404media.co
How Cities Are Forced to Funnel License Plate Data to a Massive Federal Surveillance Program
The Trump administration is using an anti-drug trafficking grant program from the 1980s to force cities around the country to funnel their ongoing collection of automated license plate reader data into large federal surveillance centers that fall under the White House’s jurisdiction, according to public records and court documents reviewed by 404 Media. The records show the workings of a complex system in which the federal government is using the “High Intensity Drug Trafficking Area” (HIDTA) program to obtain data from local cops’ Flock, Axon, and other ALPR cameras and aggregate it on federal government servers, where it is then accessible to other federal, state, and local law enforcement agencies. In some cases, data that goes to HIDTA is then also shared to a larger program run by the Drug Enforcement Agency called the “National License Plate Reader Program” (NLPRP). Through HIDTA systems, local license plate data can be accessed by various federal agencies, including those who may not have contracts themselves with the ALPR companies. The program raises significant privacy and transparency concerns; as cities begin to place restrictions on how their Flock data can be used, it represents an end-around for federal law enforcement to access data that it might not normally be able to, and to do so without any obvious oversight body. HIDTA falls under the jurisdiction of the White House’s Office of National Drug Control Policy (ONDCP), and it recently won an award from the Trump White House for “managing an automated license plate reader platform that brings together all levels of law enforcement.” Many of the documents used in this article were obtained using public records requests by Cris van Pelt, the creator of the website HaveIBeenFlocked.com and its associated investigative blog, Footnote4a . “When local police and private vendors promise community control over surveillance, they obscure a broader agenda. The DEA and ONDCP are already aggregating local data behind the scenes,” van Pelt said. “This bypasses democratic processes entirely. The public has made it clear that mass surveillance violates fundamental rights, even when it is laundered through fragmented systems, private companies, and regional task forces.” A complex setup and a quasi-government program The ONDCP, which oversees the HIDTA program, is sometimes known as the “drug czar” and has funded a series of law enforcement and overarching surveillance programs, including a call records database called Hemisphere that collected phone records and location data on more than a trillion AT&T calls. HIDTA is a “ multi-jurisdictional public safety program ” that funds a series of different HIDTA intelligence centers and other drug enforcement efforts throughout the country. There are a total of 33 HIDTA programs, which cover all 50 states. HIDTA’s intelligence centers are similar to — but separate from — government fusion centers, in which surveillance data is shared between local, state, and federal law enforcement. Individual HIDTA intelligence centers are managed by “executive boards,” and are usually made up of law enforcement officials and government lawyers, but this setup can also lead to confusion about who is actually in charge of the data that any HIDTA collects. “The White House Office of National Drug Control Policy, which notoriously funded a centralized call record database that exceeded a trillion records that was used by HIDTA participants, has apparently done a similar thing for license plate reader data,” Jeramie Scott, director of the Electronic Privacy Information Center’s Surveillance Oversight Center, told 404 Media. “The whole scheme adds another layer of obfuscation of how license plate reader data is being used and who is using it. If you’re pissed about Flock then you should be pissed about this. No doubt this database contains license plate reader data from Flock as well as from other providers of license plate reader technology. The government went to great lengths to keep the Hemisphere Project out of the public’s eye, and I wouldn’t be surprised if they have tried to keep this program from the public too.” HIDTA’s setup is complicated, but important. Over the last several years, the White House and several states have taken steps to ensure local ALPR systems are fed into HIDTA; for example, cities in Georgia are not allowed to operate ALPR systems on state rights of way without signing a “ memorandum of understanding ” (MOU) in which they promise to send their data to a HIDTA, according to copies of the agreement seen by 404 Media. A screenshot from a presentation made by the Kansas Highway Patrol This MOU highlights how convoluted this program is. Earlier this month, the city of Brunswick, Georgia, realized that it could not deploy Axon license plate cameras without signing an agreement with the Atlanta-area HIDTA to “facilitate the sharing of information contained within their electronic data systems, including but not limited to: Automated License Plate Readers and Law Enforcement Data Sharing Systems—which may include aggregated information collected from multiple individual or regional sources—into commercially available and custom developed data integration systems.” The MOU essentially states that ALPR data collected by the city must be funneled to HIDTA, where it can be accessed by various other law enforcement agencies through aggregation