Ghost Plates and the Broken Gas Tax

Spend an afternoon on any wealthy commercial strip in California and count the Montana license plates.

You will find more of them fastened to Lamborghinis, McLarens, and Bentleys than you will ever find in the actual state of Montana. These are not ranchers up from Bozeman. They are locals, and the plate on the back of each car is quietly telling you a story that is not true: that a seven-figure machine idling outside a Beverly Hills restaurant is owned, garaged, and driven by a limited liability company in a no-sales-tax state a thousand miles away.

The mechanics are simple and, for a long time, close to consequence-free. Form a Montana LLC for a few hundred dollars. Title the car to the LLC. Register it in Montana, which levies no sales tax on the sale and asks no questions about who is behind the wheel. On a $1.5 million car, that paperwork can save the buyer more than $100,000. Between 2017 and 2025, the number of luxury vehicles registered in Montana grew roughly eightfold. Almost none of them ever tasted Montana asphalt.

Figure 2

The Cheapest Address in America

A no-sales-tax registration and an anonymous LLC make Montana the place a supercar claims to live. The growth began the year Montana priced a fee for it.

Sources: Ryan Evans, Montana assistant budget director, quoted in the MSU Exponent (eightfold, 1,000 to 8,000 a year, 2017 to 2025); 2024 registration data for exotic and ultra-luxury marques (Carscoops, May 2025).

In late 2025 one such arrangement became briefly famous. A well-known online personality had titled a Ferrari to a Montana LLC and, Tennessee prosecutors alleged, skipped some $30,000 in sales tax he owed at home. He was arrested on felony tax-evasion charges. Months later California’s Attorney General went further, charging fourteen people in a single fifty-six-count complaint over roughly $20 million in luxury cars and more than $1.8 million in taxes the state says they dodged: vehicles that, the complaint alleges, never left California at all.

Here is the part worth sitting with.

At no point was anyone confused about where these cars lived. The McLaren was in the driveway. The Ferrari, by its owner’s own hand, was on the internet, on fire, in a field. Nobody needed a detective to find the obvious. And yet the state had to stand up a multi-agency task force, the kind that arrives with its own acronym, issue search warrants, audit some five hundred dealerships, and file criminal charges, all to establish a fact that was never seriously in question: that the car lived here, not there. It made for an excellent press conference. It was also an expensive way to prove something everyone already knew.

That expense, the cost of proving the obvious, is the tell. It is the sound a system makes when the one thing it relies on to identify a vehicle has quietly stopped working.

Now leave the supercars and drive to the other end of the income distribution.

A former New York City automotive-crimes investigator can give you the tour. Over the years he has catalogued the ways a driver makes a plate lie: plates cut from plastic, plates behind smoked covers, a plate with a leaf glued over one character, a plate with a letter blotted out by what looked like a wad of chewing gum. Others skip the craft project and buy a counterfeit paper tag online, or bolt on a plate peeled off someone else’s bumper. In New York alone, these “ghost” vehicles cost the MTA more than $21 million in unpaid bridge and tunnel tolls in a single year.

The Beverly Hills collector and the Bronx toll-dodger would each be insulted by the comparison. One has a tax attorney; the other has chewing gum. But strip away the price tags and they are running the identical play. Each is making the vehicle’s identity assert something the vehicle is not: not registered here, not this car, not my problem. The luxury version launders the lie through a shell company and the street version through a hardware-store adhesive, but the exploit is the same, and it works for the same reason.

The license plate has stopped being a reliable answer to a simple question: whose car is this, and is it telling the truth?

This paper is about why that question has become so hard to answer, and it is written for the two groups who will decide what happens next. The first is the public, because it is your money leaking out of the system, and your tolls and premiums and fees quietly climbing to cover the people who cheat. The second is the officials who write the rules, because the tool at the center of all this was designed in 1901, and nearly everything we have tried since has been an attempt to solve a nineteenth-century problem with twenty-first-century money. The unpaid tolls, the uninsured drivers, the cloned plates, the evaded taxes, and a road-funding model sliding toward insolvency all turn out to be versions of a single failure. The way out is not a bigger camera or a bigger fine. We have tried both, for a century. It is older and stranger than that, and it starts in 1901.

