FBI NCIC LPR Hotlist Usage Examined

Published May 26, 2022 14:45 PM

LPR usage is exploding, powered by hotlists provided by the FBI's National Crime Information Center (NCIC). However, details on how law enforcement and LPR companies leverage sensitive crime information from the NCIC are purposefully made difficult to find by the FBI, increasing privacy and accuracy risks.

IPVM Image

In this report, IPVM examines how the NCIC works, who has access to the index, how LPR companies use this information, and security/accuracy concerns, based on comments from the FBI, FOIA responses from the US government, and interviews with LPR companies Flock Safety and Rekor.

Executive *******

*********** ***** *********** ****** (****)** * ******** *** ***** ******* criminal ****, ********* ****** ******* ***********, stolen ******* ***** ***********, ****** ****** information, ***. *******, *********** ** *** data **** *** **** ***** **** the ******** ** *** ***********, **** to *** *********, ** ******.

**** *** *********** ******** *** ******* direct ****** ** ***, ****, *** search *** ****. ** ******** ******* extract ***** *** *** ** ***** from ***** ******** **** ******* *** file ************ *******, ******* *** **** being * ******** ********. *** *********** agencies **** ******* ***** ******** ** LPR *********. ***** ******** *** **** uploaded ** *** ******* ** **** stolen/wanted **** ** *** **** *** be ******** ** ** **** ******* and *******.

*** **** ** *********** ******* *** NCIC, *** ***********, *** *** ******* is ***** ** *** ******* *****:

IPVM Image

***** *** ******** *** ******** ******** with *** ****, ** ********* *********** is *********** ******* *** *** *****. Further, *** **** ** ******* ****** from ******** ******-******* ********* *** **** citizens' ******** ** **** ***** *** files ** *** ********.

NCIC *********** *********, ********* ** ****

******** **** ***** ******** ***** *********** for **** ******, *********** ** *** NCIC *** ********* *** ********* ** find. *** ***, ***** ********* *** NCIC, **** ******** ************** ********** *** ********. *******, *** webpage **** *** ******* *** ******* about *** *****-***** *** ********* *** leverage **** ******** ** ******* ******* alerts ** *** ***********. **** ***** no ******** *********, ****** **** *** government ** **** ******** ******, **** outlined *** **** ** ****** *** how ******** *** **** ** *****-***** LPR *********.

*** ****'* ********** ** ********** *** is * ****** ************ ** ****** choices. ***** ** ** *********** **** exists **** ******* *** *** ** publish *********** ** *** ****, ********* to ****'* ********. ** ***, *** NCIC ** ****** **** ******** ******-******* standards *** ****** **** ********* ******** access ** ***** ******* ** *** database. ***** ********** **** ** ******** further ** **** ******.

FBI ******* ********* *******

*** *** ******* ****'* ***** **, 2022 ******* ** ********* ******* ** the ****** ******** **** *** ****. However, *** *** *** ******* ** some ** ****'* ********* ** ********* about *** ********, ******** *** **** recent ********* **** ** *** ** and *** ** ** *** *** went **********.

"Millions ** ************" *****

*** **** "******** ******** ** ************ each ***," ********* ** *** ******* website. *******,************************ "****** ****, *** **** ******** 12.6 ******* ************ * ***." *** FBI *** *** ******* **** * "transaction" ******* (*.*. ******* * ******, edit, ********, ***. ****** ** * single ***********).

Includes **** ***** ** *****

***** *** ** ********** ** ***** that ******* *** ***********, *** *** says. *** *********** ******** ******* *********** connected **** ******** ***** ** *****,********* ** ** *** ******* ** the **** **** ****, ***** *** *** ********* ** IPVM ** *** "**** **-**-**** ******** available ***********" ** *** ****:

*** **** **** ******** ** ******** for *** **** **** ******** ******* information **** *** *******, ******* *****, Wanted ******, ********** *****, ******* ******, Gang, ***** *** ************* ********* *********, Supervised *******, *** *********** ******** ***** and *** ******** *** ******** ********.

