Agrowing movement has been campaigning against surveillance cameras from companies like Flock Safety, which allow local police to gather mass surveillance data, often citing the possibility of misuse of that data. But for years police have steadily been building a digital infrastructure with personal information on people with criminal backgrounds in the name of public safety — and often without proper digital security

Since 2020, the state police in Illinois have maintained a publicly accessible online map of 30,000 people that it has labeled as “offenders” in 685 nursing homes across the state. The map included the first and last names, dates of birth, home addresses, phone numbers, FBI numbers, and Social Security numbers of people listed. These are elderly people who are vulnerable to scammers. It’s not stated what they have been convicted of. They may have a drug charge from decades ago before marijuana was legalized in Illinois, but their past still follows them.

Matt Chapman, a researcher with the Chicago-based Lucy Parsons Labs, stumbled across the map when he was researching license plate readers maintained by the Illinois State Police (ISP). “Anybody can find this,” Chapman told Truthout. “Anybody can use this for nefarious purposes.”

“Why do these agencies have all this information?” Chapman questioned. “Why are they not protecting it? It really speaks to the lack of care that Illinois State Police have for the information of sensitive folks — the people they’re supposedly supposed to protect.”

Registries, Databases, and Shackles

As police build an increasingly sophisticated surveillance apparatus, they have been shown to be poor stewards of the mass amounts of information they collect on the public. Police have also wrongly entered people into gang databases. In 2020, a scandal erupted in Los Angeles after cops there falsified records in a gang database, which led to the suspension of several officers with the city’s police department. Last year, Kilmar Abrego Garcia was sent to CECOT, the mega-prison in El Salvador, after Immigration and Customs Enforcement accessed information from a disgraced Maryland cop who put him into a gang database linking him to M-13 for wearing a hoodie and Chicago Bulls baseball cap.

In 2021, Protocol, a company owned by BI Incorporated (a subsidiary of the private prison builder GEO Group), which supplies the Cook County Sheriff’s Office with electronic monitors, leaked the personal information of thousands of people across Chicago wearing the devices, what expert James Kilgore calls “ankle shackles.” Chapman, who also uncovered this data leak, said it included “an enormous amount of private information,” such as names, email and home addresses, and the “detailed movement schedules” of people on these digital tracking devices.

“Any scammer could have an absolute field day with this data.”

States have been expanding the use of registries to track individuals — most commonly people convicted of sexual offenses, but also those found guilty of murder, arson, methamphetamine production, and other crimes. In Kansas City, a multi-jurisdictional police operation recently rounded up nearly 100 people on the state sex offender registry who were living within 1,000 feet of a school, which is a violation. Police claimed they were protecting children heading back to school. Thirty years after they were first established, research shows there is little proof that registries make people safer.

Last year, a company that sells an app to monitor the phones of people convicted of sex offenses had the information publicly leaked in what a hacker called “one of the easiest” breaches they had ever done.

Formerly Incarcerated People Still Have Rights

The map of 30,000 names, which the Illinois State Police took down after being notified about it by Truthout, was an interactive map of nursing homes across the state. Nursing home facilities in Illinois are mandated by law to do background screenings and notify the Illinois Department of Public Health (IDPH) of what are referred to as “identified offenders.” The department is then supposed to alert the Illinois State Police, who conduct an investigation and assess the risk.

Alan Mills, an attorney at Kaplan & Grady who advocates for incarcerated and formerly incarcerated people, told Truthout: “That has meant that a lot of nursing homes simply won’t take anybody with a criminal history, and that has been a real serious problem for people getting out of prison.”

“The sharing of private information about thousands of Illinois nursing home residents is a violation of state law.”

To his knowledge, there is no stipulation that this personal information be made publicly available — and especially no justification for publicizing Social Security numbers. “That sounds completely outrageous and has nothing to do with public safety,” said Mills.

As the IDPH website states, the program is ostensibly meant to “prevent abuse and promote the safety” of its residents and staff. The release of this private data about “identified offenders” raises the question — what about the safety and abuse of those with criminal histories who are living in nursing homes?

“Convicted felons still deserve privacy rights,” said Cooper Quintin, Senior Staff Technologist with the Electronic Frontier Foundation. The list includes people who were born in the 1940s — far more likely to struggle with technology and be vulnerable to harm, rather than causing it themselves. “Any scammer could have an absolute field day with this data,” Quintin told Truthout.

“They haven’t even taken the basic steps here to secure this data,” said Quintin. “It’s open on the internet to anyone, and that’s just incredibly irresponsible.”

“Trust Us”

This breach could be dismissed as a clerical mistake. It could be claimed that laws are failing to keep up with increasingly sophisticated technology. But this pretty simple violation throws into question whether police can be trusted with our information.

In an email to Truthout, Benjamin Ruddell, a lawyer and director of criminal justice policy at the ACLU of Illinois, stated:

The sharing of private information about thousands of Illinois nursing home residents is a violation of state law. Illinois residents should be able to trust that ISP would take seriously its legal duty to secure personal information that could be exploited to do real harm — including identity theft, stigmatization, fraud, or harassment of thousands of people across the state. In recent years, we have been told repeatedly that we must trust law enforcement with ever-increasing surveillance capabilities — often enabled with artificial intelligence — to collect an ever-increasing volume of data about all of us to enhance public safety. This example shows that their mishandling of this surveillance data has the potential to make people less, not more, safe.

“The Illinois State Police … should immediately halt its expansion of its statewide surveillance infrastructure.”

Truthout reached out to inform Illinois State Police about the map, and the Illinois State Police responded to the data breach by immediately removing the map from their website. According to the Illinois Personal Information Protection Act, any state agency that collects personal information on an Illinois resident must notify them of a data breach within 45 days and provide notice to the attorney general.

When asked for comment, Melaney Arnold, the chief public information officer for the Illinois State Police, told Truthout: “This specific dashboard was initially created as part of an internal pilot data source and it was not intended for public dissemination. The data has been decommissioned and is no longer accessible to the public. ISP is in the process of notifying impacted parties.”

“With how trivial it was to find,” said Chapman, who is the first known person to have found the information online, “it fills me with dread knowing that the Illinois State Police have no idea what information it’s exposing to the public — they’re simply not looking. ISP should immediately halt its expansion of its statewide surveillance infrastructure and any agency in Illinois that works with ISP should truly reconsider whether their trust in a such a reckless agency is justified.”

---

---