EFF's FOIA investigation, published June 25, finds that Flock Safety's ALPR systems, deployed in more than 5,000 communities, include a drop-down menu letting local police subscribe to ICE's Immigration Violator hotlist. The list is built entirely on administrative warrants, issued by ICE agents
EFF's FOIA investigation exposes how a checkbox in a camera vendor's admin interface turns local police departments into passive nodes in a federal deportation apparatus.
Key takeaways
EFF's Investigations Director Dave Maass published findings on June 25 showing that Flock Safety's automated license plate reader systems give local police departments a drop-down menu to subscribe to NCIC "hotlists," including one labeled "Immigration Violator." That list is populated solely by ICE and contains plates tied to administrative removal warrants, civil documents issued by ICE agents without any judicial review. EFF reached those findings through public records requests filed with agencies across the country.
The FBI's NCIC Privacy Impact Assessment confirms ICE is the only agency authorized to enter or maintain records in the Immigration Violator File. The NCIC Operating Manual, hosted by the Illinois State Police, specifies that records may include license plates ICE has "reasonable grounds to believe" a subject may be operating, and that retention is unlimited.
Flock Safety told EFF via email: "Local agencies add/remove license plates from the NCIC list. The FBI curates the NCIC list, and pushes it out to local agencies. Once the list leaves the FBI, they do not see any agency alerts. They only see when a local agency adds or removes plates from the list."
That framing positions the system as neutral infrastructure under local discretion. The Sparks PD evidence punctures it. Sparks's Flock transparency portal lists immigration enforcement as a "prohibited use." Public records obtained by EFF show Sparks had the Immigration Violator hotlist enabled anyway. The policy said one thing. The checkbox said another.
Flock's own public statement on ICE data sharing says ICE has no direct access to camera systems "unless the agencies that control their data expressly and deliberately allow it." The hotlist subscription is precisely that deliberate allowance. It just doesn't get advertised at city council meetings.
The Maryland MPTSC guidance is clarifying on what these warrants actually are: civil instruments issued by ICE agents, not judges, that do not satisfy Fourth Amendment probable cause requirements. The California DOJ has issued guidance stating explicitly that local police generally lack authority to arrest on the basis of an administrative immigration warrant alone. More than 700,000 of these warrants, per the Maryland MPTSC's published guidance, are now sitting in a database that a local camera vendor's admin panel can query on every passing vehicle.
This is the same structural problem that surfaces in financial surveillance: permissioned systems sold as locally controlled have a federal enforcement layer baked in at the infrastructure level. The permissions are cosmetic. The UK's surveillance state arrived the same way, incremental tooling that looked administrative until it wasn't.
When an Immigration Violator hotlist hit occurs, the local agency receives the alert. ICE does not automatically receive notification, per Flock Safety. The local agency decides whether to contact ICE. That sounds like a firewall. It isn't. It means the surveillance apparatus runs continuously and silently, and the decision point is a phone call from a local officer, not a legal threshold.
Agencies with 287(g) agreements carry formal authority to act on immigration enforcement directly. EFF's current data does not confirm whether Sparks PD or Blue Island PD hold such agreements. That question matters for understanding what happens after the alert fires.
Of at least 13 agencies that have responded to EFF's public records requests as of June 25, two had the Immigration Violator hotlist enabled and eleven had it disabled. The number of agencies that have not yet responded, across a network of more than 5,000 Flock-equipped communities, is the operative unknown.
EFF's investigation is ongoing. As more agencies respond to FOIA requests, the map of enabled versus disabled hotlists will sharpen. Contract renewal votes at the local level are the pressure point where this data has immediate effect. The House Transportation and Infrastructure Committee did not advance an amendment to restrict ALPR use during its May 2026 markup of the BUILD America 250 Act, and Congress has shown no legislative appetite to address it. That leaves public records, local politics, and direct contract cancellations as the available tools.
The NCIC Immigration Violator File is a database within the FBI's National Crime Information Center maintained exclusively by ICE. It contains license plates and personal records tied to administrative removal warrants and deportation orders. Unlike a criminal warrant, these are civil documents issued by ICE agents without judicial review. The FBI's NCIC Privacy Impact Assessment confirms ICE is the only agency authorized to enter records into the file. Retention is unlimited per the operating manual.
No. A hotlist hit signals an ICE administrative warrant for removal, not a criminal warrant. Courts have held that local police generally lack authority to arrest someone solely on the basis of an administrative immigration warrant. The California DOJ's guidance makes this explicit. What a local agency does after receiving a hit depends on state law, local policy, and whether the agency holds a 287(g) agreement granting immigration enforcement authority.
File a public records request asking for the agency's Flock Safety NCIC hotlist configuration or "NCIC topics" subscription list. EFF's investigation, which first surfaced this specific hotlist question, is the only systematic national FOIA effort on this data so far. As of June 25, 2026, at least 13 agencies have responded.
