NCIC, the FBI’s National Crime Information Center, holds records such as stolen vehicles, wanted persons and missing persons that agencies often use to build license plate reader hotlists. Access is governed by the FBI’s CJIS Security Policy, which can extend to vendors. Because hotlist data can be stale, officers verify every reader hit with a live record check before acting.
What NCIC is and how it relates to plate readers
NCIC is the FBI’s National Crime Information Center, a national database of criminal-justice records maintained by the FBI’s Criminal Justice Information Services (CJIS) Division. Among its records are stolen vehicles and plates, wanted persons and missing persons, which is why it matters to plate readers. Police can query it from their patrol vehicles and through dispatch, and states and agencies feed their own records into it.
A plate reader does not “connect to NCIC” in a single standard way. How NCIC information reaches a reader’s hotlist depends on your state, your agency’s authorization and your vendor’s integration.
From hotlist to verified hit
In practice, agencies handle the relationship between plate readers and NCIC in two steps:
- Building hotlists. Stolen-vehicle and wanted-person information is loaded into the reader’s hotlists from the agency’s records and from state or national sources, under the agency’s authorization. See hotlists explained.
- Verifying hits. When a read matches, the officer visually confirms the plate and then confirms the record is still valid through dispatch or a live NCIC or state-system query before making contact. Public agency policies reviewed consistently require this, with limited exceptions for urgent circumstances.
The verification step is the safeguard. Hotlist data can be hours or days old, so a live check matters.
What CJIS security rules mean
Systems that store, process or transmit criminal-justice information, including some plate reader hotlists, fall under the FBI’s CJIS Security Policy. It sets minimum security requirements for things like access control, authentication, encryption, auditing and personnel screening. Agencies are responsible for compliance, and that responsibility extends to vendors that handle covered data on their behalf.
The policy is detailed and updated regularly, so use the FBI’s current version and your state’s CJIS systems agency as the authority. This page is a plain-language overview, not a compliance guide.
Questions to ask your vendor
| Question for any vendor | Why it matters |
|---|---|
| How does criminal-justice data reach the hotlist? | Direct integration, a state-supplied list or manual upload each carries different timing and authorization. |
| Will you sign your state’s CJIS agreement or addendum? | Agencies are usually expected to bind vendors that handle covered data. |
| Where is the data hosted, and who can see it? | Hosting location, personnel screening and access controls are core CJIS concerns. |
| Is multi-factor authentication required for every user? | Strong authentication is a standard security expectation for systems with this kind of data. |
| What audit logs do I get? | You need records of who accessed what, when and why, and the ability to export them. |
| What happens to data when we end the contract? | Retention, deletion and export terms protect you after the relationship ends. |
Frequently asked questions
What is NCIC?
The FBI’s National Crime Information Center, a national database of criminal-justice records that includes stolen vehicles and plates, wanted persons and missing persons. It is operated by the FBI’s CJIS Division.
Do license plate readers connect directly to NCIC?
Not in one standard way. Hotlists are built from agency records and state or national sources under the agency’s authorization. Ask the vendor exactly how it works for your state.
Why must a reader hit be verified with NCIC?
Because hotlists can be out of date and plates can be misread. Agency policies commonly require a visual match and a live NCIC or state-system check before contact.
What is the CJIS Security Policy?
The FBI’s set of minimum security requirements for systems that handle criminal-justice information, covering access control, authentication, encryption, audit and personnel screening.
Does CJIS apply to vendors?
It can. Agencies are generally expected to ensure vendors that handle covered data meet the policy. Ask your state’s CJIS systems agency and counsel what your contract must include.