SignalTrace: Europe Exports the Surveillance It Will Not Allow Itself

Tue, 01 Sep 2026 00:00:00 +0000

A grey saloon passes under a motorway gantry at 110 kph. The camera on the mast reads the plate, timestamps it, records it. Nothing new: this equipment has been around for twenty years, deployed in tens of thousands of units across North America and Europe alike.

But if that gantry has been fitted with the unit the Italian group Leonardo has been selling since June 2026, it has just recorded something else. The driver’s iPhone. The passenger’s wireless earbuds. The smartwatch on the dashboard. The car stereo. The connected key fob in the glovebox. The pressure sensors in all four tyres. The access badge left in a jacket. And, if a dog is asleep in the back, its identification chip.

A dozen identifiers, a plate, a position, a time. Repeat at every gantry on the network and you are no longer following a car: you are following people, and you know who they travel with.

What the equipment actually does

The product is called SignalTrace. Sold by Leonardo US Cyber and Security Solutions, it extends the ELSAG range, one of the most widespread lines of automated licence plate readers on the American market. Its existence was revealed on 8 June 2026 by Joseph Cox in 404 Media , from a manufacturer’s product sheet.

The decisive point fits in one sentence: these are not new cameras. SignalTrace is a radio sensor added to plate readers that are already installed. The mast does not change, the location does not change, the silhouette of the roadside equipment does not change. What changes is what the equipment listens to.

The sensor records the identifiers broadcast in the clear by the Bluetooth, Wi-Fi and RFID protocols of the devices inside the vehicle. A technical point that is often misunderstood: no device is hacked and no vulnerability is exploited. A Bluetooth or Wi-Fi device continuously emits discovery frames, because that is how the protocols were designed. Your earbuds announce their presence so your phone can find them, and the phone itself queries the surrounding air for the networks it knows. These emissions are public by construction, and any receiver within range hears them.

Leonardo indeed states that the system works with or without a plate reader , indoors included, and recognises a vehicle whose plate has been obscured or removed.

The retrofit is the real political issue. Installing a new camera network triggers a vote, a public deliberation, sometimes litigation. Adding a circuit board inside a housing that has already been approved triggers nothing. The surveillance capability changes in nature without public debate, because there is materially nothing new to see.

From the vehicle to the person, and from the person to the group

A plate reader answers one question: where was this vehicle. SignalTrace adds two more: who was in it, and with whom.

Leonardo makes no secret of this, it is the sales pitch. The system builds what the documentation calls an electronic fingerprint, a set of identifiers “frequently emitted together”. The manufacturer’s example is explicit: across an entire city, only one vehicle will pair an iPhone 13rev2, an Audi car stereo, a Bose headset, a Garmin watch, a key tracker and the plate ABC-1234.

The product does not merely track vehicles. It automatically produces a graph of relationships between people, without anyone having had to formulate the slightest suspicion.

This is where the qualitative leap happens. By correlating the devices that regularly travel together, the system mechanically builds a social graph. Two phones that end up in the same car every morning are a car share, or a relationship neither party wishes to make public. Fifty devices captured in the same place at the same time are a gathering: a protest, a religious service, a union meeting or a queue outside a clinic.

None of these conclusions requires access to the content of a communication. They are deduced from a proximity table, by default, across the entire travelling population rather than on designated targets. This is guilt by association, produced industrially, upstream of any investigation. Tom Bowman, a lawyer at the Center for Democracy & Technology , sums up the problem in TechNewsWorld : what makes the tool useful for tracking a genuine suspect makes it just as capable of tracking every other motorist, none of whom consented to having their devices recorded.

Leonardo offers two counter-arguments: the system neither decrypts nor reads the content of communications, and it does not identify people by itself. Both statements are accurate, and both miss the point. The intelligence sought was never the content, it lies in the location metadata, which is more revealing than a message. As for identification, the manufacturer itself acknowledges that an investigator can link an electronic signature to a plate, then work back to the registered keeper through vehicle registration records.

American law written for something else

In the United States, state laws governing plate readers do exist, and some are demanding about retention periods and access purposes. But all were drafted around one precise object: the image of a licence plate. None anticipates the capture of personal device identifiers by the same equipment.

This mismatch does not create illegality but a grey area, one more convenient for the vendor. A police department can maintain, without lying, that its plate reader programme is authorised and compliant, while now collecting under the same regime data of an entirely different nature. Leonardo also holds federal contracts, with Special Operations Command and the General Services Administration, a purchasing route that largely bypasses local approvals.

