members of the public
• all commercial and business sectors

The list goes on – all of these groups often (but not always) are working in isolation, independently of each other.

So, considering the amount invested in the sector and the many groups involved in keeping the public safe – some already working together, there is a need for an overarching, coherent strategy that underpins the use of surveillance cameras bringing together all relevant groups.

As I said I’ve been in post for almost 3 years now and during that time have been continually impressed by the support, encouragement and engagement across the range of stakeholders. What is clear is the energy for greater co-ordination to improve compliance and raise standards in the world of surveillance cameras. There is certainly an appetite for an over-arching surveillance camera strategy.

This approach was agreed by my advisory council in January and partnership working is at the heart of the strategy – there are 10 work strands all led by an industry expert giving up their time voluntarily to drive this ambitious strategy forward as one coherent plan for the surveillance camera industry.

And it is an ambitious strategy with long-term objectives and delivery plans which extend beyond 2020. My vision for the strategy is quite simple: the public are assured that surveillance cameras in public places are there to keep and make them feel safe, and that those cameras are deployed and used responsibly as well as transparently in a manner which is proportionate to their legitimate purpose.

And I will do this by providing direction and leadership in the surveillance camera community, to enable system operators to understand best and good practice, and then demonstrate compliance with the principles of the SC Code and any associated guidance.

The strategy aims to provide direction and leadership in the surveillance camera community to help system operators to understand best and good practice as well as their legal obligations, such as those contained within the Data Protection Act and the Private Security Industry Act, and then to apply that understanding to demonstrate compliance with the principles of the code and any other associated guidance.

It will provide a blueprint and a delivery plan that will afford significant operational cost benefits, economies of scale, enhanced training opportunities and more focused direction for manufacturers and suppliers. The end result being a more transparent, efficient and effective approach to public space surveillance – benefiting the public who will be safe in the knowledge that surveillance cameras are there to keep them safe and protect them.

This is not the first attempt at a national strategy for surveillance cameras in England and Wales. The 2007 CCTV Strategy attempted to do this with regard to CCTV. It was an ambitious, systematic and innovative approach but for a number of reasons much of it didn’t move from recommendations into delivery. Much of today’s strategy owes a lot to the remnants of the 2007 CCTV strategy.

As I said there are 10 work strands to this strategy each with its own objectives – I won’t go through these but you can find them in the draft strategy document on my website.

But briefly, in consultation through their networks the strand leads have identified high level objectives. They each work towards and support achieving the vision and mission.

Each of the strategic objectives will have a supporting delivery plan setting out specific action and outputs which contribute towards achieving the strategic mission. The delivery plans are owned by strand leads.

Consultation

This draft strategy has been 10 months in development – I’ve been working with the strand leads and many others to get it into shape and now we are ready to consult on it.

So, I welcome views from anyone whether they are an expert in the industry or a member of the public – the strategy is designed to benefit them so their input will be invaluable to making sure it meets their needs when we begin work on delivering its objectives in 2017.

The consultation is open now and you can submit your views via an online survey on my website – the consultation will remain open until 6 December.

Once we have gathered and analysed responses we will feed them back into the strategy to make it even better and publish the final document and delivery plans in 2017.

Published 20 January 2017