*** **** ** ***** ******** ** file ***** **** "**** **** ** million ****** *******,"********* ** *** ***. **** ****** ****** ****** *** been ********** ******** *******, ***** *** NCIC ******* **** *** ******** *** 16 ******* ****** ******* **** ******** **** **, **** ****.

******** *** ********* ********* **** *** stolen *******/******* ***** ***********, ***** *** in * ***** "******** *****" ** the ****, **** *** ********* ** not ********* ***, *** *** ********* with ***** *** *****:

  • ****** ********
  • *****
  • ****
  • *****
  • **********

***** *** **** * ***** "******* files" **** *** ********* ** *** typically ***, *********:

  • ******* ********
  • ******* **** ********** *****
  • ************ ******
  • ********** ********
  • ******** *****
  • ******* ******
  • ******** ******* ******** ********** ***** ****** (NICS) ****** ***********

Only *** *********** *** ****** ******

**** *** *********** ******** *** ******* direct ****** ** *** **** ** add *** **** ***** ****** *** database. *** ********* **** ******* ** the **** ****** ****** *** **** to ****** ******* ****** ** ***/**** information, *** *** ********* ** ****:

***** *** ** *****-***** ******* ***** recognition ********* **** ****** ****** ** NCIC.

Entry *********** ******* ***** ** **** ****

*** *********** **** *** *********** ****** into *** ****** ****** ********* ** file ****. *** ********* ***** ***** a ******* ** *********** **** ****** would **** *** *** ********* * stolen ******* ** *** ****, ********* to* **** **** ** *** ********* County ****** ** ************:

IPVM Image

**** ******* *** *********** ** *** information ** *** ******/******* **** ********* the *****:

IPVM Image

IPVM Image

******* ******* ******* *** **** ******* vehicle ***********, ********* ******* ***** ****** and *** *****/****/***** ** *** ***, according *** **** **** ** ********* ****** Police:

IPVM Image

*******, ***** **** **** **** *** extracts ** *** ******* ********** ************ information, **** ** ****, *******, ***.

State ******** ********** ****** ** ****

******** *** *** ********* *** ****, individual ****** ****** *** **** ********** LPR ******** ** ***** *** ***********, and *********, ** *** *********, *** FBI **** ** ****:

** *** ******* ** *********** ** the *** **** (******** ******* *********** Services) ******** ** ***** **** ****** Agencies (****). *** *** ******* ** utilized *** *********** ** *** ***** level ** ********** ** *** ***.

***** ***** ******** *** ********* **** differ **** ***** ** *****. *** example,*** ********** ** ****** ****** ** Texas** *** *** *** *****. *******, the********** ** ******** ******* *********** ********** *** *** *** *************. *** FBI **** *** **** * "**** for ************" **** ******** *** ** CSAs ********** *** **, ** **** IPVM.

*** ********* *** **** ** **** together **** * ***** *** *********** agency ** ****** * ****-******** ****** so **** ** ** ******* ** facilitate **** ******** **** *** *********** into *** *** ******. **** ******** the *** *********** ****** ********** * letter ** *** ***** *** ********* what *** ******** ******* *********** **** be **** *** *** *** ** will ** ****.

*** ***** ******* ***** *** ***** taken *** * ****** ** ****** approved ** *************, ********* ** **************** **** ****** ****** **********:

IPVM Image

****** *** ****** ***** *** ****** application *******, ***** **** ****, ******* that ** *** *******'* **********, **** were **** ******* ** **** ** third-party ********* ***** *** ******* *** a ****** ******** **** * *** enforcement ******:

* ****** ****** ******* * ***** and *** ****** ** ********. ** fact, **** ** ***** ******* ***, when ** **** ****** ****** ** find *** *** **********, ********* ******** would **** *** ***** ** *** say, **** ** **** *** **** an ****** ** **** **. ** only * ****** ******.When *** **** * ********, ** ****** ******** **** * *** *********** ****** *** *** ********* ** *** ******** *****. [emphasis added]

LPR *********' ****

******** *** ********* ** *** **** direct ****** ** *** ****, ******* LPR ********* *** **** ** **** NCIC ******** ******* ***** ****** *** create * "*** ****" *** *** enforcement ********. *** ******* **** **** up ******* ****** *** ******** ** the **** *** **** ** ******* the *********** ********* ******* *** **** information *** ***** *** *********** ** a ****** *******/****** ***** ** ****** vehicle ** ******* ** *** ****.

