Every time you drive past one of those pole-mounted cameras, your plate gets logged. Location, time, date. That part isn’t new. But a product called SignalTrace, built by Leonardo’s ELSAG brand, reportedly adds something to that transaction: your phone, your smartwatch, your wireless earbuds — anything broadcasting a surveillance app inside your car gets catalogued too.
This isn’t a prototype sitting in a lab. SignalTrace is a marketed add-on for existing ALPR systems, purportedly already installed in Oxon Hill, Maryland, and listed on a New York state contract price list. Law enforcement agencies are the target customers.
“Anonymous” Data Stops Being Anonymous Fast
The gap between “we didn’t collect your name” and “we can identify you anyway” is smaller than most people realize.
Leonardo’s defense is straightforward: SignalTrace captures electronic signatures from signals your devices are already broadcasting — Bluetooth, RFID — and doesn’t identify anyone by name. Investigators, the company says, must corroborate results through ordinary means.
That argument sounds reasonable until you look at what researchers have actually found. A Scientific Reports study of 1.5 million people determined that just four time-and-location data points were enough to uniquely identify 95% of them. Your name doesn’t need to appear anywhere in the dataset. A parallel case of secretly tracking users reinforces just how little data anonymity truly offers.
Here’s what SignalTrace reportedly does in practice:
- Captures Bluetooth, RFID, and other broadcast signals from phones, wearables, and devices inside passing vehicles
- Links those device signatures to license plate records, timestamps, and locations
- Identifies patterns: recurring movement, device relationships, convoy behavior
- Builds investigative leads without requiring a known suspect at the start
- Sits in legal gray territory — Carpenter v. United States and the June 2026 Chatrie v. United States decision both show courts scrutinizing location and movement records, though roadside signal capture hasn’t been clearly ruled on
NIST’s privacy framework is blunt: personally identifiable information is any data that can distinguish or trace a person, alone or combined with other sources. Your device signature plus your plate plus your home address equals you — whether or not anyone typed your name.
From Suspect-First to Pattern-First Policing
The more consequential change here isn’t technical — it’s how investigations get started.
Systems like SignalTrace move policing from “we have a suspect, let’s find their movements” toward “here’s a recurring device pattern — who does it belong to?” You become a subject of interest before anyone decides you’re interesting. Civil liberties organizations have raised similar concerns about earlier ALPR expansions, and the addition of device-proximity data sharpens that argument considerably.
It’s the surveillance equivalent of being shadow-profiled: built from signals you never knowingly shared, assembled into a pattern you didn’t know existed.
Already Priced, Not Yet Everywhere – But the Gap Is Closing
The distance between “not standard practice” and “on a state contract price list” is shorter than it should be comfortable to admit.
SignalTrace isn’t standard police practice yet. The rollout appears limited and the legal framework remains unsettled. Communities pushing back on similar infrastructure have highlighted a real Flock Problem with how these systems expand before oversight catches up.
But it’s already priced and contracted. That’s not a research lab. That’s procurement infrastructure waiting for broader adoption.
Every time your phone completes a Bluetooth handshake with a device you didn’t notice, you’re broadcasting. Roadside infrastructure is increasingly built to listen. The question isn’t whether your devices talk in public. It’s who has been collecting the conversation — and what they plan to do with it next.
