News & Commentary written by Vasudha Talla

U.S. Immigration and Customs Enforcement is using mass location surveillance to target immigrants. And local governments like Union City, California, are helping — feeding their residents’ personal information to ICE, even when it violates local privacy laws or sanctuary policies. Today, the ACLU is urging an immediate end to this information sharing.

Records obtained by the ACLU of Northern California in a Freedom of Information Act lawsuit detail ICE’s sweeping use of a vast automated license plate reader (ALPR) database run by a company called Vigilant Solutions. Over 9,000 ICE officers have gained access to the Vigilant system under a $6.1 million contract that the public first learned of last year. ICE has access to over 5 billion data points of location information collected by private businesses, like insurance companies and parking lots, and can gain access to an additional 1.5 billion records collected by law enforcement agencies.

Over 80 local law enforcement agencies, from over a dozen states, have agreed to share license plate location information with ICE. And emails show local police handing driver information over to ICE informally, violating local law and ICE policies.

The ACLU’s grave concerns about the civil liberties risks of license plate readers take on greater urgency as this surveillance information fuels ICE’s deportation machine. Many communities have license plate readers: high-speed cameras mounted on police cars, road signs, or bridges that can photograph every passing license plate. Together with time, date, and location coordinates, the information is stored for years, generating a literal and intimate roadmap of people’s private lives. Vigilant also sells ALPR systems to local police and hosts location information collected by law enforcement and private companies in a massive database called LEARN.

We already knew that ICE engages in egregious conduct: from arresting a father dropping off his daughter at school to detaining a woman in court seeking a protective order against an abuser. But adding license plate surveillance with its attendant misuse — police spying on Muslim Americans or unlawfully detaining a black woman at gunpoint — magnifies ICE’s threats to community safety. And now we know which local police departments are helping ICE terrorize immigrant communities by sharing license plate information.

A Nationwide Mass-Surveillance Dragnet

Contract documents show that ICE has long desired the ability to locate people with laser-like precision. After prior attempts were scuttled because of privacy concerns, ICE rushed to finalize a 2017 contract with Thomson Reuters for access to the Vigilant database.

The $6.1 million contract gives ICE access to the Vigilant database through September 2020. Not only does Vigilant’s existing database contain over 5 billion license plate scans nationwide, but the database would continue adding, from commercial sources, “an average of 150-200 million unique” license plate scans each month.

Vigilant draws its license plate information from the “most populous 50 metropolitan areas” in the country, corresponding to almost 60 percent of the U.S. population.

IMAGE 1

IMAGE 2

IMAGE 3

ICE was also told that law enforcement agencies “could provide hundreds of millions more LPR scans available for ICE to search” and that its database held “500 million” license plate locations collected by law enforcement.

License plate information collected and shared by police and sheriffs are key to the surveillance dragnet. Vigilant encourages law enforcement to share location information collected locally with hundreds of other agencies nationwide, making it “as easy as adding a friend on your favorite social media platform.”

In training materials, ICE was given the tools to make friends with local police: an interactive map of the United States displaying the agencies using Vigilant software, together with “a step-by-step guide (with pictures!)” containing instructions on requesting access from local agencies to their residents’ location information.

IMAGE 4

ICE’s efforts to exploit locally collected location information are working. An internal report lists the 80 local agencies nationwide that granted ICE ongoing access to license plate locations of their residents, including “sanctuary cities” like Union City, California. We do not know whether police gave notice to their residents before agreeing to share years of intimate details with ICE.

In addition to ongoing access to local information, ICE makes individual requests to friendly police for surveillance. Released emails reveal a years-long relationship between an ICE officer and a detective in a fusion center — an intelligence-sharing agency long-criticized by the ACLU for violating civil liberties — in Orange County, California.

The detective searched the Vigilant database at the request of ICE and shared the results:

IMAGE 5

IMAGE 6

These emails and others reveal ICE’s methods for circumventing both internal privacy rules and attempts by local law enforcement agencies to lock down their information. These informal inquiries violate ICE’s privacy rules requiring all use of ALPR technology to be documented and justified. And ICE exploits friendly intermediaries like the Orange County detective to obtain information collected by another law enforcement agency that may not want ICE to have access to its information. This contradicts ICE’s claim that “there are no circumstances where ICE can gain access through the vendor system if a law enforcement agency has chosen not to share its data.”

With more than 9,200 ICE employees with accounts on the Vigilant database — many of whom have deportation as their primary work — privacy safeguards are essential. Yet ICE’s so-called Privacy Guidance contains gaping holes that enable ICE to infringe on civil liberties. ICE can sweep up to “five years” of driver information when searching for an immigrant to deport.

That much location information is both a significant invasion of privacy and entirely unnecessary to find someone’s current location. The privacy rules also do not prevent ICE from ensnaring other individuals — whom they are not looking for — increasing the chances of baseless stops and false arrests.

ICE’s privacy rules fail to adequately protect First Amendment-protected speech and activity. While it requires ICE abide by its Sensitive Location policy — limiting surveillance near schools, hospitals, churches, protests, or weddings — there is no way for ICE to know before searching the Vigilant database whether the search will turn up driver information near those locations.

Resistance Is Local

In California, police sharing resident location information with ICE violates the law.

Senate Bill 34 and the California Values Act (SB 54) — passed to protect privacy and immigrant safety — prohibit local law enforcement agencies from sharing license plate information and personal information for immigration enforcement or with out-of-state or federal agencies. Many localities have gone beyond that to adopt ordinances to provide sanctuary to immigrants.

Today, the ACLU called on local law enforcement agencies to stop sharing their residents’ location information with ICE.

California state lawmakers should now call for the state auditor to review compliance with SB 34 and SB 54.

In addition, communities must regain control over their personal information. Some have already rejected contracts for license plate surveillance — like Alameda and Culver City in California. And all communities should pass ordinances to require transparency, oversight, and approval whenever a police department considers purchasing surveillance technology.

If these ordinances existed, and the right questions were being asked and answered from the start, communities like Union City wouldn’t be endangering their community by sharing location information with ICE in direct conflict with their sanctuary policies and the law. Local governments need to take immediate action to limit the exposure of local residents’ information to ICE and withhold information from fusion centers that do not do the same.

ICE has long embraced technology to target immigrants. Now it’s taking surveillance to an unprecedented level to target vulnerable communities — and sweeping up everyone else in the process. It’s time to take back control of our information and make sure our communities aren’t collaborating with ICE.

Thanks to Electronic Frontier Foundation and MuckRock for their work documenting the widespread sharing of license plate information among law enforcement agencies nationwide.