software that brings in data from multiple different companies. From a City of Brunswick city council meeting information packet From Flock's website for Georgia agencies A page on Flock’s website set up for Georgia law enforcement agencies says, “if your agency installs or operates cameras in the Georgia Department of Transportation Right of Way, you must sign a memorandum of understanding with HIDTA to remain in compliance with the new Georgia State Police policy […] LPR reads from GDOT ROW cameras will be accessible to Georgia users of the HIDTA National LPR system through the Flock interface.” Because there are dozens of HIDTAs across the country, it is not clear how many jurisdictions across the country are actively funneling data into HIDTA’s databases. A login portal for the national HIDTA system seen by 404 Media runs through the Houston HIDTA . “As we learn more about ALPRs and the extensive ALPR data-sharing infrastructure, it’s clear that we've only scratched the surface regarding the danger of these tools,” Ed of Southerners Against Surveillance Systems and Infrastructure told 404 Media. “As we learn more, it's clear that the outrage against this surveillance is justified. We need all of these cameras removed.” ONE PROGRAM INTO ANOTHER A December 2024 privacy impact assessment by the DEA about its National License Plate Reader Program explained that the DEA operates its own license plate readers but also gets access to “non-DEA equipment” through HIDTA and other “contributing law enforcement agencies.” “These contributing agencies transmit their LPR data to servers maintained by regional hubs pursuant to their individual MOUs, which stipulate that this data may be shared with the NLPRP system,” the DEA wrote in the impact assessment, and added that the DEA has been seeking to integrate itself with a Customs and Border Protection (CBP) license plate camera system. It noted that the system “may incorporate such large numbers of other governmental LPR network cameras and/or may acquire commercial LPR cameras system data in a large enough quantity in the future to effectively permit on-going tracking of individual’s travels posing a risk to individual privacy,” and that it “risks an over-collection of the personally identifiable information of every license plate passing each LPR camera location, including a large number of images of travel of law-abiding drivers not relevant to criminal investigations.” Atlanta is not the only HIDTA aggregating ALPR data. For example, Houston’s HIDTA paid $306,800 to a company called Recruitful LLC “for creating and maintaining an LPR database” that is a search tool for data collected by multiple ALPR companies. A statement of work for that contract explained that the system being built was designed to combine “third party” data into one database, meaning they were creating a database for ALPR data, and that this database would “migrate” or duplicate data from local entities into the centralized database. This means that data from various ALPR cameras — including those made by Flock, Axon, ELSAG, and Vigilant — would all be searchable in this separate database. One of the criteria for this project was “All APIs and third-party integrations (Unification Platform, FLOCK) function seamlessly in the new environment.” Flock and Axon did not respond to a request for comment. The DEA said that it did not have jurisdiction over HIDTA and refused to comment, even on how its own license plate system interacts with HIDTA. CBP did not respond to a request for comment. The White House’s Office of National Drug Control Policy did not respond to a request for comment. This system raises all sorts of questions about where local ALPR data is ultimately going and what it is being used for, how long it is being retained, and how the public can audit the data. Much of the misuse and abuse that has fueled the backlash against Flock has been uncovered by journalists and local activists working through public records obtained from Flock’s network audits and shared on websites like Have I Been Flocked . Some local jurisdictions have also argued that their data goes directly to HIDTAs, which are not queryable by the Freedom of Information Act (FOIA); the Randolph County Sheriff’s Office in North Carolina said, for example, that “all data is kept on the Federal Houston-HIDTA database,” and could not be shared with the public. The DEA has argued in court that HIDTA records are not subject to public records laws because they are complicated entities governed by an “executive board” made up of state, local, and federal law enforcement. The Obama White House described HIDTA not as an entity at all, but a “grant program” made up of “law enforcement members” (this does not change the fact that HIDTAs themselves are signing memoranda of understanding with local entities). “At the local level, the HIDTAs are directed and guided by Executive Boards composed of an equal number of regional Federal and non-Federal (state, local, and tribal) law enforcement leaders,” the DEA’s attorneys argued in a recent court filing in a case in which a man was seeking HIDTA records held about him. “Accordingly, DEA does not create, possess, maintain, or control HIDTA program records, nor does it store such records in any of its systems of records. Since DEA has no custody or control of HIDTA records, no HIDTA records responsive to Plaintiff’s request exist within DEA.” In July, the Trump administration gave HIDTA $277 million in additional funding .
