Flock is continuing to face public ire over the ways that its national network of license plate readers can be used and abused in the US, but there’s bad news for anyone worried about their personal privacy and widespread surveillance: technology that’s even more concerning is on the way.
That tech is SignalTrace from security company Leonardo, a system that takes the license plate reading approach of Flock and raises the sophistication a notch. SignalTrace scanners can identify the types of devices that are in a car as it passes by, and link them to a person even if the license plate number isn’t visible.
So, for example, a car of interest to the police might have an iPhone, an Audi stereo, and a pair of Bose headphones in it. The next time that specific combination of devices is detected on the SignalTrace network, an alert can be sent to law enforcement.
While the technology hasn’t yet been broadly deployed, security researchers are already asking questions about the potential implications and the possibility of innocent members of the public getting caught up in investigations. Here’s how the technology works and what might happen next.
How SignalTrace works
Virtually every electronic device you use is broadcasting some kind of Bluetooth or Wi-Fi information. It’s how your phone stays connected to cell towers, how your fitness tracker syncs stats back to the web, and so on. SignalTrace scanners work in addition to license plate reader cameras to catch these signals and interpret them.
Over time, the system sifts through combinations of these devices (which will typically include some of the electronics in your car too), to figure out which gadgets regularly travel in a vehicle together, suggesting the same people are inside. That gives law enforcement a way to monitor where a vehicle is and when over time, and more information about who is actually in the vehicle too.
“Algorithms can determine which specific mix of devices are predictably moving together,” explains Leonardo on its website. “That specific mix of devices — linked by common time stamps and locations — are described as an electronic fingerprint and can help develop leads that aid investigations.”
It’s a little bit like the browser fingerprinting techniques that websites use. Even if they don’t know your name or where you live, they might be able to tell from your time zone, browser version, operating system, screen resolution, and other system characteristics that you’re the same individual who visited yesterday.
Understandably, given the current debate around Flock and its license plate scanners, Leonardo goes to great lengths to emphasize that its technology is beneficial for the public and a useful tool for police investigators. The system doesn’t identify people (on its own, anyway), or read any information that’s on a device.
The company also shifts some of the responsibility for SignalTrace’s use on to the customers who actually sign up to use it — and those customers will be bound by Local, State, and Federal laws. “Information produced by SignalTrace may be corroborated through traditional investigative methods and is not a substitute for evidence,” says Leonardo in the SignalTrace documentation.
The potential implications
SignalTrace was announced last year, and so security and privacy experts are still looking into how the technology works and what it might mean for citizens. There are indications that it might be live in one or two spots in the US, but really it’s just getting started — this is in no way comparable to the scale of Flock’s operations (yet).
Digital technology researcher Nicole Bennett, from Indiana University, is one of the experts that has shared some thoughts around SignalTrace. Writing for The Conversation, she says the concerns around the technology — as with Flock’s cameras — are around how these systems might be misused and expanded, and the biases they could introduce.
Even if the technology isn’t identifying individuals, however, there might not be much extra work to do to make a connection to someone — based on a home or workplace that a vehicle is often spotted close to, for example. Bennett points to a study in Scientific Reports that found that just four time-and-place logs were enough to uniquely identify 95 percent of a study group of 1.5 million people (that is, telling one person from another, not revealing their private information).
Anonymized location data taken from phones can also build up a network of friendship groups without any other information, a study published in PNAS has shown. While these studies were carried out way before SignalTrace appeared, they show the picture that can be built up about someone using ‘anonymized’ data, if it’s unique enough.
“What SignalTrace shows is a broader change in surveillance practice,” writes Bennett. “Investigators may no longer need to begin with a known person or vehicle. Instead, they can begin with recurring patterns of movement and proximity, then use other records to identify the people connected to them.”
Unfortunately, if the police in your area decide to deploy this technology, there’s not much you can really do to avoid it — except maybe leaving most of your gadgets at home. The best way to fight back against it might be to make your feelings known to your local police force and political representatives before the tech makes its way to your area.
