Mon Jan 1, 0001

Vehicle Tracking: EZPass, ALPR, Cashless Tolling, TPMS

EZPass Beyond Tolls

DEF CON 21 (2013)

Security researcher “Puking Monkey” built portable EZPass detector, drove around NYC. Detected EZPass readers mounted on infrastructure at locations with no toll plazas — on highways, at intersections, near Brooklyn Battery Tunnel approach.

NYC DOT confirmed using EZPass readers for traffic flow monitoring since at least 2011, measuring travel times between points. Not secret but not widely publicized. Readers interrogate any EZPass transponder that passes, logging unique tag ID and timestamp. NYC DOT stated data anonymized for traffic management only.

Similar traffic-monitoring EZPass readers deployed in New Jersey, Maryland, and Virginia by respective transportation agencies.

ALPR (Automatic License Plate Recognition)

Flock Safety

Founded 2017. By 2024: partnerships with 5,000+ law enforcement agencies and communities, cameras in 4,000+ cities across 40+ states. Captures: plate numbers, vehicle make/model/color, distinguishing features. Default data retention: 30 days (configurable by agency).

Vigilant Solutions (acquired by Motorola Solutions, 2018)

One of largest commercial LPR databases in US. 14+ billion detections by early 2020s. Thousands of law enforcement agencies access via LEARN platform.

DRN (Digital Recognition Network, Motorola Solutions subsidiary)

Aggregates plate data from repo agents and commercial fleets. Repo drivers with roof-mounted cameras collect scans during normal driving. Database sold to law enforcement, insurance companies, skip tracers.

Scale

EFF estimates billions of plate scans collected annually in US. LAPD and LA County Sheriff documented collecting millions of scans per week.

Privacy advocates argue Carpenter v. United States (2018) reasoning extends to ALPR. United States v. Yang (2019, Virginia) addressed ALPR evidence.

EFF “You Are Being Tracked” (2013) and subsequent updates documented mass plate surveillance with minimal regulation.

Bill-by-Plate / Cashless Tolling

Multiple states converted to all-electronic tolling:

  • New York: cashless on all MTA bridges/tunnels by 2021, Thruway by 2020
  • Florida: SunPass/bill-by-plate on most roads
  • Colorado: Express Lanes
  • Texas: multiple tollways
  • Pennsylvania Turnpike: cashless conversion ongoing

Systems photograph every vehicle’s front and rear plates, use OCR to identify registered owner. Creates timestamped record of every passage — movement log for any car using toll infrastructure. Data held by toll authorities and in some cases private operators (e.g., Transurban in Virginia).

TPMS (Tire Pressure Monitoring System)

Mandate

TREAD Act (2000) mandated TPMS in all new US vehicles by September 2007. Each sensor transmits unique 32-bit ID on 315 MHz (US) or 433 MHz (Europe) at intervals of 60-90 seconds while driving. Signal is unencrypted.

Tracking Research

  • University of Washington (Ishtiaq Rouf et al., “Security and Privacy Vulnerabilities of In-Car Wireless Networks,” 2014): demonstrated reading TPMS from 40 meters using ~$1,500 equipment. Vehicles uniquely identifiable and trackable at fixed points.
  • Rutgers/University of South Carolina (2010): eavesdropping from ~10 meters with cheap SDR hardware.

No publicly confirmed law enforcement or mass surveillance deployments, but researchers have noted feasibility of roadside TPMS readers as vehicle checkpoints.

Sources

  • DEF CON 21 (2013) presentation
  • EFF “You Are Being Tracked” (2013)
  • Flock Safety company disclosures
  • Motorola Solutions / Vigilant Solutions
  • Rouf et al., University of Washington (2014)