Attorney General Jeff Sessions visited Sacramento, California, last week to announce that the Trump administration would sue the state of California, claiming that recent statewide sanctuary policies have made it nearly impossible for U.S. Immigration and Customs Enforcement agents to arrest and deport undocumented people in the area. Federal immigration raids had swept across Northern California at the end of February, resulting in the detention—and perhaps the eventual deportation—of more than 200 people. But that number was supposed to be bigger: Immigration and Customs Enforcement agents had originally targeted about 1,000 people for arrest. Thanks to Oakland Mayor Libby Schaaf, who tipped off constituents a day before immigration officers came to the area to conduct the raids, ICE’s plans were spoiled.

The standoff between the federal government and California leaders—whose communities face significant disruption should the Trump administration achieve its immigration-enforcement ambitions—has become intensified in recent weeks, a tension that will only ratchet up during President Trump’s visit to San Diego Tuesday to look at prototypes for a border wall. California Gov. Jerry Brown called Sessions’ lawsuit “an act of war” and part of a “reign of terror” against the state. More and more cities and towns have passed sanctuary laws since 2017, meaning they are not aiding federal immigration officials in every case with every request. But in a manner they may not realize, local law enforcement agencies in these communities may be indirectly helping federal immigration agents anyway.

That’s where a company called Vigilant Solutions, which operates multiple nationwide license-plate-reader databases, comes in. Vigilant Solutions has contracts with cities and counties across the country, including ones with sanctuary policies—and federal agencies, like the Department of Homeland Security, are able to access the same databases in order to find targets for immigration arrests. ICE inked its own contract with Vigilant Solutions in December to gain access to the company’s commercial license-plate-reader database, a separate tranche of information. License-plate numbers are collected for all kinds of policing that doesn’t necessarily have anything to do with immigration, like finding drug traffickers or other criminals. But because undocumented people can own cars or may regularly travel with, say, documented family members who own cars, their data inevitably gets siphoned up by this kind of dragnet surveillance—making it another tool for immigration officials at a time when they are dramatically stepping up enforcement.

Feeding these databases are license-plate readers, which are high-speed camera systems that capture all vehicle plates that pass by their view. The devices are usually mounted on streetlights or highway overpasses or even on cars, like police vehicles or tow trucks, which send the photos of the plates they upload to a central server, along with the location, date, and time when the photos were taken. The data can help police learn whether vehicles were at or near a crime scene as well as where a person works or lives or who they visit regularly, allowing them to help law enforcement agencies target leads and close cases. “Joining the largest law enforcement LPR [license plate reader] sharing networking is as easy as adding a friend on your favorite social media platform,” boasts the Vigilant Solutions website. With enough data points, agents can draw a fairly accurate portrait of a target’s schedule and work and home addresses, making it much easier, for example, to conduct immigration raids.

With enough data points, agents can draw a fairly accurate portrait of a target’s schedule and work and home addresses, making it much easier to conduct raids.

Vigilant’s clients include dozens of local agencies in California. Sacramento—which has robust sanctuary policies that, among other protections, provide city-funded legal aid to help residents fight deportation—shares data with more than 750 law enforcement agencies nationwide, according to Vigilant Solutions documents obtained by recent public records requests from Dave Maass, a researcher with the Electronic Frontier Foundation, a digital rights organization, and Mike Katz-Lacabe of the Center for Human Rights and Privacy. (Disclosure: I used to work at EFF.) A public records request from San Diego likewise returned a list of more than 640 agencies the city shares its license-plate-reader data with, including at least nine agencies that are within the U.S. Department of Homeland Security, under which ICE operates.

