‘This is Big Brother’: Sheffield council and police ‘spied’ on millions of driver’s road journeys

On Tuesday, technology website The Register revealed Sheffield City Council's automatic number-plate recognition (ANPR) system was found to be readily accessible for anyone to view online.

No login details or passwords were needed to access the ANPR camera system's internal management dashboard. It could be found by simply entering the IP address into a web browser.

From there, the live system could be viewed – which logs where and when vehicles, identified by their number plates, travel through Sheffield's road network via 100 live cameras.

“The unsecured management dashboard could have been used by anyone who found it to reconstruct a particular vehicle's journey, or series of journeys, from its number plate, right down to the minute with ease,” The Register reported.

No fewer than 8,616,198 records of vehicle movements in Sheffield by time, location, and number plate, could reportedly be searched through the dashboard last week.

A Sheffield City Council document from November 2018 said the ANPR cameras would be used to enforce a "clean air zone" (CAZ) proposal for the city, similar to the London congestion charge. As yet, the CAZ charge in Sheffield has not been introduced, but the cameras reportedly began recording on 20 November 2018.

According to privacy experts, the use of ANPR has to be proportionate to the problem it's trying to solve. It is not supposed to be a tool of mass surveillance.

If it is used, a data privacy assessment must be completed alongside a public consultation. Signage also needs to be put up in the relevant areas to make people aware of the cameras.

The public must also be told how their data will be held, and how long it will be held for. All of these steps must take place before authorities begin using the data, a privacy expert told The Star.

The Council’s report mentioned that “clear signing” would be introduced at entry and exit points to the CAZ. There was no mention of a privacy assessment in the report or its appendix. It is not known whether – despite cameras recording vehicles since 2018 – signage has been put up in the relevant areas.

Lib Dem peer and former Leader of Sheffield City Council Paul Scriven, who campaigns nationally on IT and civil liberties, said: “This is Big Brother. This is the Council and the police acting as Big Brother. There are laws and guidance that they have to follow if they wish to use it for legitimate purposes.

“They have just put their great big boots on the civil liberties of any driver in Sheffield.”

Mr Scriven called for “serious penalties” against the Council and South Yorkshire Police, if they are found guilty of wrongdoing.

He added: “On the face of it this seems to be a significant breach of the law by both the police and the council in Sheffield.

“I’m so concerned that this is probably one of the most significant data breaches and abuses of these types of systems that I have made a complaint to the surveillance camera commissioner, Tony Porter.”

Mr Porter described what happened as "both astonishing and worrying” and called for an investigation.

Mr Scriven said: “Both the council and the police have ignored the spirit and the letter of the law by and brought this in secretly without any discussion with the people of Sheffield that they have been spied on.”

“Our journeys could be accessed by anyone who had a basic understanding of technology and how it works.”

Councillor Alison Teal, who represents Nether Edge and Sharrow, added: “Sheffield Council had a data breach not that long ago and we in the Green Party were wondering what the Council has in place for security.

“It doesn’t look like they had any process in place to ensure this doesn't happen.”

Ms Teal was referring to an incident in 2019 when Sheffield Council accidentally released the contact details of hundreds of people - including a rape victim.

In a joint statement, Eugene Walker, Sheffield City Council's executive director of resources and assistant chief constable David Hartley of South Yorkshire Police, said:

"We take joint responsibility for working to address this data breach. It is not an acceptable thing to have occurred. However, it is important to be very clear that, to the best of our knowledge, nobody came to any harm or suffered any detrimental effects as a result of this breach.

"As soon as this was brought to our attention we took action to deal with the immediate risk and ensure the information was no longer viewable externally. Both Sheffield City Council and South Yorkshire Police have also notified the Information Commissioner's Office. We will continue to investigate how this happened and do everything we can to ensure it will not happen again."