FBI NCIC LPR Hotlist Usage Examined
LPR usage is exploding, powered by hotlists provided by the FBI's National Crime Information Center (NCIC). However, details on how law enforcement and LPR companies leverage sensitive crime information from the NCIC are purposefully made difficult to find by the FBI, increasing privacy and accuracy risks.
In this report, IPVM examines how the NCIC works, who has access to the index, how LPR companies use this information, and security/accuracy concerns, based on comments from the FBI, FOIA responses from the US government, and interviews with LPR companies Flock Safety and Rekor.
Executive *******
*********** ***** *********** ****** (****)** * ******** *** ***** ******* criminal ****, ********* ****** ******* ***********, stolen ******* ***** ***********, ****** ****** information, ***. *******, *********** ** *** data **** *** **** ***** **** the ******** ** *** ***********, **** to *** *********, ** ******.
**** *** *********** ******** *** ******* direct ****** ** ***, ****, *** search *** ****. ** ******** ******* extract ***** *** *** ** ***** from ***** ******** **** ******* *** file ************ *******, ******* *** **** being * ******** ********. *** *********** agencies **** ******* ***** ******** ** LPR *********. ***** ******** *** **** uploaded ** *** ******* ** **** stolen/wanted **** ** *** **** *** be ******** ** ** **** ******* and *******.
*** **** ** *********** ******* *** NCIC, *** ***********, *** *** ******* is ***** ** *** ******* *****:
***** *** ******** *** ******** ******** with *** ****, ** ********* *********** is *********** ******* *** *** *****. Further, *** **** ** ******* ****** from ******** ******-******* ********* *** **** citizens' ******** ** **** ***** *** files ** *** ********.
NCIC *********** *********, ********* ** ****
******** **** ***** ******** ***** *********** for **** ******, *********** ** *** NCIC *** ********* *** ********* ** find. *** ***, ***** ********* *** NCIC, **** ******** ************** ********** *** ********. *******, *** webpage **** *** ******* *** ******* about *** *****-***** *** ********* *** leverage **** ******** ** ******* ******* alerts ** *** ***********. **** ***** no ******** *********, ****** **** *** government ** **** ******** ******, **** outlined *** **** ** ****** *** how ******** *** **** ** *****-***** LPR *********.
*** ****'* ********** ** ********** *** is * ****** ************ ** ****** choices. ***** ** ** *********** **** exists **** ******* *** *** ** publish *********** ** *** ****, ********* to ****'* ********. ** ***, *** NCIC ** ****** **** ******** ******-******* standards *** ****** **** ********* ******** access ** ***** ******* ** *** database. ***** ********** **** ** ******** further ** **** ******.
FBI ******* ********* *******
*** *** ******* ****'* ***** **, 2022 ******* ** ********* ******* ** the ****** ******** **** *** ****. However, *** *** *** ******* ** some ** ****'* ********* ** ********* about *** ********, ******** *** **** recent ********* **** ** *** ** and *** ** ** *** *** went **********.
"Millions ** ************" *****
*** **** "******** ******** ** ************ each ***," ********* ** *** ******* website. *******,************************ "****** ****, *** **** ******** 12.6 ******* ************ * ***." *** FBI *** *** ******* **** * "transaction" ******* (*.*. ******* * ******, edit, ********, ***. ****** ** * single ***********).
Includes **** ***** ** *****
***** *** ** ********** ** ***** that ******* *** ***********, *** *** says. *** *********** ******** ******* *********** connected **** ******** ***** ** *****,********* ** ** *** ******* ** the **** **** ****, ***** *** *** ********* ** IPVM ** *** "**** **-**-**** ******** available ***********" ** *** ****:
*** **** **** ******** ** ******** for *** **** **** ******** ******* information **** *** *******, ******* *****, Wanted ******, ********** *****, ******* ******, Gang, ***** *** ************* ********* *********, Supervised *******, *** *********** ******** ***** and *** ******** *** ******** ********.
