Schneier on Security
A blog covering security and security technology.
« More on Kish's Encryption Scheme |
| "Data Mining and the Security-Liberty Debate" »
June 11, 2007
License Plate Cloning
It's a growing problem in the UK:
"There are different levels of cloning. There is the simple cloning, just stealing a plate to drive into say the Congestion Charge zone or evade a speed camera.
"It ranges up to a higher level which is the car criminal who wants to sell on a stolen car."
Tony Bullock's car was cloned even though his plates were not physically stolen, and he was threatened with prosecution after "his" car was repeatedly caught speeding in Leicester.
He said: "It was horrendous. You are guilty until you can prove you're not. It's the first time that I've thought that English law is on its head."
Metropolitan Police Federation chairman Glen Smyth said the problem has grown because of the amount of camera-based enforcement of traffic offences, which relies on computer records on who owns which car.
Posted on June 11, 2007 at 1:52 PM
• 58 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
UK Utopia, Not A Perfect Picture.
Is it just me, or is the UK government beginning a lobbying campaign for mandatory RFID chips in all license plates to allow the automated monitoring equipment to verify make, model, owner, authorized driver, etc for every car that passes?
You don't actually have to steal the number plate. In theory you're not meant to be able to buy a new number plate without the car's registration documents. In reality go to any car related show or event and there will be several vendors who will happily sell you a number plate with any combination of numbers and letters - no questions asked. They're also a lot cheaper and the next time I need another number plate for a trailer ( or a bank job! ) I'll get it there.
As the article commented the problem is the total reliance on cameras.
cameras aren't the problem, it's the reliance on matching the license plate in the computer records... if they double checked that the car matched the records, crims would have to ensure they clone plates onto near identical cars...
just my 2c, as i can see it's probably not far away here in NZ
Sounds like another case of technology (in this case speed and other cameras placed on side of road) being used in place of intelligence (plod being in car on side of road).
As long as there are vast amounts of money to be made, with minimal effort on the part of the government (oh no, it's all about road safety mister citizen) then these cash machines ^H^H^H^H^H^H^ cameras will be with us forever more, regardless of the cost and inconvenience that the general public has to put up with.
When does the revolution begin?
I work in the tolling industry. To be precise, in the free-flow tolling industry (for Americans, this is mostly called open road tolling), which relies on ANPR (Automatic Number Plate Recognition) and, optionally but preferably, DSRC (microwave) tags to identify cars and charge their owners the right toll. You can never be fully sure a car has not been cloned, but you can identify a lot of clones by using stereoscopic (or laser) artificial vision systems and comparing the vehicle's profile with the brand/model you have on your records. Unless the cloned plate belongs to the same brand/model, you can tell the difference without human activity. Enforcement cameras, however, mostly lack any of those additional systems, due to their high cost and necessary infrastructure (both gantries and backoffice systems).
My point is the following: those systems based on ANPR pose a minor threat to privacy. ANPR is not accurate enough (yet) to rely on and requires a lot of computing power and storage capacity, plus direct line of vision with the licence plate. DSRC tags can be easily read without letting the user know (in normal operation, the tag "beeps" when read, but this can be overriden). The real problem for privacy is the use of satellite positioning for tolls. All vehicles fitted with a GPS or Galileo on-board unit for tolls can be easily tracked even when they are out of the tolled highways. This technology could be used for speeding enforcement (listen: you will pay for a device that will later have you fined) or just to keep track of your movements... all across Europe.
I do not see many people in the industry addressing these concerns. Most people will simply disregard these fears as conspiracy theories, but this is a threat as real as it gets.
There's also the issue of the red-light cameras --
I think it was a Baltimore Orioles game where the cameras around the stadium were going off like crazy.. Thousands upon thousands of tickets were sent out.
Turns out -- the cops forgot to shut the cameras off as they became traffic guides. Must have cost a pretty penny to send them out.. and then send out the ensuing "oops" letter.