We demand a staggering amount of utility from the humble, low-tech strip of metal that is the license plate.

Today it is the key that links a vehicle to its tolls, its parking sessions, its insurance status, its registration, its red-light tickets, and, when something goes wrong, its role in a crime. It has quietly become the single point of identity on which an entire enforcement and revenue economy now rests. And it is, at bottom, a strip of stamped metal bolted to a bumper, designed in the first year of the twentieth century to do almost none of that.

On April 25, 1901, New York Governor Benjamin Odell Jr. signed the nation’s first law requiring motor vehicles to be registered and identified. The requirement was modest to the point of quaintness: an owner had to display “the separate initials of the owner’s name” on the back of the vehicle, at least three inches high. The state issued nothing. Owners fashioned their own markers from leather, wood, or metal, or simply painted their initials on the car and called it done.

The system was broken on arrival.

Within its first years, the flaws that would define the next century were already on display. Enforcement found duplicate initials it could not tell apart. Drivers used fake initials. Others posted initials and never registered at all. The ghost plate, in other words, is not a modern innovation. It is as old as the plate itself. The very first identifier the state ever asked a vehicle to carry was, within months, being forged, duplicated, and faked. We have spent the hundred and twenty-four years since refining the forgery.

To see why the plate keeps failing, borrow a distinction from the systems that guard what you value: your bank account, your email, your phone. Each draws a hard line between two kinds of identity. A username is public. You hand it out freely; anyone can read it, copy it, or type it. A password, or better still a physical security key, is private and hard to reproduce, and it is the part that proves you are the person the username claims to be.

A license plate is a username.

Consider what that means. If your bank let you log in with a username and nothing else, no password, no code, no second step, you would change banks by lunch. Your car has been logging in with only a username since 1901, and we have built an entire economy of tolling, insurance, taxation, and law enforcement on top of that single, forgeable fact.

The plate carries all three properties that make a username a disastrous stand-in for a credential. It is public: displayed to the world by design, readable by anyone with eyes or a camera. It is static: it does not change, does not expire in any cryptographic sense, and never once asks the reader to prove anything. And it is unbound: nothing about the plate is cryptographically tied to the specific car it hangs on, which is precisely why a plate swapped onto the wrong vehicle sails through without a murmur. For a hundred and twenty-four years we have treated a username as though it were a password, and then acted surprised, every single year, that people keep logging in as someone else.

Once you see the plate this way, the entire catalogue of roadway fraud collapses into a single category. The ghost plate, the cloned plate, the counterfeit paper tag, the flipper that drops the plate out of sight at the toll gantry, the smoked cover, the Montana LLC: these are not six problems. They are one problem, single-factor authentication, wearing six disguises. Each exploits the same fact, that the only thing binding a plate to a vehicle and an owner is the driver’s willingness to display the honest one.

Figure 1

One Problem, Six Disguises

The ghost plate, the clone, the counterfeit paper tag, the flipper, the smoked cover, and the Montana LLC all exploit the same fact: nothing binds a plate to a vehicle except the driver’s willingness to display the honest one.

Author framework. Illustrative, not to scale.

Our response, for a century, has been to keep turning the one dial that does not work.

When toll evasion climbs, we raise the penalty. When ghost plates spread, we multiply the enforcement: more task forces, more summonses, more tows, more warrants, more press conferences. New York’s ghost-car task force, in its first year, ran dozens of operations, made hundreds of arrests, and issued tens of thousands of summonses. The plates kept coming. This is not a failure of effort; it is a failure of theory. Decades of research on fare and toll evasion keep arriving at the same unglamorous conclusion: would-be evaders respond far more to the certainty of getting caught than to the severity of the punishment. We keep reaching for severity. The dial that moves behavior is certainty, whether the system can reliably tell who you are, and on that dial a photographable strip of metal offers nothing at all. You cannot fine your way out of an authentication problem.

