Automated license plate readers have spent the last decade telling worried drivers that they only care about the plate. That argument just got a lot harder to make. Leonardo, the Italian aerospace and defense contractor that also sells surveillance hardware to police departments and federal agencies across the United States, has started marketing an upgrade called SignalTrace that turns existing plate reader cameras into something closer to a personal tracking system.
The pitch to law enforcement customers is straightforward. A camera that only reads plates misses a lot of context: stolen plates, swapped plates, rental cars, and vehicles that slip through because a clerical error kept them off a watch list. SignalTrace is meant to close that gap by pairing every vehicle a camera photographs with the wireless signals coming from everything inside it, including phones, Bluetooth earbuds, smartwatches, fitness trackers, tire pressure sensors, employee access badges, and even pet microchips.
What SignalTrace Actually Captures
The sensor attaches to ALPR cameras already installed along roads, highways, and parking lots. As a vehicle passes, it doesn’t just photograph the plate. It also listens for the low power radio chatter that modern devices constantly broadcast: Bluetooth beacons from headphones and watches, WiFi probe requests from phones searching for known networks, and signals from in-car infotainment systems and hotspots.
Each of those broadcasts includes a hardware identifier. On its own, one identifier tells you almost nothing. But when the system logs the same cluster of identifiers riding past dozens of cameras alongside the same plate, over weeks or months, it can build what the company calls an electronic fingerprint tied to that vehicle and, by extension, to the people who regularly ride in it. Swap the plate, and the fingerprint keeps working. Sell the car, and the new owner’s devices eventually replace the old pattern.
The Privacy Protection It Is Designed to Defeat
This is the part that should bother anyone who has read a phone privacy label in the last few years. Apple, Google, and most Bluetooth accessory makers already rotate the hardware addresses their devices broadcast, specifically so that a stranger with a receiver can’t quietly follow you around a parking lot or a mall. That rotation, often called MAC address randomization, is supposed to make long term tracking by a passive listener effectively useless.
SignalTrace’s answer is correlation rather than brute force. Instead of relying on one identifier staying constant, the system watches for clusters of signals that keep showing up together at the same times and places as a particular plate. Randomizing one address doesn’t help much if your phone, your earbuds, and your watch all change together and keep appearing as a group next to the same car, at the same commute times, week after week. The safeguard was built to defeat a single nosy stranger with a scanner, not a nationwide camera network correlating months of location history.
Flock Already Tried This, and Walked It Back
Leonardo is not the first company to test this idea in public. Flock Safety, the dominant player in the ALPR market, quietly built a similar capability into a product called Nova before backing away after reporting exposed how the feature had been fed by data of questionable origin. That retreat came not long after Ring’s decision to scrap its own planned integration with Flock Safety once customers realized what a camera network built to find lost dogs could just as easily be used to find people. The pattern is becoming familiar: a company ships a tracking feature, the backlash arrives once someone explains what it actually does, and the company insists it was misunderstood.
The difference with SignalTrace is scale and pedigree. Leonardo is not a startup testing the waters. It is a defense contractor with existing relationships across US law enforcement and federal agencies, selling an add-on for hardware that is already deployed on streets in thousands of communities. There is no public list yet of which agencies have bought or piloted it, which means most drivers passing under an existing ALPR camera today have no way of knowing whether the upgrade is already active.
Why This Lands at a Tense Moment for License Plate Data
SignalTrace is arriving in the middle of a much bigger fight over who gets to use plate reader data at all. The FBI has been shopping for a way to pull vehicle location data in near real time from cameras spread across the country, rather than requesting records agency by agency. Flock is separately facing a class action in California accusing it of sharing residents’ movement data with out of state law enforcement in ways that state privacy law does not allow. Civil liberties groups have spent years warning that a technology sold as a tool against stolen cars and Amber Alerts has quietly become infrastructure for tracking anyone, including protesters, people visiting a clinic, or a person leaving a place of worship.
Add device fingerprinting to that mix and the stakes change. A plate can be swapped or removed. A phone rarely leaves your pocket. Mass retention of device to plate pairings does not just show where a car has been. It maps who was likely riding in it, whether they visited the same address every Tuesday, and whether their device showed up near a rally, a union meeting, or an attorney’s office.
What You Can Actually Do About It
There is no setting on your phone that fully defeats correlation based tracking once a network of cameras is in place, but a few things genuinely help. Turning off Bluetooth and WiFi when you are not actively using them shrinks the number of signals available to correlate in the first place. Hardened, privacy focused mobile operating systems go further by limiting background radio chatter and giving you more control over what gets broadcast at all, which is part of why Motorola’s decision to officially support GrapheneOS on its phones mattered to more than just the privacy enthusiast crowd.
It is also worth remembering that plate and device tracking is only half of the exposure most people carry around. Location patterns built from ALPR networks tend to get more dangerous when they can be matched against a name, a home address, and a workplace, all of which are often sitting in plain sight on data broker sites. Services that scrub that information will not stop a camera from logging your phone’s signal, but they do make it harder for anyone who obtains that data to turn it into a full profile.
The Bigger Picture
None of this requires a single new law to be broken. Broadcasting a Bluetooth signal in public is not illegal, and neither is photographing a license plate on a public road. That is exactly why the debate over ALPR networks keeps resurfacing every time a vendor pushes the technology one step further. Each individual capability sounds reasonable in isolation. Stacked together, across thousands of cameras and years of retained data, they add up to a surveillance system far more capable than anything most drivers assume they are dealing with when they see a camera on a pole.
Leonardo has not published a rollout timeline or a list of customers, and it is unclear how quickly SignalTrace will actually reach the street. But the underlying lesson from Flock’s abandoned Nova feature is that the technology tends to arrive quietly and only becomes a public conversation after it is already running. Given how much attention plate reader networks have drawn in the past year alone, this is unlikely to be the last time a security vendor tries to turn a camera built for cars into one built for people.