Matching shouldn't be that hard... I've worked with projects that did basically this (systems that would look at licenses plates, query DMV, and see if the reading you just got on the emissions levels were out-of-bounds for that car) in the early 90s.
Double-checks would be good here (although too many checks mean that you might be able to skip out on your congestion charge by changing your car's color frequently)
The problem with car identity is similar to, but worse than human identity.
1) Car's don't have DNA - so you don't have detailed biometrics, and
2) Authorities want to check this ID, without contact, when the subject is doing 70mph.
My father was given a ticket for a city 100 miles away from him home. The photo showed the wrong kind and colour car.
He "got off", though innocent because the "offense" was doing 50moh in a 60mph zone - Yes, 10mph SLOWER than the limit!
The camera/system was mis configured, but it was only until my father pointed this out that the charge was dropped!
it would be funny if it wasn't so sad...
Checking car model and colour doesn't go very far. It isn't hard for an attacker to drive around London until they find another white 1999 Toyota Corolla 1.6l sedan to copy the number plate from.
Here's a countermeasure to this (requires Police cooperation): if you believe your plate has been cloned, they take your old plate and issue you with a new plate, and register the old plate as "arrest on sight." If after this there are still sightings of the old plate, you're presumed innocent.
You won't have any reason to believe your plate has been cloned until you get a ticket or similar; so while your measure helps, it does still leave criminals with about a week during which they can use the plate with impunity.
Combined with a clampdown on those selling plates illegally as mentioned by John above it should minimize the problem though.
Would it be cruel if somebody learned Tony Blair's license plate number and released it to the world for the cloners to copy?
Triggering an arms race?
The person cloning will keep track of you and clone your NEW plate.
The basic problem here is replacing the cop by the side of the road with an automated ticket generating (= cash generating) machine....thereby making 'gaming the system' that much easier.
As mentioned above, this stands the law on its head by 'presuming guilty until proven innocent'.
Currently, we have a battle of wits between the police and criminals about licence plate cloning.
I think it is possible that the licence cloning problem might be used as one of the reasons to introduce mandatory GPS tracking of all UK road vehicles, as discussed in Manuel Delgado's comment.
If we do adopt mass surveillance using GPS or Galileo then a fascinating new security conflict will develop between the police and criminals who offer to "fix" your tracking device so that you cannot be tracked. Many ordinary citizens will be tempted by the prospect of dodging speeding fines and road tolls so finding a way to break a satellite tracking system will be lucrative.
Personally speaking, I'd prefer to have more traffic police.
This seems to be a really bad idea. Someday, you'll get pulled for something. The police will run make and model on the plate, and when they don't match, a routine traffic stop turns into a much larger investigation. Even if make and model match, the VIN won't.
Esp. when the guy with the valid plate starts calling in. The obvious step for the police is to set an alert when that plate is captured, and then pull the car over. The valid owner is annoyed, true -- but the invalid plate gets caught and nailed for explicitly avoiding the toll.
I don't see how replacing the camera with a cop will really fix the problem either -- indeed, the camera's got a better chance of catching a fake plate than the cop, because the camera has time to "run" all the plates, and doesn't get bored doing so.
Indeed, timing would be a real problem. Plate XYX shows up twice in a minute, in places miles apart. This is a red flag -- either there's a misread plate, or at least one of the plates is fake.
Running around with a copied plate is really running around with a badge that says "I steal plates", and if the cops ever, for any reason, run the plates, you're nailed. You can say you weren't paying attention when you did 75 in a 55, but it's hard to say that you weren't paying attention when you bolted the fake plates to your car.
A nice example of escalation.
I bet they didn't think about the cost of starting an escalation when they did their budgets!
"Tony Bullocks?" Seriously? Sounds like someone from the UK version of *The Sopranos*.
If the problem grows, you shouldn't need to prove you're not guilty. Of course you can't allways prove not beeing in West London on June 9 at teatime.
I like to introduce a new solution: Backlight LCD-plates which change their code dynamically every few hours.
You update your plate via encryption, and a database keeps track of valid codes, and which code belongs when to whom.
