Skip to content
Naked Security Naked Security

California tests digital license plates. Is tracking cars next?

Beyond potential police surveillance, the plates could be as susceptible to hacking as other wireless and IoT technologies.

Alex Roy’s father had a saying:

Anything is possible, but not everything is necessary.

Some would say you could apply this sentiment to the the Internet of Things (IoT). You could certainly apply it to the Rplate: “the world’s first digital license plate and cloud app store.”
Yes, now we can add license plates to the pile of “do we really need xyz IoT thing,” which already includes internet-enabled fridges, toasters, washing machines and coffee makers.
Roy, editor of a website called The Drive, points out that contrary to the manufacturer’s claim, the Rplate isn’t the first digital license plate.
But it is, in fact, the one that California is now piloting.
The IoT sitting inside your car’s license plate: what could possibly go wrong? But let’s start with this question: Why?
As the Sacramento Bee reports, California is the first state to adopt the digital plates. A pilot project was launched last week. Sacramento is also scheduled to start testing the plates on some of the cars in the city’s fleet.
The plates will enable those motorists who choose to buy them (the digital plates aren’t required, and they’re certainly not cheap; think in the ballpark of $699, plus installation fees, plus a monthly fee of about $7) to electronically register their vehicles. That means no more stickers that you have to slap onto your plates every year. If the Department of Motor Vehicles (DMV) decides to allow it, the plates will also be able to display personal messages that car owners can change at will.


Another advantage: according to the plate manufacturer, Reviver Auto, the plate can let police and the owner know exactly where a stolen car is – unless, that is, the thief takes off the plate. Then, at least you’ll know where the plate has been tossed.
But if the police can track your car when it’s been stolen, what’s stopping them from tracking you while you’re just normally driving around?
Beyond the risk of police surveillance, the plates could be as susceptible to hacking as other wireless and IoT technologies.
Everyday objects – things like kettles, TVs and baby monitors – are getting connected to the internet with elementary security flaws still in place.
There’s no suggestion that California police currently have plans to use the digital plates for surveillance or law enforcement. At least, not beyond what law enforcement already does with automated license plate readers. Beyond the Drug Enforcement Administration’s (DEA’s) license plate reader program, which tracks millions of Americans, Los Angeles had a novel idea for how to use the technology: back in 2015, the city proposed using the readers to figure out who owns cars that park or drive slowly through areas known for prostitution, after which “Dear John” letters would be sent, with the hope that they’d be intercepted by wives, mothers and girlfriends.
According to the Sacramento Bee, Sacramento’s innovation officer, Louis Stewart, said the city took shipment last week of 24 new Chevy Volts with Rplate devices that it got for free from Reviver. Stewart said that when a car is stopped, its license can display programmed public service messages, such as street closure notifications, an ad for a city service, an Amber or Silver Alert warning for missing or abducted children, or some other emergency alert.
First, though, the city has to talk with the labor union about refraining from using the plates to monitor city employees, he said.
Stewart says he sees the plates as a stepping stone, along with an upcoming Verizon 5G Wi-Fi network, for the city to position itself as a testing ground for autonomous or driverless vehicles. The Sacramento Bee quoted Stewart, who says that welcoming Rplates to town is all about cutting-edge jobs for city residents:

We want to look at ourselves as a laboratory for a lot of these technology companies. Come to test in Sacramento, come see how your product or service is viable.

Maybe it’s all about those jobs. But one thing we know about California: its law enforcement likes to see your plate. In fact, they recently banned people from covering up those plates. They like to know about your car, and like police everywhere, they’d prefer to know a lot about you.
If they can get it electronically, it’s quite possible they might move to do just that.


19 Comments

I am pretty sure they already track the cars with ALPR ( in the US ) at certain entry points / intersections of the city, this just takes it to the next step.

Reply

As said above “what could possibly go wrong?”…and advertizing on top of it!! What a grand idea.
A hacker fellow with a Raspberry Pi, some small two way radio, Wireshark (or something similar) can sit at a bus stop and extract (I’ll leave it to your imagination)…
Methinks somebody got sold some snakeoil ;) .

Reply

None of my first 4 cars cost as much as that plate does.
CA, they raised the Min wage so they can charge more for everything. lol economic madness.

Reply

Same thing happening in Ontario … min wage has raised but all hours have been cut and everything from consumer goods to gasoline to groceries have gone up by 15 % – Everyone has less money and is paying more taxes

Reply

Lisa,
I believe the real reason is to increase tax revenue. CA is losing gasoline tax revenue due to increased fuel economy and electric cars. The idea has been floated to tax a car for the amount of miles it is driven. This digital license plate technology will enable automatic logging of miles driven.

Reply

Why bother with a plate at all? What are we trying to accomplish. Get a standard plate, a device in the car where the thief can’t find it and stop using stickers. Cops can scan the plate and see if you renewed or not. They already scan automatically anyways.

Reply

Tracking cars is definitely next. Someone will come up with the great idea that the license plate will need to be integrated with the car electronics so you can’t drive it when your license plate expires.

Reply

California may have some problems with additional messages. This has already been tested in the New Hampshire “live free or die” motto it put on its license plates. The Supreme Court found that states cannot force drivers to be mobile billboards for messages with which they don’t agree. It’s a first amendment issue.