******** *** ********* ****** *** *** NCIC *********** ******, ** "***********" *** enforcement *** ** *** ****, ***** told ****:

**'* **** **** ****** **** *** the ********* ** ******** ** *** those *****. *****-***** ******* *** ********* to ********** **** *** ****'* **** we **, ***********.

Limitations ** *** ******* *****

*** ********* **** ******* ** *** NCIC ******* ** *** ******* **** does *** ******* ******** *********** *********** (PII), ***** **** ****:

***** *** *** ******** ** *** NCIC *******, *** **** ** **** for ***** ******** **** *** ******* do *** *****. **** ******** *** all *** *** *********** ** **** name, **** ** *****, *** **** type ** *****.Then *****'* *** *** *******, ***** ******* *** *** *** ***** ****, ******* *****, *** ******* ***** *****, *** *********** ** *** ******* ** **** ** **** ** *** ******* *** ** **** ** *** *******, *** **** ** **. [emphasis added]

******* *** *** ******* **** *** companies ******* *** ** ***, ***** is ** *********** **** ******* ****** that ***** *** * ******** ******** to * *** **** ** *******, Flock ****:

** *****'* ** **** **** ***** into *** *** ****** **** *** a ****** *** **** ** *** identity. *** *** ****** ** *** even ******** ** **** ** **** extract.

Example ** ***** ***** ******* *****

* ********* ** * ******* ***** emailed ** *** ***** ** **** its ***** *** ****** ** *****. The ***** ******** *** ******* ***** that *** **** *******, **** **** it ** ** (****** *******), *** time ** *** ***** *******, *** which ****** *** ******* *** ******** on:

IPVM Image

***** ** ***+ ***** ******* ***** alerts **** ** *** ***** **** ********** *** ******** ** **** by *** *** ********** *** & Policy ****** *** *** ****.

Mechanisms *** ******* ****

******** *** **** ** *** *********** via *** ** "****** *****," ********* to *** ***'* ********** **** ******* ** *** ****. ***** *** ***** **** ********* to **** **** *** *** ***** are *** *** **** **** *** enforcement ******** **** ***********, ******** *** method ******* **** ***** ** *****.

***** **** ****:

** ****** ***** ** *****, ***the ******* ******* ** ***** ***** ****** ** * *****-*****, *** ****, ***** **'* ****** ** ****** ** **** ******. ** **** *****, ***** ******, *** ***** *** ******** ******* ** ********. There's a few different ways that you have to deal with it. Then, essentially, so we're not necessarily downloading it per se. We're simply taking it from wherever it is located on behalf of that agency, and putting it into our, into our software for them to utilize. [emphasis added]

*** ******** *** **** ** *** enforcement ********, **** ************* ******* ** Flock's ******, ***** **** ****:

*** ******** **** **** * ****** place ****** *** **** ********** ** the ***** ******** **** *** ******** database, ***** ** ** ************* ******* on ** ******* ***** **** *** system.

**** ******* ** ********* ********* *** provided ***** *** ***, ********* ** the ***'* **** ******* *** ********* by ***** *** *****. ******* *** extract ** *** ********* *********** ***** an *****/****, **** ***** ** *** systems ** ** *********** ** **** lag ******, ***** **** ******** ******* ***** ***** ****** ***** **** Previously ****** ********, ********* **** “*** The ***** ******’* *****".

FTP/Email ******

******* *** *** ***** *** ****** methods ** ******** ********* *********** ******** in **** ********. *** ** *********** to "********, ********, *** ***** ***** attacks," ********* ***** **** ********** *******:

*** *** *** ***** ** ** secure. ** ** ********* ********** ** be ** ******** ******** ******* ** relies ** *****-**** ********* *** ********* for ************** *** **** *** *** encryption. **** **** *** *** ** vulnerable ** ********, ********, *** ***** force *******, ***** ***** ***** ****** methods.

********, *** *** ********* *** ***** transmission ****** ** "****** *****." *******, the *** *** *** ******* ** IPVM's ******* ** ******* ******* "****** email" ****** ** * ******** ******** or ********* **************.