Date and Time of speedviolations is saved although.
"""I bet they didn't think about the cost of starting an escalation when they did their budgets!"""
So what if it's not budgeted for, it looks like someone else is paying that cost.
Did someone say 'externalities'?
I'm aware my proposed countermeasure is not perfect, but it raises the bar: the attacker needs to frequently recheck the victim's plate to track changes. If the attacker fails to do so in a timely manner, they run a much higher risk of arrest.
All these ideas are wonderful, but one of the UK government responses to this automatic law enforcement by camera has been to reduce the police infrastructure and revert many responsibilities to the local authorities (which haven't picked them up). The countermeasures suggested here are dependent on having the manpower to follow through.
@Kaszeta: "Double-checks would be good here (although too many checks mean that you might be able to skip out on your congestion charge by changing your car's color frequently)"
Frankly, I think paying the congestion charge would be cheaper than constantly having your car resprayed :-)
I think this is a problem that can be neatly solved by more intrusive and expensive technology. It is possible to win this arms race. The way to do it is to make the car's identifiers so expensive to clone that the profit of selling a hot car doesn't cover the cost of circumventing them.
Today we have VINs etched into most of the important parts of cars. Faking all of them is prohibitively expensive for car thieves. Unfortunately they don't have to, because it takes a very detailed inspection of the disassembled car to check every VIN, and they only have to procure one or two fraudulent license plates to avoid that inspection.
In the future, I expect VINs to become automatically scannable, the same way license-plates are today. Perhaps the etchings will be replaced by hardened radio identifiers. Perhaps scanners will just get so good they can read the VINS through the car. Whatever the underlying technology, it will happen eventually, just like it happened with license plates.
It only takes a handful of tickets per car to offset the costs of rolling out more sophisticated identification technology.
I think it's interesting that the privacy issues some of us are debating here are an externality to the issue of cloned license plates. In this case, better surveillance technology helps the police, AND potential victims of license cloning.
"Frankly, I think paying the congestion charge would be cheaper than constantly having your car resprayed :-)"
How about paint jobs that change colour depending on lighting or temperature?
The discussions here regarding the use of GPS tracking devices seem to all be working on the assumption that the authorities will have unrestricted access to the data. I don't believe that would be necessary.
I would propose that a better system would be to allow people to record their own movements using inexpensive GPS devices, but not provide such data to authorities unless it was in order to dispute the automated infringement mechanisms. Thus, it is not tracking so much as logging. Think of it as self-surveillance.
As pointed out above, it would be very difficult to show you were not at a certain place and time without such data, but that doesn't mean you have to hand the data over to the government pre-emptively. There is *way* too much potential for abuse if the data is stored anywhere centrally, so you don't. Self storage allows you to be in control of your own data, and most importantly, it allows you and you alone to decide who can see it.
By all means, take a hash of the data sets and store *those* centrally at regular intervals (eg. daily) to allow them to be validated in the event of a dispute (when the speed camera fine arrives), but that should be all(*) that is required.
(*) Oh, and of course a way of ensuring that the device in question is not left at home while you go out speeding.
I gave a talk on such a system at the AUUG conference in Melbourne last year. There are practical ways to do it without trampling all over privacy.
catch a train... Oh sorry your in the UK, well the trains are still better than the US ;)
``If we do adopt mass surveillance using GPS or Galileo then a fascinating new security conflict will develop between the police and criminals who offer to "fix" your tracking device so that you cannot be tracked."
GPS relies upon a direct line of sight with the sky. In terms of a car, this would suggest an aerial would be required. Kids down my way like ripping off aerials.....
If it is `just a box' then surely it will be fitted out of sight (which contradicts the above, but lets assume for a minute that it is). Insulating the surrounding area with tin foil should suffice. Incidentally, I cannot put this thing on my dash - it would block my line of vision and this would get me a nice fine.
The technique of License Plate Cloning / steeling has been used by the German "Red Army Faction" in the 1970s to mask stolen cars.
