Source: Radio New Zealand
If Customs becomes a user of Auror, it could have access to police information about retail crime. File photo. RNZ /Dom Thomas
Police are cutting back what they tell a privately-run surveillance system about suspects, over concerns about who might see the information.
RNZ inquiries show Customs also wants to use the system, but might be able to see what police are telling retail stores about suspects.
“Customs may become a user of Auror, which may expose police information entered into the retail crime side of the platform,” said an internal memo in March, newly released to RNZ under the Official Information Act.
Police and Customs do not have an agreement to share data through another platform in this manner.
It would be a “significant issue” around security and privacy, the memo from the police’s technology watchdog said.
Police access the system of automated number plate recognition (ANPR) run by Auckland company Auror more than 200,000 times a year.
The widespread police use of ANPR is being legally challenged at the Court of Appeal, which lawyers expect will have wide ramifications for how this – and other surveillance technology – is used.
In official surveys, more New Zealanders say they worry about who can access and use their personal information.
Internal documents show an alarm went up in March at police, especially around officers inputting identifications into Auror of criminal suspects from CCTV images gained from shops through Auror.
“Due to the integrated nature of Auror’s platform, Customs will also have access to the retail crime side of the software,” the March police memo said.
Customs’ view “may include sensitive information such as nomination of offender identities”.
“This raises several concerns for NZ Police, particularly regarding information security and privacy.”
The problem was not just Customs, but also other potential future customers of Auror “with access”, a report said.
‘Police also aimed to reduce the amount of police information on Auror’
Customs has been quietly moving this year towards signing up with Auror.
It told RNZ it ran a trial for a year in 2022-23 to test ANPR within investigations and intelligence gathering, and “recognises the potential benefits… in law enforcement and border security”. It did not yet have a contract.
A police review of Auror usage in July told police to take more care what information they put in to the system.
“Police need to ensure on a case-by-case basis that any information visible to other parties is shared on a lawful basis.”
They did not stop the practice.
“No, police did not stop entering suspect information into Auror platform,” National Criminal Investigation Group director Detective Superintendent Keith Borrell told RNZ this week.
“Instead of ceasing the practice, police provided training and clear communication to police staff to ensure compliance with the Privacy Act Principles.”
This “emphasised that some Auror nominations may contain incorrect details, so thorough accuracy checks are required by police staff”.
“Police also aimed to reduce the amount of police information on Auror while maintaining operational effectiveness,” Borrell said in a statement.
This aligned with recommendations in a report in July.
His group was talking to Customs and Auror to ensure police information was protected.
The March memo said Auror had suggested warning boxes – or blanking out bits of the screen – but that was “likely insufficient”.
“This was never an unresolved issue,” said Borrell on Tuesday. “This approach is proactive and precautionary, not reactive to any breach or failure of Auror platform.”
Police told RNZ no records of any decisions made about this at a senior level existed.
‘It’s a beast’
A few pages of emails released under the OIA showed Customs began asking police for advice about ANPR in February.
“I’m leading Customs project to engage with and develop our ANPR capability, first with Auror, and then all going well SaferCities,” the unidentified Customs staffer wrote on 19 February to Inspector Adrian Ross.
“Suffice to say this has been a rather slow project due to the various risk and public perception concerns held by our chief executive.”
In March, they wrote about a complex security assessment set by Internal Affairs.
“I’m hoping to avoid that if I can as it’s a beast!”
They ended up doing it.
In April they asked police if there was a certain number of searches that constituted “live tracking activity”, because Customs’ lawyers wanted a figure.
“We pushed back on that, had to give staff ownership of their searches, and give them the space to make good decisions without being too prescribed.”
Police officers only live track a few hundred times a year, and it requires special authorisation.
In May 2025 the Customs staffer wrote to police: “I managed to get approval for Auror usage over the line with our Executive Board, so now the hard work begins!”
By August, the staffer was working as “a one-man band, managing the training materials, the contracts”, the standard operating procedures, the privacy impact assessment and all the certification and accreditation.
Public-private bond
Customs told RNZ the 2023 trial showed protocols, restrictions and processes were needed, and it was working on those.
The Office of the Privacy Commissioner said it was aware of the matter, but would not comment on it, although it noted the court challenge against police.
For police, sharing suspect identifications is a problem – but not sharing them is also a problem, the reports showed.
“If police staff do not enter suspect nominations in Auror this will impact the ability for the Auror retail community to identify suspects for subsequent and linked offending which currently benefits Police,” said one. If no one was identified through Auror, the police file would get less priority.
The public-private bond over ANPR surveillance extends back over a decade to a police trial and other support for Auror.
But the private side of this has acted to limit what information can be gained about the system, by the media and even at the Court of Appeal level, where a judge in September noted: “We don’t know how pervasive this system is.”
When Customs was asked in 2023 under the OIA – not by RNZ – about its interactions with Auror, it withheld information and several reports including an Auror presentation and an Auror independent privacy review, on the grounds of commercial sensitivity or it getting the information in confidence.
Sign up for Ngā Pitopito Kōrero, a daily newsletter curated by our editors and delivered straight to your inbox every weekday.
– Published by EveningReport.nz and AsiaPacificReport.nz, see: MIL OSI in partnership with Radio New Zealand
