Federal Agents Accessed Police License Plate Data Without Permission

Federal law enforcement agencies have been accessing automated license plate reader (ALPR) data from local police departments without formal requests, according to public records reviewed by researchers and reported by WBAL-TV.

A University of Washington analysis of public records found that U.S. Customs and Border Protection accessed Flock camera feeds from 10 police departments in Washington state using "back door" access without permission. Additionally, at least eight agencies in the state gave U.S. Border Patrol direct access to their Flock networks.

The findings add a new dimension to ongoing debates about ALPR surveillance, which allows police to track vehicle movements without warrants by capturing license plate data from roadside cameras.

How the data sharing works

ALPR systems feed information into searchable databases that law enforcement can query by license plate number or vehicle description. Flock Safety, the dominant provider of this technology, allows departments to choose whether they share data across the company's network.

In Maryland, state data shows federal agencies requested ALPR data 674 times in 2025, with local departments releasing information nearly 85% of the time. But the Washington state records suggest federal access extends beyond formal requests.

Brian Deehring, an associate professor of cybersecurity at Anne Arundel Community College, told WBAL-TV that federal agencies were "getting shared access from local and regional municipalities" through informal arrangements where local officers shared login credentials.

An online database called HaveIBeenFlocked.com shows thousands of searches where police departments listed "immigration" as the reason, including agencies without cooperative agreements with Immigration and Customs Enforcement. Flock Safety states it has no contract or partnership with ICE.

Data retention policies under scrutiny

Flock Safety previously deleted camera data after 30 days by default. Following public criticism, the company now recommends new customers delete data weekly, though existing departments weren't required to change their retention periods.

Baltimore Police Department operates 136 Leonardo license plate readers that tallied more than 279 million reads in 2025. The department retains this information for nine months. BPD policy requires searches to include a legitimate law enforcement purpose with an incident number or other identifier.

Why it matters

The unauthorized federal access to local surveillance infrastructure reveals a gap between stated data-sharing policies and actual practice. As Christopher Ingraham, an investigative reporter at the Institute for Justice, told WBAL-TV: "The ubiquity of these cameras has really brought us closer to universal mass surveillance than I think we've been so far." The findings raise questions about whether existing oversight mechanisms can effectively govern data access when informal sharing arrangements bypass formal request procedures.

Flock Safety disputes characterizations of mass surveillance, emphasizing that "agencies own and control the data generated by their cameras, and data sharing is not enabled by default." The company notes that 40 courts have ruled fixed ALPRs don't violate Fourth Amendment protections against unreasonable searches.

These details were first reported by WBAL-TV as part of an investigative series on automated license plate readers in Maryland.