BP New Zealand's License Plate Recognition System Reportedly Misidentified Auckland Driver for Fuel Theft in Whanganui

BP’s license plate recognition system reportedly misidentified Auckland resident Buddhika Rajapakse as responsible for petrol theft in Whanganui. Despite the suspect vehicle being a different make, model, and color, the system allegedly linked Rajapakse’s plate to the thefts. BP has reportedly acknowledged a possible doctored plate but still sent multiple payment requests. Rajapakse has reportedly been forced to contest the claims multiple times.

Risk classification

• Primary risk domain: 7 AI system safety, failures, & limitations
• Primary risk subdomain: 7.3 Lack of capability or robustness

The license plate recognition system failed to accurately read the license plate and did not robustly verify the vehicle make and model, leading to a false accusation.

Additional risk subdomains

• 5.1 Overreliance and unsafe use: BP relied automatically on the AI system's output to issue debt collection letters without human verification of the vehicle details.

Causal factors

• Entity: AI
• Intent: Unintentional
• Timing: Post-deployment

The incident was caused by the BP license plate recognition AI system misidentifying a license plate post-deployment, which was an unintentional failure of the system.

EU AI Act risk tier

• Risk tier: 4 Minimal or No Risk

Minimal or No Risk: The system is a commercial license plate recognition tool used by a private company for fuel theft prevention, which does not fall under the prohibited or high-risk categories of the EU AI Act.

AI system and alleged parties

• AI system: BP's license plate recognition system
• AI purpose: License Plate Recognition; Identification
• Behaviour type: Tool
• Alleged developer: Unspecified developer of BP's license plate recognition system
• Alleged deployer: BP New Zealand
• Alleged harmed parties: Drivers whose vehicles are scanned by BP New Zealand's license plate recognition system, Buddhika Rajapakse

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Negligible. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

People affected

• Occurrences reported: 2
• People reportedly harmed: 1
• People reportedly exposed: 1

Potential causes

Management

• Lack of System Quality Assurance: Management deployed automated billing without cross-referencing vehicle data.

Technology

• LPR System Misreading: The license plate recognition system misidentified the plate characters.
• Lack of Vehicle Cross-Matching: System fails to verify if vehicle details match the plate registration.

Data Inputs

• Doctored License Plate: The perpetrator physically altered the plate, feeding false data to LPR.

Human Factors

• Perpetrator Deliberate Fraud: An individual doctored their plate to evade payment and shift blame.

Process and Methods

• Automated Letter Dispatch: Letters are sent automatically without manual verification of the match.
• Inadequate Feedback Loop: Customer service fixes complaints but does not update the automated system.

Information quality

• Classification confidence: High
• Reason for confidence: The report clearly outlines the incident, the AI system involved (BP's license plate recognition), the nature of the error, and the impact on the affected individual. There is little ambiguity regarding the facts of the case.

A private company's automated license plate recognition system misidentified a plate, leading to false accusations of petrol theft against an Auckland resident. This is a localized commercial and administrative error with negligible national security implications.

• Overall national security impact: Negligible
• Scope: Single nation
• Primary target: New Zealand
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. This is a localized commercial billing error, presenting no threat or crisis requiring national security response.
• Autonomy: Human-supervised. The automated system generated and sent payment demands without human verification, though humans intervened to resolve the dispute once contacted.
• Novelty: Established threat. False positives in automated license plate recognition and automated billing systems are well-documented and common occurrences.

Impact by dimension

• Physical security: Negligible. Commercial gas station license plate reading error. No critical infrastructure, physical systems, or human safety affected.
• Information security: Negligible. No intelligence compromise, classified data theft, or state-sponsored information warfare operations identified.
• Sovereignty: Negligible. Commercial billing dispute between a private company and an individual. No impact on state authority or core government functions.
• Economic security: Negligible. Incident involves minor commercial fuel theft and localized automated billing errors, posing no threat to national economic or technological security.
• Societal stability: Negligible. Individual experienced frustration from false accusations of minor theft due to a system error. No large-scale threat to civil liberties or societal stability.