A roadside sensor that pairs phone signals with license plates — and the vendor's claim that it "does not identify people"

Leonardo's SignalTrace logs the Bluetooth and RFID signatures traveling past a plate reader, then makes the pattern searchable. Documented installations so far: Oxon Hill, Maryland, and a New York state price list.

The pitch for the next generation of roadside surveillance does not start with a name, a plate or a suspect. It starts with the cloud of signals a car carries past a camera: a phone, a smartwatch, a tire pressure sensor, an RFID tag. According to an analysis published by Ars Technica, written by Indiana University geography PhD candidate Nicole M. Bennett and republished from The Conversation, a system called SignalTrace is built to log those signals, notice which devices keep traveling together, and tie the cluster to license plate records and time-stamped locations.

The product is marketed by the security company Leonardo and designed to work alongside automatic license plate readers. Per the write-up, the company says the system can recognize groups of consumer devices that regularly move as a unit, and that the resulting pattern can be searched even when an investigator does not know the plate number. Leonardo's product page says the system stores electronic fingerprints for later queries and can recognize a vehicle without seeing its plate. A separate product sheet says the technology helps identify suspects through the mix of devices they carry. The patent behind it describes targets that may be people or vehicles, and searchable signatures that can be correlated with visual identifiers and used to track a target across locations.

What the company says it is not doing

Leonardo's explanatory sheet, as quoted in the piece, states that SignalTrace "does not identify people." It says the system "only collects electronic signatures" from signals that devices are already broadcasting, such as Bluetooth or RFID, and that any output must be corroborated through ordinary investigative methods.

Bennett's argument is that this rests on a narrow definition of identity. A sensor may not pull a legal name out of a phone, but a signal that repeatedly appears beside a car registered to one person, or outside that person's home, or next to a device already tied to a known subject, can be worked back to an owner using records police already hold.

Federal guidance supports the point. The National Institute of Standards and Technology defines personally identifiable information as data that can distinguish or trace a person's identity either alone or combined with other linkable information — the test being whether data can single someone out and follow them over time. A study in Scientific Reports cited in the analysis examined 15 months of mobility records covering 1.5 million people and found that four time-and-place points were enough to uniquely identify 95 percent of them. That study did not test SignalTrace.

Proximity as a lead

The second issue is association. A recurring cluster of devices might be a family, a carpool, or people who attended the same protest; the sensor observes only that they were near each other. A Proceedings of the National Academy of Sciences study described in the piece followed 94 participants whose phones recorded Bluetooth proximity and calling patterns, and correctly classified 95 percent of reciprocally reported friendships, with off-hours proximity doing much of the work. SignalTrace uses a different method, and Bennett notes that no independent study has shown comparable performance for it.

On the law, the analysis points to Carpenter v. United States, in which the Supreme Court found a reasonable expectation of privacy in the record of a person's physical movements, and to the court's June 2026 decision in Chatrie v. United States, which held that obtaining location data was a Fourth Amendment search and observed that even short-term monitoring can expose political and family associations. Chatrie involved stored location records rather than signals detected off nearby devices, and the ruling does not settle whether collecting those broadcasts is a search.

The Southern California question stays open

Bennett describes SignalTrace as "a tested and marketed capability, but not yet an established police practice." The only deployments the Ars Technica piece identifies are several devices reported installed in Oxon Hill, Maryland, and a predecessor technology appearing on an official New York state contract price list. It does not address whether any agency in Los Angeles County or elsewhere in California has bought or tested the system — a question that would be answered by purchase orders, device inventories and the surveillance usage policies California agencies are required to publish.