*** **** ** ***** ******** ** file ***** **** "**** **** ** million ****** *******,"********* ** *** ***. **** ****** ****** ****** *** been ********** ******** *******, ***** *** NCIC ******* **** *** ******** *** 16 ******* ****** ******* **** ******** **** **, **** ****.
******** *** ********* ********* **** *** stolen *******/******* ***** ***********, ***** *** in * ***** "******** *****" ** the ****, **** *** ********* ** not ********* ***, *** *** ********* with ***** *** *****:
- ****** ********
- *****
- ****
- *****
- **********
***** *** **** * ***** "******* files" **** *** ********* ** *** typically ***, *********:
- ******* ********
- ******* **** ********** *****
- ************ ******
- ********** ********
- ******** *****
- ******* ******
- ******** ******* ******** ********** ***** ****** (NICS) ****** ***********
Only *** *********** *** ****** ******
**** *** *********** ******** *** ******* direct ****** ** *** **** ** add *** **** ***** ****** *** database. *** ********* **** ******* ** the **** ****** ****** *** **** to ****** ******* ****** ** ***/**** information, *** *** ********* ** ****:
***** *** ** *****-***** ******* ***** recognition ********* **** ****** ****** ** NCIC.
Entry *********** ******* ***** ** **** ****
*** *********** **** *** *********** ****** into *** ****** ****** ********* ** file ****. *** ********* ***** ***** a ******* ** *********** **** ****** would **** *** *** ********* * stolen ******* ** *** ****, ********* to* **** **** ** *** ********* County ****** ** ************:
**** ******* *** *********** ** *** information ** *** ******/******* **** ********* the *****:
******* ******* ******* *** **** ******* vehicle ***********, ********* ******* ***** ****** and *** *****/****/***** ** *** ***, according *** **** **** ** ********* ****** Police:
*******, ***** **** **** **** *** extracts ** *** ******* ********** ************ information, **** ** ****, *******, ***.
State ******** ********** ****** ** ****
******** *** *** ********* *** ****, individual ****** ****** *** **** ********** LPR ******** ** ***** *** ***********, and *********, ** *** *********, *** FBI **** ** ****:
** *** ******* ** *********** ** the *** **** (******** ******* *********** Services) ******** ** ***** **** ****** Agencies (****). *** *** ******* ** utilized *** *********** ** *** ***** level ** ********** ** *** ***.
***** ***** ******** *** ********* **** differ **** ***** ** *****. *** example,*** ********** ** ****** ****** ** Texas** *** *** *** *****. *******, the********** ** ******** ******* *********** ********** *** *** *** *************. *** FBI **** *** **** * "**** for ************" **** ******** *** ** CSAs ********** *** **, ** **** IPVM.
*** ********* *** **** ** **** together **** * ***** *** *********** agency ** ****** * ****-******** ****** so **** ** ** ******* ** facilitate **** ******** **** *** *********** into *** *** ******. **** ******** the *** *********** ****** ********** * letter ** *** ***** *** ********* what *** ******** ******* *********** **** be **** *** *** *** ** will ** ****.
*** ***** ******* ***** *** ***** taken *** * ****** ** ****** approved ** *************, ********* ** **************** **** ****** ****** **********:
****** *** ****** ***** *** ****** application *******, ***** **** ****, ******* that ** *** *******'* **********, **** were **** ******* ** **** ** third-party ********* ***** *** ******* *** a ****** ******** **** * *** enforcement ******:
* ****** ****** ******* * ***** and *** ****** ** ********. ** fact, **** ** ***** ******* ***, when ** **** ****** ****** ** find *** *** **********, ********* ******** would **** *** ***** ** *** say, **** ** **** *** **** an ****** ** **** **. ** only * ****** ******.When *** **** * ********, ** ****** ******** **** * *** *********** ****** *** *** ********* ** *** ******** *****. [emphasis added]
LPR *********' ****
******** *** ********* ** *** **** direct ****** ** *** ****, ******* LPR ********* *** **** ** **** NCIC ******** ******* ***** ****** *** create * "*** ****" *** *** enforcement ********. *** ******* **** **** up ******* ****** *** ******** ** the **** *** **** ** ******* the *********** ********* ******* *** **** information *** ***** *** *********** ** a ****** *******/****** ***** ** ****** vehicle ** ******* ** *** ****.
