Not Just License Plates: They’re Going to Track So Much More - YouTube
A defense contractor's new surveillance system pairs roadside cameras with Bluetooth, Wi-Fi, and RFID scanners to build a dossier on every driver—and every passenger—who passes by. No warrant required.
Bottom Line Up Front
Italian defense giant Leonardo is marketing a system called ELSAG SignalTrace that bolts wireless-signal sensors onto existing license plate reader cameras, silently harvesting the Bluetooth IDs, Wi-Fi signatures, RFID tags, and other electronic identifiers broadcast by every phone, wearable, infotainment system, access badge, and pet microchip in range of the roadside unit. The data is fused with license plate images and stored in a corporate database, queryable by law enforcement at will and without a warrant under current federal law. SignalTrace works in rail stations and shopping centers as well as roadsides—meaning it can track pedestrians, not just drivers. No federal statute explicitly governs this technology. Civil-liberties groups warn it represents the most significant escalation in mass surveillance infrastructure since license plate readers themselves were introduced, and real-world abuses of the existing plate-only system—including documented use against a woman who had an abortion—illustrate exactly what is at stake.
The Technology: From Plate to Profile
For more than a decade, automated license plate readers (ALPRs) have been a fixture of American roads. These high-speed cameras photograph passing vehicles, convert the plate number to machine-readable text, stamp it with a time and location, and upload it to a searchable database. Widely used by local police, border agents, and parking enforcement, ALPRs have become the backbone of a nationwide vehicle-tracking infrastructure. According to the Electronic Frontier Foundation's Atlas of Surveillance, more than 1,800 law enforcement agencies have deployed ALPRs, and at least 4,000 agencies can run searches through the commercial ALPR network maintained by one major vendor alone.
Now that infrastructure is being upgraded in a way that changes the nature of the surveillance entirely. Leonardo US Cyber and Security Solutions—the American arm of Leonardo S.p.A., an Italian defense and aerospace conglomerate with a market capitalization exceeding €29 billion—is actively marketing a product called ELSAG SignalTrace that turns a roadside plate camera into something far more ambitious: a passive signal-intelligence node capable of harvesting the electronic identifiers broadcast by every wireless device within range.
According to Leonardo's own product sheet and website, SignalTrace integrates with the company's existing ELSAG ALPR cameras and its back-end Enterprise Operations Center (EOC) software. In addition to reading license plates, an equipped sensor collects the unique identifiers emitted by mobile phones, Bluetooth-enabled wearables such as smartwatches and wireless earbuds, RFID-enabled items including workplace access badges, and even pet microchips. The system's algorithms then look for patterns: when the same cluster of device identifiers repeatedly appears alongside the same vehicle, SignalTrace links those devices to the vehicle's plate number and builds what the company calls an "electronic fingerprint."
— Leonardo ELSAG SignalTrace product sheet, 2025
That last phrase is telling. By correlating a vehicle's occupants with their devices, investigators can identify and track a person even if they switch cars, borrow a friend's vehicle, or deliberately obscure their plate. The car tracking a person; the person is now the tracking anchor.
Leonardo received a patent for the core technology underpinning SignalTrace in 2024. In its public patent announcement, the company described ELSAG EOC Plus as "an electronic detection system designed to help law enforcement identify people of interest by the signatures their electronic devices emit such as fitness trackers, RFID tags, and local signals from mobile phones." Leonardo's customers include police departments, border security agencies, and other government organizations across the United States. The company's U.S. arm also holds contracts with U.S. Special Operations Command and the General Services Administration.
Not Just for Roads: The Shopping-Mall Problem
One detail in Leonardo's public materials deserves particular attention. A bullet point in the company's product literature lists SignalTrace as "effective for use in off-road areas such as rail stations and shopping centers." That single phrase dissolves the assumption that this system is exclusively about tracking cars.
License plate readers, by their nature, require a vehicle. SignalTrace's sensor array does not. A unit placed at a train station entrance, inside a mall corridor, or at a sporting venue can harvest the same electronic fingerprints from pedestrians carrying phones and wearing smartwatches that a roadside unit harvests from drivers. Without a vehicle in the picture, the data would be correlated differently—but the signal collection is the same, and the stored identifiers are just as linkable to an individual's movements over time.
