DEA agent used Illinois cop’s Flock license plate reader password for immigration enforcement searches

A Palos Heights police officer has been disciplined and retrained after sharing his login information to a massive license plate surveillance database with federal agents, Unraveled has learned. 

One agent admitted to using his unauthorized database access to look up license plate data related to immigration enforcement. 

Palos Heights Detective Todd Hutchinson works as a task force officer for the Drug Enforcement Administration (DEA), assisting federal agents with narcotics cases and other related criminal investigations. According to a Palos Heights Police Department memo obtained via public records request, Hutchinson has been assigned to DEA Group 22 since May 2023. 

Hutchinson was the only member of the group with access to the Flock ALPR system—a database of license plate information collected from tens of thousands of cameras nationwide that automatically scan passing vehicles. The detective stated it was “common” to allow others in the group to use his login for drug investigations, according to the department memo describing the incident.

This May, 404 Media reported on an audit log of Flock searches obtained from the Danville, IL police department. Through Freedom of Information Act requests, anonymous researchers were able to acquire the audit that showed thousands of potential immigration related searches from law enforcement agencies across the country. 

Cops with access to the Flock database must enter a search term to describe their queries. According to the log, a federal agent working with Hutchinson used his login to perform 24 searches on January 27 and 28 with the phrase “immigration violation” entered as the reason for investigation.

State legislation prohibits Illinois license plate reader data from being used for immigration enforcement purposes. 

However, the data collected by researchers showed cops and sheriffs in states like Florida and Texas performing searches of Illinois license plate reader networks. In June, Secretary of State Alexi Giannoulias announced his office will work with the Attorney General to investigate the searches, which include one performed by a Texas sheriff looking to locate a woman who allegedly self-administered an abortion. 

On August 7, U.S. Rep. Raja Krishnamoorthi announced a formal investigation into Flock’s data sharing practices. Krishnamoorthi’s letter to Flock’s CEO also mentions another recent incident out of Richmond, Virginia involving an Alcohol, Tobacco and Firearms analyst who searched their Flock database for escaped ICE detainees without permission.

Also last week, the village of Oak Park voted to terminate their contract with Flock Safety and shutter eight license plate cameras, citing concerns over privacy and immigrant rights. 

“U were so helpful in giving the group access”

Chat screenshots between Detective Hutchinson and the unidentified DEA agent who performed the searches show the agent again asked for access to the database on May 21. 

“What’s the new password? Please,” he wrote. 

“Sorry man. Keys had to be taken away,” Hutchinson responded. 

One of the provided screenshots appears to be from a group chat including other federal agents on the task force. 

Later on May 21, the agent who performed the searches—identified in the group chat by the initials B.K.—wrote, “Dear Todd, I hope you don’t get in trouble cause of my mistake. U were so helpful in giving the group access but now that is gone, gone like dust,……in the wind …”

“When I shared my account with the Special Agent, I believed it would only be used for DEA/narcotics related investigations,” Hutchinson wrote in an email to his superiors on June 16. 

Deputy Chief John Parnitzke wrote in the memo that Hutchinson changed his password, revoking the federal agent’s access to the ALPR portal once they became aware of the searches. The special agent’s full name, along with a description of what transpired in an interview with him, is redacted in the document provided.

“We did look into the issue and found that our officer had violated our security practices and shared his Flock password with a federal law enforcement partner during an unrelated federal investigation,” Palos Heights police chief Mike Yott wrote in a statement to Unraveled. “The searches that were run were done so by that federal officer. Our officer has been disciplined due to the violation, passwords have been changed, and further security training was performed.”

Countless police departments nationwide employ officers like Hutchinson assigned to federal task forces. 

Dave Maass, director of investigations at the Electronic Frontier Foundation, told Unraveled “this is not something that is supposed to happen.”

“The fact that PHPD did not know about this until journalists caught it is a sign that this agency as a whole is not acting responsibly with this data,” he added. “To be safe, not a single search that goes through should be unaccounted for.”

ALPR searches do not require any kind of warrant to execute. In his memo to the chief, Deputy Chief Parnitzke writes that they have since disabled sharing ALPR data outside of Illinois, and he believes “there is a need to start a monthly review of our own Flock searches.” 

No details are given on how or when that review will commence. 

Flock Safety claims it is now collaborating with Giannoulias’s office to ensure agencies searching Illinois license plate reader data are complying with local law, and has since shut off access to 47 out-of-state agencies. The company also claims recent reporting on its network is “clickbait-driven,” accusing reporters of mischaracterizing what the data audit revealed. 

“This isn’t clickbait reporting,” Maass said. “This is accountability reporting. This is watchdog reporting. It is absolutely in the public interest to do this kind of journalism and the fact that the [Flock] CEO wants to write this off as clickbait shows he wants to disregard legitimate criticism.”

A spokesperson for the DEA Chicago Division declined to comment on their agent’s alleged misconduct. The Secretary of State’s office and Attorney General did not respond to our inquiries about the incident.