Of cause they where smart enough to choose cars of the same brand, model and colour.
Law enforcement used to call those things "phantom cars".
Oh, and, when "pulled over" they probably would have opened fire.
@Hullu "How about paint jobs that change colour depending on lighting or temperature?"
How about paint jobs that are made from Reflective Self-Assembling Squid Proteins?
@Erik V. Olson : This seems to be a really bad idea. Someday, you'll get pulled for something.
This is not true in the UK. Unless you do something really blatant in front of a police car, especially speeding, you won't get pulled over.
I once read that most escaped prisoners in the US are caught when pulled over for a minor traffic violation. Here, no-one gets pulled over for a minor traffic violation (wrongly in my view, but we don't have that many cars on patrol.
Whiners! You should take a few for the team! I mean after all, what is more important, your life, livelihood and very existence; or the convenience of civil servants? You were created to serve the State, not the other way around!
The real scary point to this story is that, as the police become more dependent on remote monitoring and automated systems (such as red light cameras) to do their job for them, the whole concept of "innocent until *proven* guilty" gets turned on its ear, and the onus is placed on the wrongfully accused to prove their innocence.
This has always been somewhat true, but with the proliferation of these new tools, the problem has really been brought to light.
It's funny how the vast majority of answers here seem to think that *more* intrusion is the answer.
The number of laws on the books, combined with automatic enforcement of them, the set-up with the courts (Yes, you can take it to court, but then the £120 fine becomes £600 + costs) and the presumtion of guilt, and the pressure to force you to plead guilty for a much reduced sentence, rather than prove yourself innocent, means that there will rapidly be fewer and fewer people who are "clean" enoguh for many jobs, now that everyone in the UK needs to get a criminal disloseure for almost any job, no matter how trivial.
This whole system leads to a polarisation of society. One mistake follows you forever, and ensures that you can never start over, as biometrics and tracking ensure the System knows who you are.
Someone once said that laws can only control those who break them. Sadly, our current leader (Still Blair, months after he resigned!) is keen to ram through as many (mostly even more anti-terror) laws as possible, to ensure everyone is under surveillance and control.
If I speed from here to there, and hurt no-one, then what difference does it make? And what justification is there for a ticket 10 days later? Yes, if there were an accident or incident, then great, use the excess speed as a factor in the punishment. But after the fact, it becomes clear that this is simply about making up for lost smoking taxes.
Besides, I, like most every other driver, pay road fund tax and huge duties on fuel. Tracking me all over the place with a billion pound camera system to fine me for not hurting anyone - well, it seems a bit heavy.
One thing that has not come up is "official cloning" AKA Co**Ups.
The DVLA has been brought to task on a number of occasions for issuing the same licence plate to a number of vehicles (I belive the record was five vehicles of different makes and colours).
So untill they can fix that little problem (which they never will based on current attempts) all the "catch cloning" scheams are going to produce a somewhat embarising situation...
No I suspect the low cost high income stratagie is the one that is going to be followed, ie don't fix the system keep sending out the tickets and dening there is a problem. Oh and one extra wrinkle the current discount for paying promptly will be augmented by an outrageous fixed "court costs" of say 500GBP (1000USD) to discourage you from contesting....
I have never understood the issue people have with speed limits. Is it so hard to drive more slowly and get there 5 minutes later.
Speed limits are really risk limitations. "We have checked this road and considering the conditions we think that a speed of 90km/h is a good trade off between security and convenience"
Speeding people are the same kind of people that just can't resist opening every single document that ends up in their inbox. It's the same "I don't care what the professionals think is secure, I do what is continent for me" thinking. Only when it comes to speeding it's the lives of the people in the area that are the risk, not some local data.
Now, with that rant out of the way, about the plates. It's the same thing as always. If you place more value on an ID document in any form it will also be stolen or copied more often. Making ID plates that are harder to copy is the obvious countermeasure. Seems like physical engineering to me. Radio tags, holograms, special patterns and all the other stuff we use for normal ID cards could be used. It is enough if the plates can be recognized as fake on a short distance, as it makes it dangerous to park the car in any location a policeman might pass by. Stolen plates are obviously handled by having a database.