Leonardo's materials state that the system "stores device and correlation data securely in the EOC Enterprise Operations Center for future queries and analysis." In other words, even if no investigation is underway when you walk past a sensor, your device identifiers are logged and retained. "The SignalTrace system simply stores data until a specific request is made of the system by an investigator," the company's website states—framing passive, continuous collection of data on innocent people as a feature rather than a concern.
The Existing Plate-Reader Problem: Already Serious
To understand why SignalTrace represents an escalation, it helps to understand how badly the existing, plate-only ALPR infrastructure has already been abused.
In 2016 and 2017, EFF and the journalism nonprofit MuckRock obtained records from more than 200 law enforcement agencies representing over 2.5 billion license plate scans. The data showed that 99.5 percent of plates scanned were not associated with any suspected crime. On average, agencies shared that data with at least 160 other agencies. The EFF concluded that repeated plate captures at multiple points along a person's daily route were sufficient to establish what intelligence analysts call a "pattern of life"—revealing where someone lives, works, worships, receives medical care, and who their associates are.
That concern has since moved from theoretical to documented. In May 2025, a Johnson County, Texas sheriff's deputy used the nationwide plate-reader network maintained by Flock Safety—then comprising roughly 83,000 cameras across the country—to search for a woman who had self-administered an abortion. The search record stated plainly: "had an abortion, search for female." The officer queried 6,809 different camera networks, including cameras in states where abortion is legal, such as Washington and Illinois.
When the search was first reported by 404 Media, the Johnson County Sheriff and Flock Safety both denied it had anything to do with criminal investigation, claiming the search was a missing-person welfare check. Court records obtained by EFF in October 2025 told a different story: the case had been opened as a "death investigation" of a "non-viable fetus" on the same day the ALPR search was conducted, and deputies had consulted the District Attorney about whether the woman could be charged with a crime. The DA concluded charges were not possible under Texas law, but the investigation had proceeded for weeks, including review of the woman's text messages.
- Abortion investigation, Texas (2025): Johnson County deputies used Flock Safety's 83,000-camera network to search for a woman who had self-administered an abortion. Court records showed a criminal "death investigation" was open, contradicting public claims it was a welfare check.
- Protest surveillance (2025): EFF obtained audit logs showing hundreds of ALPR searches by police related to political demonstrations, including the 50501, Hands Off, and No Kings protests.
- Racially discriminatory searches: EFF documented more than 80 law enforcement agencies using racial slurs or ethnic stereotypes (targeting Romani people) in ALPR search queries, often without specifying a crime.
- School residency checks, noise complaints, background investigations: An EFF analysis of millions of Flock Safety searches found that, without a warrant requirement, agencies have used ALPR data "for virtually any whim."
- ICE immigration enforcement: Flock Safety data was used by U.S. Immigration and Customs Enforcement as part of the Trump administration's deportation program; the Illinois Secretary of State launched an audit after EFF research showed CBP was accessing Illinois data in violation of state privacy law.
- Officer stalking risk: The EFF's Street Level Surveillance project notes that individual officers have historically abused plate-reader access for personal reasons; a 1998 Washington, D.C. case involved an officer blackmailing patrons of a gay bar after looking up their plates.
The EFF's full-year 2025 investigation found that between June 2024 and October 2025, the San Jose Police Department and partner agencies searched San Jose's Flock database 3,965,519 times—all without warrants. That figure led EFF and the ACLU of Northern California to file a federal lawsuit against San Jose challenging warrantless ALPR searches. The suit remains pending.
Flock Safety itself has been expanding in ways that compound privacy concerns. The company has announced that police departments will be able to obtain not only still photos from plate cameras but also video, with live-feed and 15-second clip capabilities. It has also integrated with data brokers, allowing law enforcement to combine plate-reader sightings with commercial datasets about individuals—an arrangement critics call an "end-run" around the warrant requirements the Supreme Court has imposed on direct government surveillance.
