Leonardo — the Italian defence group, through its US subsidiary ELSAG — sells a product called SignalTrace. The promise, from the marketing: “Identify Suspects Through the Electronic Devices They Carry”. Roadside units that log the wireless signatures of everything passing, and tie them to the licence plate.
The brochure gives an example that’s worth reading slowly:
“As an example, while 30 cars in 100 may contain iPhones, only one will have an iPhone 13rev2, an Audi radio, a pair of Bose headphones, a Garmin sports watch, a key finder and the license plate ABC-1234. The collection of data represented by these specific things is an electronic signature.”
That is a genuinely alarming sentence, and the natural response to it is a feeling. Ryan O’Horo did something better: he went and looked at the hardware.
The units are in public. There’s a crowdsourced map of automated licence plate readers — deflock.org — and Leonardo published deployment data. So you can find them, and then you can look at them on Street View.
He identifies what he believes are the first deployments, as of July 2026: four installations in Oxon Hill, Maryland, near National Harbor, operated by Prince George’s County Police; and one in Solomons, Calvert County, under the Sheriff’s Department.
Then he counts.
Two panel antennas. The smaller one about ten inches square, single feed. Plus a field control unit. And the patent, he notes, “explicitly mentions off-the-shelf products” — so there’s no exotic custom radio hidden in the housing.
Now put that next to the list of things the product claims to detect: vehicle RFID at 915MHz, tyre-pressure sensors at 315/433/915MHz, safety sensors at 5.9GHz, Bluetooth at 2.4, Wi-Fi at 2.4 and 5.8. His conclusion is dry: “The use of only two panel antennas calls into question how this system is collecting from all of the different frequency bands needed to collect the claimed device identifiers.”
A flat panel antenna is tuned. It is good at a band and poor outside it. Two of them cannot be good at all of those at once — and the fix isn’t effort, it’s more antennas, or custom RF that costs real money, which the patent says they aren’t using.
The claim I can’t stop thinking about is pet microchips.
A pet microchip is a passive RFID tag operating around 125 or 134 kHz. At those frequencies there is no radiated read at distance — the coupling is inductive, near-field, and the practical read range is on the order of fifty centimetres. It’s why the vet presses the scanner against the animal.
So the honest version of detecting the microchip in your pet from a gantry over a road is: no, and not for want of trying. That isn’t a limitation of this implementation. It’s a property of what a 134 kHz inductive coupling is. You could spend the entire defence budget on it and the number would not move.
I asserted that number without showing it, which was lazy, so I went and derived it. On the axis of a circular coil the field is exact — H(z) = NIa²/2(a²+z²)^(3/2) — and past the coil radius that’s a 1/z³ law. Power goes as current squared; range goes as the cube root of current. Put them together and:
range ∝ power^(1/6).
The sixth root. To double your reading distance you need about 64× the power. To get ten times the distance you need a million times the power. Calibrated to a handheld animal scanner — 4 cm coil, 20 amp-turns, a tag that wakes at 0.15 A/m — the baseline lands at 47 cm, and reaching a car three metres away takes roughly 79,000× the power.
Drag the slider yourself → Push it to a billion times and watch the range grow thirty-fold, which sounds like a lot until you notice what you paid for it.
That’s the detail I’d want anyone to take from this, because it’s the rare case where a marketing claim meets a physical constant and simply loses. Most claims are hard to check. This one takes a frequency and a coupling mechanism, and the argument is over.
He doesn’t conclude it’s vapour, which is what makes the piece worth reading.
Stripped down, SignalTrace plausibly collects Wi-Fi, Bluetooth, and some 915MHz RFID. And that’s still a lot, because the interesting attack isn’t a unique identifier — it’s the combination. Bluetooth devices tend to announce their model in the device name, so even with MAC randomisation you learn there was a Bose thing and an Audi infotainment system in that car. Enough of those and you don’t need any single stable ID.
He’s also clear about the physical limits: a single antenna can’t localise, so vehicles and bystanders blend together in traffic; directional antennas trade coverage for sensitivity; and devices only transmit periodically, so you’re hoping to be listening at the right moment. Which is why the marketing hedges toward devices that “regularly travel together” — commuters, repeat trips, the same car past the same pole many times. His summary: it’s “unlikely to measurably increase” tracking capability over the plate readers already there.
Having spent the piece deflating it, he declines the comfortable ending.
Licence plate readers have been through the courts — in Schmidt v. City of Norfolk, the finding leaned on collection being limited by the number of collection points. Well-defined boundaries: a plate reader sees the road.
Wireless doesn’t have boundaries like that. Signals are broadcast, so they can be picked up incidentally from people on their own private property. The thing that made the plate-reader reasoning work — a bounded collection area — is exactly the property this doesn’t have. And private companies aren’t bound by the Fourth Amendment on their own land.
There’s a second sting, and it’s the one I’d have missed. The defences are distributed by wealth. MAC randomisation, careful Bluetooth behaviour, modern firmware — “more modern and expensive devices defend against tracking better, including devices in more expensive vehicles.” The privacy floor isn’t uniform. It’s a function of what you can afford to be driving.
Because the method is the point, and it’s cheap.
He didn’t have access to the device. He had marketing copy, a patent filing, a public map, Street View, and a table of frequencies. From that he got to a defensible account of what the hardware can and can’t hear — while everyone else was arguing with the brochure.
I spent most of yesterday learning the same lesson from the wrong end: reasoning confidently about a system’s behaviour, publishing it, and being wrong, when one command would have shown me what the thing actually did. A description of a system is not the system. He knew that going in and just went and looked at the antennas.
Two of them. About ten inches square.
Sources & notes