## A database no one asked for The federal government has built a large, nationwide repository of license-plate reader data by routing it through a program originally created to fight drug trafficking, according to public records and court documents. The system works because participation in the program is effectively mandatory for cities that want to operate the cameras in certain places. ## What the program is The mechanism is the High Intensity Drug Trafficking Area (HIDTA) program, a multi-jurisdictional public-safety program created in the 1980s that funds law-enforcement and intelligence efforts across the country. There are 33 HIDTA programs covering all 50 states. Each one is overseen by the White House's Office of National Drug Control Policy (ONDCP) — sometimes called the drug czar — and each is run by an executive board made up of law-enforcement officials and government lawyers. HIDTA funds intelligence centers that aggregate surveillance data. These are separate from, but similar to, government fusion centers, where data is shared between local, state, and federal law enforcement. The complication is that the executive boards are composed of officials from different levels of government, which can make it unclear who is actually in charge of any given piece of data. ## How cities get pulled in The compulsion comes through state-level policy. In Georgia, for example, cities are not allowed to operate automated license-plate reader (ALPR) systems on state rights of way without signing a memorandum of understanding (MOU) with a HIDTA. The MOU commits the city to sending its ALPR data into the HIDTA's systems. The city of Brunswick, Georgia, discovered this when it realized it could not deploy Axon license-plate cameras without signing an agreement with the Atlanta-area HIDTA to facilitate the sharing of information from its electronic data systems — including ALPR data — into commercially available and custom developed data integration systems. Under the agreement, the city's collected data is funneled to HIDTA, where it can be accessed by other agencies through aggregation software that pulls in data from multiple companies. A page on Flock's website set up for Georgia agencies states that if an agency installs or operates cameras on the Georgia Department of Transportation right of way, it must sign an MOU with HIDTA to remain in compliance with a new state police policy — and that the resulting LPR reads will be accessible to Georgia users of the HIDTA national LPR system through the Flock interface. Because there are dozens of HIDTAs across the country, it is not clear how many jurisdictions are actively funneling data into the program's databases. A login portal for the national HIDTA system runs through the Houston HIDTA. ## Who can see the data Once data reaches HIDTA, the access circle widens. Local license-plate data can be queried by various federal agencies, including some that do not have their own contracts with the ALPR companies — the program gives them a route to data they could not otherwise obtain. In some cases, data that goes to HIDTA is then shared into a larger program run by the Drug Enforcement Administration (DEA) called the National License Plate Reader Program (NLPRP). The Houston HIDTA paid $306,800 to a company called Recruitful LLC for creating and maintaining an LPR database, under a contract that described the system as combining third party data into one database and migrating or duplicating data from local entities into it. That means data from cameras made by Flock, Axon, ELSAG, and Vigilant would all be searchable in the same place. One of the project's requirements was that all APIs and third-party integrations — including Flock's — function seamlessly in the new environment. Flock and Axon did not respond to requests for comment. The DEA said it did not have jurisdiction over HIDTA and declined to comment, even on how its own license-plate system interacts with HIDTA. Customs and Border Protection and the ONDCP also did not respond. ## What the data captures — and who it sweeps up The scale of what is collected matters for understanding the stakes. A December 2024 privacy impact assessment by the DEA about the NLPRP explained that the DEA operates its own readers but also receives data from non-DEA equipment through HIDTA and other contributing agencies. Those agencies transmit their data to regional hubs under individual MOUs that stipulate the data may be shared with the NLPRP system. The DEA's own assessment warned that the system may incorporate such large numbers of other governmental LPR network cameras and/or may acquire commercial LPR cameras system data in a large enough quantity in the future to effectively permit on-going tracking of individual's travels posing a risk to individual privacy. It also noted the system risks an over-collection of the personally identifiable information of every license plate passing each LPR camera location, including a large number of images of travel of law-abiding drivers not relevant to criminal investigations. In short, the database does not only hold plates linked to suspects. It holds images of the travel of ordinary drivers, and the mechanism makes that collection hard to audit. ## Why it is hard to challenge The opacity is structural. Much of the misuse and abuse that has fueled backlash against Flock has been uncovered by journalists and local activists working through public records obtained from Flock's network audits and shared on sites like HaveIBeenFlocked.com. But some local jurisdictions argue their data goes directly to HIDTAs, which are not queryable by the Freedom of Information Act (FOIA). The Randolph County Sheriff's Office in North Carolina said, for example, that all data is kept on the Federal Houston-HIDTA database and could not be shared with the public. The DEA has argued in court that HIDTA records are not subject to public-records laws because they are governed by an executive board of state, local, and federal law-enforcement leaders. In a recent court filing, the DEA's attorneys stated that the agency does not create, possess, maintain, or control HIDTA program records, nor does DEA store such records in any of its systems of records — and therefore no records responsive to a request exist within the DEA. The Obama White House described HIDTA not as an entity but as a grant program made up of law-enforcement members, though HIDTAs themselves are the ones signing memoranda with local entities. The program has also received a political boost. In July, the Trump administration gave HIDTA $277 million in additional funding, and it recently won an award from the White House for managing an automated license plate reader platform that brings together all levels of law enforcement. ## A precedent, not an anomaly This is not the first time the ONDCP has funded a centralized law-enforcement database. The agency previously funded Hemisphere, a call-records database that collected phone records and location data on more than a trillion AT&T calls. The Electronic Privacy Information Center (EPIC) notes that Hemisphere — later renamed the Data Analytical Services (DAS) program — allowed law enforcement at every level to access more than a trillion phone records through administrative or grand-jury subpoenas, with no judicial review, and that it actively sought to keep the program from public scrutiny. The parallel is instructive: the license-plate system appears to follow a similar pattern of centralizing sensitive data under a program designed for a narrower purpose. ## What remains uncertain Several questions the records leave open. It is not clear how many jurisdictions across the country are actively funneling data into HIDTA's databases, since there are dozens of HIDTAs and no public accounting. It is not clear how long the data is retained, what it is ultimately used for beyond drug enforcement, or how the public can audit it. The DEA's privacy assessment itself flagged the risk of on-going tracking of individual's travels and over-collection of law-abiding drivers' information, but the assessment describes a risk the agency has chosen to accept rather than resolve. Until those gaps are filled, the system's shape is this: a grant program from the 1980s, overseen by the White House, is quietly turning local camera networks into a federal database — one that law-abiding drivers cannot opt out of, and that no single agency appears willing to take responsibility for.