Suppose you carpool to work with the same colleague every morning. When your car passes a license plate reader, the camera records the vehicle, and vehicle records can tie it to its registered owner. Alongside it, another sensor picks up signals from nearby devices on the move, such as your smartphone or your colleague's smartwatch.
After enough trips, the software may begin to treat some of those devices as a repeated electronic signature associated with that vehicle. Weeks later, one of those same device signals shows up again, this time alongside a different vehicle that is under investigation. The signal itself may not contain its owner's name, but its past association with a known vehicle gives investigators a new lead for working out who was carrying that device.
SignalTrace is a system sold by the security company Leonardo and designed to work with automatic license plate readers. According to the company, it can recognize groups of consumer devices that regularly travel together and link them to license plate records and timestamped location data. The pattern can be searched even when investigators do not know a license plate number.
I am a researcher who studies the intersection of data governance, digital technology and government involvement, including surveillance technology. I believe SignalTrace could push police investigative methods further toward focusing on people's movements and relationships before their identities are known.
SignalTrace is a demonstrated and marketed capability, but it is not yet an established police practice. According to one report, some of the devices have been installed in Oxon Hill, Maryland, and the company's predecessor technology appears on New York State's official contract price list.
License plate readers help police track vehicles, but they also raise serious privacy concerns.
"Identification" in a narrow sense
Leonardo's new explanatory sheet states that SignalTrace "does not identify people." According to the document, the system "only collects electronic signatures," derived from signals already being emitted, such as Bluetooth and radio frequency identification (RFID) tags. Those signatures do not, by themselves, reveal a person's identity. The company says its output must be corroborated through ordinary investigative methods.
But that description relies on a narrow meaning of the word "identity." A sensor may not pull a legal name directly from a phone, but police may be able to determine the device's owner by connecting the signal to other records. For example, the same signal might appear repeatedly with a vehicle registered to a particular person, be detected near that person's home, or show up with another device already associated with a known subject. In other words, even if police initially had no reason to suspect a person, the places where that device repeatedly appeared, and whom it was near, could pull that person into an investigation.
According to Leonardo's SignalTrace product page, the system stores electronic fingerprints for later queries and can identify vehicles without reading a license plate. Another product sheet says the technology helps identify suspects through the combination of devices people carry. The patent underlying the system describes the target as potentially a person or a vehicle. It also describes searchable signatures that can be correlated with visual identifiers and used to track a target across multiple locations.
SignalTrace may start with anonymous patterns, but its value comes from recognizing those patterns again and tying them to information police already hold. Once investigators link a repeating signature to license plate records and case files, the fact that the original signal contained no name offers little protection.
Even anonymous identifiers can be personal information
Federal privacy guidance does not limit identifying information to names. The National Institute of Standards and Technology (NIST) defines personally identifiable information (PII) as data that can distinguish or trace a person's identity, either alone or when combined with other linkable information. The key question is whether the data can single out a specific person and follow them over time.
Research on mobility data, meaning records collected from people's mobile devices showing where they have gone, helps illustrate the risk. One study published in Scientific Reports examined 15 months of records for 1.5 million people. Just four data points of time and place were enough to uniquely identify 95% of the people in the dataset. The study did not examine SignalTrace itself, but it shows why repeated movement patterns can make seemingly anonymous records distinctive.
The U.S. Supreme Court has already recognized that cellphone location records can reveal more than simple movements. In Carpenter v. United States, the court concluded that people have a reasonable expectation of privacy in the record of their physical movements.
The court extended that logic further in its June 2026 decision in Chatrie v. United States. Police investigating a bank robbery used a type of warrant to obtain anonymized location records for phones near the bank, narrowed the pool of subjects based on their movement patterns, and ultimately obtained the names of several users. The justices held that obtaining the location data was a "search" under the Fourth Amendment. They also noted that even short-term surveillance can reveal political, familial and other associations.
The ruling does not decide whether police collection of the wireless signals SignalTrace detects is similarly a "search." Chatrie concerned location records, whereas SignalTrace is designed to detect signals emitted by nearby devices. But the two technologies raise a related question: What Fourth Amendment protections apply when police start from an unidentified device and use its movements to work out who may be connected to an event or to another person?
When proximity becomes an investigative lead
The more fundamental issue is association. A repeating cluster may reflect a family's routine or a shared commute. Or it may capture fellow protesters or passengers who happened to be traveling together. The system only observes that people were near one another; it cannot know why.
Devices can also be borrowed or left behind in a car. A roadside sensor can pick up someone who happened to be standing nearby. Even an exact match between a device and a vehicle does not prove who was carrying it on a given day.
Still, these patterns can direct police attention in particular directions. Leonardo says SignalTrace is designed to generate investigative leads. Leads influence which records investigators request and whose behavior comes under further scrutiny. By the time investigators attach a name, the inferred connection has already shaped the direction of the investigation.
One study published in the Proceedings of the National Academy of Sciences demonstrates the power of relationship-based inference. Researchers tracked 94 participants using smartphones that recorded Bluetooth proximity and call patterns. They found that behavioral patterns alone could accurately classify 95% of mutually reported friendships. Proximity outside the workplace and outside working hours played an important role in distinguishing friends from people who merely saw each other often.
SignalTrace uses a different method, and no independent study has shown comparable performance. Even so, the research shows that repeated proximity can reveal social ties.
This matters, for example, at protests. A person's device could draw police attention simply because it repeatedly appeared near a group under investigation. The inference would arise not from that person's own actions, but from whom they were with.
When anonymous signals become identifying information
SignalTrace illustrates a broader shift in surveillance practice. Investigators may no longer need to start with a known person or vehicle. Instead, they can start with repeating patterns of movement and proximity, and then use other records to identify the people connected to them.
This distinction matters because an electronic signature can be identifying even if it contains no name. A phone repeatedly detected with the same group of devices over time may reveal relationships before police know who its owner is.
SignalTrace therefore raises a question that existing license plate reader rules do not adequately answer: How should the law treat systems that identify people indirectly, through the patterns and associations their devices create?