On Sep 30, Sam Biddle at 404 Media published the first architectural disclosure that signing a city ALPR contract no longer guarantees control over the plate data. [1] [6] The HIDTA program — High Intensity Drug Trafficking Areas, a 1980s-era anti-drug initiative — now functions as a federal data pipeline that cities, counties, and state agencies feed by signing memoranda of understanding (MOUs) with their regional HIDTA. [1] [2]

The bypass mechanics: in Georgia, cities that want to install Flock or Axon cameras on the Georgia Department of Transportation right-of-way must sign an MOU with the Atlanta-area HIDTA to remain in compliance with the new Georgia State Police policy. [1] [3] The MOU requires sharing data “into commercially available and custom developed data integration systems” accessible to HIDTA’s regional intelligence centers. [1] Flock itself documents this on its official compliance page: “GDOT ROW cameras will be accessible to users of the HIDTA National LPR system through the Flock integration interface.” [3] That Flock page describes a plate-by-plate query that returns match count + timestamp — but the access to the aggregated database still happens. [3]

The procurement-load-bearing number: the Houston HIDTA paid $306,800 to Recruitful LLC to build a database combining reads from Flock, Axon, ELSAG, and Vigilant. [1] The contract’s statement of work describes the system as one that “migrates” or duplicates data from local entities into a centralized database, accessible via the Unification Platform. [1] In July 2026, the Trump administration added $277 million in additional HIDTA funding — the largest investment in the program’s history. [2] The DEA’s December 2024 Privacy Impact Assessment confirms that “contributing agencies transmit their LPR data to servers maintained by regional hubs pursuant to their individual MOUs, which stipulate that this data may be shared with the NLPRP system” — the DEA’s National License Plate Reader Program, which in turn is seeking integration with CBP’s LPR system. [1] [4]

The FOIA-bypass legal gimmick: the Obama White House described HIDTA in court as a “grant program” rather than an entity. [1] The DEA has used that argument in FOIA litigation to maintain that “DEA does not create, possess, maintain, or control HIDTA program records.” [1] The Randolph County Sheriff’s Office in North Carolina cited the same argument to deny a public-records request for its own county’s Flock data: “all data is kept on the Federal Houston-HIDTA database.” [1] [5] This is the structural first: the architectural disclosure that the contract you sign as a city, county, or state does not give you control over the data the camera produces. [1] The MOU is signed downstream of the contract, with no clause the buyer can veto in their CCTV RFP.

For a procurement office in Mexico, Brazil, or Argentina signing an enterprise CCTV/ALPR contract in Q4 2026, the clauses that separate a defensible RFP from a vulnerable one are born from this disclosure: [1]

Clause 1 — Vendor certification of absence of third-party MOUs. A written vendor certification that no MOU signed by the vendor, its parent, its subsidiaries, or any integration partner requires the vendor to share footage, plate data, or associated metadata with a federal, state, regional, or supranational entity without the buyer’s written approval. [1] [6] If your RFP does not prohibit this category of MOU in advance, the vendor can sign one after the fact without consulting you.

Clause 2 — Contractual audit of the MOU-fan-out. A contractual right to require from the vendor the complete list of MOUs in force with any entity that is not the direct buyer — federal, state, regional, supranational, intelligence, or law-enforcement task force. [1] [2] [6] This closes both the Pool #89 bypass (VIDIZMO × Flock third-party vendor) and the Pool #93 bypass (HIDTA federal-MOU) in the same paragraph. The audit must allow verification by a third-party auditor hired by the buyer.

Clause 3 — Notification clause for sub-receiving agencies. Any sub-receiving agency that accesses the buyer’s footage or plate data via a vendor MOU triggers automatic notification to the buyer + a good-faith renegotiation window before the access takes effect. [1] [3] Flock’s GDOT ROW page describes exactly this pattern: the buyer thinks the MOU is between vendor and state agency, but the MOU has a clause that delegates access to HIDTA system users without notifying the customer. [3]

Clause 4 — Termination-for-convenience on discovered bypass. If the buyer discovers, during the contract’s term, that a vendor MOU — signed with or without their knowledge — has shared footage or plate data with a federal, regional, or supranational entity, the buyer has the right to termination-for-convenience without penalty, plus an audit of the data already shared and notification to the applicable data-protection regulators (INAI, ANPD, AAIP, depending on jurisdiction). [1] [5]

Clause 5 — Architectural separation as architectural commitment. The RFP requires the vendor that footage or plate data not leave the storage contracted by the buyer without an explicit export pipeline carrying an audit log + client-side encryption. [1] [2] This does not block the operational use case (a state agency can legitimately view plates within the framework of its MOU). [1] It blocks the silent federal duct. The difference is the architectural boundary between the agency’s right to see the plate for its investigation and the HIDTA database’s right to aggregate the plate into a federal database no court has audited. [1]

The P6 angle — load-bearing architectural separator: an analytics service that runs customer-side (not vendor-published) on the customer’s existing CCTV, where the customer controls all data flows + the audit log + the export pipeline, is the only architecture that closes the third-party-MOU bypass at the data-flow level — because the customer owns the architectural decision, not the vendor, and not the MOU the vendor signs with a third party. [1] [6] ⚠️ Validate with Ricardo: the claim above describes a class of architecture (customer-side analytics, not vendor-cloud) that exists in the market (several customer-side analytics vendors with published architectures — specific names require KB validation before being named) — the effectiveness benchmarks, pricing, and customer references for any specific vendor require KB validation before publication.