GPS has great potential, yes, but as it is essentially realtime processing of varying-strength L-band signals from the sky, it can come up with badly wrong values.
If taken without regard for the noise level of the measurement, GPS could easily give your car's position as 100 meters above the street level and inside a building -- while you were doing 90 km/hr in a hospital zone -- meaning you were obviously flying too low in a no-fly zone in your car.
I have a Garmin Etrex handheld. The worst estimate it ever gave of my speed was 127 km/hr. This was while I was walking in a residential area of two storey homes with a lot of large old trees around.
Imagine how poorly one could perform in the concrete canyons of a large city, where L-band signals will have lots of reflections ('ghosts').
In this era of guilty-until-proven-innocent, the government, or their mercenary contractor, will seize on anything that looks bad for you, without regard for how reliable the information is.
Speed limits are really risk limitations. "We have checked this road and considering the conditions we think that a speed of 90km/h is a good trade off between security and convenience"
Sadly, that's not how the operate round here. They operate on the basis that
- One or two people have complained about a road being fast
- or there's been a slight rise in the number of accidents on a bit or road
They don't take into account anything to do with the road it self, or real statistics at all. Say for example there's been more accidents on a stretch of road, and they introduce something (lower speed limits, cameras) on a stretch of road. Then, over the next years accidents are down again to their old level. This is then used as proof that the intervention worked, rather than the fact that accident levels have returned to "normal" after a blip.
Bah, enough of a rant. I could go on all day here.
Suffice it to say, I used to have great respect for speed limits, but these days there little or no reason for most of the ones indicating a limit that is lower than that which you would normally drive on a section of road. So personally, if it looks residential, I drive an 30, if it doesn't I drive nearer 40, no matter what the signs say.
In London at least it appears plates are stolen to order. My friend has an import FTO and of the whole row of cars parked outside his block of flats, his was the only one targetted. He was made to feel guilty by the DVLA and the police for letting it happen and had to wait two weeks for replacements as (he being disabled and now not allowed to drive the car) could only order new plates from the original garage he bought the car from - which is a great security measure for preventing postal fraud, but hey...
Note to non-UK readers; The rear plates are normally black on yellow and are easy to get anywhere (think the need fot extra plates for trailers etc.) but the front plates are normally black on white and the blanks are (supposed to be) controlled. Not that this helps at all.
In addition to number plate cloning, the other major related crime if the theft of disabled parking badges.
As so many cars (and drivers) in London are now uninsured, untaxed and probably unlicensed to drive, then these two crimes are often the easiest way of continuing to avoid the law while being able to go about your normal business. No conjestion charge, no parking charges, no worries about hit and run either.
One more anecdote; I was hit from the side by another driver trying to cut between two cars, took my front bumper off and carried on driving at, probably, 50mph in a 30mph zone. The police ? I had to insist they take the details over the phone when I pulled up as they wanted me to fill in paper work instead - they only became interested when I emphasised to them that the driver was likely to cause real harm further down the road. A few weeks later the results came back "untraceable vehicle". Do you think that his vehicle or plates were put on any "instant stop" list ? Of course not - I am not one of the privileged classes, such as a politician, celebrity or funny-handshake police officer.
I ran into that exact situation with a Washington DC speed trap last year. In Maryland, the speed limit is 65. Cross over to DC, it quickly drops to 50. You don't notice it till you see the speed limit sign and the flash of light coming from behind you that occurs at the same time.
The fee for a quick early turn is seemed quite reasonable to the alternative if you decice to fight. If you contest and loose, you pay the full fee, court costs, and points on your drivers license. What are the odds that the judges in the District side w/ the camera?
Pay the lousy "TAX" and move on....
@Peter - the restrictions for number plates supply apply equally to both front and rear. However, the law only applies to England and Wales - not Scotland or NI. This leads to the situation where I can mail order plates (with no proof of ID/entitlement) from NI much more easily than going down to the local motor factors (and it's cheaper as well!).
