A year ago I ran for the 16th District council position in Nashville (no, I’m not that person currently in the news.) One of the things that seemed like a good idea during that run was to go through the Citizen’s Police Academy and actually learn what needs one of the branches of government I would be in communication with on a regular basis had, and what challenges they faced.
TL;DR – idea for fingerprinting a car using TPMS rather than relying on license plate info.
One of the things that stuck out at me was a course we had on stolen vehicles. Thief steals a car, drives around and finds another car that looks just like it, swaps plates, and chances are that the person who’s plates have been swapped will never notice the swap until they get talked to by officers (possibly at gunpoint,) because it looks to police like they’re driving a stolen vehicle.
If you’re dealing with a professional, they’re going to have found and disabled LoJack or any satellite trackers pretty quickly. You can purchase signal jammers fairly inexpensively (totally illegal but they’re cheap,) so that you can get the vehicle wherever you want and at your leisure extract the tracking stuff.
That said, most stolen cars are not stolen by professionals, they’re stolen out of driveways and parking lots because people left their keys inside, left the cars running, or otherwise made the vehicle a very easy target. They’re driven around, abused and abandoned eventually without an international spy cartel somehow involved.
I read a story about a guy who had that happen (the removal of the LoJack,) and just happened to have a TYLE sitting in his trunk. Someone walked by, picked up the TYLE beacon, and he and police converged on his now-abandoned car and retrieved it. Now, these BTLE trackers are useful, but they rely on a battery, and someone running the app happening to walk by and be within range for enough time (you probably would not pick up someone driving past you).
But what about other signals your car makes? We learned from the Sense Energy Monitor that everything in your house has a pretty unique signal … probably not… TPMS sensors however have been jumping around in my head for a while.
A TPMS is a small little wireless device that’s in most people’s tires these days that tells a receiver in your car when your air pressure is too low or too high. The TPMS transmits a serial number, and a notification whether things are good or bad. The notification is able to be picked up by a receiver 10 feet or more away in the engine compartment.
As your car rolls along imagine four little TPMS sensors broadcasting unique (enough,) serial numbers and pressure indication several times a second for all the world to hear. Because they do. So how hard is it to turn TPMS data that your tires are transmitting into usable data? Not particularly.
You’d build a database in a couple of phases probably – identification phase in which you’ve got an internet connected $30 Raspberry Pi, a TPMS reader, a $50 plate cam, and some MTN Dew for your programmer.
Set the device out at a busy road, car drives by, TPMS sniffed, plate captured and tagged in a database with all the TPMS sensor data your little internet connected box can hear. After a few runs by different equipment and some outlier sorting you’ve probably narrowed it down to the TPMS sensors just on that car and not the others nearby.
What’s that good for? You’ve now got a fingerprint of cars and their associated license plates. The license plate passes with a different fingerprint you’ve potentially got a plate swap, or four new tires and $240 worth of TPMS sensors thrown in (mine have generally been reused.) As this is just a cheap computer that could be solar powered easily set it and forget it and build a mass database.
You can disable a tracker pretty easily, but your average car thief is not going to be disabling TPMS sensors, stealing tires to change the fingerprint, etc. They wanted a vehicle with the least effort possible.
Now when a car is stolen, police would look up the plate, see if there’s sensor data in a TPMS database, and see where the last $100 monitoring device heard the TPMS signals that matched the car and what plate it has on it at the moment.