Thinking Critically About SignalTrace
- ryanohoro
- 2 days ago
- 17 min read
Updated: 40 minutes ago
The following work includes my own personal opinions and analysis based on public information. Detailed technical information about the product has not been made available by the manufacturer, and the product is not generally available for examination. The information focuses on devices, vehicles, and infrastructure most common in the United States.
TL;DR: SignalTrace advertises sophisticated technology, but is likely haphazardly implemented for its stated purpose. This type of technology still poses a genuine threat to public safety and privacy if widely adopted. Individuals and device manufacturers may be able to make changes to render it irrelevant.
Introduction
In the middle of June 2026, social media became briefly outraged about a product called SignalTrace, which claimed to be able to track people and their vehicles using wireless signals, after 404 Media reported on its new marketing materials. Since then, I’ve seen claims that license plate readers in general are now tied to “bluetooth tracking”.
Even Leonardo seems to have been surprised. They published a fact sheet "SignalTrace: What It Is and What It Isn't" at the beginning of August (days ago as of this writing), seemingly in direct response to the backlash.
While the potential privacy threat of this type of a product seems to be real, it has not yet gained any traction in the local law enforcement space. This product seems to be basically non-existent in the US market, and no other ALPR vendor advertises this kind of capability, yet.
Given my extensive research into license plate reader technology, professional experience with wireless security, and privacy advocacy, I wanted to dive deeply into this topic to try to help clear up misconceptions about how something like SignalTrace might work.
Background
Leonardo’s US subsidiary is mostly known for its ELSAG-branded license plate readers, the fixed versions have seen modest adoption (notably New York City). They claim to have thousands of US law enforcement customers, which I think mostly use their vehicle mounted mobile ALPRs.
You yourself can seek them out on Deflock. Open the map, click the filter button on the bottom right, and choose Brand: Leonardo.
This subsidiary is substantially different from its parent defense contractor Leonardo S.p.A., which sells various types of electronics to militaries. Leonardo US Cyber and Security Solutions, LLC seems to be mostly composed of what was Remington ELSAG Law Enforcement Systems acquired in 2008, which itself was a 2004 joint venture by Remington Arms Company, Inc. and ELSAG (Elettronica San Giorgio) Datamat, to sell ALPRs to US law enforcement.
Last year, Leonardo released new marketing material for a product it was rebranding as SignalTrace, an “Intelligence System”, with the promise to “Identify Suspects Through the Electronic Devices They Carry”. In January 2023, a patent for the device had been filed which described some of its capabilities. The filing process seems to have started December 2020 with a provisional application.
Perhaps because of the name change, people could be forgiven for not noticing Forbes covered this product launch in 2024 when it was called "EOC Plus". Even sharing some shocking claims like it could identify specific models of phones, and that it was "Stringray by another name".
Leonardo also sells Enterprise Operations Center (EOC), the software platform where customers manage and search data from various sources. It can also integrate with third-party platforms, and pair SignalTrace with an existing Flock Safety camera network, for example.
Leonardo’s marketing materials show SignalTrace as a set of two antennas connected to what’s colloquially known as a Field Control Unit (FCU), which houses the sensor hardware and, if included, LTE antennas for connecting the FCU to a network, otherwise hardwired. I suspect this system is too power hungry for solar.
What SignalTrace Does
Leonardo claims, in marketing and patent, that they can correlate license plates and various types of wireless devices.
From Leonardo:
Identifies the movements of electronic devices, individuals, and vehicles
Stores data on the SignalTrace server where it can be queried and analyzed to aid investigations
Respects individuals’ privacy rights (does not decrypt or read content from devices)
Allows law enforcement to recognize a specific vehicle included in an electronic signature, without the license plate number
Reveals signatures frequently travelling together with an individual or vehicle, which can lead to the discovery of convoys and other movement and travel patterns
SignalTrace is effective in off-road areas such as in subways and malls [elsewhere, “rail stations, event venues, and shopping centers”]
Performs with or without license plate readers at every collection site, allowing for a wider coverage area while keeping deployment costs down
The bit about deploying SignalTrace in other public areas is of course concerning, but also this opens the opportunity to use it in combination with live video surveillance. To match a phone with a face, for example.
