A signed, chain-of-custody public records index of government-owned vehicles operating in public space — built by the citizens those vehicles are deployed against.
Commercial automated license plate reader networks — Flock, Motorola Vigilant, Rekor — have indexed billions of citizen vehicle movements. Federal and local agencies query these networks at sub-second speed. The infrastructure that watches us is fast, well-funded, and answerable to almost no one.
The opposite direction operates on a different clock. A state vehicle records request takes weeks. A federal GSA fleet inquiry goes through FOIA. Both are routinely denied under law-enforcement exemptions. The administrative remedy that was supposed to make government transparent does not run at the speed government already runs at us.
Pedestrians with phones already see what the camera sees. Software running on those phones can, at the moment of observation, recognize the license plates within view, sign each sighting locally with a per-device cryptographic key, and store them on the device. The same observational access the surveillance industry already exercises is given to the citizens that industry already watches. Faces are never captured. Identities are never captured. The photograph itself is processed in the browser and discarded after the recognition pass.
What gets published is narrower than what gets captured. Only sightings of government-owned vehicles enter the public index. The discrimination is administrative — humans, not algorithms, decide what becomes part of the public record.
The reasoning in the earlier draft was that government vehicles have no privacy interest while civilian vehicles do, so the project should respect that distinction by maintaining a known-government-plate whitelist and silently dropping everything else at the recognition layer. The framing was carefully restrained — the version of the project that a hypothetical journalist or judge could approve of.
It was also self-defeating. The whitelist has to come from somewhere. You cannot match against a list of known government plates if you do not have one. The list grows by observing plates in government-vehicle contexts — present at a raid, exiting a federal facility, transporting detainees — and promoting them. Discarding non-matches at source breaks the discovery mechanism. The index never grows. The project becomes an archive of what was already known instead of a tool for finding out what is not.
The deeper problem is that the privacy framing concedes the wrong premise. Commercial automated license plate reader networks — Flock, Motorola Vigilant, Rekor — capture every plate on every street, indiscriminately, without consent, and sell the resulting graph to police, federal agencies, repo companies, and insurers. They do this lawfully. The legal regime that permits this — that plates are public information visible from public space, with no reasonable expectation of privacy — applies symmetrically. If it is lawful for a private surveillance company to capture every plate on a public street, it is lawful for a citizen with a phone to do the same.
The whitelist-only design was not a privacy principle. It was a posture — an attempt to make the project legible as the careful, restrained version of itself. But that posture concedes the entire legitimacy of the surveillance regime as it currently exists. It says: mass plate capture is bad, we just want it pointed in the other direction. That position is weaker than the actual one.
The actual position is that plates are either private or they are not. The law and the existing infrastructure have long held they are not. If they are not, the regime should run symmetrically. Citizens deserve the same observational access to public space that the surveillance industry already exercises against them. The discrimination — the part where humans decide what is worth publishing — happens at the moderation layer, not at the camera.
An installed app — progressive web, side-loadable, no app store dependency — reads license plates through the phone's camera. On-device OCR runs in milliseconds. Each sighting is signed locally with the device's cryptographic keypair, geotagged, timestamped, and stored on the device until the operator chooses to submit it.
Submitted sightings flow into a federated network of independent moderator instances — not a single database, not a single point of capture. A plate is published to the public index only after N independent device-signed observations corroborate it. The hash chain makes alteration after the fact mathematically detectable. Verification standards are open and the moderation log is public.
Every confirmed plate triggers an automated records request — to the relevant state DMV, to the GSA fleet office, to the appropriate federal records officer. Templates and appeals are templated. Denials are logged as part of the public record. The administrative paper trail that the records system was supposed to produce becomes itself a published artifact.
The device captures what the camera sees: license plates, in public space, visible to anyone walking past. Each sighting is signed and stored locally on the operator's device. Faces are never recognized. Identities are never resolved. The photograph itself never leaves the browser — only the OCR output is retained.
The local capture is the operator's data, sitting on the operator's device, signed with the operator's key. What the operator chooses to submit is a separate decision. What the federated network chooses to publish is a third decision, made by the moderators of an independent records office. Only sightings of government-owned vehicles are promoted to the public index.
Local data the operator does not submit stays on the operator's device. Submitted data the moderator network does not publish stays in the moderation queue under the same chain-of-custody guarantees as everything else. The architecture treats publication as a deliberate act, not a default behavior.
This project does not track persons. It maintains an index of government-owned vehicles. The First Amendment protects the act of recording public-facing government activity. Vehicle plates carry no privacy interest. State vehicle records and federal GSA fleet records are statutorily public.
The legal framework that permits Flock, Vigilant, and Rekor to capture every plate in America applies symmetrically. The same constitutional analysis that makes their capture lawful makes a citizen-administered records project lawful. The asymmetry that exists today is not a legal asymmetry. It is a commercial one.
The project's role is to make the existing public-records system function at the speed the surveillance system already operates at. It is the boring, administrative version of accountability — and the boring, administrative version is exactly the version that survives.
Volunteer plate-tracking projects already exist — texted in, manually verified, painstakingly published. PublicPlates is built to slot underneath that work, not to replace it. The hardware is in everyone's pocket. The administrative process is statutorily mandated. What's missing is the connective tissue.
Install the app, point the camera, sign the sighting. The only data that ever leaves your device is the plate string. You participate in a public records project, not a surveillance one.
Drop-in capture for groups already running plate-tracking work by hand. Federated moderation means your existing team becomes a records office of its own — not a node in someone else's database.
An open, citable, signed record of government vehicle deployments — with the FOIA filings and denials attached. Source documents, not anonymous tips.
Public-records-grade data on government fleet activity, with full provenance and verification chain. Available under an open data license for academic and policy use.
The prototype runs. The architecture is drafted. What's next is partnerships with the groups already doing this work, infrastructure for the federated moderator network, and the people who care enough about public records to help administer them.