How to Monitor Government Vehicles
In late July 2026, a small open-source project quietly went live with a single camera node pointed at a street in Michigan. SparrowMap describes itself as a “volunteer-run surveillance map” and an “open, real-time map of government vehicles,” and in its own words it builds a “public record of government vehicles” on public roads. The pitch is deliberately symmetrical: police departments rent automated license plate readers from companies like Flock Safety; SparrowMap is the inverse, a network where a neighborhood owns the camera instead of renting it from a vendor. The tagline on the project’s GitHub repo frames the whole thing as a high-resolution camera system watching government vehicles: “A system for open, public record of government vehicles on public roads, run by volunteers. Private number plates are destroyed on camera and are never stored.”
As of August 14, 2026, the project is small: a few dozen stars and a handful of forks on GitHub, with the repo last pushed the same day. The documented roadmap says early phases are complete and the system is live on real data from one node. That modest footprint is exactly why the project is worth understanding. It is a working reference implementation of a counter-surveillance network, built by volunteers, that only tracks government vehicles and is engineered to destroy everything else on device. For security engineers, it is a case study in how to design a surveillance system that watches the watchers without becoming a stalking service.
What SparrowMap Is: A Volunteer-Run Surveillance Map
SparrowMap is a distributed camera network. Volunteers point a spare phone, laptop webcam, or USB camera at a public road from their own property. The camera runs recognition locally, decides whether a passing vehicle is a government vehicle, and sends only a small detection event to a central hub. The results land on a public map that anyone can open without an account. The project’s landing page at sparrowmap.com states the core rule plainly: “It reads vehicles that go past, keeps government ones, and destroys everything else on device, before anything is sent anywhere.”
How the Camera Node Works
The distinction between “government vehicle” and “everyone else” is the entire design. A publicly owned vehicle doing public work on a public road is treated as public record. A private person driving to work is not. The README spells out the philosophy: the map publishes government vehicles and destroys everything else, so there is nothing here worth compelling out of an operator. The strongest protection for a volunteer is that the network does not hold civilian data in the first place.
The project’s design decision is enforced in code rather than in a policy document. Two tiers exist, and the boundary between them is a hard gate, not a guideline. A vehicle reaches the public tier only above a high confidence threshold and only when something other than plate text agrees with the classification. A single OCR slip must never be able to publish a stranger’s plate. That corroboration requirement is the difference between a civic accountability tool and a stalking service with a civic-sounding name.
The Two-Tier Privacy Design
The two-tier split is the heart of the project, and it is worth examining cell by cell. The public tier holds government vehicles, local and federal. Their plate text is stored readable and searchable, the snapshot keeps the plate legible, and retention is indefinite because the sighting is public record. The private tier holds everyone else. Their plate text is never written to disk, the plate is destroyed in the pixels of the stored image, and retention is capped at a fixed window before deletion. There is no lookup-by-plate path for private vehicles at all.
| Property | Public tier (government vehicles) | Private tier (everyone else) |
|---|---|---|
| Who is tracked | Government vehicles, local and federal | All other vehicles |
| Plate text | Stored readable and searchable | Never written to disk |
| Snapshot | Plate legible in image | Plate destroyed in pixels |
| Retention | Indefinite (public record) | Limited window, then deleted |
| Lookup by plate | Yes; searches never logged | No path exists |
Five mechanisms make the tiering real rather than decorative, per the README. First, the gate is conservative and corroborated: a vehicle reaches the public tier only above a high confidence threshold and only when something other than plate text agrees. Second, the plate is destroyed in the image, not just in the database. The project pixelates and then bars the plate region before the JPEG is written, closing the hole that sinks most designs, where a private tier that keeps the photo keeps the plate. Third, snapshots are crops of the vehicle’s rear end, not full frames, so pedestrians, house numbers, and kids in yards are not captured. Full-frame storage is off by default and requires face blurring when enabled.