It’s important to distinguish devices that stay with a vehicle at all times from those that a person would carry with them. I’ve grouped the list of devices Leonardo claims to detect in their product sheet and patent, and noted what wireless spectrum devices like that typically use.
Vehicle
RFID 915MHz
Asset/pallet/livestock * tags, access control *, tags, toll transponders *
ISM 315MHz / 433MHz / 915MHz
Tire pressure monitors (TPMS), security sensors, key fobs , remote start *
ISM 5.9GHz
Safety sensors †
Bluetooth 2.4GHz
Infotainment systems, tire pressure monitors (TPMS)
Wi-Fi 2.4GHz/5.8GHz
Vehicle (Wi-Fi) hotspots, dashcams *, backup cameras *, GPS units *
Personal
RFID 915MHz
Library book tags
NFC 13.56 MHz
Key cards, credit cards *, transit cards *, library book tags
125kHz / 134.2kHz
Pet microchips ‡
Bluetooth 2.4GHz
Tablets, smartphones, laptops, pet collars ‡, watches, fitness trackers, headphones, personal tracker tags §
Wi-Fi 2.4GHz/5.8GHz
Tablets, smartphones, laptops, pet collars ‡
* Item included by me through inference.
† I’m not sure exactly what “safety sensors” means here. It’s possible it refers to Vehicle-to-Everything (V2X) protocols that have very low adoption in the US, operate on 5.9GHz. V2X seems pretty resistant to persistent tracking.
‡ Leonardo’s marketing says “pet microchips” but their patent says “pet collars”. I think the marketing is a genuine error. More on that later.
§ Mentioned in the Forbes article referencing an early brochure.
You can be tracked and perhaps identified specifically by some devices you carry with you, even while away from your vehicle. Though, if law enforcement already has the license plate, then why bother with wireless signals for the vehicle itself? Perhaps they’re looking for a vehicle with its plates removed, replaced, or updated. Leonardo markets this as a SignalTrace benefit, much like Flock Safety’s Vehicle Fingerprint, which also claims to be able to identify specific vehicles visually without a license plate. It can also be used separately from ALPR to do similar types of vehicle tracking, only likely less effectively and seemingly at the same cost.
The patent alludes to tracking distances 50ft to 200ft away from the product, but not in any specific technical terms. Considering the types of devices claimed, SignalTrace could struggle to capture RFID tags past 75ft using typical commercial hardware within FCC power limits. It can only be safely assumed that some devices with strong signals, stationary, and with line-of-sight – ideal conditions – can be detected at hundreds of feet. However, the majority of devices that SignalTrace intends to detect are not operating in ideal conditions, and are certainly not stationary.
The Real World - Oxon Hill, MD
Here’s the only real-world deployment of SignalTrace I know of, as of July 2026 – two intersections in Oxon Hill, Maryland near National Harbor on Oxon Hill Road, operated by Prince George’s County Police Department (confirmed with data Leonardo published, and pending a records request). Readers are encouraged to bring other installations to my attention.
The smaller antenna, about 10” square, has a single feed and has a shape typical of circularly polarized panel antennas designed for RFID applications. These antennas are most useful when the orientation of the transmitter antenna is typically random, rather than vertical like you might typically imagine an antenna.
The larger antenna, about 15” square, has a dual feed and is most likely a dual-band 2.4/5GHz WiFi/Bluetooth antenna. There are a few possibilities for the configuration of this antenna, one feed per band, separate feeds for horizontal and vertical polarization, or separate feeds for Wi-Fi and Bluetooth. Most Wi-Fi antennas are dual band, but it’s possible Leonardo chose to only utilize the 2.4GHz band. It’s not critical which approach was used, I’m pretty confident that this antenna is combined for Wi-Fi and Bluetooth based on the available evidence.
I did not see any other antenna or surveillance camera at these installation points. However, a few hundred feet north, a Flock Safety ALPR camera is installed. Leonardo’s EOC software appears to still be somewhat capable of correlating wireless signals and ALPR scans in this configuration.