The Legal Landscape: A Framework Built for a Simpler Era
Courts have generally held that ALPRs, as currently deployed, do not trigger Fourth Amendment warrant requirements. The key precedent is Carpenter v. United States (2018), in which the Supreme Court required a warrant for historical cell-site location information (CSLI) because it produced an "all-encompassing" log of a person's movements. Courts since then have consistently found that ALPR snapshots—discrete images at fixed locations—fall short of the Carpenter threshold. In Commonwealth v. Church, the Virginia Court of Appeals reversed a lower-court ruling that had required warrants for Flock data, holding that the technology does not require one. A 2025 federal district court ruling in Kansas reached the same conclusion.
But those rulings were written for plate-only ALPRs. SignalTrace is a qualitatively different system: it combines license plates with Bluetooth harvesting, Wi-Fi collection, RFID scanning, and persistent algorithmic correlation—stored indefinitely in a corporate database. Legal scholars and the courts themselves have recognized that the constitutional calculus may shift as the technology evolves. A concurring judge in the Ninth Circuit's United States v. Yang (2020) explicitly cautioned that "if the technology evolves in the way that amici hypothesize, then perhaps in the future a warrant may be required."
SignalTrace is precisely that evolution. No federal statute currently regulates mass Bluetooth or RFID harvesting from public spaces. State ALPR laws were written to govern plate-image collection; they say nothing about signal interception. As one analysis put it, SignalTrace sits in "a legal gray zone"—permitted not because legislators or courts have approved it, but because they had not yet imagined it when existing rules were written.
The Electronic Communications Privacy Act of 1986 (ECPA), which governs interception of electronic communications, contains an exception for signals "readily accessible to the general public." Leonardo's defense—that SignalTrace merely captures "device frequencies emitted into the air" and "does not decrypt or capture the contents of the devices or their communications"—appears calibrated to fit within that exception. Whether courts will agree that passively harvesting a device's unique identifiers, linking them to a person, and retaining them indefinitely amounts to something more than reading a publicly broadcast signal is an open question that will almost certainly reach the federal courts.
Security Vulnerabilities in the Existing Infrastructure
Whatever the legal status of ALPR data, the security of that data once collected is a distinct and serious concern. In June 2024, the Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory identifying seven vulnerabilities in one major brand of ALPR camera systems, including missing encryption and insufficiently protected credentials. Security researchers have demonstrated the ability to access massive ALPR datasets and live-broadcast camera feeds. A 2025 Virginia State Crime Commission report found systemic non-compliance with the state's own ALPR data rules: 13 percent of agencies admitted granting out-of-state entities continuous access to their data; 6 percent had given the federal government continuous access; and 35 percent failed to implement required public notice measures.
One in ten ALPR readings contain an error, according to a study cited by the ACLU of Iowa in its December 2025 statewide ALPR survey. Those errors have real consequences: people have been stopped by police at gunpoint due to incorrect plate reads. Adding wireless device harvesting to this error-prone foundation does not reduce the risk of mistaken identification; it compounds it.
What You Are (and Are Not) Broadcasting
To understand what SignalTrace can actually capture, it helps to know what your devices broadcast without your active knowledge. Bluetooth Low Energy (BLE) devices—which include most modern smartphones, smartwatches, wireless earbuds, AirTags, and tire pressure monitoring systems—continuously advertise their presence to nearby devices. While Apple introduced MAC address randomization to reduce trackability, research has documented that randomization is imperfect; other identifiers (including certain BLE advertising payloads) can persist across randomization cycles and allow consistent re-identification of a device. Wi-Fi probing, in which a device searches for familiar networks, similarly broadcasts identifiers. RFID chips embedded in workplace access badges, transit passes, and pet microchips emit a fixed identifier when queried by a nearby reader.
Leonardo's disclaimer—that the system does not read the content of communications—is technically accurate but practically misleading. The content of your phone calls is not what creates a surveillance dossier. What creates a dossier is the persistent association of your device's unique identifiers with specific locations at specific times: the oncologist's office on Tuesday, the political meeting on Thursday, the border crossing on Saturday. That pattern of presence, not the content of your conversations, is the intelligence product.
What You Can Do
Individual technical countermeasures offer limited protection. Disabling Bluetooth reduces your exposure to BLE harvesting, but many vehicle infotainment systems re-enable Bluetooth automatically on restart, and tire pressure monitoring systems broadcast continuously without any user-accessible off switch. Leaving your phone at home eliminates that signal, but not the RFID in your access badge or transit card. Turning off Wi-Fi reduces probe-request broadcasts, but does not eliminate them on all devices. MAC address randomization, while helpful, is not a complete solution given the state of current research on BLE fingerprinting.