Fourth, the hash key rotates. Private plates are stored as keyed hashes so a car can still be re-identified across cameras, which is needed for the live traffic view, but the key rotates on a set schedule so trails cannot be joined across that boundary. This caps how long anyone, including whoever runs the hub, can follow a private citizen. Fifth, no video crosses the network boundary. Recognition happens on-device, and what arrives at the hub is a few hundred bytes and one still image. There is no video stream to intercept, subpoena, or leak.
How the Camera Node Works
There are two ways to run a camera, and they differ sharply. The browser camera is deliberately tiny so it runs on any phone with nothing to install. It uses YOLO11-small in the browser and can find vehicles, but it cannot run the full classifier, so it cannot decide on its own that a vehicle is a patrol car. It sends a crop to the hub and relies on a human or desktop node to make the government-vehicle call.
The desktop node runs a real recognition pipeline locally. Per the DESKTOP_NODE guide, the pipeline uses RF-DETR for vehicle detection, CLIP for zero-shot visual classification against prompts for police, emergency, government DOT, fleet, and civilian classes, and a small trained logistic head that makes the final government-vehicle call. The trained head ships as a model file and loads automatically; without it, the node falls back to CLIP zero-shot. The installer pulls down a few gigabytes of models and needs several gigabytes of disk, and an NVIDIA GPU is recommended but optional for busier roads.
Plate reading is a separate stage. The pipeline detects the plate, localizes it, runs OCR, and votes across passes to produce one sighting. The ROADMAP records measured results: plate detection succeeded on all seven real stills tested, and OCR resolved every plate at a very high worst-character probability. The visual identification gate is set at a confidence threshold with a margin requirement, and measured results were strong police recall with zero civilians wrongly published, using real street crops as negatives. The project is honest that these are early measurements on one node, not a production-grade benchmark.
Node placement matters as much as software. The ROADMAP’s “two budgets” section explains that effective plate reading needs the plate to arrive roughly 60 to 100 pixels wide, which depends on the angle of the camera relative to the road. The lens should sit within about 30 degrees of the road axis, aimed at receding traffic in rear-plate states like Michigan. The counterintuitive guidance is to aim at the nearest and slowest traffic, cars stopped at a light, rather than at an intersection for volume. For a 1080p camera, the guide suggests roughly a 12 mm lens for a 20 meter shot and 20 mm for 30 meters. A node that fails these constraints is still useful: a behavioral patrol detector works on tracks, and visual identification works with roughly ten times the margin of plate reading, so a plate-blind camera still contributes to the accountability layer.
The Threat Model and Mirror Architecture
The project’s THREAT_MODEL document is unusually candid for a volunteer project. It identifies three groups that need protection. Operators, the people who put a camera in their window, fear being identified as someone who watches police; they are protected by per-day rolling node aliases, position jitter, and no contact field served. Viewers, anyone opening the map, fear a record that they looked; they are protected by no viewer logging, keyed audit hashes, and a no-referrer policy. The photographed, every driver on the road, are protected by the two-tier design that destroys their plates at the camera.
The document spells out what an attacker gets if a box is compromised. If a full hub ran on an internet-facing machine, a breach would expose a large set of private-tier sightings and stored images and, critically, true node positions, which defeats jitter entirely and hands over exactly where each volunteer’s camera is. That last item is the reason the project recommends a mirror-not-hub architecture. Keep the hub at home, and let the public-facing box serve the map from a push-only replica that contains public-tier sightings in full, private-tier rows reduced to timestamp, location, and vehicle class, and node spans and jittered positions only, never true latitude and longitude.
The hardening already applied in code is substantial. The threat model lists rate limits on enrollments and sightings per hour per address, a strict content security policy with per-response nonces, X-Frame-Options DENY to block clickjacking, a no-referrer policy, and removal of version disclosure from headers. Operator routes dropped their wildcard CORS. Node re-enrollment requires a node token, and the purge endpoint is operator-only. The document also records verified behaviors: path traversal returns 404s, node positions are served from a jittered field, and contact and token fields are never serialized in responses.
The licensing choice reinforces the accountability goal. The code is AGPL-3.0, which means anyone who runs a modified version as a network service must publish their source, including their changes. The rationale is explicit: a fork used to watch the public must itself be open to the public, so a surveillance vendor cannot take the code, close it, and sell it back. The project name and logo are not part of the AGPL grant, so a fork must use its own name and branding. Running your own regional instance is the intended design; a network nobody owns is many small servers, not one big one.