******** *** ********* ****** *** *** NCIC *********** ******, ** "***********" *** enforcement *** ** *** ****, ***** told ****:
**'* **** **** ****** **** *** the ********* ** ******** ** *** those *****. *****-***** ******* *** ********* to ********** **** *** ****'* **** we **, ***********.
Limitations ** *** ******* *****
*** ********* **** ******* ** *** NCIC ******* ** *** ******* **** does *** ******* ******** *********** *********** (PII), ***** **** ****:
***** *** *** ******** ** *** NCIC *******, *** **** ** **** for ***** ******** **** *** ******* do *** *****. **** ******** *** all *** *** *********** ** **** name, **** ** *****, *** **** type ** *****.Then *****'* *** *** *******, ***** ******* *** *** *** ***** ****, ******* *****, *** ******* ***** *****, *** *********** ** *** ******* ** **** ** **** ** *** ******* *** ** **** ** *** *******, *** **** ** **. [emphasis added]
******* *** *** ******* **** *** companies ******* *** ** ***, ***** is ** *********** **** ******* ****** that ***** *** * ******** ******** to * *** **** ** *******, Flock ****:
** *****'* ** **** **** ***** into *** *** ****** **** *** a ****** *** **** ** *** identity. *** *** ****** ** *** even ******** ** **** ** **** extract.
Example ** ***** ***** ******* *****
* ********* ** * ******* ***** emailed ** *** ***** ** **** its ***** *** ****** ** *****. The ***** ******** *** ******* ***** that *** **** *******, **** **** it ** ** (****** *******), *** time ** *** ***** *******, *** which ****** *** ******* *** ******** on:
***** ** ***+ ***** ******* ***** alerts **** ** *** ***** **** ********** *** ******** ** **** by *** *** ********** *** & Policy ****** *** *** ****.
Mechanisms *** ******* ****
******** *** **** ** *** *********** via *** ** "****** *****," ********* to *** ***'* ********** **** ******* ** *** ****. ***** *** ***** **** ********* to **** **** *** *** ***** are *** *** **** **** *** enforcement ******** **** ***********, ******** *** method ******* **** ***** ** *****.
***** **** ****:
** ****** ***** ** *****, ***the ******* ******* ** ***** ***** ****** ** * *****-*****, *** ****, ***** **'* ****** ** ****** ** **** ******. ** **** *****, ***** ******, *** ***** *** ******** ******* ** ********. There's a few different ways that you have to deal with it. Then, essentially, so we're not necessarily downloading it per se. We're simply taking it from wherever it is located on behalf of that agency, and putting it into our, into our software for them to utilize. [emphasis added]
*** ******** *** **** ** *** enforcement ********, **** ************* ******* ** Flock's ******, ***** **** ****:
*** ******** **** **** * ****** place ****** *** **** ********** ** the ***** ******** **** *** ******** database, ***** ** ** ************* ******* on ** ******* ***** **** *** system.
**** ******* ** ********* ********* *** provided ***** *** ***, ********* ** the ***'* **** ******* *** ********* by ***** *** *****. ******* *** extract ** *** ********* *********** ***** an *****/****, **** ***** ** *** systems ** ** *********** ** **** lag ******, ***** **** ******** ******* ***** ***** ****** ***** **** Previously ****** ********, ********* **** “*** The ***** ******’* *****".
FTP/Email ******
******* *** *** ***** *** ****** methods ** ******** ********* *********** ******** in **** ********. *** ** *********** to "********, ********, *** ***** ***** attacks," ********* ***** **** ********** *******:
*** *** *** ***** ** ** secure. ** ** ********* ********** ** be ** ******** ******** ******* ** relies ** *****-**** ********* *** ********* for ************** *** **** *** *** encryption. **** **** *** *** ** vulnerable ** ********, ********, *** ***** force *******, ***** ***** ***** ****** methods.