On the point of further surveillance - most (if not all) traffic cars have ANPR that are continuously surveying the passing traffic. Vehicles that are untaxed/uninsured will be flagged automatically, and the police have the powers to seize the vehicle. Of course this all relies on the database being correct - there are instances when this isn't the case.
Speed limits are being more rigourously enforced (though cameras etc) - however there is a general cynicism that this is about money rather than safety.
Yup--I was ticketed for 4 tolls I paid (and one I didn't due to being forced into the scanning lane by traffic). When I questioned the accuracy of the coin collector, and the sensors, and their timing (as I had paid the toll), the toll representative could not answer any questions of the above, but I was judged to have to pay 3 of the tolls/fines because the photos on the other two showed my window being down. I could have appealed by paying a $250 bond and requesting a court date, or pay $60 + tolls. I had low cash flow at the time, so had to accept the fines.
Automation > accuracy > justice.
@Student, @Simon_C: Actually Simon is still giving them more credit that they are due. In the US speed limits are implemented by politicians with no science, fact or thought input of any kind; who figure it's better to be in charge of a shitty world than one of the peons in a good world, so they make a big advertising push during the election stating that the country is going down the toilet because [pick some made up crisis] and electing them to lower the speed limit will fix it all.
Some studies (which back up my own observations in ~1,000,000 km of driving in the US) have shown that people drive at the speed they feel comfortable at regardless of the posted limit. This is especially noticable in the US where we have every possible combination of limit between 5 and 80 mph in 5mph increments and even on a single road, the limit can change more than once per city block (not counting school speed limits) yet people drive the same speed when moving from 55 to 65 and back to 60 zones.
Funny. Back here it is usually trivial to see what kind of road you are on.
Smaller roads inside towns
places with lots of accidents
Major roads of low quality, with no safety areas
Good quality roads, plenty of space on the side but no traffic separation
Highways with full traffic separation, plenty of space on the side and so on.
Oh, the fact that people ignore security regulations hopefully doesn't surprise anybody reading this blog... I don't consider the fact that people ignore security regulations a motivation for removing them. Improving them, perhaps, but not remove them.
@ Erik V. Olson: "Running around with a copied plate is really running around with a badge that says "I steal plates", and if the cops ever, for any reason, run the plates, you're nailed."
Not really. If I watch your car, I can clone the plates then swap them onto your car & take the real plates for myself.
It's quite easy for kids to alter license plates on publicly parked cars with a little tape or paint. Ranks right up there with key'ing (scratching) the paint job on cars, or other forms of vandalism.
Would you notice if it happened to you? How often do you check your plates?
Get some exercize, and get out of jail free...
Park at some random spot a block or two from your house, every day, and report your car stolen. When the police "find" it for you, say "thank you very much".
When the automated speeding ticket arrives, point to the police-report about a stolen car that day...
@Student: "Only when it comes to speeding it's the lives of the people in the area that are the risk, not some local data."
Partially true, but partially false. At least in relatively high-traffic situations, it isn't speeding per se that's the real risk factor - it's going at a different speed than the prevailing traffic. If all the traffic is going 65, but you insist on doing the legal limit of 50, you become a serious traffic hazard. In many states in the U.S., it is quite possible to get a ticket for obstructing traffic while exceeding the speed limit. (Rare, I'll admit - but technically possible.)
Of course, if all the traffic is crawling along at 25, and you insist on doing the legal 50, you're also a serious traffic hazard.
-----"I don't see how replacing the camera with a cop will really fix the problem either -- indeed, the camera's got a better chance of catching a fake plate than the cop, because the camera has time to "run" all the plates, and doesn't get bored doing so. "-----
When police stop a car for a violation, they talk to the driver (actually see the driver for that matter), review license and other documents. Certainly a much stronger legal case -- and if there's a serious issue can detain the driver. None of this is possible with cameras.