From above, I’ve annotated the approximate angle the antennas are pointed, a typical beamwidth, and distance arcs at 50ft, 75ft, and 100ft.
The placement of these antennas covering each direction of traffic separately seems to acknowledge practical limitations of collecting on a wide suburban road.
They are mounted at different angles to oncoming traffic, and at different heights. I don’t see any obvious reason for the difference, other than perhaps available mounting space.
It’s also worth noting that the antennas are close enough to sidewalks and crosswalks that devices carried by pedestrians will also be detected.
There's another installation on National Harbor Blvd. that's actually co-located with Leonardo's ELSAG PlateHunter 900 ALPRs. SignalTrace antennas here are oriented to face the rear of vehicles. There's devices mounted on the inbound and outbound routes of this road.
This one is where the Leonardo hero marketing photo was taken. One strap is missing due to edits to the original photo, which was also mirrored.
Finally, what may be most shocking to me, the earliest StreetView image for this location that shows the SignalTrace product installed is May 2022. This pre-dates the Forbes article by two years, where Leonardo is quoted in 2024:
Leonardo spokesperson Nate Maloney told Forbes the company recently obtained a patent for the technology so it was “going full steam ahead” in trying to sell the product across the world. It currently has no paying customers, though confirmed at least one of its current license plate detection customers was trialing the tech in a test environment, Maloney said. He didn’t say which American police department was assisting in trials, but said they were not currently being used to surveil the public.
They did say at least one, so they may not have been talking about Prince George's County PD, but that statement sure as heck implies that in 2024, no public installations of SignalTrace existed. These devices are seen in imagery May 2022 - July 2025. They are not seen August 2021.
Images for the Oxon Hill Road SignalTrace antennas don't show them in September 2022, so they were installed later.
The Real World - Continued
Calvert County, MD, unincorporated - Served by Calvert County Sheriff's Department).
Tracking Moving Devices is a Hard Problem
Correlating the various wireless signals and images of a particular passing vehicle is very difficult. This is why the marketing hedges, talking about devices that “regularly travel together”. Here are the challenges:
Single antennas, even directional ones, cannot pinpoint a device to a specific location, so different vehicles and bystanders blend together in traffic.
Using a directional antenna trades the area over which signals can be collected and decreases the time window of collection for improved receive sensitivity.
Devices are only periodically transmitting identifying information. For WiFi or Bluetooth, this could be tens of milliseconds up to a minute. For TPMS sensors, it could be 30 seconds or more. Cars moving at 50 mph will travel roughly 50 ft in about 600 ms – in and out of the detection zone in less than a second.
Most devices transmit on distinct channels within a band. A common way of getting multiple-channel coverage for something like Wi-Fi is to hop quickly between the channels. Using a single radio, you typically can only listen to one channel at a time. You'll end up missing data as you hop around.
Using more radios to get better coverage with a single antenna reduces the overall sensitivity of the system. Custom engineering RF hardware would dramatically increase costs.
There is steep cost and complexity needed to improve the collection quality from a single point. Leonardo is likely not using custom RF hardware either – their patent explicitly mentions off-the-shelf products. SignalTrace absolutely depends on a vehicle of interest passing multiple collection points, or passing the same point multiple times, such as commuters, or round-trips.
This is further reinforced in their marketing materials. There are graphs in the EOC software showing confidence levels for correlations between specific devices. There’s no magic there. The end user needs to look at the correlation data and decide for themselves if the evidence is strong enough to act on.
What SignalTrace Really Does
The use of only two panel antennas calls into question how this system is collecting from all of the different frequency bands needed to collect the claimed device identifiers. Particularly for the most commonly used TPMS sensors, which operate on frequencies not suitable for flat panel antennas. This perhaps suggests that the only TPMS sensors SignalTrace can actually detect are of the still rare Bluetooth variety commonly found on newer Tesla models, and cheap aftermarket TPMS kits that use sensors in stem caps.
