ALPR cameras were sold to us as a tool for tracking cars. A new wave of "upgrades" quietly turns them into a tool for tracking you — through the phone in your pocket, the watch on your wrist, and even the microchip in your dog.
For years, the pitch for automatic license plate readers — ALPRs — was reassuringly narrow. They're just cameras that read plates, we were told. Your plate is already visible to anyone on the road, so what's the harm? That framing is the entire reason these cameras now sit on poles, patrol cars, and intersections in thousands of towns across the country. It's also, as of this month, obsolete.
A new product called SignalTrace, advertised by the defense contractor Leonardo, bolts a fresh set of sensors onto existing plate-reader cameras. These sensors don't read plates. They listen — to the wireless chatter your devices broadcast into the open air every second of every day. And in doing so, they quietly change what an ALPR is: from a machine that logs cars into a machine that identifies people.
We covered this on Episode 58 of the podcast, but it's important enough to write down plainly. Here's what changed, why it matters, and what you can actually do about it.
What SignalTrace actually does
A normal plate reader captures one thing as a car drives past: the plate, plus a timestamp and a location. SignalTrace captures all of that — and then sweeps up the unique identifiers leaking out of everything else in and around the vehicle. According to the product material reported on by 404 Media, that includes Bluetooth devices (phones, wireless earbuds and headphones, fitness trackers, smartwatches), Wi-Fi sources (in-car hotspots, laptops, tablets), components of the car itself (tire-pressure sensors, the infotainment system), and even RFID tags — the access card in your wallet, and yes, your pet's microchip.
The system bundles these signals into what the marketing literally calls a unique, trackable "electronic fingerprint," and correlates that fingerprint to a license plate. When a cluster of devices keeps showing up alongside the same car, the software decides those devices — and the people carrying them — belong to that vehicle.
Two details turn this from creepy into genuinely dangerous. First, the company brags that the correlation keeps working even if a driver changes or removes the license plate — the one low-tech privacy move most people assume still works. Second, this isn't a momentary scan. The data is stored in what Leonardo calls an "Enterprise Operations Center" for future queries — a searchable, historical record of which devices, and which people, travel with which cars, available to be mined long after the fact.
Leonardo isn't a startup experimenting at the edges. It's a major defense and security contractor that already sells plate readers and communications gear to police, border agencies, and government — its U.S. arm holds federal contracts. SignalTrace appears to be a rebrand of an earlier Leonardo product. This is the surveillance industry upgrading infrastructure that's already in the ground on your street.
From plate to person: the mission creep
The reason privacy researchers use the phrase "mission creep" is that no single step ever looks like the dystopia. A camera that flags stolen cars sounds fine. Adding a sensor that also notes nearby Bluetooth sounds technical and harmless. But stack the steps and you arrive somewhere nobody voted for.
It moves tracking from your car to your body. The standard advice for plate-reader anxiety was always some version of "don't drive a car registered to you." SignalTrace doesn't care whose name is on the registration. Your watch and your earbuds broadcast their own identifiers whether you're driving, riding shotgun, or sitting in the back of a friend's car. You can leave your phone at home. Almost nobody thinks to leave their watch, their earbuds, and their keycard at home too.
It maps your relationships, not just your movements. The whole selling point is "devices that travel together." That's a social graph drawn from the physical world — who you live with, who you carpool with, who you're quietly seeing, which two phones spend every Thursday night at the same address. A plate reader tells an investigator where a car went. This infers who you're connected to, from nothing more than your gadgets keeping each other company.
The pipe to the federal government already exists. This capability isn't landing in a vacuum. 404 Media has separately reported that the FBI wants nationwide access to plate-reader data, that Customs and Border Protection had access to more than 80,000 Flock cameras, and that ICE has tapped into that nationwide network. Flock — the biggest name in the space — even built a system called Nova that planned to use data from old breaches to "jump from license plate to person," before backing off after the reporting. Picture SignalTrace not as an isolated gadget, but as a richer sensor feeding a national pipe that agencies are already drinking from.
