A multinational aerospace, defense, and security technology company has begun marketing an upgrade to its Automatic License Plate Reader (ALPR) system that records smart device identifiers — like those used by smartphones, earbuds, watches, tire pressure sensors, employee badges and pet microchips.
The upgrade, called SignalTrace, can be installed on the ALPR systems already deployed across the United States by Leonardo, an aerospace, defense, and security technology company headquartered in Rome.
SignalTrace expands traditional ALPR capabilities by detecting and correlating electronic devices near vehicles of interest, the company said in a statement.
By capturing publicly broadcast frequency activity from smartphones, Bluetooth wearables, car infotainment systems, and other devices, it continued, SignalTrace creates a unique “electronic fingerprint” that can be used for investigative purposes.
The system links multiple devices that consistently move with a vehicle, correlating them to the vehicle’s license plate and time-stamped location data, it added. Even if a suspect changes or removes a license plate, SignalTrace’s algorithms can still provide actionable intelligence by identifying the unique mix of devices they carry or use.
Boon for Investigators
More context is usually better than less, provided it is collected and used appropriately, explained Chris Boehm, chief technology officer at Zero Networks, of Tel Aviv, Israel, a provider of automated microsegmentation, zero trust networking, identity-based access control, and secure remote access services.
“We build security tools that correlate multiple pieces of information because a single indicator rarely tells the whole story,” he told TechNewsWorld. “I think the same principle applies here.”
“A license plate identifies a vehicle,” he continued. “A nearby device identifier can help investigators determine whether the same person or device is consistently associated with that vehicle. That can be incredibly valuable in investigations involving organized crime, human trafficking, serial burglaries, or stolen vehicles where suspects intentionally change cars or swap plates to avoid detection.”
However, he cautioned that it is important to remember that this is an investigative lead, not evidence of guilt. “Good investigators should treat it as another data point that helps narrow the search rather than something that automatically identifies a suspect,” he said.
SignalTrace is marketed as building a unique “electronic fingerprint” by correlating the Bluetooth, Wi-Fi, and RFID signals that travel with a vehicle, added Tom Bowman, policy counsel for the security and surveillance project at the Center for Democracy & Technology, an online civil liberties and human rights advocacy organization in Washington, D.C.
“For investigators, that means another layer of identification when a plate goes missing and a way to link people, not just vehicles, to a time and place,” he told TechNewsWorld.
“But the same feature that makes it useful for tracking a genuine suspect makes it equally capable of tracking everyone else on the road, none of whom consented to having their devices logged,” he added.
Enormous Privacy Issues
Bowman noted that collecting device information raises serious privacy concerns. “Your devices are constantly chirping out unique identifiers you can’t see and didn’t ask to broadcast, and products like SignalTrace are built to scoop them up and tie them to a car and a location,” he explained.
“Those identifiers travel with you when you step out of the car, which means the system can begin to map not just where a vehicle went, but where a person then walked,” he continued. “Stored in a central repository, it becomes a permanent, searchable history of association and movement.”
“Just this week, the Supreme Court ruled that by accessing a user’s location history, the police have intruded upon the privacy guarantees of the Fourth Amendment,” he said. “SignalTrace reaches for similarly sensitive data through a camera on a pole, but without the constitutional safeguards required by the Fourth Amendment.”
Richard Kersey, founder of Chirpper, a decentralized, human-centric, social network based in Liverpool, N.Y., maintained that the core issue is that a MAC address or Bluetooth identifier is a persistent, involuntary handle.
“A license plate is already a registered identifier tied to a vehicle,” he told TechNewsWorld. “Pairing it with the wireless identifiers of every phone, earbud, and watch in range means you are no longer logging ‘a car passed here’; you are logging ‘these specific people, carrying these specific devices, were together at this place and time.’ People did not opt into broadcasting that, and most do not know their devices do it.”
At its website, Leonardo explained that it does not aggregate, monetize, access, or share LPR data without explicit customer direction. Each agency’s data is stored either on-premises or in a dedicated, siloed cloud environment, never pooled into a nationwide database, it noted. Data sharing, when it occurs, is strictly opt-in and fully controlled by the customer agency.
This data sovereignty model ensures that communities, not vendors, decide how LPR data is used, it added.
Circumventing Fourth Amendment
“The main problem with SignalTrace and other technologies similar to it is that they turn existing ALPR infrastructure into personal device trackers without anything that would require public review,” argued Arif Gasilov, a partner with Gasilov Group, a consultancy covering energy, water, and built environment policy, in Tucson, Ariz.
“There is technically no federal law prohibiting law enforcement from collecting Bluetooth identifiers via roadside sensors,” he told TechNewsWorld.
“Your phone might be broadcasting a Bluetooth identifier because you’re using headphones or a smartwatch, but that does not mean that you’re consenting to surveillance while driving to work, so I would say that collecting device information in the way that SignalTrace is doing creates serious questions around individual privacy in this day and age,” he said.
Rick Bentley, co-founder of Cloudastructure, a provider of video surveillance and remote guarding services headquartered in Palo Alto, Calif., asserted that collecting device identifier information doesn’t benefit legally enforcing traffic laws. “The benefit is only to assist law enforcement in illegally or unconstitutionally spying on citizens,” he told TechNewsWorld.
He contended that the business model of ALPR companies is to outsource Fourth Amendment violations from the government to private companies, which sell the information back to the government.
“There is no justifiable reason for a government operating under the Fourth Amendment to record these broadcasts and use that information to do things that would normally require a warrant — like tracking someone’s location over time,” he said. “The fact that a private company acts as an intermediary does not change the constitutional implications.”
“The government cannot circumvent warrant requirements simply by outsourcing the collection to a third party and purchasing the results,” he added.
Cyber Threats
Collecting device identifier data also raises cybersecurity issues. John Gallagher, vice president of Viakoo Labs, an enterprise IoT security company in Mountain View, Calif., explained that SignalTrace can determine which devices an individual is carrying. “If that device is a mobile access control credential, it could be exploited for physical stalking or targeted spearfishing if the threat actor can see where and when it is used,” he told TechNewsWorld.
“Of greater impact is if cyber criminals hack the physical security device itself,” he said. “Gaining root access could be used to turn the passive monitoring of devices into active injections of malware and exploit kits into the devices.”
“This is another example of technology deployment getting ahead of governance,” he added. “Many municipalities have policies and open hearings as they deploy LPR systems. This extension of their capabilities to incorporate individually identifiable data should also go through extensive review to determine if it is being secured, governed, and managed in a responsible way.”
Malicious actors can also program transmitters to broadcast hardware addresses belonging to others to mask movement or implicate bystanders, added Jason Soroko, a senior fellow at Sectigo, a global digital certificate provider. “Because network identifiers lack authentication protocols, criminals can fabricate evidence,” he told TechNewsWorld. “This tactic poisons algorithms and corrupts evidence chains.”
In addition, he noted that fusing transit markers with network emissions bypasses randomization safeguards implemented by manufacturers. “Operating systems cycle hardware addresses at intervals to prevent tracking,” he explained. “Algorithms correlating identifier clusters with a license plate defeat this mechanism.”
“Radio receivers capture signals within a radius, including emissions from pedestrians or traffic,” he continued. “This signal bleed guarantees correlation errors, prompting algorithms to assign electronics belonging to bystanders to drivers.”
