Every time you drive past a plate-reading camera, your car’s location goes into a database that police can search months later, usually without asking a judge. On Monday, that quiet system faced three challenges at once: A warrant fight in a federal appeals court, a critical audit of Seattle’s police camera hub, and a Texas bill to delete most plate data within 48 hours and keep it away from immigration agents.
In Paris, the government named Iran’s Revolutionary Guards as the hackers behind the supermarket freezer attacks, and Brussels is preparing a response.
Jump To Section
- The Plate Readers Keep a Diary of Your Drive
- Paris Blames Iran for the Freezer Attacks
- Summary
- Outlook
- What You Should Do Now
- What Moved Since Yesterday
This briefing is part of your Rekindled membership. See what each tier includes.
The Plate Readers Keep a Diary of Your Drive
An automated license plate reader (ALPR) is a camera that photographs every passing plate and logs the time and place. Companies such as Flock Safety sell networks of them to police, homeowner associations and retailers, and many share data with each other. The result is a searchable record of where millions of ordinary cars have been, and in practice a time machine for anyone’s movements, built before most people being tracked were asked.
Confirmed (OSINT): On Monday the Electronic Frontier Foundation (EFF), the American Civil Liberties Union (ACLU) and the ACLU of Ohio filed a brief in the Sixth Circuit Court of Appeals in United States v. Sturdivant (EFF; brief). The key facts:
- The search: Cleveland-area police knew only the make, model and color of a robbery suspect’s car. They ran open-ended searches of two plate-reader databases, Flock and ELSAG, found a matching car near the robbery sites, and arrested its owner. No warrant was sought.
- The ruling under appeal: A district court said there is no expectation of privacy in a license plate because anyone can see it, so tracking the car in public is not a search.
- The argument: EFF’s Andrew Crocker writes that plate readers give police “a virtual time machine to view suspects’, or anyone else’s, past movements (and much more) with just the click of a button.”
The same day, New York University’s Policing Project released its audit of Seattle’s Real-Time Crime Center (RTCC) (KUOW; Policing Project). Mayor Katie Wilson ordered it after pausing the network’s expansion. Its 19 recommendations include a warrant to track a person across cameras, except in active emergencies, and limits on recording protests and sharing data. Several safeguards turned out to be habits, not written rules: Footage is kept five days in practice, but policy allows 30. The Axon Fusus software logs who views a camera but does not require a case number or reason, and does not log its artificial intelligence (AI) object detection at all.
State Rep. Mary González (D-Clint) filed House Bill 763 on Monday (KPRC). It would limit plate readers to listed purposes, require most data to be destroyed within 48 hours, ban sharing with federal agencies including Immigration and Customs Enforcement (ICE), and let people sue for $1,000 per violation. Texas has no statewide plate-reader law today. The legislature convenes on 12 January.
Our Take: These fixes are welcome, and all of them arrive after the cameras went up. The databases and sharing agreements already exist, and the default is still “search first, justify never.” A court ruling or a bill does not take down a single pole. Until a warrant rule is law where you live, assume your car’s movements are on file and available to far more agencies than the one that bought the camera.
If you want to cut what your daily movements reveal, the Travel and Physical Operational Security Guide in your Arsenal covers route and vehicle habits and much more.
Status now: The Sixth Circuit appeal is briefed, Seattle’s mayor has the audit on her desk, and Texas HB 763 waits for January. What it means for you: In North America, plate searches without a warrant remain legal in most places today. In the UK and much of Europe, automatic number plate recognition (ANPR) networks are run nationally and retain data for long periods, so the same diary exists with even less local debate.
Paris Blames Iran for the Freezer Attacks
In mid-October, hackers took over the digital thermostats on refrigeration systems in hundreds of French supermarkets and pushed them from as low as -27C to over 50C, destroying thousands of tons of food. A second wave hit stores in Belgium, Ireland, the Netherlands, Sweden and Estonia at the start of November. It was the first time most people saw a connected shop appliance turned into a weapon against the food supply.
