Washington Wants More of Your Data. Read What They Left Out

On July 9, the White House announced "a historic $277 million" for the High Intensity Drug Trafficking Areas program, known as HIDTA, calling it "the largest investment in the HIDTA Program's history." What the announcement did not say is something a Drug Enforcement Administration document does: HIDTAs can act as regional hubs that gather license plate reader data from local police cameras and feed it into a federal system.

The gap is not a hidden clause. It is the difference between how a program is described in a press release and what the government's own paperwork says it does.

What they said

The July 9 White House release describes the program as providing assistance to federal, state, local, Tribal and territorial law enforcement agencies in areas "determined to be critical drug trafficking regions." Searching the release for "license plate," "plate reader," "camera," "surveillance," "data," "intelligence" and "technology" turns up none of them. The program page from the Office of National Drug Control Policy, which operates HIDTA, says the program coordinates and assists law enforcement agencies "to address regional drug threats." It mentions "intelligence-sharing initiatives" and sharing "more than 1 million pieces of evidence," but in the pages we opened, nothing about license plate readers.

What they left out

On Sept. 30, 404 Media reported that HIDTA hubs are collecting automated license plate reader data from local cameras, including those made by Flock, Axon, ELSAG and Vigilant, and that cities are being required to sign agreements to share it.

The DEA's Privacy Impact Assessment for its National License Plate Reader Program, issued Dec. 20, 2024, defines a regional hub as a state, local or tribal agency, or a HIDTA, that "gathers LPR information from contributing law enforcement agencies within the region." It says "the NLPRP has established MOUs with over 250 law enforcement agencies and hubs." It says the system "automatically, and without human intervention, photographs all vehicles that come into range," and that images may capture "passersby." It also says DEA "is seeking to partner with" Customs and Border Protection "to add CBP LPR cameras located at United States Ports of Entry."

The assessment's headline safeguard is a 90-day limit, but the full sentence matters: records "become inaccessible to users within 90 days" of collection if they are not included in a case file. A user can keep a record past 90 days by downloading it into a case file, and the assessment says such copies fall under the user's own agency retention policy.

In Georgia, Flock's compliance page says agencies with cameras in the state transportation department's right-of-way must sign a memorandum of understanding with HIDTA "to remain in compliance with the new GSP policy." 404 Media quotes the Atlanta-Carolinas HIDTA agreement as requiring partners to share information in their electronic data systems, "including but not limited to: Automated License Plate Readers." We could not open that PDF ourselves, so that quote rests on 404 Media's reporting.

The other side

Several facts cut against alarm. The DEA assessment was issued in December 2024, under the previous administration, and nothing in the July release ties the $277 million to license plate readers. The assessment lists safeguards: queries require a legitimate investigative need and "reasonable, articulable suspicion," or a lawful traffic stop, or a missing-person case; the system is audited quarterly. It calls the tracking risk "partly mitigated" because camera coverage is not extensive enough "to enable comprehensive nationwide tracking."

Flock's page says the HIDTA interface returns only the number of matching reads, the time of the latest match and the owning agency, not images or locations. In a court filing quoted by 404 Media, the DEA said it "does not create, possess, maintain, or control HIDTA program records." Flock, Axon and ONDCP did not respond to 404 Media's requests for comment, and the DEA told the outlet it has no jurisdiction over HIDTA and declined to comment.

Congress has a related bill. Sen. Josh Hawley, R-Mo., has a bill, the Stop Flock Abuse Act, that CBS News described on Sept. 30. It would require deletion of driver data within 10 days unless a criminal investigation is active and ban local governments from selling or sharing the data. We have not reviewed the bill text, so we cannot say whether it reaches HIDTA hubs.

Our Take

This section is opinion.

We oppose a surveillance state and distrust any federal program that builds a searchable record of where law-abiding Americans drive. We also want to be fair: the paper trail here runs through two administrations, and the DEA at least published its assessment, including the part acknowledging "a large number of images of travel of law-abiding drivers."

But a record $277 million announcement that does not mention the data side of the program is a communications failure, and Americans should not have to find a privacy assessment to learn what a program does. We would ask the administration to say so plainly: publish the HIDTA license plate agreements, the retention rules for case-file copies, and who can search what.

We also think this is a states' rights problem. Georgia's leaders in both parties, per the AJC, are debating retention, access, audits and penalties for Flock cameras. In the report we opened, none of that discussion mentioned HIDTA. The requirement Flock cites is a Georgia State Patrol policy, so part of this is Georgia's own choice. That is the point: if a state wants to keep a federal data pipeline off its roads, its voters and legislators should decide, not a memorandum signed at the agency level.