If you’ve bought groceries, filled your car with petrol or shopped at a major Australian retailer recently, chances are you’ve probably been surveilled by a company using Auror.
Auror is a little-known “crime intelligence platform” used in thousands of stores across Australia, including Coles and Woolworths.
Promising to help combat retail crime, Auror users share information about suspects with each other and police, alert each other when people or cars enter their stores, and even use analytics to “prevent crime before it happens”. The company works closely with Australian police forces, who have access to the data collected by Auror’s users on millions of Australians.
Now privacy experts are raising concerns about how the use (and potential misuse) of a private company’s crime surveillance network without oversight.
Monash Data Futures Institute digital surveillance expert Professor Mark Andrejevic said Auror’s widespread use in Australia is “fascinating”.
“The technology takes the familiar process of posting photos of banned people and escalates it to quite a different level that can have significant consequences for people,” he told Crikey.
Auror did not respond to requests for comment.
What is Auror?
Auror was started by “four Kiwi friends” in 2013. Their pitch was they were going to solve the $100 billion in retail theft each year by helping companies collect information on what happens in their stores and make it easier to share that information with police.
Its product is an online platform for logging “incidents”: everything from theft to accidents in stores’ parking lots to hate crimes. Users are prompted to submit information about what happened using descriptions of the suspect, images, CCTV footage, licence plate information and even social media content.
Auror users can search through reports by people’s names and by products stolen. Individual stores and companies can see overviews of the information and analyse the report data by location and time, which the company said would help prevent future crime.
Auror is also used to track people. While it doesn’t offer facial recognition, its use of machine learning helps identify individuals across different reports. It allows users to input features about an individual’s appearance such as hair colour, age and build (race is notably absent). It analyses photographs or footage to suggest these features and then checks across other reports to link it to an existing profile of an individual, if relevant. This allows Auror to recognise individuals across its network even if the user isn’t aware of other users’ reports.
The platform can then send mobile phone notifications to let users know when an individual has been reported at another location or, using automatic licence plate recognition, if a car has been spotted by any of the cameras on the network.
An important part of Auror’s appeal is its integration with police. The platform is designed to help users share data with police by generating an “evidence box” in just a few clicks.
Importantly, Auror makes it simple for police to access records generated by automatic licence-plate recognition technology, instantly turning a company’s individual cameras into a worldwide car-tracking network. Police are given a “real-time alert” if Auror detects a licence plate linked to a car of interest (a suspected stolen vehicle, for example) is detected by a camera in their network.
During a 2018 interview at a US-based retail loss conference, interviewer Gus Downing summarised its appeal to police: “It acts as the investigative arm for law enforcement. All they have to do is punch [details] in and boom, they got them.”
“Exactly,” said Auror co-founder and co-CEO Tom Batterbury at the time.
From startup to covering 40% of Australian retail
Auror is a start-up success story. During its first year, it picked up one of Woolworths’ major supermarkets, Countdown, as a customer, and also partnered with New Zealand Police. Soon after, part of the company was bought by Westpac-backed venture capital fund Reinventure and snagged a “top 30 ASX-listed” Australian major retailer by 2017. In 2021, Auror raised NZ$30 million in new funding and expanded overseas. EY named Auror founders James Corbett, Batterbury and Phil Thomson its 2022 Entrepreneurs of the Year.
Today Auror boasts having 75,000 retail users across 32,000 stores in Australia, New Zealand, the US and the UK. It said it is working with 40% of Australia’s retail market — including places such as Woolworths, Coles, Bunnings, and Myer — and records more than 100,000 “crime events each month”.
Retailers speak glowingly about how Auror has helped them crack down on crime. Coles national security manager Austin Craddock spoke in a Auror webinar about getting his employees to use the platform.
“I’ve got a little army of people in our shops … If I can find the right person who’s passionate and just can’t wait to get on the platform and report the next thing … that’s the kind of power we’re trying to harness,” he said.
“We’re finding that police love … [how] with such ease they can get the evidentiary material that they want.”
Coles didn’t respond to a request for comment. Woolworths told Crikey that it uses Auror in its supermarket and metro stores to report antisocial and unlawful incidents including theft, abuse to team members and violence.
“The system is used in partnership with police and, along with other measures, has contributed to a safer workplace environment for our team members,” it said.
Auror’s website lists 2000 police agencies having used its platform. It lists NSW Police as a law enforcement partner on its website. In its 2019 report, Victoria Police said Auror’s data “could be leveraged to help with investigations and more serious crimes”. (Victoria Police’s 2019 gifts, benefits and hospitality register also included accommodation in Sydney paid by Auror.) Social media posts show South Australia Police and Western Australia Police have engaged with the company in the past.
‘I love having a browse on Auror’: concerns about potential misuse
The existence of such a widespread surveillance network run by a private company and available to police has raised some privacy concerns. Digital Rights Watch Australia’s executive director James Clark said it’s “worrying” that a business can build up profiles on individuals, track their movements and share it without oversight.
“Most people would not be aware that supermarkets are contributing data about them into a database accessible to police,” Clark told Crikey. “People should be able to shop for groceries without being treated like suspects and having their every move tracked and recorded.”
The Auror website’s privacy page outlines some of its measures. It “encourages” the platform’s users to be “open and public” with people whose information is captured by the platform. It also includes safeguards built into its products and terms of service that prevent users from “racial profiling, on-selling personal information to third parties, automated decision-making about people and sharing information about minors outside of their organisation”, although it notes the information may still be used by police.
The company has also added features such as automatic face redaction for people who are captured in footage but are not persons of interest.
Andrejevic said Auror’s business model of sharing information between retailers raised ethical questions.
There are examples of individuals having or claiming to have misused the platform to access its data. In 2021, New Zealand Police falsely reported a car as stolen to access Auror’s licence plate recognition technology to track down three women who sparked a COVID-19 lockdown. While acknowledging that police should not pretend a car is stolen, a spokesperson said it had the “same outcome [lawfully locating the car]”.
Neither NSW Police nor Victoria Police responded to questions about guidelines around their use of Auror.
On social media, users who say they work for retailers such as Coles and Woolies talk about using the systems, too: “I love having a browse on Auror, fun to see what’s happening,” one user wrote on Reddit.
“Someone uploaded a picture of [a suspect] shovelled into a paddy wagon. Made me laugh,” he said. (These users did not respond to a request for comment.)
Digital Right Watch’s Clark said that Auror was another example of major corporations rolling out harmful surveillance technology without public discussion: “We need far more oversight and public debate about the harms of mass surveillance technology before it’s too late.”
Auror is looking to expand its offerings to allow facial recognition technology and artificial intelligence monitoring of self-checkouts. The company has begun offering its Retail Crime Intelligence Hub, a platform that allows different technologies to work with each other.
“We go from lots of individual data points with no connection, to a full view of all data points that shows the real, full picture of their offending and beyond,” its website said.
“The connected ecosystem collates data to remove anonymity and bring the hidden to light.”
