In just 20 minutes this morning, an automated license-plate-recognition (ALPR) system in Nashville, Tennessee, captured photos and detailed information from nearly 1,000 vehicles as they passed. Among them: eight black Jeep Wranglers, six Honda Accords, an ambulance, and a yellow Ford Fiesta with a vanity plate.

This trove of real-time vehicle data, collected by one of Motorola’s ALPR systems, is meant to be accessible to law enforcement. However, a flaw discovered by a security researcher revealed live video feeds and detailed records of passing vehicles, revealing the shocking scale of surveillance carried out by this widespread technology.

More than 150 Motorola ALPR cameras have exposed their video feeds and leaked data in recent months, according to security researcher Matt Brown, who first reported the issues in a series of YouTube videos after buying an ALPR camera on eBay and reverse engineering it.

As well as broadcasting live footage that can be accessed by anyone on the internet, misconfigured cameras also reveal the data they collect, including photos of cars and logs. license plate. The real-time video and data feed does not require any usernames or passwords to access.

companions other technologistsWIRED reviewed video feeds from several cameras, which confirmed vehicle data—including the brands, models, and colors of vehicles—that were accidentally exposed. Motorola confirmed the revelations, telling WIRED that it is working with its customers to shut down access.

Over the past decade, thousands of ALPR cameras have appeared in towns and cities across the US. The cameras, manufactured by companies such as Motorola and Flock Safety, automatically take photos when they detect a vehicle passing by. Cameras and databases of collected data are often used by police to track down suspects. ALPR cameras can be placed on roadsides, on the dashboards of police cars, and even on trucks. Got these cameras billions of photos of cars—sometimes including bumper stickers, lawn signs, and T-shirts.

“Every single one of them that I’ve seen exposed is in a specific location on certain streets,” Brown, who runs the cybersecurity firm Brown Fine Security, told WIRED. The exposed video feeds each cover one lane of traffic, with cars driving in the camera’s view. In some streams, snow fell. Brown found two streams for each exposed camera system, one in color and one in infrared.

Basically, when a car passes an ALPR camera, a picture of the car is taken, and the system uses machine learning to extract the text from the license plate. It is stored along with details such as where the photo was taken, the time, as well as metadata such as the make and model of the car.

Brown said the camera feeds and vehicle data were likely exposed because they had not been set up on private networks, possibly by law enforcement who deployed them, and instead were exposed. on the internet without any authentication. “It’s misconfigured. It should not be open to the public internet,” he said.

WIRED tested the flaw by analyzing data streams from 37 different IP addresses apparently tied to Motorola cameras, spanning more than a dozen cities across the United States, from Omaha, Nebraska, to New York City. In just 20 minutes, those cameras recorded the make, model, color, and license plates of almost 4,000 vehicles. Some cars were even captured multiple times—up to three times in some cases—as they passed through different cameras.