The constitutional debate, for its part, has just shifted, and precision matters here because the state of the law changed this summer. In January 2026, a federal court in Virginia held, in Schmidt v. City of Norfolk, that the city’s Flock camera network did not constitute a search under the Fourth Amendment, because it did not cover the entirety of residents’ movements. The decision is on appeal before the Fourth Circuit, where the ACLU has intervened.

Then, on 29 June 2026, the Supreme Court handed down Chatrie v. United States . By five votes to four, in an opinion written by Justice Kagan, it held that police acquisition of a phone’s location data constituted a search, an individual retaining a reasonable expectation of privacy in that data even when held by a third party and over a short period. The ruling extends Carpenter v. United States from 2018 and weakens the third-party doctrine, as the CDT noted.

The precise reach of Chatrie over SignalTrace is unsettled, and it would be careless to claim otherwise: the ruling concerns data demanded from Google, not direct capture by a police sensor in public space. But it establishes the reasoning that matters, namely that the sensitivity of location data does not depend on who holds it.

The European question, which is the real question

This is where the file becomes uncomfortable for Europe. Leonardo is not an American supplier but an Italian group listed in Milan whose leading shareholder is the Italian Ministry of Economy and Finance, holding around 30 % of the capital, with the power to appoint the majority of the board. The Italian state is not a passive shareholder in this product.

The technical point, first

Under European law, a device identifier is personal data. This is not a doctrinal opinion but the settled position of the authorities. The CNIL explicitly treats the MAC address as such in its guidance on footfall measurement systems , and permits their collection in public space only under narrow conditions: anonymisation within a few minutes with a high collision rate between individuals, or reliable pseudonymisation followed by destruction within twenty-four hours, failing which consent becomes mandatory. The same guidance specifies that inviting people to switch off their Wi-Fi is not an acceptable means of objecting.

On 4 September 2025, in EDPS v. SRB (C-413/23 P), the Court of Justice of the European Union clarified that whether pseudonymised data is personal is assessed against the means of re-identification that can reasonably be deployed. Here the holder is a police authority, which has access to vehicle registration records. The means of re-identification are not hypothetical, they are in the next office along.

The nuance that changes everything

It would be wrong to write that SignalTrace “would be illegal in Europe”, and a legally trained reader would spot it immediately. Processing carried out by a competent authority for the purposes of preventing and prosecuting criminal offences does not fall under the GDPR. It falls under Directive (EU) 2016/680 , known as the Law Enforcement Directive, transposed separately by each member state, in France under Title III of the Data Protection Act. The CNIL points out that this regime is autonomous, with its own grounds for lawfulness and its own rights.

The right question is therefore not one of abstract legality, but one of conditions. Under that regime, such a system would require an express national legal basis, defined purposes, demonstrated necessity, a bounded retention period, an impact assessment and independent oversight. In France, plate readers are governed on these terms: articles L233-1 and L233-1-1 of the internal security code set out an exhaustive list of offences that open the way to their use, and retention remains among the shortest in the Union, fifteen days in principle, even if a Senate bill seeks to extend it.

That is the fundamental difference with the American situation. In the United States, the law governs an object, the plate, and silence on device identifiers amounts to permission. In Europe, the law governs purposes and categories of data, and that silence amounts rather to prohibition, for want of an express legal basis. The vacuum observed across the Atlantic does not exist here in the same form. Not that Europe is more virtuous: its legal technique is the reverse.

What the protection is then worth

That leaves the question this article is about. What is European regulatory protection worth when a European company, controlled by a member state, sells outside Europe a capability it could not deploy at home without new legislation?

The objections deserve to be taken seriously. A manufacturer is not responsible for its customer’s legal framework: it is for the American authorities to decide what they permit at home. The product is not sold to a dictatorship but to a state under the rule of law with an active supreme court, as Chatrie has just shown. And the industrial sovereignty argument is legitimate: if European groups shut themselves out of these markets, they will be taken by Israeli, American or Chinese suppliers, without surveillance receding by a single metre, and Europe will lose its technological base.

These arguments are admissible. They do not answer the problem.

