The short version: a defense contractor, Leonardo, is marketing a system called ELSAG SignalTrace that bolts sensors onto automatic license plate readers so the cameras capture more than your plate — they sweep up the electronic identifiers of the phones, smartwatches, earbuds, RFID tags and vehicle components moving past, then tie that “electronic fingerprint” to a specific vehicle and plate. It is the convergence of two tracking layers into one: where your car goes and which devices travel with it. Crucially, it can identify a vehicle by its devices even when the plate can’t be read. As of September 2026 a security researcher had found it installed in Oxon Hill, Maryland, with purchase records in Calvert County, Maryland. It is not widespread, but the patent is granted, the product sheet is public, and it is being sold.
What SignalTrace actually is
The product drew wide attention on 8 June 2026. That day 404 Media’s Joseph Cox described a plan to add sensors to ALPRs that would sweep up unique identifiers of mobile phones, wearables, and other Bluetooth-enabled devices in passing vehicles. That could let law enforcement identify specific drivers or passengers. The technology itself was not new: Leonardo announced its patent in May 2024, under the earlier product name EOC Plus. BusinessWire (30 May 2024). The product is marketed by Leonardo US Cyber and Security Solutions — a company already in the license-plate-reader business through its ELSAG systems.
Leonardo’s own description is unusually clear about the mechanism. The company’s product page starts from the fact that devices such as fitness trackers, smartwatches, RFID tags and mobile phones emit signals into the air. It then says SignalTrace creates an electronic signature for groups of the signals that the system determines are frequently emitted together. Strategically placed sensors collect the signals, and SignalTrace sites correlate them “along with LPR data if present.” The product sheet calls the result “an electronic fingerprint for signals that regularly travel together”. In plain terms: it watches which devices keep showing up together, calls that cluster a person, and staples it to a plate.
How the two systems work together
This is the part you asked about, and it is the whole design goal — SignalTrace is not a standalone gadget, it is a layer on top of ALPR. The mechanism, straight from the patent that underpins it: if LPR cameras are deployed at the same sites as the electronic-signature sensors, officers can match the date and time stamps from both systems to associate a specific license plate number with a device signature. Two independent readings — the camera sees the plate, the sensor sees the devices — are joined on a shared timestamp and location. The output is a single record: this plate, this car, these devices, here, then.
Jalopnik’s walk-through makes the result concrete: pass one associated ALPR-plus-SignalTrace site and authorities could know you operate a specific make and model in a specific state, carry a particular smartwatch, and a particular phone — an “electronic fingerprint” that can then be used to track movements or flag when multiple suspects are traveling together. The plate identifies the machine; the device signature identifies the people in it. Fused, they convert a car-tracking network into a people-tracking network.
The plate becomes optional
The most consequential detail is the one that gets least attention. Because the device signature is an independent identifier, the system doesn’t need the plate at all. Leonardo’s patent announcement states the technology allows law enforcement to recognize a specific vehicle by electronic signature even if the license plate is removed, obscured, or changed. Every physical countermeasure people have reached for against ALPR — a dirty plate, a cover, a swap — is defeated by a system that was never looking at the plate to begin with. The camera becomes optional; the surveillance does not.
Why the “bolt-on” design is the real story
SignalTrace matters less as a gadget than as a strategy. One analysis put it precisely: surveillance growth here comes less from dramatic new hardware than from attaching fresh data layers to systems cities and police already bought, and the strategic advantage for agencies is adoption friction — it can be pitched as an extension of an existing ALPR ecosystem rather than a wholly separate surveillance buildout.
That is the same pattern the Flock-to-Axon vendor story exposed from a different angle: the expensive, visible fight is over the cameras, while the capability quietly expands through the plumbing already in the ground. A city that debated its ALPR contract for months may never get a second debate before a device-signature sensor is added to the same pole. There is no camera to spot, no new pole to notice at the council meeting — just a firmware-and-sensor upgrade to infrastructure the public already lost the argument about.
The privacy problems this raises
Stacking a persistent device identity on top of a location network changes the privacy calculus in specific, documented ways.
- You cannot opt out. As Jalopnik notes bluntly, like ALPRs, you can’t just “opt out” — the collection happens as you pass, with no notice and no consent, to anyone carrying a powered-on device.
- It identifies people, not just cars. 404 Media’s framing is the core shift: the technology would turn ALPR cameras from devices focused on tracking cars into ones that can more readily track the location of particular people. A passenger who never owns the car is now in the record.
- “We don’t read content” sidesteps the actual harm. Leonardo emphasizes that SignalTrace captures device signals but does not decrypt or read the contents of the devices or their communications. Its August 2026 release announcing the SignalTrace name goes further: “It does not identify individuals, access communications, or retrieve information stored on personal devices.” That is the vendor’s claim. The content point is true — and beside the point. The privacy injury from persistent location-and-association tracking doesn’t require reading a single message; knowing who went where, with whom, how often is the harm.
- The abuse track record is already there. ALPR data specifically has a documented history of misuse. Officers have been charged with stalking using plate data, state fusion centres have monitored anti-Flock activists’ social-media accounts, and plate data has been searched for immigration enforcement. Layering permanent device identities onto that same infrastructure raises the stakes of every one of those failure modes. Max Intel keeps the running accountability file of documented ALPR misuse.
