Few people had ever heard of Perceptics, a Tennessee-based subcontractor that sells license plate readers to U.S. Customs and Border Protection, before last month, when news emerged that the company had been hacked and that sensitive data — including images of license plates and drivers — had been released on the dark web.

The hack is just the sort of privacy breach that civil liberties advocates have long warned could come from massive government data collection, especially when it is contracted out to private firms. And it comes at a time when the CBP is under scrutiny for monitoring activists and journalists at the U.S.-Mexico border and airports.

Yet while photos of faces and license plates of some 100,000 U.S. drivers are now freely available online, the CEO of Perceptics, John Dalton, claimed in an email a few years ago that “CBP has none of the privacy concerns at the border that all agencies have inland.”

Writing to one of his company’s lobbyists in 2013, Dalton suggested that the border agency offered Perceptics an opportunity to make greater use of license plate images, stating, “Data mining and looking at traffic patterns/abnormalities are strong analytics for CBP, and could be for others.” Dalton appeared to be referring to the CBP’s relatively unfettered powers of search and seizure within 100 miles of the border. In contrast, for agencies other than CBP, “there is much concern with ACLU state level lawsuits and elsewhere around privacy issues, so this is a live challenge,” he wrote.

The CEO of Perceptics claimed in an email a few years ago that “CBP has none of the privacy concerns at the border that all agencies have inland.”

Dalton’s email and other internal documents laying out Perceptics’ strategy to politically defend its products are among the data taken from the company by an anonymous hacker and analyzed by The Intercept.

“Obviously, we don’t agree with the blanket assertion that there are no privacy concerns at the border,” said Nate Freed Wessler, of the American Civil Liberties Union’s Speech, Privacy, and Technology Project. “The government position is that they have latitude to do whatever they want there, and we vigorously disagree with that.”

Wherever they are used, said Wessler, license plate readers, or LPRs, are concerning when the data they collect is retained and analyzed, providing a gold mine of location information as people go about their daily lives in their cars.

“Especially for people who live in border communities, who live binational lives, it can really be sensitive information,” he said. And as the Perceptics hack shows, data that is retained is also vulnerable to unintended release or use, whether by hackers or unscrupulous government employees or contractors.

Dalton’s emails distinguish between analyzing data and merely capturing it but suggest that Perceptics could be in the business of both. In response to the suggestion by an industry colleague that they “need to really hit back hard on separating technology with policy (data collection vs. data use)” in order to ward off privacy concerns, Dalton wrote, “Perceptics can do anything any of these extremes want and everything in between. That is just the kind of customer friendly company we are.”

He continued, “For CBP, we do not host any data at all, as we are a complex sensor; for the Pentagon, the vehicle data is hosted/stored on our provided hardware/software solution, database and user interface. In any system, the data can be dumped just about under any set of timing or other conditions.”

In early July, CBP suspended Perceptics from receiving any further contracts with the federal government, citing “evidence of conduct indicating a lack of business honesty or integrity.” The suspension apparently came because the company “had transferred copies of license-plate and traveler images onto its private network in violation of agency rules,” according to the Washington Post. A CBP official told the paper that Perceptics was trying to “refine its algorithms to match license plates with the faces of a car’s occupants, which the official said was outside of CBP’s sanctioned use.”

Neither CBP nor Perceptics responded to questions from The Intercept. Reached for comment, Cristina Antelo, a lobbyist who has worked with Perceptics for over a decade as part of the Podesta Group and at her own shop, said that the company’s position on privacy has always been about the distinction between the technology, which Perceptics provides, and its use, which is determined by the customer.

When she spoke with members of Congress, she said, “The question was always what happens to that data: Who has access to it, where is it stored? Does ICE get access to it? How long would you keep it? Our response at that time is that those are all valid policy concerns, and that is a policy issue for Congress to determine.”

Preempting Privacy Concerns

Perceptics nonetheless showed a strong interest in shaping Congress’s determinations around license plate policy. The company engaged in years of lobbying to preempt criticism of its products from privacy advocates, insisting that what happened to the data that its license plate readers captured was none of its business — even as the company worked on controversial trials pairing its camera systems with other companies’ facial recognition products.

Perceptics staff and lobbyists tracked the reaction to stories about ICE gaining access to license plate databases and the DEA building them out, the emails show. In monthly reports spanning several years, the Podesta Group detailed its work on appropriations bills and other spending vehicles. In 2014, for instance, Podesta Group representatives mentioned monitoring legislation regulating location data collection, saying that their staff would “preemptively meet if necessary to ensure LPRs do not get drawn further into the privacy conversation.” In 2015, Podesta Group representatives spoke about building a “possible coalition against LPR bans,” according to one of the reports.

