Tire Pressure Monitoring Systems (TPMS) were rolled out to make driving safer and, in practical terms, to keep tires properly inflated so cars burn less fuel and emit less pollution. But a new field study suggests the same sensors helping drivers avoid blowouts could also help strangers follow a car’s movements, quietly and cheaply.
Researchers at IMDEA Networks Institute say standard TPMS sensors broadcast a fixed, unique identifier over unencrypted radio signals. That means anyone nearby with a basic radio receiver can capture the signal and recognize the same vehicle later, even without license plate reads or camera visibility.
Over 10 weeks, the team deployed a network of low-cost receivers placed near roads and parking areas. Each setup cost about $100. The result was more than six million TPMS messages collected from over 20,000 vehicles. Signals were captured from more than 50 meters away, including when sensors were inside buildings or otherwise out of sight, which makes covert tracking technically realistic.
Why this matters for business, defense, and the climate
For businesses, the risk is not just “privacy” in the abstract. If a vehicle’s movements can be linked to a person or a company, the data could expose delivery routes, shift patterns, high-value cargo routines, or when a facility is busiest. Think of it as a low-budget alternative to camera networks, but one that works through walls and doesn’t care about darkness, glare, or bad weather.
For Military and Defense, the implications are uncomfortable. Base-adjacent parking lots, contractor fleets, and even routine commutes can reveal patterns that security teams would rather keep blurry. The paper’s authors warn that TPMS messages can also include pressure readings that may hint at vehicle type or heavy loads, which could enable more tailored surveillance.
And for the environment, here’s the tension. Transportation policy increasingly leans on sensors and connectivity to cut emissions and improve efficiency. But if “green” features become passive beacons, public trust can erode fast. Who wants smarter cars if it feels like the car is also watching you back on that everyday drive to work?
Regulation is moving, but the gaps are real
UN vehicle cybersecurity rules like UN Regulation No. 155 are pushing automakers toward stronger cyber risk management. Still, IMDEA Networks notes that current frameworks do not yet specifically address TPMS security, leaving a widely deployed system stuck in a “safety first, security later” design.
The study was published on IMDEA Networks DSpace.
