The US Department of Homeland Security (DHS) has subpoenaed the American Association of Motor Vehicle Administrators (AAMVA) for a copy of all entries in the CDLIS national database of state-issued commercial driver’s licenses held by AAMVA. The administrative subpoena was issued August 11th and ordered AAMVA to hand over a copy of all records that were found in the CDLIS database any time in the last five years, by 8 am Monday, August 17th.

DOT says that “AAMVA operates the CDLIS database on behalf of the federal government; it is contractually and legally obligated to furnish the requested records at FMCSA’s direction.”

In response, a group of states led by Illinois has filed separate lawsuits in Virginia, where AAMVA is incorporated, against the DHS to quash the subpoena and against AAMVA and the US Department of Transportation (DOT) to enjoin AAMVA from complying with the DOT’s parallel demand for the same data.

US District Judge Anthony Trenga immediately issued temporary stays which prohibit AAMVA from complying with the subpoena and prohibit any actions by DOT to punish AAMVA for noncompliance with the DHS subpoena or DOT demand for CDLIS data. Initial hearings before Judge Trenga in both cases are scheduled for Thursday, August 20th.

We hate to have to say, “We told you so.” But in this case, we told you so.

The CDLIS database is the little brother for commercial driver’s licenses (for truckers) to the big brother SPEXS database for all driver’s licenses and state-issued ID cards. Like SPEXS, CDLIS is a national database of “pointer” records (including name, date of birth, state, license or ID number, and Social Security Number)  aggregated from information uploaded by state motor vehicle agencies but held by AAMVA or AAMVA’s contractors.

CDLIS (commercial license) and S2S (non-commercial license) pointer records are all stored in the same SPEXS database as part of AAMVA’s central site:

[Excerpts from AAMVA’s “SPEXS System Specification”]

We’ve warned repeatedly that once data is uploaded to AAMVA’s SPEXS database, Federal agencies could demand it from AAMVA in bulk. State authorities, most recently in California, have brushed off our warnings. But as conceded in declarations from the California Department of Motor Vehicles in one of the new cases, the California DMV has already been uploading CDLIS information about commercial driver’s licenses to SPEXS, and plans to start uploading “S2S” data about all California license to SPEXS in 2027.

The DHS is now seeking to obtain driver’s license data from every state, in bulk, through an administrative subpoena to AAMVA, for use for immigration enforcement, in exactly the manner and for the purpose we predicted and warned about.

AAMVA’s role is noteworthy and contemptible, although unsurprising.

AAMVA was sent a demand for the entirety of the CDLIS database on June 25th, but didn’t tell the states that had uploaded the data  in question about the Federal demand until almost a month later on July 23rd. State can’t count on prompt notice from AAMVA.

Even now, AAMVA isn’t  challenging the demand for CDLIS data. AAMVA is a defendant, along with the Federal agencies, in the lawsuits brought by states to protect their residents’ data against bulk disclosure to Federal agencies for immigration enforcement.

According to the complaints, the DHS and DOT have threatened to cut off all Federal funding for AAMVA, including funding for CDLIS itself (and presumably also SPEXS), if AAMVA doesn’t hand over the requested data. AAMVA depends on Federal funding, so it can’t afford to challenge Federal demands, making it in effect a captive proxy for the Feds despite being a nominally non-governmental private nonprofit corporation.

Presumably, the Feds will learn from AAMVA’s failure to challenge their demands for the data it holds. Next time, they’ll come back with a subpoena that includes a gag order prohibiting AAMVA from disclosing the subpoena to states that uploaded the data, so states will have no chance to file lawsuits like the ones filed this week.

The obvious next step after that would be a similar demand for SPEXS data about ordinary non-commercial licenses, probably as soon as California completes its planned bulk upload to SPEXS sometime early in 2027.

Officials in California and other states can no longer claim this isn’t possible.

State legislators need to act, now, to withdraw their states from SPEXS, before the DHS expands its data demands from the commercial licenses in CDLIS to all licenses in SPEXS.