Massive ANPR camera data breach reveals millions of private journeys

Sheffield's ANPR system left wide-open for hackers, putting drivers' privacy and security at risk

camera

A vast data breach caused by deficient online security has seen the details of almost nine million private journeys released onto the internet. The breach happened after a major automatic number plate recognition (ANPR) network was left completely unprotected and accessible simply by entering its IP address into an internet browser, with no login details or passwords required to see details of 8.6 million journeys.

The breach concerns Sheffield City Council's ANPR network, and was uncovered by IT publication The Register, who alerted the council, which subsequently patched up the gaping holes in its system.

London Congestion Charge explained

Sheffield's ANPR network, The Register says, has been built in preparation for the city's clean-air zone, due next year. But while the proposed zone wouldn’t affect private cars - only HGVs, buses, vans and taxis that fail to meet emissions standards - all vehicles' number plates are scanned by the cameras.

The breach means that anyone with a computer and internet connection could have viewed details of millions of journeys. The Register says hackers could also have tracked individual vehicles through the city using their number plates, putting vulnerable people at risk. The cameras could also have been renamed or had the locations that network operators believed they were in changed - potentially leaving the system open to individuals wanting to make someone else look guilty of a crime, for example.

Eugene Walker, from Sheffield City Council's, and Assistant Chief Constable David Hartley from South Yorkshire Police, told The Register:

"We take joint responsibility for working to address this data breach. It is not an acceptable thing to have occurred. However, it is important to be very clear that, to the best of our knowledge, nobody came to any harm or suffered any detrimental effects as a result of this breach."

Last year, we exclusively revealed how the UK's automatic number plate recognition (ANPR) cameras scanned billions of number plates a year and generated hundreds of millions of pounds worth of fines for authorities, while privacy campaigners warned the network had “no clear legal basis” and consisted of the “constant monitoring of innocent motorists.”

Exclusive: the UK’s ANPR camera network exposed

In 2018 alone, automatic number plate recognition (ANPR) cameras carried out 10.1 billion number plate scans across the length and breadth of the country, generating 203 million ‘hits’ on vehicles of interest in the process.

While the police use ANPR cameras to track and trace criminals, local councils in England, Scotland and Wales are adopting the technology for traffic and parking infractions, issuing 6.96 million penalty tickets over the past five years, generating fines equivalent to around £472million.

Best speed camera detectors to buy

Privacy campaigners are concerned that the widespread use of ANPR technology amounts to the mass surveillance of innocent citizens. Silkie Carlo, director of privacy campaign group Big Brother Watch, said our figures, uncovered following freedom of information requests, “reveal the astonishing scale of secretive ANPR surveillance in the UK”. Carlo added “there is no clear legal basis” for the UK’s ANPR network, and that it represents “constant monitoring of innocent motorists”.

Partnership
Need to sell your car?
Find your best offer from over 5,000+ dealers. It’s that easy.

Carlo isn’t alone in having misgivings, either. At the start of the year, Tony Porter, the Government’s surveillance camera commissioner, warned that the UK’s ANPR network operates with “limited democratic oversight” and the system “must surely be one of the largest data gatherers of its citizens in the world” – although he recognised the vital crime-fighting role the camera network plays.

How do ANPR cameras work?

ANPR cameras use optical character recognition to convert number plates to digital text, which can then be cross-checked against national police and driver databases. While early devices were expensive and hard to configure, modern systems can be integrated into CCTV cameras, and run on a PC. ANPR cameras are available for less than £200 online, although pro systems are pricier.

The number of ANPR cameras operated is modest compared with the number of plates they scan. Highways England, the police forces and councils that responded to our Freedom of Information requests told us 8,768 ANPR cams are active nationally.

Police ANPR cameras 

The police’s ANPR cameras are certainly busy: constabularies are required by national guidelines to erase ANPR data after storing it for 12 months, and the 6,094 cameras operated by the 31 police forces that provided data following our requests (some declined on security grounds) carried out 10.1 billion number-plate scans in 2018, with those scans resulting in 201 million hits on vehicles of interest.

Of those ‘hits’, Dorset Police told us roughly 85 per cent were for cars with no registered keeper or no road tax when cross-checked against DVLA records, and Wiltshire Police put the figure at 91 per cent. But officers say a single vehicle would generate a series of hits on one journey. 

Top 10 ANPR-scanning police forces

Force  Scans per year Number of hits on vehicles of interest* Number of ANPR cameras
West Midlands 896,785,269 23,983,701 308
Thames Valley 780,734,346 14,388,461 359
Cheshire 773,010,999 20,790,909 317
South Yorkshire 726,867,269 186,729 Declined to list
Surrey 584,000,000 1,139,114 292
Merseyside 550,689,769 364,734 297
Lancashire 520,314,326 14,344,069 150
West Mercia 447,167,232 819,420 208
Wiltshire 445,313,100 15,277,015 182
Dyfed-Powys 414,295,902 10,581,255 330
    *Methods of classification vary between forces

Council ANPR cameras

Of the 114 local councils that told us they use ANPR tech, 65 said they did so to issue penalties to motorists for offences ranging from bus lane and parking contraventions to turning left or right at prohibited junctions and stopping in yellow boxes.

There are different levels of council penalty charge notices, which typically range from £40 to £130 depending on the type of offence, and wherein the UK the infraction took place. With 6.9 million penalties being issued over the past five years thanks to ANPR cameras, and the average PCN costing £68.50, authorities using the tech sent out fines equivalent to around £472million from 2014-2018 – although the income generated may reflect discounts offered for early payment.

ANPR-generated council fines over five years

Council Number of fines Estimated value of fines
London Borough of Barnet 547,393 £38.3m
Glasgow 566,598 £33.9m
London Borough of Islington 397,624 £27.8m
London Borough of Barking & Dagenham 345,589 £24.1m
London Borough of Brent 312,031 £21.8m
Royal Borough of Kingston upon Thames 358,046 £21.4m
City of London 316,369** £20.5m
Leeds City Council 250,317 £15.0m
Essex County Council 244,010 £14.6m
Coventry City Council 270,596 £13.5m
  **Over 20 months  

What the authorities say

Councillor Martin Tett from the Local Government Association said councils “make no apologies for enforcing the law” with ANPR cameras, and that surplus revenue generated from fines is spent on transport improvements. Tett added that over 99 per cent of parking and bus lane fines are not appealed, demonstrating “the overwhelming majority of people who are ticketed accept that they have broken the rules”.

A spokesperson from the National Police Chiefs’ Council told us ANPR is necessary to “better protect the public from harm and reduce crime”. The NPCC admitted this had to be balanced against “our responsibility to be as transparent as possible and protect individuals’ privacy”, and that “police will only get involved if there is a criminal issue arising as part of an automatic check”.

Do you think that ANPR cameras are a good idea? Let us know in the comments below...

Most Popular

New Renault Scenic 2023 review: the famous nameplate returns in style
Renault Scenic - front
Road tests

New Renault Scenic 2023 review: the famous nameplate returns in style

We get behind the wheel of new all-electric Renault Scenic to see what all the fuss is about
27 Nov 2023
“Renault is taking over as the manufacturer of cars for the people”
Opinion - Renault Twingo
Opinion

“Renault is taking over as the manufacturer of cars for the people”

Mike Rutherford thinks Renault is doing more than any other manufacturer when it comes to making affordable electric cars
26 Nov 2023
Are we at the end of the road for the spare wheel?
Spare wheel
News

Are we at the end of the road for the spare wheel?

Just three per cent of new cars have a standard-fit spare in the boot, latest RAC data reveals
21 Nov 2023