********, *** *** ********* *** ***** transmission ****** ** "****** *****." *******, the *** *** *** ******* ** IPVM's ******* ** ******* ******* "****** email" ****** ** * ******** ******** or ********* **************.
State ******** ********* **********
*** **** ** * ******** ********, however, **** ****** **** ***** *** criminal ********* ** ****. *** *******, the*** *********** *********** ******* (****)** ******** *** *************** *** *********** ********** ******* (*****)** ************.
**** *** *********** ******** ******** ****** information ** * ***** ****** ***** then ** ********* ** *** ****, Flock **** ****:
**** ********** *** *********** ******** ***** go ******* * ***** ****** ** submit * ***** ** *** *** for ** ** ** ** ****, so **** **** ***'* ******** ****** to *** **** ********.
**** ****** **** ********** **** ******* files **** *****-******** ******** ** ******** of ********, ***** **** ****:
** **** ******, **** *** ****** to ******* **** **** ******* **** additional *********** *** ********** ** **** state ******** ******** ** ***** ******** of ******** *** **** ******* **** to *** ****** *** **** ******** it ** *** ******.
Accuracy ****** - ******* *** *********
*** **** ** *********** **********, ******* and ***** ********* ************* **** ***** **** ******* **** ******. ** ****, *** ** ****************** *** ******** *** ******* *** ** ****:
*** *** ** ********* *** ***'* National ***** *********** ******, ******* ******* System *** ******** ****** *** *** Analysis ** ******* ***** ******* ** records **** ********** (*)(*) ** *** Privacy ***,* *.*.*. ****.
******* (*)(*) ** *** ******* ***** * *********** *** ********** ******** to **** ******** *******:
(*) ****** ************.—**** ****** **** ********* a ****** ** ******* *****—
(*) ******** *** ******* ***** *** used ** *** ****** ** ****** any ************* ***** *** ********** **** such ********, *********, **********, *** ************ as ** ********** ********* ** ****** fairness ** *** ********** ** *** determination.
"*** ********* ** ********* ** ***** interference **** *** *********** ********* *** responsibilities ** *** ***," *** ** government ***** ** *** ******** ** exempt *** **** **** ******** ********* standards.
***** **** **** ******** ***** ***** in ***** ****** **** ******** ** inaccurate **** **** ** ********** ****** people, *** *******:
- ***** *. **** ** *** *******- * *** *** ******** * times *** ** ********** *********** ** the ****, ** * ****** ** identity ***** *** * ******* ** the ****** **** *** ****.
- ******* *. *****- * *** *** ******** ***** an **** ****** ******** ** *********** misdemeanor ****** ******* **** *** ******** been ******* ***** ******* *** *** updated ** *** ****.
- ****** *. ******- * *** *** ******** ***** an ******** ****** ******* *** ********* parole ********* ** ***** ** *** NCIC ********.
**** ***** *** ***** **** **** that ***** *** ****** ******** ** place ** **** **** ******* **** are ********, *** *******, ******-******** **** the **** ***** ** ***** **-**-**** with *** *****'* *********** ******. *******, the ******* ** **** ********** ** the **** ****** ******** ** *** follow ********.
