SignalTrace units have been spotted in Oxon Hill, Maryland, according to a security researcher. The system can link some device signals with plate-reader data and vehicle movements. Its limitations today don’t mean its surveillance potential will stay limited. Over a month ago, we told you how Leonardo SignalTrace could soon tie your phone, pet, and AirPods to images captured by license plate readers. Now, new reporting says installations are already operating in Oxon Hill, Maryland, for Prince George’s County Police. It also highlights an important caveat. SignalTrace might not be as potent as its own marketing and early fears imply. That doesn’t make it benign. What SignalTrace Actually Does SignalTrace isn’t a plate reader itself. Leonardo says its sensors capture publicly emitted Wi-Fi, Bluetooth, and other electronic signals, matching devices that routinely travel together into an “electronic fingerprint.” When an ALPR camera is present, that bundle can be correlated with a plate number, time, and location. In theory, that lets investigators recognize a car even when its plate is unknown. Read: How Las Vegas Installed A Massive Flock Camera Network Without Asking You Consultant Ryan O’Horo tells The Drive that he’s identified several apparent Maryland installations and says they’re the only real-world deployments he knows about. His technical review also puts pressure on some of Leonardo’s more spectacular claims. Devices don’t continuously broadcast stable, identifiable data, and their transmissions occur across different channels. A sensor must be listening at the right time and frequency. That makes typical TPMS sensors and pet microchips a difficult sell. O’Horo says SignalTrace’s flat-panel antenna likely can’t receive the radio frequencies used by most tire-pressure sensors, and pet microchips are generally read from just centimeters away. A Bluetooth pet collar, phone, or set of wireless headphones is much more plausible. Anonymous Isn’t Anonymous Still, as Ars Technica notes, a device signature doesn’t need to include your name to become identifying. Repeatedly linking the same phone or watch to a registered vehicle, a home, and other devices can turn a supposedly anonymous pattern into an investigative lead. That could implicate passengers, relatives, coworkers, or people who simply appear near someone under investigation. A 2013 mobility-data study cited by Ars found that four time-and-place points could uniquely identify 95 percent of 1.5 million people in its dataset. A recent Supreme Court decision also adds a fresh wrinkle. It held that police acquisition of Google location records through a geofence warrant is a Fourth Amendment search. SignalTrace is different because its sensors collect broadcast signals directly, so the ruling currently doesn’t settle the question. It does show the courts are becoming less willing to treat supposedly anonymous location information as harmless. For now, SignalTrace doesn’t look like an all-seeing roadside vacuum. Wi-Fi and Bluetooth tracking alone, though, can be questionable to privacy advocates. On top of that, technology like this doesn’t usually become less capable as it matures. Better antennas, more sensors, and smarter processing could erase some of today’s limitations. Photos: Leonardo
