Imagine that you share a ride to work with the same colleague most mornings. As it passes by a license plate reader, the camera records the car, which can be linked through vehicle records to its registered owner. Beside it, another sensor detects signals broadcast by devices traveling nearby, such as your phone and your colleague’s smartwatch.

After enough trips, software may treat some of those devices as a recurring electronic signature associated with the vehicle. Weeks later, one of the same device signals appears alongside a different car connected to an investigation. The signal itself may not contain its owner’s name, but its previous association with a known vehicle gives investigators another clue they can use to work out who was carrying the device.

SignalTrace, a system marketed by the security company Leonardo, is designed to work alongside automatic license plate readers. The company says it can recognize groups of consumer devices that regularly move together, then associate them with license plate records and time-stamped locations. The pattern can then be searched even when a police investigator does not know the plate number.

I am a researcher who studies the intersection of data governance, digital technologies, and governments, including surveillance technologies. I see that SignalTrace could further shift how police conduct investigations, putting emphasis on people’s movements and associations before their identities are known.

SignalTrace is a tested and marketed capability, but not yet an established police practice. One report indicates that several of the devices are installed in Oxon Hill, Maryland, and the company’s predecessor technology appears on an official New York state contract price list.

A narrow definition of identification

Leonardo’s new explanatory sheet states that SignalTrace “does not identify people.” It says the system “only collects electronic signatures” from signals already being broadcast, such as Bluetooth or radio frequency identification tags. Those signatures, by themselves, do not disclose a person’s identity. The company says the output must be corroborated through ordinary investigative methods.