Further supporting, the illustrations from the patent only refer to Wi-Fi, Bluetooth, and RFID targets and antennas. They also describe a “Bluetooth tire monitor” specifically.
So, that’s all. SignalTrace can likely only collect data from Wi-Fi, Bluetooth, and certain 915MHz RFID devices. Data collection from Wi-Fi and Bluetooth devices is significantly hampered by modern device security.
Missing from current marketing is any mention of the correlation of device types. As mentioned in the Forbes article:
“As an example, while 30 cars in 100 may contain iPhones, only one will have an iPhone 13rev2, an Audi radio, a pair of Bose headphones, a Garmin sports watch, a key finder and the license plate ABC-1234. The collection of data represented by these specific things is an electronic signature,” Leonardo explained in its brochure.
Bluetooth devices particularly tend to reveal the model in the device name, so even when they use BLE's address randomization feature, you could know you've captured information about Bose product, or an infotainment system installed in an Audi. Fair to say this strategy could possibly identify an individual relatively uniquely, even if all of their devices are not emitting unique identifier data.
The marketing images of EOC don't display any further device metadata, so I don't know if much more information is made available to customers.
Maybe Mobile Data Collection
The SignalTrace patent references a “site” called “TC Android”. I recognize this as likely to be Zebra’s TC line of Android based mobile devices (commonly used in retail). Zebra markets some of its devices specifically to law enforcement. Leonardo also markets a license plate scanning app for Android called PlateTrace. It’s not great, but it’s free if you don’t want to integrate it with the EOC software.
What worries me about this is how simple implementing wireless scanning into a mobile app is, just like the WiGLE project’s wardriving mobile app. The WiGLE project is a database of crowdsourced wireless data collection, primarily focused on Wi-Fi and Bluetooth. Their mobile app can be run in the background, scanning for nearby devices, and occasionally uploading that data to WiGLE’s central database. If Leonardo offers this type of always-on scanning for mobile devices that law enforcement use, their vehicles become SignalTrace sensors – like mobile ALPRs – anywhere they go. Even as they drive by your home. At that point, it’s easy to have a hotlist feature that notifies an officer when they’re near a target device.
With the ability to collect Wi-Fi and Bluetooth probes/beacons with $5 low-power radios, this collection method could even be extended to DFR drones, like Flock Safety has extended its ALPR capability to DFR.
For now, I don’t think this capability is available from Leonardo, but the path there is clear.
Everything Has WiFi or Bluetooth
WiFi and Bluetooth are some of the world’s most ubiquitous signals. They are typically very chatty, with strong signals, and present the highest risk of tracking of individuals through their devices. Though efforts have been made to implement device address randomization features to prevent this exact problem, application has not been uniform, and is difficult to find outside of newer laptops and mobile phones. Even with randomized addressing, there are more sophisticated attacks on these implementations, as well as very simple attacks exploiting probe requests for previously connected devices or advertisements, which can identify a device as well. This also creates an economic inequity. More modern and expensive devices defend against tracking better, including devices in more expensive vehicles.
Pet Microchips
This marketing claim by Leonardo I find to be the least credible. The term “pet microchip” generally refers to small, implantable RFID tags operating in the 125/134kHz ranges, and is listed as RFID in the marketing. This extremely low frequency requires inductive coupling between antennas, which research generally suggests reading distances at a practical maximum of 50cm, making road based collection implausible.
These pet microchips are typically registered in one or more missing pet databases associated with the owner’s personal information. These chips can be read with widely available and low-cost tools.
I just don’t think Leonardo has brought this to reality for collection. Charitably, I think the read on this is a miscommunication with whoever wrote the marketing copy. What the technology actually collects are identifiers for Wi-Fi/Bluetooth pet collars intended for tracking or training.
Recurring Revenue! At The Car Wash
The explosion in the car wash industry has come alongside the adoption of subscription based car wash access. The way car washes are billing for these subscriptions is with RFID windshield tags. These tags are also applied by car dealers to track customer information. Less commonly, similar tags are used for parking enforcement, and for gate access in private communities or parking garages. I point this out specifically as a technology that the average person might not consider to be a privacy threat which has seen a sharp uptick in use.