After Donald Trump took office, Antelo and other Podesta staff provided updates on government negotiations over border spending, which sometimes raised the concern that Trump’s hard-line immigration demands would end up scuttling spending on technology and hurt her clients’ bottom line.

“A Trump presidency doesn’t guarantee a bonanza for Perceptics.”

“A Trump presidency doesn’t guarantee a bonanza for Perceptics,” Antelo wrote in a January 2017 email to a Perceptics executive, noting the administration’s pledge to cut budgets. “We might want to do some pre-emptive defense of Perceptics’ programs early on, in addition to affirmatively pushing for more funding,” she continued. In an October 2017 update, Podesta staffer Lucia Alonzo wrote that the administration was holding “to the idea of a southern border wall — there is little mention of other types of technology and infrastructure.” Their job, she said, “continues to be ensuring our LPR language is in any future compromise package.”

In a February 2018 email, Antelo described meetings with staffers for Democrats Peter Aguilar, a California congressman, and Michael Bennet, a Colorado senator and presidential candidate: “Both staffer brought up privacy and data mgmt concerns generally and seemed content with the response that we have no input as to how the data is managed and that it is a valid policy discussion for CBP.” Antelo wrote that when Bennet’s staff asked “about privacy and security of LPR data Perceptics camera captures, we gave them the standard response.”

Staffers for Democratic Sen. Bob Menendez, of New Jersey, on the other hand, “assured us their office has no objection to LPRs. In the larger discussion of DACA/border security, they said they don’t really have a problem with border tech, but rather dramatic stuff like the wall.”

“Michael’s staff raised flags about the privacy risks associated with license plate reader technology and the recent data breach appears to bear out their concerns,” according to Courtney Gidner, a spokesperson for Bennet. “This event has underscored the risks of collecting such information in the first place and how it is stored and protected.” (The offices of Aguilar and Menendez did not respond to requests for comment.)

About-Face

Antelo insisted that Perceptics “makes cameras, really good cameras, and we sell cameras. We do not do facial recognition, we never have and are not developing it.”

But recent emails make clear that Perceptics was at the very least involved in trials to work with other companies that do do facial recognition. The company worked on a pilot for CBP’s “Vehicle Face System,” which, as reported by The Verge last year, was aimed at scanning drivers’ faces through the windshields of their cars, in order to match drivers with the photos on file in government databases. Emails and other Perceptics documents reference work with Unisys, another contractor, on the project.

One email discussing Perceptics’ success in identifying people in cars for policing HOV lanes references “a CBP project” that was “touting high match rates using facial recognition.” In June 2018, an email chain about naming “new products for our borders market” referenced efforts they called “Face Find” and “Face at Speed.” The suggested names from one employee? “1. Big Brother 2. Voyeur 3. Mug shot 4. Head shot 5. paparazzo.”

In Brownsville, Texas, in December 2018, a Perceptics employee was instructed to “hold off on the face cam for the moment. We didn’t have permission to install that in Brownsville, and with privacy concerns we need to do some thinking before we install any face capture utilities within the CBP facilities.”

“Technology that is used at the border doesn’t stay at the border.”

“We’ve never had full insight into what CBP is collecting and what they are storing, and what piece of the puzzle each subcontractor has,” said Neema Singh Guliani, a senior legislative counsel with the ACLU. But, she said, although CBP has rolled out face recognition technology in airports and at pedestrian crossings, for her, there are “big questions about whether CBP has explicit authority to use face recognition.”

“Technology that is used at the border doesn’t stay at the border,” said Mana Azarmi, policy counsel with the Center for Democracy and Technology. “Automatic license plate readers are fairly ubiquitous, and if they manage to attach the software to these cameras and get readable images, then it spreads, we have the ability for law enforcement to do real-time facial recognition of drivers which is something we’ve always warned of.”

Perceptics was alert to the controversy and impending policy changes around face recognition. In August 2018, Alonzo flagged Sen. Kamala Harris, another Democratic presidential contender, for her “interest in privacy and data security surrounding these technologies.” She said that she would track the progress of the legislation Harris had introduced “for any potential impact on Perceptics’ work with facial recognition firms,” and added “we’ll also track reactions to see who else might extend their privacy/data security concerns to technologies like LPRs, and conduct preemptive outreach.”