And here is who covers the shortfall. You do. New York City’s own investigators found that vehicles with untraceable plates owed, on average, more than twice what compliant vehicles owed, and paid less than a fifth of the fines they ran up. Nobody audits that leak nationally, but in the systems that have been audited, the uncollected tolls run to hundreds of millions of dollars a year, per system. Every dollar a ghost avoids does not vanish; it is quietly reassigned to the driver who follows the rules, through a higher toll, a higher premium, a higher registration fee. The plate’s failure is not a victimless abstraction. It generates a bill, and the bill is mailed to the honest.

So this is the box we are standing in. We took a nineteenth-century honor system, bolted twenty-first-century cameras onto it, and called the result modern enforcement. The cameras got sharper every year. The credential never did. It is still a username: still public, still static, still unbound, still doing a job it was never built to do. Every fix we have reached for, more cameras, more fines, more task forces, has been another coat of paint on the inside of a box built in 1901.

For the officials who will have to authorize what comes next, that is the frame worth holding. The question is not how to enforce the 1901 plate harder. It is whether we are willing to step outside the box that plate came in.

Because the fix is not another camera. It is a second factor.

Montana is not the villain of this story. Montana is simply the cheapest address in America, and it is not even the only one. Alaska, Delaware, New Hampshire, and Oregon offer the same essential product: a place where a car can be said to live, without the inconvenience of a sales tax, and without anyone asking whether the car has ever been there.

Because that is what a vehicle registration actually is. Not a fee, not a sticker, not a line item on a renewal notice. A registration is a claim about geography. It is the vehicle asserting, in the only voice it has, where it belongs and to whom it answers. Every dollar of state and local revenue attached to that assertion, the sales tax at purchase, the annual fee, the emissions inspection, the insurance requirement, rests on the assumption that the claim is true.

The Montana LLC is a way of making the claim without making it true.

It is worth appreciating the elegance of the thing. For a few hundred dollars, a registered agent forms a limited liability company whose entire corporate purpose is to own a car it will never see, in a state it will never visit, on behalf of a person who lives somewhere else. The company has no employees, no revenue, and no office beyond a mailbox. It exists to be the answer to a question: whose car is this? And it is a very good answer, because it is technically correct, legally formed, and geographically false.

If you have ever paid your state’s sales tax on a car, you have paid for the privilege of telling the truth.

What the state already does, by hand

Here is the part that ought to interest anyone who writes vehicle law.

When California, Georgia, or Utah decides to test whether a Montana-plated Bentley actually lives in Montana, they do not look at the plate. The plate is not evidence; the plate is the claim under investigation. Instead, investigators go looking for something the driver cannot easily forge: where the car actually is, and where its owner actually lives.

So they correlate. They pull automated license plate reader hits showing the vehicle in the same metropolitan area, week after week, month after month. They pull toll transponder records. They check the insurance database, because insurance rates are priced on where a car is garaged and drivers rarely lie to their insurer in the direction that costs them money. They audit the dealership that sold the car. One tax practitioner summarized the resulting logic with admirable bluntness: if your insurance says you live in Los Angeles and your car is registered to a Montana LLC, you are on a list.

Read that paragraph again and notice what the state is doing.

It is taking the vehicle’s asserted identity, the registration, and testing it against an independent factor the vehicle cannot fake, its observed physical presence. It is then binding both to a third factor, the identity and residence of the human being who controls it. The state is performing multi-factor authentication on a motor vehicle.

It is simply doing it the hard way: by hand, after the fact, one car at a time, with subpoenas.

The results are exactly what you would predict from a system that authenticates retroactively. California estimates it loses more than $10 million a year to the scheme. Its tax authority has identified close to five hundred dealers tied to more than 2,500 qualifying sales since 2023. Its DMV has opened dozens of criminal investigations, flagged 601 fraudulently registered vehicles, and recovered $2.3 million. Utah passed a data-sharing enforcement law in 2025 amid concern it was losing as much as $100 million a year. Wyoming has kept a rebuttable-presumption statute on the books since 2017, which places the burden on the resident to prove the car really is a Wyoming car.

And in California, the Attorney General assembled a task force, ran the correlations, obtained the warrants, and charged fourteen people across fifty-six counts.

Fourteen people. Meanwhile, luxury registrations in Montana grew roughly eightfold in eight years.