Reply

I have this intense desire to hack this thing to throw an HTTP status 418 code “I am a teapot” (under driver control) anytime I think I am being tracked, er, asked to brew coffee.
Yes, I got a new supply a Silly Pills this morning. :)

Reply

The SacBee article states that the purpose of the pilot is to identify potential benefits. The three “benefits” that are already being considered are not very compelling. Replacing a physical, annual registration sticker with an e-ink “sticker” fails to ponder why we even need stickers in 2018. Police could be equipped with ALPR, and departments that can’t afford to do so could have their officers manually enter a license plate number. I would be okay with ALPR checks in the narrow use case where a police vehicle driving behind me wants to check out everything they already can lookup based on my license plate number. They should also be required to manually double-check a positive hit to avoid a false positive caused by an OCR misidentification.
Using the digital plates to help people locate their stolen vehicle is not a good idea because thieves will remove the plate, likely causing even more damage. Using the digital plates to let people or the state display custom messages is a silly benefit at best that doesn’t add much value to justify its cost. Edward added that digital plates could be used to implement mileage based use taxes. I think it would be much better to track people’s mileage by coming up with ways to audit enough people (e.g. pay-per-use insurance, smog checks) so they are honest when they self report. I’d be leery of ALPR checkpoints for this case.

Reply

The UK ditched stickers (actually they were paper discs that you stuck inside the windscreen so they could be read from the outside) a few years ago. The sticker only told 1/3 of the story anyway, given that vehicles also need an annual safety test certificate and drivers need a minimum level of insurance cover. These days ANPR apparently draws down all that data in one go.
As for ANPR in police vehicles…it’s not such a narrow case as the cop being right behind you, given that oncoming vehicles can be scanned, too. (I don’t know if you have front tags in California – in the UK cars do but motorocycles, trikes and quadricycles don’t. I assume that the issue of no front tags is moot anyway given a rear-facing camera.)

Reply

A front plate is required by law in California, but many people still ignore it even though the DMV provides two plates. I don’t anecdotally hear people get cited for a missing front plate, and a lot of cars (like mine) don’t even have a proper mounting area for them. You are correct that most checkpoints with cameras (e.g. red light cameras, toll bridges) can also capture rear plates.
My concern with ALPR everywhere is that it enables government to be overzealous with surveilling and tracking its citizens. I’m okay with police using it in the narrow case when they pull up behind me because they can already manually lookup my plate. However, I generally agree with jimv that our 4th Amendment should protect us from being caught in overly broad dragnets.
P.S. Our local San Francisco Bay Area CBS affiliate, KPIX 5, reported that the digital license plates also require a $7 per month fee presumably for its cellular data connection! $84 a year is a hefty price to pay to avoid dealing with a registration sticker.

Reply

Well, people pay weirdly for automotive coolness. In the UK all plates follow strict alphanumeric patterns, so proper personalised plates are impossible because you aren’t allowed whatever you want. You have to find weird “1337speak” combinations of existing patterns, sometimes (illegally) aided by a strategically placed bolt through the plate for an optical illusion, e.g. making 11 look like H or 6 look like G.
Apparently, the old-style plate 51 NGH, which looks like the surname SINGH if you cheat a bit with the typeface when you print the plate…
…went for more than £250,000.
You could pay a lot of monthly $7 tag fees for that!

Reply

Should they also double check to see if those slow drivers through hightraffic prostitution letters are just lost before sending dear john letters to their wives, perhaps. Like any tracking software, where is the data being stored, for how long, and who has access to it? What level of threat constitutes a video search? What if this information affects hiring decisions? You Didn’t get arrested but you hang out in some shady areas…

Reply

Why is “potential police tracking” such a threat/concern? I guess you’d rather crimes didn’t get solved. Also ignores the fact that this already regularly happens, and the HUGE upsides of this type of tech. Your personal bias and opinions are showing WAY too much in almost all of your articles Lisa.

Reply

Re: “HUGE upsides of this type of tech.” Please list them all for us, with specific details to ensure that your enlightenment is brought to the rest of us.
As for the addition of another method/tool for tracking all of us free citizens of the United States and the Great State of California, just exactly how do you define the possible benefit to all of us other “citizens”? Is it the ads you can profit from on your digital license display? Is it the warm and comforting feeling that our state government is not only watching us from cameras and collecting our vehicle and cellular data from our vehicles as we pass by the data readers, but also using Cellular spoofing devices to make our phones think that they are actually accessing a cell tower for normal communications?
I get the idea of making sure that our Law Enforcement personnel have the best tools to do their jobs in finding and apprehending criminals and people who disobey the law. I’m all for that, but only up to a point. And that point is the 4th Amendment to the United States Constitution.
And I’ll end this particular comment by taking a quote out of context; but only because it has just as much meaning today as it did back in 1775 when Ben Franklin wrote in his “Contributions to the Massachusetts Conference”; “They who can give up essential Liberty to obtain a little temporary Safety, deserve neither Liberty nor Safety.”

Reply

And of course these “smart (ass) plates” will never break down or have ANY tech issues. So here’s some idiot with way more money than sense (proven because he spent $700 on a fancy license plate) which plate suddenly decides it has been stolen and displays that message. Idiot gets pulled over and arrested, calls his attorney, and sues *everyone* for wrongful arrest, plate maker, installer, dealer, police jurisdiction, DMV and probably the abominable snowman. Eventually he wins a huge judgement and lives happily ever after. Except the taxpayers get to pay for it because this whole brilliant idea was pushed by the state for the “benefit” of the state in the first place.
Why did it go bad? Someone *just* tapped it while parallel parking. Click – bzzt – poof.
I’ll keep my Paleolithic aluminum “dumb plate” and put a sticker on it every two years. Man, that’s such hard work, I have to open the envelope, actually bend down to put the sticker on, and then throw away the trash – but if I had a “smart plate” for only $700 plus $20 a month, I could avoid ALL of that work and hassle!

Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

Subscribe to get the latest updates in your inbox.
Which categories are you interested in?
You’re now subscribed!