Security Researcher’s ‘NULL’ Personalised Number Plates Cause Glitch That Lands Him Nearly £10,000 in Parking Tickets

By Melanie Ehrenkranz on at

You can’t put a price tag on the value of sticking it to the man—specifically, trying to own an official surveillance system. Except maybe when you are owned right back.

A security researcher going by the name of Droogie, based in the US state of California, attempted to mess with Automated Number Plate Reader (ANPR) systems (called Automated License Plate Reader, or ALPR, systems in the US) by customising a personalised number plate with the word “NULL.” The word was a play on the term used in programming to indicate no value, and Droogie hoped that it would mess with the systems.

ALPR systems involve surveillance cameras mounted on police cars and around cities that collect a vehicle’s number plate as well as the time, date, and location. And the collection of this data isn’t relegated to suspects—anyone’s vehicle is subject to being surveilled and subsequently loaded into a comprehensive database with robust information on their real-time whereabouts. It’s also presently unclear all the ways in which government agencies and private companies are using (and potentially abusing) this data.

Droogie presented his misadventure at the DEF CON security conference in Las Vegas on Saturday, in which he explained that while his customised plate was successful in confusing the systems, it resulted in thousands of dollars of other people’s parking tickets.

When he went to renew his tags on the US Department of Motor Vehicles (DMV) website, the website informed him that his license number was invalid, Mashable reported. Droogie then started receiving thousands of dollars in parking tickets, totalling over $12,000 (£9,960), addressed to him. He told the convention audience that a processing centre was assigning “NULL” to vehicles with outstanding tickets that the DMV didn’t have number plate information on. And so Droogie received all of those unassigned tickets.

The DMV and Los Angeles Police Department reportedly told him to change his plates (he didn’t), but eventually the processing centre erased the fines that were mistakenly sent to Droogie. But the system is still operating as it was prior to the erasure of his fines, and the system has since assigned him over $6,000 (£4,980) more in tickets.

“I was like, ‘I’m the shit, I’m gonna be invisible,’” Droogie told the crowd at DEF CON, Mashable reported. “Instead, I got all the tickets.”

Droogie’s stunt is a powerfully comedic statement about a mass surveillance system being deployed without the consent of civilians, and until recently, with little to no oversight. In June, a legislative committee in California voted to enforce a state audit into ALPR systems used by police. Leading up to that, reports indicated that these systems were being exploited by US Immigration and Customs Enforcement and potentially other American government agencies and that agencies often obfuscated the honest accounts of how the data gleaned from these readers was being used.

“These systems wouldn’t work at all if the government did not require drivers to post identifying numbers in public view,” the Electronic Frontier Foundation wrote in a blog post. “But unlike an officer writing down plate numbers by hand, the collection and storage on a massive, automated scale can reveal intimate details of our travel patterns that should be none of the government’s business.”

Featured image: Getty