Companies that provide license plate cameras want you to think they have the ability to track everything. An expert clarifies the reasons why this is not the case.

      Leonardo US Cyber and Security Solutions

      The most significant automotive news and reviews, without the fluff.

      Subscribe to our free daily newsletter for the most important stories delivered to your inbox every weekday.

      Automatic License Plate Readers (ALPRs) from various vendors—most notably Flock, along with products like ELSAG from the company Leonardo—have been gaining considerable attention lately for good reason. These systems can monitor individuals using a network of cameras without needing warrants, a reality my colleague at The Drive unfortunately experienced firsthand last month. Recently, Leonardo has introduced a new product called SignalTrace, which, while not an ALPR, can be paired with these systems to link license plates with different wireless signals, such as Wi-Fi and Bluetooth, as well as frequencies emitted by devices ranging from tire pressure monitoring systems to pet microchips.

      At least, that’s what Leonardo asserts; however, a security researcher has recently examined SignalTrace’s advertised capabilities to distinguish between what is truly achievable and what is not, and his findings are notable.

      Ryan O’Horo is an offsec engineer and security consultant who located several SignalTrace installations in Oxon Hill, Maryland, thanks to the Prince George’s County Police Department. To O’Horo’s knowledge, these are currently the only real-world instances of SignalTrace deployment, though he requests that anyone who encounters additional installations report them to him.

      Thus, it seems that SignalTrace technology is not yet appearing on every lamp post and traffic signal across the United States. However, the real value of O’Horo’s insights—and what often gets overlooked when those outside the security field discuss the capabilities of such systems—is that he acknowledges the limitations that companies like Leonardo typically avoid discussing.

      A Flock camera installed on a light pole in Burbank, California. Justin Sullivan/Getty Images

      To begin with, electronic devices do not constantly emit identifiable data, so for SignalTrace to capture information from your phone, it would need to do so at the right moment. Additionally, communications travel across multiple channels, making it difficult for a single radio to monitor all at once. While Leonardo might address some challenges with custom hardware, O’Horo notes that they claim to use “off-the-shelf” components for SignalTrace.

      These are just a few initial obstacles. As O’Horo explores the types of devices that Leonardo claims SignalTrace can access, further discrepancies emerge between the product’s advertised capabilities and what is realistically achievable. The flat-panel antennas used by SignalTrace cannot detect the frequencies utilized by the most common tire pressure sensors. Furthermore, pet microchips—RFID tags that operate on very low frequencies—are typically only readable at very close distances. O’Horo speculates that in this context, Leonardo might actually mean Wi-Fi/Bluetooth-enabled pet collars.

      An excerpt from Leonardo’s own materials on SignalTrace. Leonardo US Cyber and Security Solutions

      This is the crux of the issue. Wi-Fi and Bluetooth are ubiquitous and can operate over long distances, making them particularly susceptible to tracking, which might be the most viable application for SignalTrace, even if other potential functionalities are less feasible. Although there still seems to be a gap between what Leonardo promotes and actual capabilities—O’Horo suggests it would require multiple passes of the same sensors or several collection points to capture all potential signals—Wi-Fi and Bluetooth scanning are features already present in some Flock cameras.

      In certain aspects, surveillance solutions like SignalTrace may be exaggerated, but in others, the issue lies within the current commercial offerings. With that in mind, I encourage anyone particularly interested in the technical details of this subject to explore O’Horo’s blog, which delves much deeper than this summary.

      Have a tip? Contact us at tips@thedrive.com.