More durable protections require policy action:
- Attend public meetings. Local governments typically vote on ALPR contracts; municipalities from Austin to Evanston to Eugene have canceled or declined Flock Safety contracts following organized community opposition. Your city council members are elected officials who are legally obligated to hear from constituents.
- Contact state legislators. Ask them to extend state ALPR data-protection laws to cover wireless signal harvesting, to require warrants for database queries, to mandate data minimization and short retention periods, and to prohibit cross-agency and cross-state data sharing without judicial oversight.
- Support federal legislation. The Fourth Amendment Is Not For Sale Act, which would ban law enforcement from purchasing location data from brokers without a warrant, passed the House in 2024 but was blocked in the Senate. Urge your senators to support warrant requirements for commercial surveillance data.
- Reduce your wireless footprint where practical. Disable Bluetooth when not in active use. Use a Faraday sleeve for RFID-enabled badges when not needed. Understand that these steps reduce but do not eliminate your exposure.
- File public records requests. Organizations like EFF and MuckRock have published guides to requesting ALPR audit logs from your local police department. These logs have been the foundation of every major documented abuse case.
The core issue is structural. Mass surveillance infrastructure, once deployed, does not remain confined to its original stated purpose. Systems sold for stolen-car recovery are used to investigate abortions. Systems designed for criminal suspects are queried in noise-complaint investigations. Systems marketed to local police are accessed by federal immigration enforcement. The pattern is consistent and well-documented. Adding a wireless device-harvesting layer to a nationwide network of roadside sensors—and extending that network into train stations and malls—does not change that pattern. It accelerates it.
"When a single search can access more than 83,000 cameras across nearly the entire country," EFF legislative activist Rin Alajaji observed in October 2025, "the potential for abuse is enormous."
SignalTrace is that same network, upgraded to also know who is in every car.
Verified Sources
-
[1]
Leonardo US Cyber and Security Solutions. ELSAG SignalTrace — Integrated Signal Intelligence Platform (product page). Leonardo Company US, 2025.
https://www.leonardocompany-us.com/lpr/elsag-signaltrace -
[2]
Ismail, Adam. "License Plate Cameras Will Soon Track Phones, Wearables, Infotainment, and Even Your Pets." The Drive, June 2026.
https://www.thedrive.com/news/license-plate-cameras-will-soon-track-phones-wearables-infotainment-and-even-your-pets -
[3]
"Leonardo's SignalTrace Could Let Police Plate Readers Track Your Devices." The Deep Dive, June 2026.
https://thedeepdive.ca/leonardo-signaltrace-alpr-device-tracking/ -
[4]
"License Plate Readers Move Beyond Plates to Track Phones, Wearables, and Pet Microchips." SOFX, June 2026.
https://www.sofx.com/license-plate-readers-move-beyond-plates-to-track-phones-wearables-and-pet-microchips/ -
[5]
Guariglia, Matthew. "New ALPR Vulnerabilities Prove Mass Surveillance Is a Public Safety Threat." Electronic Frontier Foundation Deeplinks Blog, June 19, 2024.
https://www.eff.org/deeplinks/2024/06/new-alpr-vulnerabilities-prove-mass-surveillance-public-safety-threat -
[6]
Maass, Dave and Beryl Lipton. "Data Driven: Explore How Cops Are
Collecting and Sharing Our Travel Patterns Using Automated License
Plate Readers." Electronic Frontier Foundation, updated April 2021.
https://www.eff.org/pages/automated-license-plate-reader-dataset -
[7]
Electronic Frontier Foundation. "Automated License Plate Readers (ALPRs)." Street Level Surveillance, updated October 1, 2023.
https://sls.eff.org/technologies/automated-license-plate-readers-alprs -
[8]
Guariglia, Matthew, et al. "More License Plate Reader Mission
Creep: School Residency Verification, Background Checks, and Noise
Complaints." Electronic Frontier Foundation Deeplinks Blog, May 2026.
