DHS privacy assessment reveals scope of Secret Service HELIX surveillance system

The U.S. Secret Service has transformed an older White House camera network into a searchable surveillance platform that combines facial recognition, license plate data and video analytics, according to a newly released Department of Homeland Security privacy assessment. The document provides the clearest public picture yet of HELIX, while leaving unanswered questions about who can be monitored, what data sources the system can access and how long information can ultimately be retained. 

HELIX is not an entirely new system, though. Its lineage runs through Crown CCTV, the camera infrastructure used in a 2018 White House facial recognition pilot Biometric Update reported on at the time.

An April 2025 appendix to DHS’s department-wide surveillance camera privacy assessment identified “USSS HELIX, formerly operating as CROWN CCTV P3C,” more than a year before the agency published a dedicated HELIX assessment. The Secret Service has acknowledged that HELIX is not necessarily new but has not said when the transition occurred. That leaves an important question unanswered: when did the former Crown CCTV system become the integrated analytical platform DHS now describes? 

The distinction matters because DHS acknowledges that integrating these capabilities creates privacy risks greater than those posed by the individual systems operating separately. 

A camera image, a license plate observation, or a photograph in a protective intelligence file may reveal relatively little in isolation, but once those records can be searched together, the system can establish connections among identity, vehicles, movements, and locations that were not readily visible before.

The Secret Service tested facial recognition on selected Crown CCTV camera streams at the White House Complex in 2018.

The six-month pilot compared people appearing in the cameras’ field of view with a gallery of volunteer employees to determine whether the technology could alert officers to known subjects of interest before an encounter.

The Crown CCTV feeds were sent directly into the Secret Service’s Facial Recognition Pilot database.

The Government Accountability Office (GAO) later reported that the pilot ended and its photographs and other test data were deleted. DHS retired the pilot’s privacy assessment in August 2024. While the new HELIX assessment does not describe the current platform as a continuation of that pilot, the April 2025 CCTV appendix establishes the underlying system lineage. 

It also shows that DHS had publicly listed HELIX as an operating Secret Service camera system before explaining that it could combine facial matching, plate recognition and video content analysis.

Watchlists, retention and privacy gaps

Under the newly described system, the Secret Service can manually create facial recognition galleries using photographs held by the agency. HELIX then compares faces appearing in selected imagery against those galleries.

DHS says the capability is restricted to people of interest identified by the agency’s Protective Intelligence and Assessment Division and is not intended to identify every person appearing on camera.

The assessment does not define “person of interest,” identify the evidentiary standard for placement in a gallery, or describe an appeal process for a person who believes they were included improperly.

It also does not state how often entries are reviewed, when they must be removed, or whether a fixed expiration date applies. The document also does not explain what happens to the faces of bystanders.

A watchlist comparison generally requires software to detect a face and create a mathematical representation long enough to determine whether it matches an enrolled image.

The assessment says biometric information is generally retained for one year, but does not clearly distinguish retained gallery templates and match records from any temporary representations of people who do not match.

The same ambiguity surrounds license plate data. HELIX can process plate numbers, vehicle images, locations, and timestamps, but the assessment does not clearly say whether the information comes only from cameras controlled by the Secret Service or can include outside plate databases.

That omission is important because GAO reported in December 2024 that the Secret Service, Customs and Border Protection and Immigration and Customs Enforcement (ICE) all had arrangements allowing them to query or view information from a nationwide third-party license plate reader source.

The report also said the Secret Service planned to acquire fixed and mobile plate readers, additional closed-circuit cameras, and drones.

There is no public evidence that HELIX ingests the third-party plate data. The privacy impact assessment (PIA) nevertheless leaves the boundary unclear at precisely the point where a localized protective security system could become a much broader vehicle-tracking tool.

HELIX does not have a new, system-specific System of Records Notice, the Federal Register document that tells the public whose information a federal agency keeps, why it keeps it, and how it may be shared.

Instead, the Secret Service relies on the DHS/USSS-004 Protection Information System notice last updated in October 2020.

That notice is broad enough to cover much of the agency’s protective mission. It includes information about people who may be near a protectee or protected location, people subjected to non-criminal protective inquiries, witnesses and informants, and people who have been granted or denied access to a protected site.

It permits the collection of vehicle identifiers, biometric profiles, and information supplied by government agencies, private organizations, or members of the public.

