A new surveillance system is being marketed to law enforcement agencies as a way to pair the signals emitted by everyday electronic devices with the data already captured by automated license plate readers. The system, called SignalTrace, is built by the security company Leonardo. According to the company, it does not decrypt or read the contents of phones, smartwatches, fitness trackers, RFID tags, or communications. Instead, it detects the fact that those devices are present and broadcasting, then uses timestamps and locations to determine which devices repeatedly appear together.

The pitch is that a vehicle can be associated with a cluster of electronics rather than a single phone. That cluster can become an electronic signature, a pattern that investigators could compare with the time and place of a crime. The idea is not to identify a person directly from a device, but to generate leads that police can follow up with traditional investigative work.

Key facts at a glance

• Automated license plate readers are already controversial because of how much personal information they collect and how that data can be misused.
• SignalTrace is designed to detect electronic signals from phones, smartwatches, fitness trackers, RFID tags, and similar devices.
• The company says the system does not decrypt or read device contents or communications.
• Sensors record device signals and correlate them with license plate data when it is available.
• Algorithms use timestamps and locations to work out which devices consistently travel together.
• A cluster of devices can form an electronic signature that is more distinctive than a single phone or vehicle.
• The data belongs to the law enforcement agencies that collect it, and the company says it will never access that data.
• Electronic signatures are stored until an investigator makes a specific query and could become a lead if a signature appears near a crime scene.
• A study of mobile phone location data found that four time-and-place points were enough to uniquely identify 95 percent of people in a data set covering 1.5 million people over 15 months.

What the system claims to do

The company describes SignalTrace as a tool for identifying suspect people or vehicles, not as a device-reading system. Its sensors pick up the wireless signals that consumer electronics give off in ordinary use. A phone may announce itself to a network, a smartwatch may maintain a connection, a fitness tracker may sync with a phone, and an RFID tag may respond to a reader. The system does not need to know what is inside those communications to notice that the devices are nearby.

That distinction is central to the company's defense of the product. If the system does not read messages, photos, contacts, or account data, it can be presented as less invasive than a tool that extracts content from a phone. But privacy researchers are likely to argue that the distinction matters less than the company suggests. Metadata about where devices go, when they appear, and which devices travel together can reveal a great deal even when the content of communications remains unread.

How electronic signatures are built

The system looks for combinations, not just individual devices. A single phone model may be common, but the same phone traveling with a particular car radio, a pair of headphones, a sports watch, and a key finder is far less common. The company has offered a hypothetical example: in a group of 100 cars, 70 might contain iPhones, but only one might contain a specific iPhone model, a particular car radio, a pair of headphones, a sports watch, and a key finder. That combination of signals becomes the electronic signature.

Algorithms then compare timestamps and locations. If the same cluster of devices keeps appearing together over time, the system can treat that cluster as a unit. When a license plate is captured at the same time and place, the device cluster can be correlated with the vehicle. Over repeated observations, the system can build a profile of which devices routinely travel with which cars.

What happens to the data

The company says the data belongs to the law enforcement agencies that collect it, and that the company itself will never access it. Once the scanners establish an electronic signature, the information is stored until an investigator makes a specific query. If investigators later spot that signature near a crime scene, it could become a lead in an investigation.

That model places responsibility for retention, access, and use on police agencies. It also means the rules governing the system will vary from one jurisdiction to another. Some agencies may have strict limits on how long data is kept and who can search it. Others may not. The absence of a single national standard could make oversight difficult, especially when agencies purchase systems from private vendors and store data in vendor-managed cloud environments.

Why movement data is so identifying

A study published in Scientific Reports examined 15 months of mobile phone location data covering 1.5 million people. It found that just four time-and-place points were enough to uniquely identify 95 percent of the people in the data set. That result is a warning about how easily movement patterns can single someone out, even when the data does not include names or message content.

License plate readers already create a record of where vehicles have been. Adding device signals to that record can make the picture more detailed. It can show not only that a car was in a certain place, but that a particular set of electronics was in the car at the same time. For investigators, that may be useful. For the public, it raises questions about how much of daily life is being recorded and how long those records persist.

The misidentification problem

There is another concern that is harder to solve with technical safeguards. Tying an electronic signature to the wrong person can happen easily, especially in connection with a crime. A device may be borrowed. It may be left in someone else's car. It may be stolen. A passenger may carry a phone while the driver carries none. A family member may use the same vehicle on different days.

None of the information gathered by SignalTrace can confirm who was actually carrying a device while driving a car on any given day. The system can show that devices traveled together. It cannot show who was behind the wheel, who owned the device at that moment, or whether the device was in the vehicle at all rather than nearby in a building or on a sidewalk. Police will need to figure out how to use electronic signature patterns and associations responsibly when identifying possible leads.

Operational and legal questions

The legal questions begin with probable cause and reasonable suspicion. A signal match may be treated as a lead, but it is not the same as eyewitness identification or forensic evidence. If an investigator uses an electronic signature to justify a stop, a search, or a request for more data, courts may ask whether the match was reliable enough to support that action. The answer will depend on how the system works, how often it produces false associations, and whether the agency can explain its limitations.

There are also questions about audit trails. Can a defendant challenge how a signature was generated? Can an independent expert review the algorithm? Are queries logged? Is there a record of which investigator searched for which signature and why? Without clear procedures, electronic signatures could become black-box evidence that is difficult to test in court.

The broader surveillance landscape

Automated license plate readers are already widespread. Estimates have put the number of one company's cameras alone above 100,000 in the United States, and agencies across the country use plate data for investigations. That growth has brought complaints about mass collection, retention, and misuse. In some cases, officers have been fired for misusing camera data.

SignalTrace would add another layer to that landscape. It would not replace license plate readers. It would work alongside them, turning wireless signals into another stream of location data. The result could be a more powerful investigative tool, but also a more complicated privacy problem. Each additional sensor creates more records, more opportunities for error, and more ways for data to be queried or shared.

What agencies will need to show

Agencies that adopt the system will need clear policies on retention, access, and sharing. They will need to explain how a signature becomes a lead, what corroboration is required before it is used against a person, and how errors are corrected. They will also need to address public trust. People are already skeptical of how license plate data is collected and used. A system that also detects phones, watches, and fitness trackers is likely to intensify that skepticism.

The company's claim that it does not read communications will not settle the debate. The relevant question is not only what the system reads, but what it records, how long it keeps it, who can search it, and what conclusions police draw from it. A device cluster can be distinctive without proving who was present. A signal can be useful without being conclusive. The difference between a lead and a false accusation will depend on the safeguards built around the system, not just the sensors that feed it.

Source:SlashGear News