ALPR Hotlists and Alerts

What a hotlist is

A hotlist is a list of license plates for vehicles of interest. The California State Auditor described them as lists agencies compile “based on vehicles sought in crime investigations and vehicles connected to people of interest,” such as stolen vehicles or missing persons. When a camera reads a plate, software automatically compares it against the hotlists loaded into the system.

This page separates three kinds of information, because they come from different places and aren’t interchangeable:

Where hotlist entries come from

National and state databases

Flock says its customers can receive alerts when a vehicle matches “a customer-defined or NCIC hot list.” NCIC is the FBI’s National Crime Information Center, a national database of records entered by law enforcement agencies, including stolen vehicle and stolen plate records. Under the NCIC operating manual, the agency that enters a record is “responsible for [its] accuracy, timeliness, and completeness,” and must be available around the clock to confirm it.

Agency-entered (“manual”) entries

Agencies can also add plates themselves, for example a vehicle connected to a local investigation. Knoxville’s policy defines a hotlist as “a database of manually entered license plates of interest to law enforcement,” limits who may add entries to specific supervisors, and requires them to remove an entry “as soon as the alert is no longer needed.”

The practical point: an entry is only as accurate as the person or system that created it, and only as current as the last time it was updated.

How an alert is generated

1. The camera reads a plate. Software converts the plate in the image to text. See how Flock cameras work.
2. The text is compared to loaded hotlists. This happens automatically for every read.
3. A match generates an alert, often called a “hit.” Flock says customers “receive instant alerts” on a match. NHTSA describes ALPR systems generally as alerting the officer and, in some cases, displaying photographs so the user can identify the vehicle.
4. A person decides what to do. The alert itself doesn’t stop anyone. An officer or dispatcher decides whether and how to respond, and that is where verification is supposed to happen.

Exactly how alerts are delivered, who receives them, and what information is attached depends on the vendor, the system configuration and the agency.

A match is not a confirmation

An alert tells you that one string of characters matched another. It does not, on its own, confirm any of the following:

• The plate was read correctly. Software can misread characters. Knoxville’s policy acknowledges that “the ALPR can misread the alphanumeric characters on a license plate.” See plate misreads and accuracy.
• The plate is from the same state. The same characters can appear on plates issued by different states.
• The hotlist entry is accurate and still active. A vehicle may have been recovered, or a matter resolved, without the entry being removed.
• The vehicle is the one the entry describes. A plate can be on a different vehicle than the one in the record.
• The person driving is the person of interest. See vehicle identification vs. driver identification.

The FBI’s NCIC manual makes the same point about its own records: “An NCIC 2000 hit alone is not probable cause to arrest.” It describes a hit as only one element of the legal grounds needed, and requires confirmation with the agency that entered the record before an arrest or seizure based on it.

How officers are expected to verify alerts

There is no single national ALPR verification rule. Requirements come from agency policy, state law and database rules. Knoxville’s policy is one documented example:

• “Receiving of an ALPR hit does not provide legal authority for enforcement action.” The hit only draws attention to a vehicle that might warrant further investigation (¶ 16).
• Before any enforcement action, the officer must visually verify that the hit matches the digital image and confirm the hit’s authenticity (¶ 17).
• For an NCIC-based hit, the officer must confirm through NCIC that the entry is still active (¶ 18).
• For a manual hotlist entry, the officer must verify its active status. If that can’t be done, the officer needs reasonable suspicion or probable cause from their own observations before acting (¶ 19).

Policies are only as good as the practice. In NHTSA’s 2021 case studies, agencies reported that verification protocols can be time-consuming, “so officers may not always follow the required process.” Whether the required steps were actually followed in a specific stop is a factual question.

Outdated and incorrect entries

A correct plate read can still produce a wrong alert if the list itself is wrong. NHTSA’s review found that “databases may not be up to date, resulting in false positive hits,” that “hot lists need to be frequently updated,” and that in some case-study agencies, infrequent list updates were a technical challenge. For example, a stolen vehicle may have been recovered, or a manual entry may never have been removed after it was no longer needed.

This is different from a misread. A misread is the camera getting the plate wrong. An outdated entry is the list being wrong. Both can produce an alert for a vehicle that shouldn’t have been flagged, and they leave different records behind.

Records that may exist about an alert

Depending on the system and the agency, an alert can leave a trail of separate records. Not every system keeps all of these, and retention periods vary:

• The read record: the image, the plate text, the time and the camera location. See what data ALPR cameras collect.
• The hotlist entry: which list it came from, when and by whom it was entered, the reason, and whether and when it was updated or removed.
• The alert itself: when it fired and who received it.
• Verification records: for example, database queries confirming the entry, and dispatch communications.
• Search and audit logs: Flock says every search is tied to a user and logged. Knoxville’s policy requires that all queries be logged and audited monthly. See ALPR audit logs and search records.
• Officer records: reports, and where used, dash or body camera video of the stop.

Because ALPR data can be deleted on short schedules, whether these records were preserved, and when, can matter.

Why an alert doesn’t establish guilt

An alert is an investigative lead. Even when it is accurate, it shows that a plate associated with a vehicle of interest passed a camera. It doesn’t show who was driving, what that person knew, or whether they committed any offense. In a criminal case, the prosecution must prove every element of the charged crime beyond a reasonable doubt.

A separate question is whether police acted lawfully on the alert, for example whether a stop based on it was justified. That is a constitutional question, and the answer can depend on what officers knew and verified before they acted. See motions to suppress license plate reader evidence.

Questions a defense attorney may investigate

• Which hotlist produced the alert: NCIC, a state system, or an agency’s own list?
• Who created the entry, when, and why? Was it still active at the time of the alert?
• Does the plate in the image match the plate text and the state in the hotlist entry?
• What did officers do to verify the alert before acting, and is there a record of it?
• What does the agency’s ALPR policy require, and was it followed?
• Were the read, alert and audit records preserved, or deleted under the retention schedule?

For more, see questions to ask a defense attorney about ALPR evidence.