The notice also reaches information about behavior, personality traits, criminal and mental health history, and what it calls “social deviancy” when the agency considers it relevant to protective duties.

Although the notice refers to biometric identifiers and profiles, it does not expressly describe HELIX facial templates or the combined analysis of faces, plates, and location records.

Its routine uses allow protective information to be shared with federal, state, local, and foreign authorities, as well as private institutions and individuals involved in threat assessments.

With approval from DHS’s chief privacy officer, information can also be disclosed to government or multilateral organizations testing new technology.

The legal issue is not whether a records notice exists, but whether a mission-wide notice written six years ago gives meaningful public notice of a platform that can create a more revealing picture by linking data originally gathered through separate systems.

Another Secret Service privacy assessment makes the scope problem more pronounced. A September 2024 assessment governing facial recognition in criminal investigations says the covered Secret Service office does not use the technology to surveil the public and would not acquire a device that analyzes live or streaming video in real time.

HELIX appears to operate under a different Secret Service office and its protective rather than criminal investigative authority, so the two documents are not necessarily contradictory.

They do, however, expose a significant boundary in the agency’s public rules. A restriction presented in one facial recognition assessment may not apply when similar technology is deployed under another part of the Secret Service mission.

The agency is also testing Sentry, a mobile face-and-fingerprint identification application used by a limited group of Uniformed Division officers in Washington.

As Biometric Update reported in June, the application allows officers to initiate identity checks during encounters, while HELIX is built around fixed-site monitoring and watchlist comparisons.

No separate public Sentry privacy assessment has been located. The available documents do not say whether Sentry and HELIX share galleries, matching services, audit records, or downstream protective intelligence files.

The HELIX assessment says ordinary video is retained for 30 days and biometric information for one year, with exceptions tied to protective events. Those limits can give a misleading impression of how long selected information may remain in government hands.

The 30-day period is the default for footage left inside the surveillance platform. Once a recording is judged relevant to an inquiry, exported from HELIX, or incorporated into a protective intelligence case, a different retention regime can apply.

The governing Protection Information System notice says surveillance recordings relevant to an investigative inquiry can be kept for at least three years and potentially with the associated case file.

Records involving highly unusual or significant incidents can be retained permanently and eventually transferred to the National Archives.

A records schedule approved by the National Archives in 2024 and modified in 2025 goes further. Video retained for other authorized law enforcement purposes may be kept for as long as 20 years or until the related case or project closes, whichever comes later.

Protective intelligence case files maintained by the controlling office can remain for 30 years after closure, while material used for active research can be retained for up to 50 years. Selected records involving significant cases or events are permanent.

The critical privacy decision is therefore not the automatic deletion of routine footage after 30 days, but rather the largely invisible decision that converts a passing image, plate observation, or location record into investigative material that can follow a person for decades.

The assessment says HELIX logs user access, exports, and certain requests. It does not say how often those logs are audited, whether reviews are independent of the operational program, or what findings would trigger corrective action.

DHS identifies role-based access, training, internal policy, and audit logging as safeguards. It also says HELIX does not collect audio or Social Security numbers and that signs provide notice at some protected facilities.

However, GAO concluded in 2024 that Secret Service policies did not consistently turn privacy protections described in assessments into enforceable requirements governing surveillance technology.

GAO’s recommendation that the agency incorporate those protections into each monitoring technology policy remains open. Recommendations for bias reviews and more complete DHS facial recognition documentation also remain unresolved.

HELIX is part of a wider shift inside DHS toward analytical systems justified through the protective mission. A September 2025 ICE privacy assessment, for example, describes tools that collect and analyze open source and social media information for threats to ICE personnel and facilities.

ICE’s RAVEn environment similarly brings disparate government datasets and analytical tools into a common platform, though there is no evidence that either system connects to HELIX.

What links them is the governing logic. Data collected through separate authorities and for different immediate purposes becomes more powerful when placed in an environment built to search across it, resolve identities and identify relationships.

DHS’s HELIX privacy assessment recognizes that integration creates the risk. It leaves unresolved who may be placed under its gaze, how far its data sources extend, and what must happen before a record created by an ordinary encounter with a government camera becomes part of a file that can last most of a lifetime.

Article Topics

biometrics  |  cctv  |  DHS  |  facial recognition  |  Secret Service  |  U.S. Government  |  video analytics