Genetec ALPR removed from Montreal street after public scrutiny

It only took a few hours after CBC Radio-Canada reported on the installation of a Genetec Cloudrunner CR-H2 on a Montreal lamp post for local police to take the camera down. A follow-up report from CBC says that, “similar to the controversial Flock Safety cameras widely used in the United States, the system does more than scan licence plates. It also captures and stores specific vehicle characteristics, including colour, make and model.”

At first, representatives from Service de police de la Ville de Montréal (SPVM) denied knowledge of the camera. Eventually, a spokesperson for the force confirmed that the SPVM had installed the camera atop a post on Henri-Bourassa Boulevard – and that they had taken it down, “in order to preserve ongoing investigative strategies.”

“Investigative techniques, including the means and technologies used, are governed by clear rules from the courts and constitute privileged information,” says the SPVM’s Marc-Antoine Bélanger.

Meanwhile, the head of the SPVM, Fady Dagher, says the Radio-Canada report ruined a perfectly good surveillance operation. “It was an investigative technique, used not at all to monitor the population, quite the contrary, it was to protect the population and anticipate and prevent crimes,” Dagher says. “I think it’s a shame, because we’ve just ruined an investigation.”

Police not helping case for license plate readers

Such is the stink around Automatic Licence Plate Recognition (ALPR) technology. Last October, Genetec signed a $17,134 contract with the SPVM to obtain four Cloudrunner units on a one-year subscription. The solar-powered, wireless Cloudrunner ALPR cameras collect vehicle information and feed it into a closed network, offline from external databases. The data obtained is kept for five years before being deleted. The company says privacy by design is a central tenet of its philosophy and operations.

Nonetheless, the immediate removal of the Genetec Cloudrunner camera by the SPVM following the Radio-Canada report shows that public sensitivity to ALPR in Canada has reached parity with the U.S. – even though Genetec’s Canadian-made system employs a different privacy architecture and data-sharing model than Flock.

Police response to questions about the tech does little to help its case. Fady Dagher’s comments imply that covert police work takes precedence over public transparency and accountability. Indeed, through an access-to-information request, CBC News acquired an internal SPVM privacy assessment acknowledging that the force knows the technology poses civil liberties risks.

The force’s nonchalance about surveillance is clear in its official statement in response to the Cloudrunner matter. “Investigative techniques, including the methods and technologies used, constitute confidential information that some malicious individuals could attempt to exploit,” says spokesperson Mélanie Bergeron. “You will understand that these are, among other things, the reasons why we do not disclose the location of our investigative equipment.”

The CBC report also quotes Dominique Peschard of Quebec human rights group Ligue des droits et libertés, who expresses the fundamental concern about ALPR: “investigative techniques are getting more and more invasive with technology. You need more and more oversight to make sure it doesn’t go overboard and infringe on our Charter rights.”

Three decades of experience, no VC ties for Genetec

Regardless of police intention, there are key differences between the systems offered by U.S. provider Flock and Montreal’s Genetec.

For one, Genetec is an established Canadian security firm – a new advantage in an economic environment stretched by cross-border tensions.

“Genetec is a 30-year-old private company,” says Genetec Vice President Andrew Elvish in an interview with Biometric Update. “We’re based in Montreal. We’ve never had outside investors, no venture capital, no private equity. We’re not publicly traded, which allows us to make a lot of decisions that represent the philosophy of our founder and current president, Pierre Racz. And Pierre is a very firm believer that privacy is an essential human right.”

Elvish says the company makes decisions “that are informed by how we believe our technology is best implemented in communities.” In Silicon Valley shorthand, Genetec is trying not to be evil. But that comparison itself is part of the problem. A culture built on venture capital is a culture constantly chasing debt and quarterly growth. And a culture built on collecting data casts its pall across a wide network of digital enterprises.

Elvish says VC-funded businesses will follow trends, and “with the success of certain social networks in monetizing people’s data and usage, it’s not a big leap to say, well, let’s monetize ALPR data, location data, movement data, and let’s avail that to a wide range of customers for a charge.”

Genetec does not deal in data. The biggest point of difference, Elvish says, is that “Genetec has not built a business model around a sort of smorgasbord of data that you can use to peep into to see what’s going on in people’s lives and potentially use it for any number of inappropriate uses.”

He notes that, by market share, it is the largest company of its kind in the world. There is much at stake in maintaining its operational and ethical standing. In any security industry, trust is a load-bearing pillar. And so, for those who can’t shake the concerns about mass surveillance, Genetec has receipts, in the form of regulatory compliance.

“We adhere to a number of very rigorous certifications, right from how we build our software,” Elvish says. Its certifications include ISO/IEC 27001 and 27017 for Genetec’s information security management system (ISMS); ISO 27017 for cloud security management; level 1 compliance in the U.S. Department of Defense’s Cybersecurity Maturity Model Certification; and the Cyber Assurance of Physical Security Systems (CAPSS) 2023 Certification from the UK government’s NPSA for Security Center with Synergis Cloud Link.

But Elvish is also realistic about privacy risk in a society that is already under constant surveillance. “In the end, it really comes down to a question of what is the community’s desire to implement new technology to help better understand flow, to improve civic services, to improve traffic, to reduce crime. If the risk is very high, sometimes you have to give up a little bit more.”

No facial recognition, no selling data

It’s a hard truth to communicate to a culture that is both deeply paranoid and addicted to platforms that thrive on collecting their data. Many of us now expect that any tech company dealing in cameras and security actually exists to harvest customer data.

This is a world-scale trust problem. And for a company like Genetec, it has become an explanatory challenge: the company simply doesn’t do that. It’s not how it makes money. It’s trying to follow strict rules, to serve exacting customers as discreetly as possible.

The concerns over misuse that have pushed Flock to make changes to its platform, making it mandatory for all law enforcement clients to implement an auditing tool to flag abnormal search behavior, are mostly not applicable to Genetec. Unlike Flock, Genetec does not operate a shared database. Cloudrunner does not include facial recognition capabilities or collect biometric data, according to the company.

Indeed, while fears about mass data collection are valid, the notion that pole-mounted cameras are performing complex facial recognition processes is off the mark. Elvish says “cameras up on poles doing facial recognition” is “mostly the domain of movies,” and founded on misplaced optimism about the tech’s capabilities.

In reality, Elvish says, “it’s very, very difficult.”

Article Topics

ANPR  |  data privacy  |  Flock Safety  |  Genetec  |  license plate readers  |  video surveillance