Private ******** ****** ******* ****
*******, ******* ******** *** ****** ** request ** **** *********** ** ********** that *** ***** ** *** ****, because ** ****, *** ** ********** also******** *** **** **** ***** ***********. ************, *** ****** ****** *********** (*) ** *** ******* *** of ****, ***** ******** **** ********** ******** must ***** *********** ****** ** ***** own *******:
(*) ****** ** *******.—**** ****** **** maintains * ****** ** ******* *****—
(*)upon ******* ** *** ********** ** **** ****** ** *** ****** ** ** *** *********** ********** ** *** ***** ** ********* ** *** ******, permit him and upon his request, a person of his own choosing to accompany him, to review the record and have a copy made of all or any portion thereof in a form comprehensible to him, except that the agency may require the individual to furnish a written statement authorizing discussion of that individual’s record in the accompanying person’s presence. [emphasis added]
******* (*)*, ***** *** **** ** also ****** ****, ****** *********** ** amend ******* ** **** **** **** information ** ** **********:
(*) ****** *** ********** ** ******* amendment ** * ****** ********** ** him
***** ********** *** ********* ** ******* "ongoing, ********** *** *********** *** ************ efforts," *** ********** **** **** ** exempted *** **** **** ***** ************ in ****:
********* **** *********** ***** ********** *******, authorized *** *********** *** ************ *******, particularly ******* ** ******** *** ****** any ********* **** ** ********* ** other ********* ********** ** ******** ***. Revealing **** *********** ***** **** ****** the ****** ******* ** ****** ******** insight ********** *** *********** ******** ****** any ************* *** ** **** ******** to ********** *** ************* (*.*.,******* ******** ** **** *** **** to ***** *************).
********* *********! **** ** ***********.
**** ******* * *** ** ********* and ******* **** **** ** ** answered.
* **** ******* ** * ******-** report...
********* **** *********** ***** ********** *******, authorized *** *********** *** ************ *******, particularly ******* ** ******** *** ****** any ********* **** ** ********* ** other ********* ********** ** ******** ***. Revealing **** *********** ***** **** ****** the ****** ******* ** ****** ******** insight ********** *** *********** ******** ****** any ************* *** ** **** ******** to ********** *** ************* (*.*.,******* ******** ** **** *** **** to ***** *************).
** ** ******* ******* *** ******* their *** **** (*** ** ********** to ******* * ** *** ******* Act ** ****) - ******* ****** could ** * *********.
******.
**'* **** **** ** ******* **** LE ** **** ************ ******** **** Section *(*) (********** ********** ** ********* data) ** ** ******* ******* *** even ****** ***** *** **** ** see ** ***** **** ** ********* data.
********* ******!!!! *’* ********* ***** *** some ******** ******* **** ***** *** others ** ****** ************* **** **. Donation$ **** * **** ***.
***** ***** ****** *** *** ******* findings!
*********** ******* ** *********** **** ** responsibility *** ******** ** * ****** for *********.
**** ******* *** *** **** ******** especially ** *** **** ** ******** of *** ****. * **** ** sell *** ******* **** ******** ** MA *** * ***** **** *** years **** *** **** ***** **** knowledge ** **. ******** ********** **** they ***** *** ** **** ***** hits *** ***** ** ** *** it *** ************* **** ** *** the ****** **** *** ******. ***** newer ************ **** ******** **** **** make *** ***** ***** ** *** NCIC **** ** *** ******* **** accurate.
**** ** ** ******* *******. *** always ****** ** ********* ********* **** this ****** ****** ** ** *** road. *** **** ********** ***********, **** good **** ** ** ** ****. Only * **** ** ***** ****.
**** **** *******. ****** **** **** the ***/*** **** *** * ************ on ***** **, **** ** *** CJIS **** **** ****** *** *** NCIC ******* ** ** ** ********** CJI.
*** ***** ******** ** "**** *** data ******** ********** ************ *********** *** meets *** ********** ** ******** ******* Information (***). *** *** *** ******* the **** *** *** ** ******* use ** **** *** **** **** meet ******* ************ *** *** ********** of *** ***** *** **** ******** Policy (**********)".
**** ************* ******* *** ************ *** will ***** *** ** ******** ** modify ***** *********** ******** ********* ********* to **** *** ************ *** ********** the **** *** ******* ** ***.
**** ** * **** **** ***** for *** ********** ** *** ****.
**** ** *** * ********* ** IPVM. *'** ********* ** ***** **** about **** ****** *******, *** *** roadblocks *********** **** ****** ** **** me **** **. ***** ******* ** help ** ********** ** ***. ******!