Toll Transponders
There are numerous protocols used historically in road tolling, but they are all some flavor of RFID. The commercial hardware to read all of them is quite pricey, for example the TransCore Encompass line of readers. I don’t think SignalTrace uses toll-specific hardware, but instead uses the overlap in technologies used for access control tags that also use the ISO18000-6B or 6C (EPC Gen2) protocols. Why? Because that’s what off-the-shelf UHF RFID hardware supports, particularly the Impinj Speedway reader noted in the patent.
Many popular toll transponders use one of these two protocols. Which toll operators, like E-ZPass, and states use which technologies is kind of complicated, and beyond the scope. It’s probably safe to say that SignalTrace can detect many, but not all of the most common toll transponders.
A Wallet Full of Radios
It’s common for people to have a mix of contactless access cards (for work), credit cards, and transit passes on them. These cards are almost all based on 13.56MHz ISO/IEC 14443 (proximity, NFC). These cards are difficult to read at any significant distance, but putting your work access card lanyard on your dashboard might make you vulnerable, for example. It’s also possible but extremely rare that your place of work uses access cards in the UHF RFID 915MHz range.
Luckily, I don’t believe SignalTrace supports the 13.56MHz band the vast majority of these cards use. It would require a separate antenna and radio, and specifically a large loop antenna, which there’s currently no evidence for so far. Even if one were to embed something like this in the road surface, the body of the car would block the signals.
Library Book Tags
This is mentioned only in the patent. The most exciting thing to happen to library science in the last several decades has been the use of RFID tags to replace barcodes as a means for identifying books. There’s two primary protocols for this are 13.56MHz ISO/IEC 15693 (vicinity), and the far less popular 915MHz UHF EPC Gen2. There’s a whole protocol stack designed around ISO/IEC 15693 for library management specifically, which is why it’s so popular.
It’s actually pretty creepy that the patent mentions this application specifically. Probably not a coincidence the current marketing omits it. What you read at the library is your business. In theory, law enforcement could trace that book tag to a specific library, a specific book, and you the patron.
On the bright side, again, I don’t believe SignalTrace supports the 13.56MHz band used by most library systems.
The Retail Elephant in the Room
I’d like to acknowledge that retail and marketing companies have been using Wi-Fi and Bluetooth tracking for many many years to do what’s now called in retail parlance “Footfall Analytics” – the tracking of people. Though there’s been a shift to privacy preservation in implementations, the same identifying information SignalTrace is after has historically been collected and sold by companies wanting to figure out how to sell you stuff.
There’s not much more to say, other than the potential for cross-over where law enforcement buys this same data from brokers to enrich SignalTrace data.
Law Enforcement Appeal
Ostensibly, law enforcement gets slightly enhanced vehicle tracking, and some marginal people tracking capability with SignalTrace. There’s currently very little ability to turn SignalTrace data into a person’s actual identity for local law enforcement. I personally believe that the reality for a law enforcement customer would be that it would not measurably increase their ability to track suspects or close cases when compared to using ALPRs alone in the same locations.
This has never stopped law enforcement customers from acquiring such technologies, but it may be difficult to justify the cost, maintenance, and public relations over time. SignalTrace already creeps people out, and it’s barely entered the market two years on.
There may be some evidentiary incentive, such as demonstrating in court that a specific person was occupying a vehicle at a certain time.
For law enforcement agencies that want to track people who are in public but not in a vehicle, this could also be an incentive, however, for local law enforcement, population density is a big factor, and it seems like this would be used for specific sensitive locations, or densely populated urban areas, limiting the addressable market.
The price of SignalTrace (as EOC Plus, in the price sheet) is comparable to Leonardo’s Plate Hunter fixed ALPR product, though twice as expensive as their solar powered ALPR Sentry. And Sentry is more than three times the annual cost of leasing a Flock Safety Falcon ALPR. Leonardo does also apparently lease Sentry, but I could not find the price.
