A program employed by the Drug Enforcement Agency (DEA) to log the license plates of possible criminals also photographs drivers and passengers, regardless of whether they are suspected of a crime, according to documents obtained by the American Civil Liberties Union.

The ACLU reports that the National License Plate Recognition Initiative holds data obtained from devices dotted across the United States. An earlier release from the ACLU revealed that the program is capable of tracking the location of millions of drivers.

A Freedom of Information Act (FOIA) request by the ACLU yielded documents that show that the license plate program is able to provide “the requester” with images that “may include vehicle license plate numbers (front and/or rear)” as well as “photos of visible vehicle occupants” and “a front and rear overall view of the vehicle.”

It does not specify who those requesters are, and the ACLU notes that it is unclear if other government agencies have access to the photographs, although it is believed local and state law enforcement agencies do.

Another record handed over to the rights group noted that the system can store “up to 10 photos per vehicle transaction, including four occupant photos” — indicating, the ACLU said in a blog post, that such photos are not an incidental or even occasional aspect of the license plate readers.

Law enforcement already uses facial recognition technology and automated license plate readers (ALPRs) to identify and track suspected criminals. But the ability to view photographs of car occupants, irrespective of whether they are suspects, has led to privacy concerns.

The ACLU said it would be “particularly worrisome” if the DEA was using the information to target First Amendment–protected activity.

“We don’t want to see someone’s photo entered into a facial recognition database simply because a person’s presence at a gun show (or any other gathering) is considered suspicion of illegal activity,” the ACLU noted.

Some law enforcement agencies appear to recognize such concerns. The ACLU cites an ALPR policy from Tiburon, California, that states, “Cameras will be directed only to capture the rear of vehicles and not into any place where a ‘reasonable expectation of privacy’ might exist.”

To give an example of the type of photos ALPRs can capture, the ACLU referred to a 2012 Wall Street Journal report in which a network security engineer in San Leandro, California, Michael Katz-Lacabe, submitted a public records request for photos of his license plate.

One of the images showed him and his daughters getting out of their car in their driveway. The ACLU emphasized that he had never been suspected of any crime.

The documents obtained under the FOIA request said it is unclear which policies, if any, govern the use of ALPRs, the photos they take or the database of Americans’ locations. The program’s budget is also unclear.

In the ACLU’s earlier report on the program, the group revealed the DEA program’s capability to track people’s movements by storing location data taken by ALPRs. It suggested that the program had been widened from its original purpose — tracking drug traffickers — to quietly collecting data on millions of Americans not suspected of any crimes.

Information is retained for six months for nonhit data, or records that are not matched to any crime. It is unclear how many ALPRs the program has access to, though documents revealed the DEA can tap into similar databases kept by local, state and federal law enforcement agencies nationwide.

The DEA referred Al Jazeera's request for comment to the Department of Justice, of which it is a part, but the department did not respond by the time of publication.