The RAF (german terrorist organization of the 60s and 70s) started to look for cars matching theirs and made replicas of the number plates.
This worked pretty good, since number plates could be checked against vehicle manufacturer, type, colour etc. - and would always pass.
I thought british police would automatically compare a foto of the driver with their passport-database to identify car and driver?
If you think mandatory GPS tracking is sci-fi, you don't follow general aviation news. Want to have to buy an $8000 GPS tracker for your Cessna? Google for [ADS-B].
...and just why is it we 'need' automobile license-plates at all (??)
Get rid of license-plates entirely -- and any cloning problem is gone.
Government license-plates are no doubt very helpful to the police in controlling the "bad-guys" and monitoring the general citizenry. But it would also be quite helpful to the police if all persons were required to wear a large, visible name tag (with their social-security or other unique number) when out in public.
License-plates merely inform observers that the owner of the vehicle has legally registered that machine with the government, and paid the required fees. There's no fundamental reason why a uniquely identifying 'license-plate' is required for that registration function. A small non-unique window decal would serve as well... or merely a paper copy of the registration slip in the glove compartment.
The police have no general legal need for the capability to positively identify a vehicle's owner when a car is driving down a road... any more than a need to identify people walking down a city sidewalk. If the police observe or have probable cause that a specific vehicle has broken the law, they can follow or stop the vehicle... and then determine its 'registration' status. However, license-plates have long been a major citizen-surveillance tool for the police, which is now the primary purpose of license-plates.
Car theft is a problem, but so is jewelry theft; we don't require $30,000 wedding rings to have public 'license' tags.
The very existence of vehicle license plates is a significant privacy & civil liberties issue, but people are so used to this intrusion... they don't notice.
>Frankly, I think paying the congestion charge >would be cheaper than constantly having your >car resprayed :-)
Spraying your car green ... $1000
Spraying your car red ... $1000
Sticking it to the man ... Priceless
If, hypothetically, they took the undoubtedly huge amount of money that any of these intrusive schemes will cost and spent it on actually getting traffic policement to stop offenders, the problem would be solved. At the same time they could check the driver's insurance and license, thus dealing with another major problem in Britain.
International conversations are complicated by differing rules in different countries.
'jayh' suggested that police can check the driving license and registration documents when they stop a car. I am sure this works in many jurisdictions.
In the UK (where the example that triggered this conversation came from), if a police officer asks to see your driving license or registration document you are allowed seven days to comply at a police station of your choice. In other words the law assumes that you do not carry such documents with you.
In fact it seems prudent not to carry registration documents in a vehicle as this makes it harder for thieves to sell a stolen car.
Official advice from HMG is actually NOT to carry registration documents (or insurance) for that very reason.
Mark and Rich: It sounds like the UK registration also serves the purpose of the car title, which is a separate document in the USA. Here, only the title is needed to sell the car, and most people don't carry it with them. The registration is just the paperwork for the number plates, and must be carried in the car (along with proof of insurance). In most sales, the owner keeps the plates to transfer to his next car.
So in a traffic stop here, the police officer will expect to see a driver's license (this has a picture ID), car registration, and proof of insurance, and will check for mismatches in these documents, and whether the registration matches the plate. In most cases, before the cop gets out of his car he will have run a computer check of the plates - if they come back as a stolen car, a car suspected of use in a crime, or as belonging to a wanted criminal, his approach will be quite a lot different! Other than that, if your buddy loaned your his car, the cop will ask why your name is not on the registration; he probably already knows the car has not been reported stolen, at least not yet, but it's surprising how many criminals give themselves away with a long and self-contradictory story when a simple lie would have been accepted.
However, traffic stops are rare unless you are doing something to attract the attention of the cops, so I think someone who just drove as legally as anyone else could be driving around with fake plates for many years without being stopped. In the last ten years, I've had a policeman speak to me once - and he was seeking my vote in the election for county sheriff. (That's probably two more words that have different meanings in the UK and USA; here, the sheriff is the elected supervisor of the police force for a county, which is a subdivision of a state.)
