Researchers in Europe have revealed a potential backdoor surveillance system that is mandatory in all cars in the United States built over the last two decades, and can be exploited with as little as $100 in equipment.
Scientists at the IMDEA Networks Institute, working with European partners, found that Tire Pressure Monitoring Systems (TPMS)—required in all new passenger vehicles sold in the United States since the late 2000s—pose a significant security risk because their identifiable wireless signals can be captured and analyzed.
Their forthcoming paper, to be presented at the Wireless On-Demand Network Systems and Services Conference, describes how the team collected signals from more than 20,000 vehicles in just 10 weeks, highlighting the need for stronger security protections.
Tire Pressure Monitoring Systems
TPMS provides drivers with real-time tire pressure information. Following controversies over defective tires that contributed to fatal accidents in the 1990s, the United States passed the TREAD Act in 2000. The law required manufacturers to begin installing TPMS systems in 2005, with full compliance for new vehicles by late 2007. These systems were intended to prolong tire life, improve fuel economy, and reduce accidents. However, researchers say they also create an unintended privacy vulnerability.
TPMS relies on small sensors mounted at each wheel that wirelessly transmit pressure data to the vehicle. To ensure the correct signal is received, each sensor broadcasts a unique identifier. Because these transmissions are not encrypted, they can be detected and distinguished from a distance.
$100 Vehicle Surveillance
To capture the signals, the researchers used a low-cost radio receiver costing about $100. Once a signal was recorded, the vehicle’s unique identifier could be stored and later recognized. By deploying multiple receivers, the team tracked individual vehicles and reconstructed travel patterns.
This approach differs from traditional vehicle surveillance methods, which typically rely on cameras and line-of-sight observation. Radio-based tracking can operate invisibly, even through walls, making detection far more difficult. Instead of relying on license plates, the system identifies vehicles by their electronic signatures.
“Our results show that these tire sensor signals can be used to follow vehicles and learn their movement patterns,” said Domenico Giustiniano, a research professor at IMDEA Networks Institute. “A network of inexpensive wireless receivers could quietly monitor cars in real-world environments. Such information could reveal daily routines, such as work arrival times or travel habits.”
Increased Tracking Precision
The researchers further improved accuracy by correlating signals from all four tires on a single vehicle, rather than relying on a single transmitter. This allowed them to monitor vehicles arriving at or departing from specific locations and to infer recurring schedules. They also demonstrated that signals could be captured from moving vehicles inside buildings at distances exceeding 50 meters. In some cases, variations in tire pressure readings could even indicate when a vehicle was carrying heavier loads.
“As vehicles become increasingly connected, even safety-oriented sensors like TPMS should be designed with security in mind, since data that appears passive and harmless can become a powerful identifier when collected at scale,” highlights Alessio Scalingi, former PhD student at IMDEA Networks and now Assistant Professor at UC3M, Madrid.
The team urges greater awareness of this vulnerability to pressure regulators and manufacturers to close the gap on this potential surveillance exploit.
“TPMS was designed for safety, not security,” adds Dr. Yago Lizarribar, former PhD student at IMDEA Networks during the research study, and now Researcher at Armasuisse, Switzerland. “Our findings show the need for manufacturers and regulators to improve protection in future vehicle sensor systems.”
The paper, “Can’t Hide Your Stride: Inferring Car Movement Patterns from Passive TPMS Measurements,” will be presented at IEEE WONS 2026 in March 2026.
Ryan Whalen covers science and technology for The Debrief. He holds an MA in History and a Master of Library and Information Science with a certificate in Data Science. He can be contacted at ryan@thedebrief.org, and follow him on Twitter @mdntwvlf.