Immigration and Customs Enforcement allows thousands of employees to access a controversial license plate database with questionable legal safeguards in place to prevent abuse, the American Civil Liberties Union said today as it published thousands of pages of agency documents.

The documents, which were obtained through a Freedom of Information Act lawsuit and include emails as well as internal ICE policies, detail the agency’s access to a massive private database that civil liberties advocates have criticized as unduly invasive. The database, run by a company called Vigilant Solutions, allows law enforcement to track cars against previously compiled license plate data, giving police a way to closely monitor the movement of vehicles.

In emails obtained by the ACLU, ICE was told that law enforcement could expect access to billions of license plate scans, with hundreds of millions more added each month. A law enforcement data-sharing process makes the system “as easy as adding a friend on your favorite social media platform,” according to the emails.

More than 9,200 ICE employees have access

More than 9,200 ICE employees have access to the database, according to an email from last year, but there were scant privacy safeguards in place, the ACLU said. The agency is provided access to up to five years of driver information, which the group describes as “both a significant invasion of privacy and entirely unnecessary to find someone’s current location.”

According to a report published in the documents, more than 80 local law enforcement agencies share license plate information with ICE. Those cities, the ACLU notes, include sanctuary cities like Union City, California. The documents also showed a close relationship between ICE and local authorities, with one California detective informally sharing information with ICE.

In a statement, an ICE spokesperson pointed to a privacy assessment, and said the agency “does not use the [license plate reader] data service to locate or track individuals who have no connection to ICE investigatory or enforcement activities.” The spokesperson also said the agency does not take action solely based on license plate data.

“All authorized ICE users must complete appropriate training before accessing the commercial LPR database,” the spokesperson said. “Additionally, all ICE employees are required to take mandatory training for data security, privacy, information assurance, and records management on an annual basis.” ICE says it also limits access to those who need license plate reader data for “mission-related purposes.”

ICE’s use of the license plate database was first revealed in early 2018, and it quickly set off privacy concerns. As ICE, under the Trump administration, expands how far it will go to deport immigrants, the database provides a powerful tool to track people around the country.

Vasudha Talla, a staff attorney for the ACLU of Northern California, said in a statement that the practice was “appalling” and that “local law enforcement agencies must immediately stop sharing their residents’ information with this rogue and immoral agency.”

Update, 5:48PM ET: Includes statement from ICE spokesperson.