Security Researcher’s ‘NULL’ Vanity Plates Cause Glitch That Lands Him $12,000 in Parking Tickets

You can’t put a price tag on the value of sticking it to the man—specifically, trying to own an official surveillance system. Except maybe when you are owned right back.

A security researcher going by the name of Droogie attempted to fuck with Automated License Plate Reader (ALPR) systems by customizing a vanity California license plate with the word “NULL.” The word was a play on the term used in programming to indicate no value, and Droogie hoped that it would mess with the systems.

ALPR systems involve surveillance cameras mounted on cop cars and around cities that collect a vehicle’s license plate as well as the time, date, and location. And the collection of this data isn’t relegated to suspects—anyone’s vehicle is subject to being surveilled and subsequently loaded into a comprehensive database with robust information on their real-time whereabouts. It’s also presently unclear all the ways in which government agencies and private companies are using (and potentially abusing) this data.

Droogie presented his misadventure at the DEF CON security conference in Las Vegas on Saturday, in which he explained that while his customized plate was successful in confusing the systems, it resulted in thousands of dollars of other people’s parking tickets.

When he went to renew his tags on the DMV website, the website informed him that his license number was invalid, Mashable reported. Droogie then started receiving thousands of dollars in parking tickets, totaling over $12,000, addressed to him. He told the convention audience that a processing center was assigning “NULL” to vehicles with outstanding tickets that the DMV didn’t have license plate information on. And so Droogie received all of those unassigned tickets.

The DMV and LAPD reportedly told him to change his plates (he didn’t), but eventually the processing center erased the fines that were mistakenly sent to Droogie. But the system is still operating as it was prior to the erasure of his fines, and the system has since assigned him over $6,000 more in tickets.

“I was like, ‘I’m the shit, I’m gonna be invisible,’” Droogie told the crowd at DEF CON, Mashable reported. “Instead, I got all the tickets.”

Droogie’s stunt is a powerfully comedic statement about a mass surveillance system being deployed without the consent of civilians, and until recently, with little to no oversight. In June, a California legislative committee voted to enforce a state audit into ALPR systems used by cops. Leading up to that, reports indicated that these systems were being exploited by Immigration and Customs Enforcement and potentially other government agencies and that agencies often obfuscated the honest accounts of how the data gleaned from these readers was being used.

“These systems wouldn’t work at all if the government did not require drivers to post identifying numbers in public view,” the Electronic Frontier Foundation wrote in a blog post. “But unlike an officer writing down plate numbers by hand, the collection and storage on a massive, automated scale can reveal intimate details of our travel patterns that should be none of the government’s business.”