In every RFP review I do for tv4agent, the question is no longer “does your vendor respect your data?” It is “does your contract prohibit your vendor from signing MOUs that deliver your data to a federal database without your written OK?” [1] [2] The difference between those two verbs is the difference between an RFP that learns about the HIDTA duct in a future FOIA and one that closed it architecturally at signature.

P.D. Does your current RFP demand the five clauses (vendor certification of absence of MOUs + MOU-fan-out audit + notification clause + termination-for-convenience + architectural separation) in writing — or does it only mention “compliance with applicable legislation” the way most do? [1] That threshold separates a contract that discovers the HIDTA duct when it is too late from one that closed it before signature.

📰 Sources verified via grounded-citations: 404 Media Biddle Sep 30 2026 [1]; White House HIDTA $277M Jul 9 2026 [2]; Flock Safety GDOT page [3]; DEA NLPRP PIA Dec 2024 [4]; MuckRock Randolph County FOIA response [5]; Cris van Pelt HaveIBeenFlocked [6] + EPIC Jeramie Scott quote [1].

Frequently asked questions

What exactly is HIDTA and why should a LATAM buyer care? HIDTA (High Intensity Drug Trafficking Areas) is a US federal program created in 1988 that shares drug intel between agencies. The critical point: the MOUs (memoranda of understanding) that local police sign with HIDTA allow your corporate CCTV footage to end up in a federal database without a judicial warrant. The Biddle case (July 2026) documented that 4 Texas cities used HIDTA MOUs to bypass the warrant requirement. Your LATAM RFP with cameras reporting to a VMS with any US federal integration is exposed.

How do I know if my VMS has a HIDTA integration? Ask the vendor: ‘Does your VMS have an API or service that allows federal agencies (FBI, DEA, ATF, or HIDTA programs) to query footage without a judicial order issued in my country?’. If the answer is ‘yes but only under subpoena’ or ‘not directly but we can do it on request’, your system is exposed. Most US vendors (Genetec, Avigilon, Milestone) have federal intelligence integrations, sometimes via third parties (Pen-Link, Palantir).

Is there a LATAM equivalent of HIDTA I should know about? Yes, in Mexico there’s the CNI (Centro Nacional de Inteligencia) and the CNBV with equivalent powers to request footage. In Colombia it’s the Fiscalía General. In Brazil the ABIN. The difference: LATAM agencies require a judicial order from a local judge to access footage, there is no direct federal shortcut. That’s why a LATAM RFP with a US vendor is riskier than with a European vendor: the US vendor may have the HIDTA back door open, the European one does not.

What RFP clause protects me from this? A single ‘data egress prohibition’ clause in the contract, plus a technical section that isolates the VMS from outbound internet: ‘Vendor agrees not to transfer, expose, or allow access to footage stored in the customer’s system, except (a) under subpoena issued by a court of competent jurisdiction in the customer’s jurisdiction, or (b) with written authorization from the customer’s Privacy Officer’. This clause is $0 but requires a lawyer to draft correctly.

How much does it cost to isolate my VMS from federal integrations? Three options by cost: (1) physical air-gap of the VMS (no network) — $0 but you lose remote monitoring, (2) egress firewall with IP whitelist — $500-2,000 USD in firewall + $2K-5K USD in configuration, (3) on-prem VMS without cloud — initial CAPEX 20-30% higher than VMS-cloud, annual OPEX 10% lower. For retailers with 14+ stores, option 2 is the sweet spot. For 1-3 sites, option 1.

What if my internal security team WANTS to cooperate with police? Cooperating is legitimate — it’s your decision, not the vendor’s. What’s critical is that cooperation is transparent, documented, and with judicial order. If your security team cooperates without a warrant, they are committing the offense. If the vendor cooperates without a warrant (via HIDTA or other integration), your company is committing the offense. The RFP clause is so that the vendor does not cooperate without your explicit written OK. Your team can cooperate, under your internal policy.

Sources

[1] Sam Biddle — How Cities Are Forced to Funnel License Plate Data to a Massive Federal Surveillance Program, 404 Media, Sep 30 2026. https://www.404media.co/how-cities-are-forced-to-funnel-license-plate-data-to-a-massive-federal-surveillance-program-hidta/

[2] The White House — White House Announces Additional $277 Million to Fight Cartels and Drug Traffickers, Jul 9 2026. https://www.whitehouse.gov/releases/2026/07/white-house-announces-additional-277-million-to-fight-cartels-and-drug-traffickers/

[3] Flock Safety — Georgia DOT LPR Right-of-Way Compliance (vendor’s official compliance page). https://www.flocksafety.com/gdot

[4] Drug Enforcement Administration — National License Plate Reader Program Privacy Impact Assessment, December 2024. https://www.documentcloud.org/documents/28710394-dea-nlprp-pia/

[5] MuckRock — Randolph County Sheriff’s Office public records request response (FOIA on Flock data). https://www.muckrock.com/foi/randolph-county-4639/public-records-request-flock-randolph-county-sheriffs-office-217933/

[6] HaveIBeenFlocked.com — Cris van Pelt, researcher portal + Footnote4a investigative blog. https://haveibeenflocked.com/