Maryland blocked sharing driver data with ICE. A new report says it didn’t work.

Federal immigration agents continue to obtain Maryland driver information to make arrests despite state lawmakers’ efforts to curtail access, according to a new report.

Researchers at the University of Washington’s Center for Human Rights found that laws in four states, including Maryland, intended to prevent U.S. Immigration and Customs Enforcement and Customs and Border Protection from accessing state motor vehicle data “may not be as airtight as they appear.”

Maryland has some of the strongest such laws in the nation, including a new data privacy law that took effect in July. But the state is stumbling to implement it effectively, said Angelina Godoy, the report’s author.

The report comes nearly two years into President Donald Trump’s immigration crackdown that has led to more arrests of immigrants residing in Maryland than ever. Its findings spotlight how states are limited in their attempts to curb federal enforcement efforts.

ICE officers have used vehicle stops as an enforcement tool for a long time. But they have faced increased scrutiny since last year as videos of some traffic stops that turned violent have gone viral across the country.

In an emailed statement, the Department of Homeland Security, which oversees ICE, wrote that its officers are highly trained and conduct vehicle stops in accordance with federal law. The statement did not, however, directly address questions regarding the report and agents’ access to Maryland data.

In 2021, local immigrant advocates hailed the passage of the Driver Privacy Act, which prohibited Maryland’s Motor Vehicle Administration from directly sharing driver’s license or vehicle registration information with immigration agents.

However, ICE continued to access that information through a back channel called the International Justice and Public Safety Network, an independent nonprofit organization that facilitates information sharing across law enforcement agencies. All 50 states participate in the system, and ICE is one of several federal agencies with membership.

In practice, the system’s users have an agency identifier code, which functions like a username, to submit queries for specific information. The query — like an ICE agent requesting the name associated with a license plate number — pings a corresponding state system that houses a variety of data, like motor vehicle records and individuals’ criminal histories. Godoy’s report indicates that this is where the leaks are.

Del. Lorig Charkoudian, a Montgomery County Democrat who sponsored the state’s most recent data privacy law, said the legislation was meant to close that loophole in cases involving immigration enforcement. It put strict guardrails on when Maryland could respond to data queries and which agencies could receive the information.

Charkoudian said that tracking and responding to ICE’s operations requires “constant vigilance” from the state and indicated she may return to the General Assembly in January with another bill that tightens the state rules further if necessary.

In an email, Yianni Varonis, spokesperson for the Maryland Department of Public Safety and Correctional Services, the state administrator of information that is accessible through the national database, wrote that Maryland is “fully committed” to the Data Privacy Act and has taken several steps to implement it.

The Department now has a screening process that asks those requesting data if their request is for immigration enforcement. If so, they must upload proof of a valid judicial warrant.

Robyne McCullough, spokesperson for the MVA, wrote in an email that the data requests may be fulfilled or denied after official review of the warrant.

Varonis highlighted that the unauthorized sharing of MVA data “can prompt immediate criminal investigations” and that officers receive regular training on how to prevent disclosures.

The MVA has already blocked over 250,000 attempts to access its records by federal agents conducting immigration enforcement, McCullough wrote. Varonis wrote in an email that both the correctional services department and the MVA are working to block system usernames associated with immigration enforcement agencies.

Godoy, however, said that immigration agents have access to tens of thousands of different usernames for the system. And evidence across various states suggests that shutting them down in a “whack-a-mole” approach isn’t entirely effective.

The MVA is also requiring all third parties who purchase its data to sign privacy agreements that prohibit its disclosure for immigration enforcement, McCullough wrote. Still, data brokers like LexisNexis are private organizations, and Godoy’s team has been unable to access and review any evidence regarding ICE purchasing MVA data through them.

Federal agents continue to get driver information “in precisely the ways these laws seek to prohibit,” the University of Washington report states.

Godoy’s team combed through federal court records in which immigration agents detail how they obtained and relied on MVA data to make arrests. The report includes cases like that of Tiago Alexandre Sousa-Martins, whom ICE accused of overstaying his visa. Federal agents shot him during a Christmas Eve arrest that began with running his license plate in a parking lot.

But it also includes cases of arrests made after July 1, when the new Data Privacy Act took effect, adding to a growing body of evidence suggesting state records continue to play a role in ICE activity.

Through public records requests, Godoy’s team obtained reports of MVA data queries made on vehicles involved in ICE traffic stops during the first two weeks of July. In an interview, Godoy also pointed to an August arrest in Laurel in which an ICE agent later testified in court to having queried law enforcement databases about a license plate to identify the registered owner.

And on Oct. 31, Alfredo Herrera, a 56-year-old New Carrollton resident who DHS said had entered the U.S. illegally, was arrested in Ellicott City by ICE after agents scanned his license plate, according to Herrera’s family.

Ninfa Amador-Hernandez, policy manager for We Are CASA, Maryland’s largest immigrant advocacy organization, wrote in an email that these data security lapses have led to Maryland families being separated by ICE enforcement.

In September, We Are CASA sued the Trump administration for what it called a pattern of indiscriminate and illegal arrests across the state, at times made during traffic stops that turned violent.

“Maryland has made a promise to protect its residents. We Are CASA is here to work closely with state officials to safeguard that promise and to remind them of the harrowing consequences of when that promise is broken,” she wrote.