State ******** ********* **********

*** **** ** * ******** ********, however, **** ****** **** ***** *** criminal ********* ** ****. *** *******, the*** *********** *********** ******* (****)** ******** *** *************** *** *********** ********** ******* (*****)** ************.

**** *** *********** ******** ******** ****** information ** * ***** ****** ***** then ** ********* ** *** ****, Flock **** ****:

**** ********** *** *********** ******** ***** go ******* * ***** ****** ** submit * ***** ** *** *** for ** ** ** ** ****, so **** **** ***'* ******** ****** to *** **** ********.

**** ****** **** ********** **** ******* files **** *****-******** ******** ** ******** of ********, ***** **** ****:

** **** ******, **** *** ****** to ******* **** **** ******* **** additional *********** *** ********** ** **** state ******** ******** ** ***** ******** of ******** *** **** ******* **** to *** ****** *** **** ******** it ** *** ******.

Accuracy ****** - ******* *** *********

*** **** ** *********** **********, ******* and ***** ********* ************* **** ***** **** ******* **** ******. ** ****, *** ** ****************** *** ******** *** ******* *** ** ****:

*** *** ** ********* *** ***'* National ***** *********** ******, ******* ******* System *** ******** ****** *** *** Analysis ** ******* ***** ******* ** records **** ********** (*)(*) ** *** Privacy ***,* *.*.*. ****.

******* (*)(*) ** *** ******* ***** * *********** *** ********** ******** to **** ******** *******:

(*) ****** ************.—**** ****** **** ********* a ****** ** ******* *****—

(*) ******** *** ******* ***** *** used ** *** ****** ** ****** any ************* ***** *** ********** **** such ********, *********, **********, *** ************ as ** ********** ********* ** ****** fairness ** *** ********** ** *** determination.

"*** ********* ** ********* ** ***** interference **** *** *********** ********* *** responsibilities ** *** ***," *** ** government ***** ** *** ******** ** exempt *** **** **** ******** ********* standards.

***** **** **** ******** ***** ***** in ***** ****** **** ******** ** inaccurate **** **** ** ********** ****** people, *** *******:

  • ***** *. **** ** *** *******- * *** *** ******** * times *** ** ********** *********** ** the ****, ** * ****** ** identity ***** *** * ******* ** the ****** **** *** ****.
  • ******* *. *****- * *** *** ******** ***** an **** ****** ******** ** *********** misdemeanor ****** ******* **** *** ******** been ******* ***** ******* *** *** updated ** *** ****.
  • ****** *. ******- * *** *** ******** ***** an ******** ****** ******* *** ********* parole ********* ** ***** ** *** NCIC ********.

**** ***** *** ***** **** **** that ***** *** ****** ******** ** place ** **** **** ******* **** are ********, *** *******, ******-******** **** the **** ***** ** ***** **-**-**** with *** *****'* *********** ******. *******, the ******* ** **** ********** ** the **** ****** ******** ** *** follow ********.

Private ******** ****** ******* ****

*******, ******* ******** *** ****** ** request ** **** *********** ** ********** that *** ***** ** *** ****, because ** ****, *** ** ********** also******** *** **** **** ***** ***********. ************, *** ****** ****** *********** (*) ** *** ******* *** of ****, ***** ******** **** ********** ******** must ***** *********** ****** ** ***** own *******:

(*) ****** ** *******.—**** ****** **** maintains * ****** ** ******* *****—

(*)upon ******* ** *** ********** ** **** ****** ** *** ****** ** ** *** *********** ********** ** *** ***** ** ********* ** *** ******, permit him and upon his request, a person of his own choosing to accompany him, to review the record and have a copy made of all or any portion thereof in a form comprehensible to him, except that the agency may require the individual to furnish a written statement authorizing discussion of that individual’s record in the accompanying person’s presence. [emphasis added]

******* (*)*, ***** *** **** ** also ****** ****, ****** *********** ** amend ******* ** **** **** **** information ** ** **********:

(*) ****** *** ********** ** ******* amendment ** * ****** ********** ** him

***** ********** *** ********* ** ******* "ongoing, ********** *** *********** *** ************ efforts," *** ********** **** **** ** exempted *** **** **** ***** ************ in ****:

********* **** *********** ***** ********** *******, authorized *** *********** *** ************ *******, particularly ******* ** ******** *** ****** any ********* **** ** ********* ** other ********* ********** ** ******** ***. Revealing **** *********** ***** **** ****** the ****** ******* ** ****** ******** insight ********** *** *********** ******** ****** any ************* *** ** **** ******** to ********** *** ************* (*.*.,******* ******** ** **** *** **** to ***** *************).