First because the Union has already recognised that exporting surveillance capabilities is not trade like any other. Regulation (EU) 2021/821 on dual-use items introduced, in its article 5, a catch-all clause covering cyber-surveillance items, because the legislator accepted that a tool that is legal to manufacture may be illegitimate at its destination. Its limit is instructive: it is triggered by a risk of internal repression or serious human rights violations, categories designed for authoritarian regimes. A sale to an American municipal police force does not fall within them. The European grid examines the morality of the customer, never the nature of the capability being sold.

Second because such a product is not a stock to be cleared, but a capability that is sustained: it funds research, trains engineers, accumulates know-how and creates an installed base. The day a major attack pushes a member state to demand this capability, the debate will no longer be about whether to build it. It will exist, it will be European, it will be mature, and its supplier will be partly public. The “we are only following the market” argument then becomes circular, since the domestic market will have been prepared by the export.

That is what regulatory protection is worth in this scenario: it protects Europeans against uses, not against the existence of the means. It settles the question of who is entitled to press the button, and leaves industry to build it, sell it, improve it, then wait.

What can be done, without kidding ourselves

The first answer raised is always MAC address randomisation. It deserves an honest examination, neither promotion nor disparagement. It is real and it works.

Android since version 10 and iOS since version 14 randomise by default the MAC address used over Wi-Fi, with a distinct address per network. In Bluetooth Low Energy, modern devices broadcast resolvable private addresses, which change periodically and can only be tied back to the real device by a counterpart holding the resolution key.

Its limits are just as real.

Pairing reopens the door. The resolution key is transmitted during pairing. A device already paired, or explicitly approved, recovers the stable identity behind the rotating address. The mechanism is designed for that.
Many objects randomise nothing. Tyre pressure sensors, RFID badges, animal identification chips, car stereos and cheap peripherals emit fixed identifiers. Leonardo’s product sheet mentions exactly these categories, which is no accident.
Randomisation can be switched off. It is disabled network by network, and often is, out of convenience, for MAC filtering on a home router or by corporate policy.
The group survives the rotation of identifiers. This is the least intuitive and most important point. SignalTrace is not looking for an identifier, it is looking for a set of devices travelling together. If a single member of the group emits a stable identifier, the whole set remains attributable, whatever the discipline of the others.

The most effective measure remains the most tedious: do not emit. That means disabling Bluetooth and Wi-Fi at system level, in the settings, and not from the shortcut panel. The distinction is not cosmetic, we detailed it in our article on how your phone tracks your location : on most consumer systems, the quick panel button cuts visible pairing but leaves the software stack alive, and proximity scanning continues. That article described Bluetooth scanning as a theoretical vector. SignalTrace is its commercial product, catalogued and deliverable.

We have to stay honest about the outcome: these measures reduce the exposure surface, they do not eliminate it. A vehicle is still a plate, and a plate is still readable. The only way to emit nothing is to carry nothing, which is not a public policy.

What this says about our design choices

At Arpokrat, it is this reasoning that led us to handle Bluetooth at the Core level of ArpokratOS rather than at the settings level. A switch in an interface is a user preference: an update, a system application or a location service can bypass or re-enable it, without the user knowing. A stack that is absent cannot be re-enabled.

Faced with capture of the SignalTrace kind, this obviously does not make a device undetectable, and we do not claim it does: a phone remains on a mobile network, and the other objects in a vehicle emit on their own account. What it does guarantee is that one specific emission vector is absent by construction rather than disabled on trust. That is the argument we made about 5G and the law’s targeting error : legal protection concentrates on access to data when it should bear on the very existence of the infrastructure that produces it. SignalTrace illustrates the point, except that this infrastructure is built in Europe.

Conclusion

The most striking thing in this file is not the technical capability, which researchers have been describing for years. It is the deployment method.

There will be no new camera network to inaugurate, no municipal deliberation to challenge, no public contract identifiable as a change in nature. There will be units added to existing masts, under existing contracts, within programmes already authorised. By the time public debate opens, the infrastructure will be installed, written down and integrated into investigative procedures. The debate will then be about the conditions for accessing a database that exists, never about whether it should have been built.

That is the usual order of things where surveillance is concerned, and it is not accidental. What remains to be seen is whether Europe considers it has anything to say when its own manufacturers, backed by its own states, build this infrastructure for others. European law has carefully organised the answer to the question of who may consult this data at home. It has never asked who is entitled to build the machine.

Bluetooth on ARPOKRAT