Secret Service reveals new surveillance system amid slowd...

Overview

The Secret Service has disclosed a new surveillance capability called Helix in a Privacy Impact Assessment (PIA). Helix aggregates video surveillance, facial recognition, and license plate recognition data at protected locations, representing a notable expansion of biometric surveillance capabilities. The disclosure — coming amid a slowdown in privacy impact assessments — signals potential changes in data handling expectations and procurement priorities for contractors working on DHS (Department of Homeland Security)/Secret Service facilities or building similar surveillance and analytics systems. Contractors in physical security, biometric technology, video surveillance, license plate recognition, and data analytics should review their architectures, data flows, and privacy controls now. This event also warrants closer monitoring of DHS, the USSS, the DHS Privacy Office, and CISA for follow-on guidance, procurement notices, or updates to assessment requirements. See the Secure Operations Guide (/insights/secure-operations-guide) for operational baseline guidance and the related CMMC (Cybersecurity Maturity Model Certification) Compliance Guide (/insights/cmmc-compliance-guide) and CUI (Controlled Unclassified Information)-Safe CRM Guide (/insights/cui-safe-crm-guide) for proposal and data-handling templates.

Immediate Actions (This Week)

[ ] Monitor official channels (USSS, DHS Privacy Office, CISA) and the published Helix PIA for any clarifications, attachments, or follow-on notices.
[ ] Inventory current programs and contracts that involve video surveillance, facial recognition, or license plate recognition and flag any work on DHS/Secret Service facilities.
[ ] Run a rapid data-flow and data-classification review to identify where biometric data, video, or plate-reader data is collected, stored, transmitted, and who has access.

Short-Term Actions (30 Days)

[ ] Map affected systems to applicable privacy and security controls (see Compliance Checklist below) and identify gaps requiring remediation or design changes.
[ ] Prepare a PIA/Privacy Requirements packet (templates, data flow diagrams, retention policy drafts) so capture and proposals teams can respond quickly to RFPs or information requests.

Long-Term Actions (90+ Days)

[ ] Update system architectures and procurement strategies to embed privacy-by-design measures (minimization, retention limits, access controls, auditing) and to reduce future compliance risk.
[ ] Position for future opportunities or task orders by aligning past performance and solutions to relevant contract vehicles and market segments; consider pursuing placement on vehicles used by DHS-related solicitations (e.g., DHS EAGLE II, OASIS+, GSA (General Services Administration) MAS, FirstSource II, Alliant 3).

Compliance Checklist

[ ] Conduct or update Privacy Impact Assessments consistent with DHS Privacy Impact Assessment requirements and E-Government Act Section 208.
[ ] Ensure handling of personal data complies with the Privacy Act.
[ ] Map and remediate privacy controls per the NIST Privacy Framework and NIST 800-53 privacy controls.
[ ] Assess applicability of FedRAMP (Federal Risk and Authorization Management Program)/FISMA for any cloud-hosted components handling sensitive biometric/video data.
[ ] Review identity and credentialing requirements in light of HSPD-12 and FIPS 201 where systems integrate with federal identity systems.

Resources

DHS Privacy Impact Assessment requirements: https://www.dhs.gov/privacy/privacy-impact-assessments
E-Government Act Section 208 (Privacy Impact Assessments): https://www.govinfo.gov/content/pkg/PLAW-107publ347/html/PLAW-107publ347.htm
Privacy Act: https://www.justice.gov/opcl/privacy-act-1974
NIST Privacy Framework: https://www.nist.gov/privacy-framework
NIST SP 800-53 (NIST Special Publication 800-53) (privacy controls): https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
FedRAMP: https://www.fedramp.gov
FISMA guidance: https://www.cisa.gov/federal-information-security-modernization-act
HSPD-12 (overview): https://www.dhs.gov/homeland-security-presidential-directive-12
FIPS 201: https://csrc.nist.gov/publications/detail/fips/201/final
Agency homepages:
Department of Homeland Security (DHS): https://www.dhs.gov
U.S. Secret Service (USSS): https://www.secretservice.gov
DHS Privacy Office: https://www.dhs.gov/privacy
CISA: https://www.cisa.gov

How Cabrillo Club Automates This

Cabrillo Signals War Room — Already detected this event and delivered this briefing within minutes. War Room continuously monitors federal sources (agency announcements, PIAs, regulatory updates) and immediately flagged the Helix PIA and related activity so your team can act without delay. It will surface subsequent PIAs, clarifications, and any procurement notices tied to this disclosure.

Cabrillo Signals Match Engine — Automatically rescoring your opportunity pipeline when events like the Helix disclosure shift priorities. Match Engine updates relevance scores for opportunities and keywords (e.g., facial recognition, license plate recognition, video analytics), reprioritizing opportunities and past-performance matches so capture teams focus on highest-probability pursuits.

Cabrillo Signals Intelligence Hub — Tracks the affected agencies, NAICS codes, and contract vehicles and enables saved searches and alerts. Configure saved searches for DHS, USSS, DHS Privacy Office, CISA, the NAICS categories in your pipeline, and the listed contract vehicles (DHS EAGLE II, OASIS+, GSA MAS, FirstSource II, Alliant 3) to get notified the moment matching solicitations, amendments, or notices appear on SAM.gov (System for Award Management) and related feeds.

Proposal Studio (Proposal OS) — Generates compliance matrices, PIA/PAR templates, and first-draft technical approaches using your past performance and win themes. Proposal Studio will pull the updated compliance checklist items (NIST privacy mappings, FedRAMP considerations, Privacy Act statements) into draft language so capture and legal teams can iterate faster.

Proposal Studio Workflow Tracker — Routes capture tasks automatically through a 9-gate workflow from opportunity identification through post-submission. For events like this, Workflow Tracker can auto-open privacy-review gates, route PIA and legal reviews to the correct reviewers, track supplier certifications, and assemble audit-ready documentation packages linked to the opportunity.

Explore these features in the Secure Operations Guide (/insights/secure-operations-guide) and use the related proposal and compliance guides to accelerate capture and compliance work.