These sharing agreements mean that even if a city with sanctuary policies doesn’t provide vehicle-location information to ICE directly, other agencies at the DHS that do provide information to ICE have easy access to, say, Sacramento’s data, because the county sheriff’s department sends its license-plate data to Vigilant Solutions’ database. The same goes for Los Angeles County, which also has sanctuary protections. Because Los Angeles County elects to share its license-plate-reader data with San Diego and Sacramento and possibly even other cities or DHS offices that have data-sharing arrangements with Vigilant, ICE can likely obtain Los Angeles County’s data with relative ease. In Northern California, for example, public records obtained by Katz-Lacabe show how ICE has specifically queried the local DHS fusion center, a regional DHS-data clearinghouse that coordinates intelligence sharing between state, local, and federal agencies, for license-plate-reader data. That fusion center also participates in Vigilant Solutions’ shared database, according to public records from Sacramento and San Diego. “Different fusion centers may have different policies, but we know that at least some do provide information to ICE,” said Jay Stanley, a senior policy analyst at the American Civil Liberties Union who specializes in surveillance tech.

Santa Clara, Contra Costa, Marin, Orange, Alameda, and San Bernardino counties all have cities with sanctuary policies, and all also share data with the Vigilant Solutions license-plate-reader database. More places are signing on: For example, in Culver City, a municipality within Los Angeles County with sanctuary policies of its own, the police department submitted a request earlier this year to contract with Vigilant Solutions for its license-plate-reader technology, which the city council is slated to vote to either finalize or refuse on Tuesday. Law enforcement agencies that contract with Vigilant Solutions can hand-pick which agencies across the country they want to share their data with or if they want to share with the entire network. But looking at the long list of hundreds of agencies that share data with Sacramento and San Diego alone, it appears many of Vigilant Solutions’ clients are fairly permissive.

Sacramento alone shares data with at least 11 DHS agencies. And at least seven fusion centers share data with Vigilant Solutions, too, according to documents obtained through records requests from Maass and Katz-Lacabe. DHS openly boasts in multiple instances in which fusion centers have coordinated with ICE on its “Fusion Centers Success Stories” page.

The direct contract ICE finalized with Vigilant Solutions that was published in January isn’t for access to the company’s shared law enforcement license-plate-reader data, but rather for access to its “commercial database,” which has more than 5 billion records. Unlike its law enforcement database, which ICE can likely also request queries from through its DHS partners, the commercial database is the result of private collection efforts, like by repossession and towing companies, for example, that connect license-plate readers to their vehicles to scan plates on cars they pass by, recording the location and date of the collection, too. Repossession businesses regularly publish ads for jobs to Craigslist looking for contractors to drive vehicles around with license-plate readers attached, collecting data that can then be sold to private companies like Vigilant Solutions.

Although ICE’s own contract is for Vigilant Solutions’ commercial database, that doesn’t mean ICE can’t sometimes directly access the law enforcement database. In another records request, Maass found that an ICE agent accessed Vigilant Solutions’ database through the Long Beach Police Department’s system in November 2016 and ran 278 license-plate searches over a nine-month period. During the same period, two officers from Customs and Border Control conducted 578 license-plate searches through Long Beach’s system, too, likely through joint investigations with the department. In September the next year, ICE announced that it arrested 167 people throughout the Los Angeles area, which includes Long Beach, though it’s unclear if any of the data obtained through the ICE agent’s license-plate search contributed to the arrests. Long Beach passed its own set of sanctuary policies in September, days before the immigration raid.

In Trump’s first year, ICE arrested more than 105,000 people with criminal convictions and more than 37,000 people without criminal records—a 146 percent increase over the year before of people without known convictions. And as the raids continue and feds continue to challenge local sanctuary laws that can prevent law enforcement from sharing data (like a person’s home or work address) with ICE, private companies that share their data with national law enforcement networks, like Vigilant Solutions’ license-plate system, may start to play an even more central role in mass arrests. Local police in sanctuary cities may be sharing data with ICE without anyone having to ask.

Cities often adopt sanctuary policies to make it tougher for ICE agents to arrest and deport residents who haven’t committed serious offenses. But when police contract with companies that engage in dragnet digital surveillance and data sharing, they inevitably give up some level of control over where that data may end up. “If you want to protect undocumented people in your community, don’t engage in surveillance in the first place,” says Stanley of the ACLU. “And don’t store it.”