This isn't hypothetical — the abuse is already documented
The industry's answer to all of this is always the same: trust us, there are audit logs, abuse is rare and we catch it. So let's test that claim against the plate readers already deployed today.
In the summer of 2024, a police officer in Orange City, Florida ran his ex-girlfriend's license plate through Flock at least 69 times — plus her mother's plate two dozen times and her father's fifteen. He was doing it so openly that a colleague in the next cruiser warned him to stop. He'd also dropped an AirTag into her wallet. He was eventually charged with stalking and computer-crime offenses. Crucially, he wasn't caught by Flock's audit tools — he was caught because his victim reported it.
And he is not an outlier. An April study by the Institute for Justice found at least 18 officers caught using Flock to stalk a romantic interest in just the last few years. A volunteer-run "ALPR Abuse Library" has logged 20 distinct stalking and targeting cases. In Milwaukee, an officer searched one woman's plate more than 100 times and a second woman's 124 times in two months — logging the reason, each time, as simply "investigation." A police chief in Idaho allegedly stalked his own wife with the justification "test." In Joplin, Missouri, a citizen group pulled the public audit logs and found one officer who had searched a single plate 395 times over ten months, completely undetected by the department.
Flock told 404 Media it's aware of 15 incidents of abuse against 140,000 monthly users, and that abuse is therefore rare. But look at the structure of that defense: nearly all the known cases were surfaced not by the company, but by stalking victims, journalists, and activists filing records requests — some using a website, HaveIBeenFlocked.com, that lets people check whether their own plate has been searched. "Rare" really means "rarely detected," and the detection is being done by the public. There is, in most jurisdictions, no warrant required to run any of these searches.
Now combine the two stories. Today, with plate readers alone, hundreds of unwarranted searches of a single victim can run for a year before anyone notices. SignalTrace hands that same workforce — with that same "we'll audit it later" culture — a system that also tracks your watch, your earbuds, and your pet, and that keeps working when you cover your plate. It isn't a new risk in a vacuum. It's a massive upgrade to a capability we have hard, documented proof gets abused.
What you can actually do
We'll be honest in both directions here, because this is a hard problem and toggles alone won't solve it.
On the personal side, your devices are chatty by default, and you can make them quieter. Turn Bluetooth and Wi-Fi off when you're genuinely not using them — actually off, not just "disconnected." Make sure MAC address randomization is enabled, so the Wi-Fi identifier your phone presents keeps rotating; it isn't airtight, but it breaks the persistence these systems rely on. Remember that always-on wearables and earbuds are the chattiest offenders, so on a sensitive trip the real move is to leave the watch and buds at home, or use a signal-blocking Faraday pouch. And for higher-threat situations, a locked-down platform like GrapheneOS, with granular control over the radios, earns its keep.
But the real lever is structural, because this gets solved in city council chambers, not your settings app. ALPR deployments are usually approved locally — which means they can be questioned, limited, and rejected locally, and the single most important reform is requiring a warrant before police can query these systems at all. Check whether your own plate has been searched at HaveIBeenFlocked.com, and see whether your town has cameras through community mapping efforts like DeFlock. Show up: residents who've turned out to council meetings have forced towns to question their contracts — some cities, unsure how to cancel, have literally thrown trash bags over the cameras. Groups like the EFF, ACLU, and Institute for Justice have active campaigns and model policies.
Remember: the maker of one of these systems already backed down once, because a journalist shined a light and people pushed. Sunlight and local pressure have a track record here that no Bluetooth toggle ever will.
The question worth carrying
We were told these cameras were fine because they only read your plate, and a plate is public. So here's the question worth carrying the next time one's approved in your town: what's the smallest piece of information a system needs before it stops being about your car and starts being about you?
The answer turns out to be a wireless address your earbuds shout into the open air a few times a second. You're broadcasting several of them right now. The line between watching the car and watching the person was never a wall — it was a single sensor. And a company just shipped it.
This piece expands on a segment from Episode 58 of the Closed Network podcast. Reporting on SignalTrace and police misuse of Flock by Joseph Cox and Jason Koebler at 404 Media. Stay curious, and stay closed.