As for speed limits, in the USA they often appear to have picked a number out of the air. E.g., in the industrial park where I work, most of the roads are 45 mph, which is as fast or faster than I feel safe driving, but at one point no different from the rest, they plopped down a 25mph sign. I've sometimes recognized the car ahead of me as belonging to a state policeman, who drops his wife off at her job before proceeding to his, and he doesn't slow down for that sign...
Beyond that, there is the federally-imposed 55 mph limit on rural highways except interstates. Many of these roads around here were built in the 1950's and 1960's for 65 mph, for cars which were substantially inferior in tires, handling, and braking to modern ones - and yet, politicians that have never driven on them have arbitrarily set the limit at 55. It's got nothing to do with safety, it's just big.gov showing off it's power.
I live in Australia. The system we have here (which is pretty much the same in all 6 states) is structurally very similar to those described in the US and UK, but with some small technical refinements. Yet, number plate cloning and theft do not seem to be big problems here. (At least, they were nearly non-existent when I last had access to detailed crime statistics about 6 years ago; maybe it's worse now.)
Firstly, people are talking about casually copying UK plates as if it's no effort, or even modifying them with paint or tape. Our plates are stamped out in a 3-dimensional low relief shape, and painted in a baked enamel paint embedded with microscopic retroflectors which work in both visible and IR light. A plate modified with tape or normal paint is immediately obvious at a glance, from a considerabe distance. Completely faking a plate, once again is certainly far from impossible but would take a fairly skilled craftsman with access to specialised equipment.
Further, unlike in the UK, plates can only be received directly from the government motor registry authorities, in person, and remain the property of the State at all times. If a vehicle goes out of registration you have a limited amount of time to return them or else are subject to prosecution. You don't get spare plates for trailers; they are registered separately. You can get a high mounted plate if your normal rear plate is obscured by a bicycle rack, but these plates are a different size and shape to normal ones. Getting replacements if they are stolen is expensive, so most people mount them in a way that is quite hard to remove quickly and quietly. Generally, the plate is attached with several screws which are free-wheeling from the outside (making them difficult to either cut or unscrew) and the mounting location is slightly recessed into the car, making it difficult to apply tools to the plate or screws, or to cut through the plate above the screws. Not impossible by any means, but very difficult do both quickly and quietly; a fairly high risk for a low pay-off, given that a stolen plate is likely to be quickly reported to the police.
In short, the cost of obtaining a stolen or faked plate is sufficiently high that it is only going to be of interest to a serious criminal, not to someone trying to evade a $20/month road toll.
Secondly, in a sort of cross between UK and US practice, vehicle titles and registrations are separate documents. You do not and should not carry the title documents in the car. But the registration document is not just required to be carried in the car, it is a decal fitted inside the front windscreen in a standard location where it is most easily visible to parking inspectors. It identifies make and model, expiry date, and license plate number (plus a few extra codes mainly relevant to commercial vehicles). For most of these, you need to be within a couple of metres to read them, although expiry date is also colour coded and can be quickly identified by a police officer passing in another lane. Forging this decal is certainly not impossible, but it would be fairly difficult; more to the point, it has to be replaced every year so if forgery became widespread, more advanced anti-forgery measures could be quickly introduced. Stealing the decal to go along with the plates would be quite hard. Not only is it inside the car (so you need to break into the car to get access), but it is designed to be extremely difficult to remove from the glass without ripping it to shreds. Removing it without tearing it certainly cannot be done quickly. And of course if it was removed, the owner would soon notice (perhaps not as soon as the plates) and report it to the police.
Thus, even if criminals were to successfully forge the actual cloned plates, that would only do for observation at a distance, unless they can also forge a tamper resistant paper-and-polymer document. Otherwise, the moment a parking inspector or police officer strolls past the parked car, they are busted big time.
None of this is necessarily impossible, but it is a sufficiently high hurdle that in practice license plate cloning is rare, and it has the feature of being able to raise the hurdle even higher when it becomes necessary.
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.