Confirmed (OSINT): French Foreign Minister Jean-Noël Barrot said on Monday that Iran’s Revolutionary Guards were behind the attacks, calling them an act of “unprecedented scale and unprecedented aggression,” and promised Europe-wide sanctions (The Guardian; France Diplomatie). Paris prosecutor Laure Beccuau named the unit Shahid Kaveh, citing Farsi and IP addresses traced to Iran. As many as 700 stores were hit in October; cold stores holding French blood products were targeted last week. The European Union is ready for a “swift and united response,” and EU foreign ministers meet on 16 November.
Our Take: The attribution may well be right, and Iran has motive while Europe hosts bases used in the war. But no technical evidence has been published, and governments that blame a foreign enemy rarely stop at sanctions. Expect the answer to include more monitoring of networks and devices at home: Mandatory reporting, more access for security agencies to company systems, and pressure to register and certify connected equipment. Some of that will improve security. Some of it will widen what the state can see.
The same weak points sit in your home. The Home Network Hardening Guide shows how to wall off smart thermostats, cameras and appliances from the rest of your network, and much more.
Status now: France has named the unit, opened a criminal case and asked for EU sanctions; the EU decides its response next week. What it means for you: In Europe, expect fresh cyber rules for retailers and critical suppliers. In North America, the same unit has a history of targeting water utilities, so treat any internet-connected home device as a door that needs a lock.
Summary
Monday showed the two faces of the same problem. State surveillance networks keep growing faster than the rules, and the official answer to a foreign hack tends to be more state visibility into networks. In both cases the ordinary person is the one being watched, and the limits come years after the equipment.
Outlook
(analysis, not certainty) Our Take: Plate-reader warrant rules will spread through courts and statehouses over the next two years, slowly and unevenly, while vendors sell new cameras faster than cities can audit them. The EU will sanction named Iranian individuals and push faster incident reporting for food suppliers. What To Watch: A Sixth Circuit date in Sturdivant; Mayor Wilson’s response to the Seattle audit; Texas referral of HB 763 in January; the 16 November EU ministers’ meeting; any release of the secret Section 702 opinion as Congress returns. I cannot predict how fast courts move, but every month without a warrant rule adds another month of your driving to the file.
What You Should Do Now
- Find the cameras on your commute. Check your city’s council records or public trackers for plate readers on your regular routes, and ask your council member whether a warrant is required to search them.
- Ask who gets the data. In the US, ask your police department in writing whether plate data is shared with federal agencies or other states. Silence is an answer.
- Support plate-data limits. Texas members: Contact your representative about HB 763. Elsewhere: Push for 48-hour deletion and a warrant rule in your state or city.
- Isolate connected devices at home. Put smart thermostats, cameras and appliances on a separate guest network, change default passwords and turn off remote access you do not use.
- UK and EU members: Ask your police force or data protection authority how long ANPR data on your car is kept, using a subject access request.
What Moved Since Yesterday
- Australia’s Digital Duty of Care bill (Monday’s lead): eSafety Commissioner Julie Inman Grant asked the Senate inquiry for clearer duty-of-care obligations. The inquiry has received more than 160 submissions, and its report is still due on 20 November (MLex).
Status for you: “Clearer” duties for the regulator usually means stronger scanning obligations, not weaker.
- DHS and ICE oversight: No new move since Rep. Bennie Thompson’s records letter; his 2 December document deadline stands.
Status for you: The surveillance stack built since 2025 keeps running until January at the earliest.
- Section 702: Congress returned on Monday. Lawmakers may push a renewal in the lame-duck session while privacy groups demand the secret 17 March court opinion first; it has not been released (Nextgov).
Status for you: Warrantless collection continues to March 2027 either way.
- Freezer attacks (2 November lead): France’s attribution to Iran is the first official answer to who did it.
Status for you: The cause is named, but the vulnerable equipment is still in stores and homes.
Get more from The Rekindled. Seer members get every daily briefing, weekly summaries, and The Arsenal, including the travel and home-network guides linked above. If you want firmer predictions on where plate readers, camera hubs and state cyber powers are heading on both sides of the Atlantic, plus concrete steps and periodic crypto market tips, Sage is the next logical step. Compare membership tiers.
