Over the past decade, license plate readers have become an increasingly popular tool for law enforcement around the United States. One federal agency that has aggressively pursued this data is US Immigration and Customs Enforcement, through a $6.1 million contract with a private firm called Vigilant Solutions. Now, new details of this arrangement have been revealed through extensive documents obtained by the American Civil Liberties Union of Northern California, via a Freedom of Information Act request.

The internal documents show that through its Vigilant Solutions contract, which began in 2018 and runs to September 2020, ICE has access not only to 5 billion records gathered by private businesses, but also to 1.5 billion data points contributed by over 80 local law enforcement agencies from more than a dozen states. Often, these data-sharing agreements stem from friendly professional relationships between local police and ICE, but these casual arrangements may violate ICE privacy policies and state and local data-sharing laws—particularly in cases where the data originates from sanctuary cities. Vigilant Solutions and ICE did not immediately return a request for comment.

"The records raise many questions about the relationship between ICE and local agencies," says Matt Cagle, a staff attorney at the ACLU of Northern California. "Federal law does not require that local agencies expose sensitive local driver locations. It is surprising when a government agency obtains unfettered access to information that reveals where we live, where we work, and our private habits."

Automated license plate readers, sometimes called ALPRs, are high-speed cameras mounted on overpasses, bridges, road signs, public vehicles, or on private property such as malls or parking lots. They can record thousands of license plates per minute and capture the location coordinates, date, and time along with each photo for long-term aggregation and storage. The data they accumulate can be used to create a detailed picture of where a car has been over time. Both private companies and local law enforcement partner with Vigilant to build up its databases.

ICE doesn't collect license plate data directly or maintain a database. It instead relies on its Vigilant contract. The ACLU documents, which were viewed by WIRED, show that more than 9,200 ICE officers have database accounts. And Vigilant claims to add hundreds of millions of new license plate scans from private businesses every month. The documents also show that Vigilant provided training to ICE on how to convince local law enforcement agencies to make their regional license plate data available. The documents also show ICE agents asking local police to run searches for them, even when ICE doesn't have full access to that repository.

This type of informal access seems incongruous with ICE's privacy guidance for license plate location data. For example, ICE claims to limit license plate data collection near "sensitive locations" like churches, hospitals, schools, or protests. But when data is streaming in from so many sources, both public and private, it's almost impossible to avoid this data in searches. The more data is collected and stored through private contractors, the easier it is in practice for the boundaries to bleed together.

"Like most other law enforcement agencies, ICE uses information obtained from license plate readers as one tool in support of its investigations," the agency said in a statement, adding that it does not use license plate data to track individuals outside of its purview, and does not rely on it by itself to justify enforcement action. "Any ICE personnel who have accessed the system without authorization or who used the database in an inappropriate manner may be disciplined, which may include revoking access to the database, suspension, or termination of employment."

"It is surprising when a government agency obtains unfettered access to information that reveals where we live, where we work, and our private habits." Matt Cagle, ACLU

The documents indicate that sanctuary cities like Union City, California, have contributed local license plate data to ICE-accessible databases. And the ACLU points out that, in addition to sanctuary protections, which limit a municipality's cooperation with federal immigration investigations, some states have more general laws that limit or prohibit license plate data sharing between local and out-of-state agencies. In California, for example, local agencies sharing license plate data with ICE may be in violation of Senate Bill 34 and the California Values Act (SB 54), which limit data sharing between local and federal authorities, particularly for immigration enforcement.