California malls have been feeding license plate data back to ICE

More than 46 malls in California appear to be feeding data back to Immigration and Customs Enforcement (ICE) agents through a license plate reader network, according to a new report from the Electronic Frontier Foundation (EFF).

The report focuses on Irvine Company Retail Properties, which operates a string of open-air malls in southeastern Los Angeles. According to a disclosure on the company’s website, Irvine Company has been an active client of Vigilant Solutions since at least 2016 by feeding back data to the Vigilant network and appropriate law enforcement agencies.

Irvine Company could not be reached for comment, but the disclosure makes it clear that it shares data with law enforcement agencies. “The ALPR Operator also allows law enforcement agencies to access the ALPR System directly for the purposes indicated in the law enforcement agency’s applicable policies,” the ALPR policy reads. Those agencies would seem to include ICE, which signed an agency-wide contract with Vigilant earlier this year.

It’s unclear how widely Irvine Company is collecting license plate data; the company did not respond with a clarifying comment. Still, there are no apparent restrictions on how broadly Vigilant can share the data once collected. Irvine’s policy ensures users that data is deleted as soon as it is sent to Vigilant, but it may persist in Vigilant’s systems indefinitely. As EFF’s Dave Maass told The Verge, “They’re sharing with Vigilant, and then Vigilant can do what it wants.”

Vigilant Solutions was built on a private network of license plate readers from retail sources like Irvine Company, but it has found success in selling access to law enforcement. The company currently has some form of data-sharing agreement with roughly 3,000 law enforcement agencies across the country, including departments in New York, Chicago, and Dallas. Vigilant’s network processes an estimated 100 million license plates every month. The ACLU is currently suing ICE for more details on how the agency accesses the network.

Reached by The Verge, ICE emphasized that any use of the Vigilant database was performed in accordance with the agency’s 2015 Privacy Impact Assessment. “Like most other law enforcement agencies, ICE uses information obtained from license plate readers as one tool in support of its investigations,” a representative said. “ICE conducts both criminal investigations and civil immigration enforcement investigations. ICE is not seeking to build a license plate reader database, and will not collect nor contribute any data to a national public or private database.”

The EFF has already called on Irvine Company to discontinue the program. “By conducting this location surveillance and working with Vigilant Solutions,” the report reads, “the company is putting not only immigrants at risk, but invading the privacy of its customers by allowing a third-party to hold onto their data indefinitely.”