Comments (10)
UI
Undisclosed Integrator #1
May 26, 2022

**** ** *** * ********* ** IPVM. *'** ********* ** ***** **** about **** ****** *******, *** *** roadblocks *********** **** ****** ** **** me **** **. ***** ******* ** help ** ********** ** ***. ******!

(6)
Avatar
Dwayne Cooney
May 26, 2022

********* *********! **** ** ***********.

**** ******* * *** ** ********* and ******* **** **** ** ** answered.

* **** ******* ** * ******-** report...

(2)
U
Undisclosed #2
May 27, 2022

********* **** *********** ***** ********** *******, authorized *** *********** *** ************ *******, particularly ******* ** ******** *** ****** any ********* **** ** ********* ** other ********* ********** ** ******** ***. Revealing **** *********** ***** **** ****** the ****** ******* ** ****** ******** insight ********** *** *********** ******** ****** any ************* *** ** **** ******** to ********** *** ************* (*.*.,******* ******** ** **** *** **** to ***** *************).

** ** ******* ******* *** ******* their *** **** (*** ** ********** to ******* * ** *** ******* Act ** ****) - ******* ****** could ** * *********.

******.

**'* **** **** ** ******* **** LE ** **** ************ ******** **** Section *(*) (********** ********** ** ********* data) ** ** ******* ******* *** even ****** ***** *** **** ** see ** ***** **** ** ********* data.

UI
Undisclosed Integrator #3
May 27, 2022

********* ******!!!! *’* ********* ***** *** some ******** ******* **** ***** *** others ** ****** ************* **** **. Donation$ **** * **** ***.

***** ***** ****** *** *** ******* findings!

UI
Undisclosed Integrator #4
Jun 01, 2022

*********** ******* ** *********** **** ** responsibility *** ******** ** * ****** for *********.

(1)
(2)
UI
Undisclosed Integrator #5
Jun 02, 2022

**** ******* *** *** **** ******** especially ** *** **** ** ******** of *** ****. * **** ** sell *** ******* **** ******** ** MA *** * ***** **** *** years **** *** **** ***** **** knowledge ** **. ******** ********** **** they ***** *** ** **** ***** hits *** ***** ** ** *** it *** ************* **** ** *** the ****** **** *** ******. ***** newer ************ **** ******** **** **** make *** ***** ***** ** *** NCIC **** ** *** ******* **** accurate.

(2)
ED
Eduardo Delgado
Jun 02, 2022

**** ** ** ******* *******. *** always ****** ** ********* ********* **** this ****** ****** ** ** *** road. *** **** ********** ***********, **** good **** ** ** ** ****. Only * **** ** ***** ****.

CM
Chris Morgan
Jul 19, 2022

**** **** *******. ****** **** **** the ***/*** **** *** * ************ on ***** **, **** ** *** CJIS **** **** ****** *** *** NCIC ******* ** ** ** ********** CJI.

*** ***** ******** ** "**** *** data ******** ********** ************ *********** *** meets *** ********** ** ******** ******* Information (***). *** *** *** ******* the **** *** *** ** ******* use ** **** *** **** **** meet ******* ************ *** *** ********** of *** ***** *** **** ******** Policy (**********)".

**** ************* ******* *** ************ *** will ***** *** ** ******** ** modify ***** *********** ******** ********* ********* to **** *** ************ *** ********** the **** *** ******* ** ***.

**** ** * **** **** ***** for *** ********** ** *** ****.

UI
Undisclosed Integrator #4
Jul 20, 2022

*** ****** **** ****?

UI
Undisclosed Integrator #6
Jul 20, 2022

* *** ** ***