Imagine that you share a ride to work with the same colleague most mornings. As it passes by a license plate reader, the camera records the car, which can be linked through vehicle records to its registered owner. Beside it, another sensor detects signals broadcast by devices traveling nearby, such as your phone and your colleague’s smartwatch.
Author
- Nicole M. Bennett
Ph.D. Candidate in Geography and Assistant Director at the Center for Refugee Studies, Indiana University
After enough trips, software may treat some of those devices as a recurring electronic signature associated with the vehicle. Weeks later, one of the same device signals appears alongside a different car connected to an investigation. The signal itself may not contain its owner’s name, but its previous association with a known vehicle gives investigators another clue they can use to work out who was carrying the device.
SignalTrace , a system marketed by the security company Leonardo , is designed to work alongside automatic license plate readers. The company says it can recognize groups of consumer devices that regularly move together, then associate them with license plate records and time-stamped locations. The pattern can then be searched even when a police investigator does not know the plate number.
I am a researcher who studies the intersection of data governance, digital technologies and governments, including surveillance technologies. I see that SignalTrace could further shift how police conduct investigations, putting emphasis on people’s movements and associations before their identities are known.
SignalTrace is a tested and marketed capability, but not yet an established police practice. One report indicates that several of the devices are installed in Oxon Hill, Maryland , and the company’s predecessor technology appears on an official New York state contract price list .
A narrow definition of identification
Leonardo’s new explanatory sheet states that SignalTrace “does not identify people.” It says the system “only collects electronic signatures” from signals already being broadcast, such as Bluetooth or radio frequency identification tags. Those signatures, by themselves, do not disclose a person’s identity. The company says the output must be corroborated through ordinary investigative methods.
That description relies on a narrow meaning of identity, however. A sensor may not pull a legal name from a phone, but police could still work out who likely owns the device by linking its signal to other records. For example, the same signal might repeatedly appear with a car registered to one person, outside that person’s home, or alongside another device already connected to a known subject. That means a person could become part of an investigation because of where their device repeatedly appeared and who it appeared near, even if the police had no reason to suspect that person at the outset.
Leonardo’s SignalTrace product page says the system stores electronic fingerprints for later queries and can recognize a vehicle without seeing its license plate. A separate product sheet says the technology helps identify suspects through the mix of devices they carry. The patent behind the system describes targets that may be people or vehicles. It also describes searchable signatures that can be correlated with visual identifiers and used to track a target across locations.
SignalTrace may begin with a nameless pattern, but its value comes from recognizing that pattern again and connecting it to information that police already possess. Once an officer links a recurring signature to a license plate record or case file, the absence of a name in the original signal offers little protection.
A nameless identifier can still be personal
Federal privacy guidance does not limit identifying information to names. The National Institute of Standards and Technology defines personally identifiable information as data that can distinguish or trace a person’s identity, either alone or when combined with linkable information. The key question is whether data can single someone out and follow them over time.
Research on mobility data – records collected from people’s mobile devices indicating where they went – helps explain the risk. A study in the journal Scientific Reports examined 15 months of records covering 1.5 million people. Four time-and-place points were enough to uniquely identify 95% of the people in the dataset. The study did not test SignalTrace, but it shows why repeated movement can make a supposedly anonymous record distinctive.
The Supreme Court has recognized that phone location records can reveal far more than movement. In Carpenter v. United States , the court concluded that people have a reasonable expectation of privacy in the record of their physical movements.
The court extended that reasoning in its June 2026 decision in Chatrie v. United States . Police investigating a bank robbery had used a type of warrant to obtain anonymized location records for phones near the bank, narrowed the list based on their movements and eventually obtained the names of several users. The justices held that obtaining location data constituted a Fourth Amendment search. It also noted that even short-term monitoring can reveal political, family and other associations.
The ruling does not determine whether police collection of wireless signals detected by SignalTrace would also count as a search. The Chatrie case involved location records, while SignalTrace is designed to detect signals broadcast from nearby devices. But the two technologies raise a related question: What Fourth Amendment protections apply when police begin with unidentified devices and use their movements to determine who might be connected to an event or another person?
When proximity becomes an investigative lead
The deeper issue is association. A recurring cluster may reflect a family routine or shared commute. It may also capture fellow protesters or passengers who happen to travel together. The system simply observes when people are near one another – it cannot know why people were close to each other.
A device can be borrowed or left in a car. A roadside sensor could capture someone standing nearby. Even a correct match between a device and a vehicle does not establish who carried it on a particular day.
Still, a pattern can direct police attention. Leonardo says SignalTrace is designed to develop leads . Leads influence which records officers request and whose movements receive further scrutiny. By the time an investigator attaches a name, the inferred association has already shaped the inquiry.
A study in the journal Proceedings of the National Academy of Sciences illustrates the power of relational inference. Researchers followed 94 participants using phones that recorded Bluetooth proximity and calling patterns. They found that patterns of behavior could accurately classify 95% of reciprocally reported friendships , with proximity outside work and during off-hours playing an important role in distinguishing friends from other people who regularly encountered one another.
SignalTrace uses a different method, and no independent study has shown comparable performance. The research nonetheless demonstrates that repeated proximity can reveal social ties.
This matters at a protest, for example. A person might come to police attention because their device repeatedly appeared near a group under investigation. The inference would arise from the company they kept, rather than an act attributed to that person.
When anonymous signals become identifying
What SignalTrace shows is a broader change in surveillance practice. Investigators may no longer need to begin with a known person or vehicle. Instead, they can begin with recurring patterns of movement and proximity, then use other records to identify the people connected to them.
That distinction matters because an electronic signature can become identifying without containing a name. A phone detected beside the same devices over time may reveal a relationship before the police know who owns it.
SignalTrace therefore raises a question that existing rules for license plate readers does not fully answer: How should the law treat systems that identify people indirectly through patterns and associations that their devices create?