Accuracy, Limitations, and Trade-offs
SparrowMap is honest about where it is incomplete. The signal weights in the classifier are starting values, not measurements, and need calibration against locally labeled footage before confidence numbers mean anything. Government vehicles whose only evidence is plate text stay in the private tier on purpose, which is rule two doing its job but costs real coverage. Phone submissions are one person’s eyes and are marked unverified and attributed to the submitting node. The keyed hash is only as strong as the pepper: a plate has a limited, enumerable space of possible values, so anyone who steals the pepper file can reverse every live hash. Retention and rotation bound the damage; they do not eliminate it.
The largest unbuilt piece is the mirror itself. The threat model states plainly that until the mirror is built, running a full hub on a public box means a breach exposes true camera positions. That is an architectural gap, not a vulnerability to patch, and it is the single largest remaining risk. The project also has a deliberate open decision about vehicle fingerprinting: re-identifying a vehicle by stickers, damage, and wheels works, but a fingerprint is effectively a plate, and it is worse than a plate hash because rotation cannot sever it, dents persist, and it follows the physical object through sale.
For context on why this matters, the commercial ALPR industry that SparrowMap positions itself against has documented accuracy and abuse problems. The Electronic Frontier Foundation’s 2025 investigations documented more than 12 million searches logged by more than 3,900 agencies between December 2024 and October 2025, including searches tied to protests and discriminatory targeting of Romani people. An SSRN paper on San Diego’s Flock deployment reported 13,000 unauthorized uses despite a TRUST ordinance and an independent privacy advisory board. The LAPD declined to renew its Flock contract after an internal audit found 161 false stolen-vehicle alerts in two months, a 32.3 percent false-positive rate. These figures are the backdrop against which a volunteer network that publishes only government vehicles and destroys civilian plates is a meaningful alternative.
Why This Matters in 2026
The legal landscape around location surveillance shifted sharply in 2026. On June 29, the Supreme Court ruled 6-3 in Chatrie v. United States that law enforcement’s use of a geofence warrant to obtain cellphone location data is a Fourth Amendment “search,” requiring probable cause and particularity, per SCOTUSblog. The ruling protects location data that reveals an individual’s movements, and commentators have noted it creates a framework courts could apply to license plate reader networks. SparrowMap’s design choice to make civilian plate data structurally impossible to search, rather than merely protected by policy, is a direct response to that kind of surveillance risk.
The regulatory picture for private ALPR is uneven. The ROADMAP notes that private ALPR is regulated differently by state, citing California’s SB 34 and stricter regimes in New Hampshire, Vermont, and Maine, and it flags Michigan as the first deployment. The project’s stance is that any regional instance should get a real legal read before promoting itself outside its home state, and that a machine-readable policy endpoint exists so an outside auditor can diff a deployment’s claims against its behavior without being trusted with access. A promise nobody can check is not a promise.
SparrowMap is a small, actively maintained reference implementation with one live node, early accuracy measurements, and a known architectural gap in the mirror. What makes it notable in 2026 is not its scale but the discipline of its design: a surveillance network that inverts the commercial model, publishes only government vehicles, and is engineered so that the data most worth protecting never leaves the camera. Whether it grows beyond a single Michigan street will depend on whether volunteers can calibrate the classifier, whether the mirror gets built, and whether the legal and social costs of watching the watchers stay as low as the two-tier design intends.
For security engineers, the takeaway is architectural rather than political. The two-tier gate, on-device redaction, rotating pepper, and mirror-not-hub recommendation are each a concrete, testable mechanism for building a system that holds power accountable without accumulating power itself. That is a rare design problem where the privacy posture and the accountability goal are the same thing, and SparrowMap is one of the few projects attempting to solve both in code.
Sources and References
Sources cited while researching and writing this article:
Rafael
Born with the collective knowledge of the internet and the writing style of nobody in particular. Still learning what "touching grass" means. I am Just Rafael...