For what it’s marketed as, the pricing makes sense. But compared to the various solar powered, cellular networked ALPRs from Flock, Axon, Motorola, and Genetec it seems out of reach for most local law enforcement. Especially considering that SignalTrace requires an additional annual software license which costs as much as a Flock ALPR lease.
I find it remarkable that the RFID feature on its own is $10,000 of the total cost. The off-the shelf commercial RFID readers, like the Impinj Speedway the patent mentions, needed for this application are typically $1,000 - $2,000.
EOC Plus FCU | $16,153.85 |
EOC Plus FCU w/o RFID Hardware | $6,446.15 |
EOC Plus License (annual) | $2,769.23 |
ELSAG Plate Hunter™ M7 – 1 Camera | $14,692.31 |
Street Sentry Turnkey - South | $6,769.23 |
What SignalTrace has going for it ultimately is that it’s sexy. Even if this type of tracking is effectively useless from a policing perspective, it just sounds like a tool law enforcement wants to brag about having. To even modestly increase their surveillance capabilities, and send a chilling message of advanced capabilities to the community to reassure residents of the police’s power, and tell anyone law enforcement deems fit to be targeted by this technology to stay in line.
Legal
Retail analytics company Nomi was penalized for this behavior by the FTC, but private companies do not have a duty to respect the 4th Amendment on their property. I don’t believe this type of signal tracking has been evaluated legally the way ALPRs have been established in Schmidt v. City of Norfolk in the Eastern District of Virginia to not run afoul of the 4th Amendment. Merely because the tracking was limited by the number of collection points, the conclusion was that an individual’s 4th Amendment right to privacy was not violated.
These identifiers are more likely to be connected to an individual, and those identifiers can be collected from more locations than on public roads. In fact, because wireless signals are broadcast, they can be collected incidentally from people on their own private property. This is not a problem for ALPRs, their collection boundaries are well-defined. The collection is more akin to the geofence warrants that the Supreme Court just ended with the line "an individual has a reasonable expectation of privacy in his cell-phone location information."
Is it possible remotely discovering the electronic contents of a vehicle could be considered an unlawful search? If "Lisa's iPhone" was stolen, and one or more "Lisa's iPhone" devices turned up in a SignalTrace search, is it probable cause to pull over the vehicles SignalTrace identified to search them? Ambigious and erroneous license plate scans certainly haven't stopped law enforcement from detaining innocent drivers.
What is out of bounds for data collection with local law enforcement?
Jenoptik TraffiCatch
Also in 2024, another ALPR company was offering a product that did a similar type of wireless data collection, Jenoptik TraffiCatch. Trials of the product are known to have been conducted in Texas. Jenoptik seems to have never published marketing for the product, and I have no idea if it every got traction, or if it's even sold anymore.
Hopefully we would know had it exploded in popularity all of a sudden. Perhaps it died an unremarkable death, perhaps because they used tiny rubber duck antennas, or perhaps because the technology isn't worth buying for local policing. One of the trials in Texas by CBP was for monitoring for border crossings where electronic devices were rare.
Conclusion
SignalTrace as a product does not impress me. Its marketing oversells its capabilities. I think it’s a feeble attempt to cash in on the mass surveillance money train in local US law enforcement. But what concerns me is that the more established ALPR vendors in the US might add the same appealing sounding features to their existing ALPR hardware.
Flock Safety (and other) ALPR cameras already have on-board Bluetooth and Wi-Fi, which can easily be used to scan for nearby devices. A rudimentary implementation, with limited range and no RFID capability, but it doesn’t need to work well. It just needs to sell more ALPRs, because it costs them almost nothing to implement. And to be clear, as far as we know, they don't currently.
At the scale of a Flock Safety or Motorola Vigilant, this type of tracking would vacuum up enough useful data to be worrisome, barring a successful legal challenge.
I foresee some straightforward fixes for individuals and manufacturers to help address vulnerability to device tracking. But those fixes could involve purchasing new devices, not utilizing common features, or stowing devices in signal blocking containers – impractical for daily use.
The burden of not being tracked in public should not be on the individual.
At this point, it seems to be a matter of keeping an eye out for adoption, and challenging it where it appears.