https://www.eff.org/deeplinks/2026/05/more-license-plate-reader-mission-creep-school-residency-verification-background -
[9]
Maass, Dave, and Rindala Alajaji. "She Got an Abortion. So a Texas Cop Used 83,000 Cameras to Track Her Down." Electronic Frontier Foundation Deeplinks Blog, May 2025; updated October 7, 2025.
https://www.eff.org/deeplinks/2025/05/she-got-abortion-so-texas-cop-used-83000-cameras-track-her-down -
[10]
Maass, Dave, and Rindala Alajaji. "Flock Safety and Texas
Sheriff Claimed License Plate Search Was for a Missing Person. It Was an
Abortion Investigation." Electronic Frontier Foundation Deeplinks Blog, October 2025.
https://www.eff.org/deeplinks/2025/10/flock-safety-and-texas-sheriff-claimed-license-plate-search-was-missing-person-it -
[11]
Electronic Frontier Foundation. "EFF's Investigations Expose Flock Safety's Surveillance Abuses: 2025 in Review." EFF Deeplinks Blog, January 2, 2026.
https://www.eff.org/deeplinks/2025/12/effs-investigations-expose-flock-safetys-surveillance-abuses-2025-review -
[12]
American Civil Liberties Union. "Flock's Aggressive Expansions Go Far Beyond Simple Driver Surveillance." ACLU.org, August 18, 2025.
https://www.aclu.org/news/privacy-technology/flock-roundup -
[13]
Schneier, Bruce. "Enhanced License Plate Tracking." Schneier on Security, June 2026.
https://www.schneier.com/blog/archives/2026/06/enhanced-license-plate-tracking.html -
[14]
Flock Safety. "Automated License Plate Readers and the Fourth
Amendment: A Public-Safety-by-Design Perspective from Flock." Flock
Safety White Paper, November 2025.
https://www.flocksafety.com/blog/automated-license-plate-readers-and-the-fourth-amendment-a-public-safety-by-design-perspective-from-flock -
[15]
ACLU of Iowa. "Automatic License Plate Reader Report Raises
Concerns About Expansion of Government Surveillance in Iowa." Press
release, December 16, 2025.
https://www.aclu-ia.org/press-releases/automatic-license-plate-reader-report-raises-concerns-about-expansion-of-government-surveillance-in-iowa/ -
[16]
Carpenter v. United States, 585 U.S. 296 (2018). U.S. Supreme Court. Warrant requirement for historical cell-site location information.
https://www.supremecourt.gov/opinions/17pdf/16-402_h315.pdf -
[17]
United States v. [Defendant], No. 2024cr10010-48, U.S.
District Court for the District of Kansas (May 30, 2025). ALPR Fourth
Amendment analysis under Carpenter.
https://ecf.ksd.uscourts.gov/cgi-bin/show_public_doc?2024cr10010-48+= - [18] Cybersecurity and Infrastructure Security Agency (CISA). Advisory on ALPR camera system vulnerabilities. U.S. Department of Homeland Security, June 2024. (Summarized in Style Weekly, June 2026.)
-
[19]
Samples, Jackson. "Barcoding Bodies: RFID Technology and the Perils of E-Carceration." 23 Duke Law & Technology Review 89–113 (2024).
https://scholarship.law.duke.edu/dltr/vol23/iss1/4/ -
[20]
"It's Time to Turn Off the Flock Safety Cameras." Style Weekly (Richmond, VA), June 2026. Includes Virginia State Crime Commission compliance data and CISA advisory summary.
https://www.styleweekly.com/its-time-to-turn-off-the-flock-safety-cameras/ -
[21]
"Surveillance Cameras Now Track Phones, Smartwatches, and Pet Microchips Alongside License Plates." Georgia Record, June 22, 2026. (Includes summary of Leonardo's 2024 patent announcement and product-sheet language.)
https://www.georgiarecord.com/business-ga/2026/06/22/surveillance-cameras-now-track-phones-smartwatches-and-pet-microchips-alongside-license-plates/ -
[22]
Electronic Frontier Foundation. "California Automated License
Plate Reader Policies." (Includes Flock Safety abortion-investigation
and SFPD inter-state data-sharing documentation.)
https://www.eff.org/pages/california-automated-license-plate-reader-policies