Who Leonardo is — and why that matters
Context worth having: this is not a startup. Leonardo is a large publicly traded Italian defense and security company, with a market capitalization well above $17 billion, and its US arm markets SignalTrace as integrating with its Enterprise Operations Center to support identification of suspect people or vehicles even when a license plate number is not known. The lineage runs from defense to local policing — the capability being pitched to a county sheriff descends from a patent, US 11,941,716 B2, granted March 26, 2024 for “Systems and Methods for Electronic Signature Tracking”, built for finding “people of interest” by the signals their devices emit.
How widely is it deployed? (Be precise here)
This is where accuracy matters, because the topic invites overstatement in both directions. Update (Aug 2026): SignalTrace is no longer purely hypothetical — but it is also nowhere near ubiquitous, and both halves of that sentence matter. Security researcher Ryan O’Horo identified four SignalTrace installations in Oxon Hill, Maryland, near National Harbor, operated by the Prince George’s County Police Department, which he calls “what I believe to be the first deployments of SignalTrace, as of July 2026.” At least the National Harbor Boulevard installation is co-located with ELSAG plate readers. He also points to Calvert County, Maryland (Solomons and Dunkirk). There, a June 2023 invoice shows the Sheriff’s Office bought two EOC Plus (now SignalTrace) devices. His analysis was published on 2 August 2026 and last updated on 18 September. Street View imagery shows the Oxon Hill hardware as far back as May 2022, years before the June 2026 reporting. He asks readers to bring other installations to his attention. The likely capability is also narrower than the marketing. O’Horo concludes from the antennas that the sensors probably collect only Wi-Fi, Bluetooth and 915 MHz RFID. The patent alludes to ranges of 50 to 200 ft. He calls the claim about reading pet microchips the least credible, since those chips read at about 50 cm. The Drive (10 Aug 2026) reported his analysis.
So the honest status is: installed in at least one Maryland jurisdiction, not yet widespread. A granted patent, a public product sheet, active marketing, and documented installations are all real — but that is still a handful of sensors in two Maryland counties, not a camera on every commute. Two things make the small footprint less reassuring than it sounds. First, procurement is frictionless. The hardware appears, under its former name EOC Plus, on a New York State contract price list (Hazardous Incident Response Equipment award, 5 Jun 2025), from about $3,350 per unit plus an annual licence. An agency on such a contract can buy it off a pre-negotiated list rather than through a new tender. Second, O’Horo’s technical analysis is a useful counterweight to the hype — he argues that some marketed capabilities outrun what radio physics and off-the-shelf hardware allow, so “it exists and is installed” is not the same as “it reliably fingerprints everyone who drives past.” The correct posture remains watchfulness over alarm: the capability is now demonstrably real and deployed at small scale, the footprint is still narrow, and the effectiveness is genuinely contested.
What actually reduces your exposure
Because the system reads what your devices emit, the only real mitigations are on the emission side — and they are the same device-hygiene steps that limit any passive wireless tracking:
- Cut needless radios in transit. A phone with Bluetooth and Wi-Fi off emits far less for a roadside sensor to fingerprint. AirTags, wearables, and always-on earbuds are the loudest, most persistent beacons you carry — each one is a stable identifier.
- Keep MAC randomization on, per-network. It doesn’t defeat every technique, but a stable MAC or a fixed Bluetooth device name is the easy identifier; removing it forces any tracker to work harder.
- Understand the limits. Randomization is not a force field. O’Horo notes that it is applied unevenly and that Bluetooth device names often reveal the model. He adds that simple attacks exploiting probe requests for previously connected devices can identify a device. This is about reducing your footprint, not achieving invisibility.
- Aim the real fight at policy. Device-signature collection tied to plates is precisely the kind of persistent, warrantless association tracking that the mosaic-theory / Carpenter line of Fourth Amendment argument targets — a line the Supreme Court extended in Chatrie v. United States (29 June 2026) by rejecting the idea that a small enough slice of location data escapes the Amendment — and, like ALPR, the durable limits will come from state law and local procurement oversight, not from a setting on your phone.
Bottom line
SignalTrace is the logical next step of the ALPR business model: having saturated the country with cameras that identify cars, the vendors are now adding sensors that identify the people and devices traveling with them — and joining the two on a timestamp so a plate and a pocket full of electronics become one record. It defeats plate-based countermeasures because it was never watching the plate. It is not yet widely deployed, and honesty about that is part of taking it seriously. But the patent is granted, the product is being sold, and the design intent is explicit. The meaningful response is the same one that works against the rest of this ecosystem: emit less, and push the fight to the statutes and contracts that bind whatever sensor goes on the pole next.
Primary sources: 404 Media (Joseph Cox, original reporting); Leonardo US — ELSAG SignalTrace product page and EOC Plus product sheet; BusinessWire / Silicon UK (patent US 11,941,716 B2 announcement, Mar 2024); Leonardo SignalTrace release (Aug 2026); Ryan O’Horo (deployment analysis, Aug–Sep 2026); New York State OGS price list (Jun 2025); Jalopnik, CarPro, The Deep Dive (Jun 2026) and The Drive (Aug 2026) (secondary reporting). Claims describe a marketed capability and its documented design; they do not assert a specific agency’s current use.