Figure 3

Authentication by Subpoena

What it takes for California to test whether one Montana-plated car actually lives in Montana. Widths not to scale; the counts are the point.

Source: California DOJ, Feb 2026 charging announcement; CDTFA dealer analysis since 2023; DMV recovery figures. All figures as published by the Attorney General’s office and reported case coverage.

That is not a triumphant enforcement statistic. That is a system announcing its own arithmetic. When authentication happens only after a criminal referral, the probability of any individual car being tested approaches zero, and the expected cost of the lie collapses to nearly nothing. Recall the finding that keeps surfacing in the research on evasion: people respond to the certainty of being caught far more than to the severity of the penalty. California can charge a fifty percent penalty on the purchase price and still lose, because fifty percent of a number multiplied by a vanishing probability is a rounding error. The deterrent is not the fine. The deterrent is the audit that never comes.

The part where I defend the Montana registrant

Now the necessary complication, and it matters more than the enforcement story.

Registering a vehicle in Montana is not, by itself, a crime. It is frequently, boringly legal. People genuinely relocate. People own second homes. Businesses legitimately domicile fleets in one state and operate them across many. The line between lawful tax avoidance and criminal tax evasion does not run through the LLC paperwork at all. It runs through a question of fact: where is the vehicle actually used, kept, and garaged?

Every state draws that line with a number. California says twelve months. Florida says six. Arizona says ninety days. These thresholds are not moral judgments; they are attempts to convert a question about physical reality into a rule an agency can administer.

Which means the state is not really struggling with a legal question. It is struggling with an evidentiary one. The law is clear. What is missing is a cheap, reliable, continuous answer to a factual question that a vehicle, of all things, should be able to answer about itself.

This is the point that gets lost when the story is told as a morality tale about rich people and Ferraris. A verifiable vehicle credential does not make the Montana LLC illegal. It does not change a single word of tax law. It does something narrower and more useful: it makes the underlying factual question cheap to answer, continuously and automatically, for everyone.

And notice who that protects. Today, the honest Montana registrant, the actual rancher, the legitimate fleet, the person who really did move, is indistinguishable from the shell company. They carry the same plate, make the same claim, and stand under the same cloud of suspicion, because the state has no economical way to tell them apart. The compliant driver’s proof of innocence is currently a shoebox of gas receipts. Under a system where the vehicle can attest to its own history of use, the rancher is exonerated by the same mechanism that exposes the shell. Verification is not the enemy of the law-abiding. Ambiguity is.

Why this pillar comes first

The tax case is the clearest illustration of the argument in this paper because the fraud is concentrated, high-dollar, and already producing indictments. But it is not the biggest number on the table, and it would be a mistake to leave it as a story about luxury cars.

Look closely at what the investigators were trying to establish. Not who owns this vehicle. Not what this vehicle is. They were trying to answer a question about mileage and place: where has this car actually been, and on whose roads?

Hold onto that question. Every state in the country is about to need the answer, and not to catch anyone. As the gas tax quietly stops working, that same question, which roads did this vehicle actually use, becomes the foundation of how we pay for roads at all. The tax cheat and the road-funding crisis are not two problems that happen to share a technology. They are one question, asked twice, and we currently cannot answer it either time.

You would change banks by lunch.

Andrew Sachs

The gasoline tax is the most successful user fee in American history, and no one has ever thanked it.

For most of a century it quietly performed a small miracle. You pulled into a station, you filled a tank, and without a form, a bill, an account, or a single conscious thought, you paid for the roads in proportion to how much you used them. Drive more, pay more. Drive a heavier vehicle that burns more fuel and chews up more pavement, pay more still. The collection cost was almost nothing. The compliance rate was almost perfect. Nobody evaded it, because nobody could: the tax was baked into a physical substance you had to buy in order to move.

Here is what almost nobody notices about that arrangement.

The gas tax was never really a tax on gasoline. It was a tax on road use, and gasoline was merely the meter. Fuel consumption happened to correlate with miles driven and vehicle weight closely enough that the pump could stand in for an odometer. Every time you filled up, you were reporting your road consumption to the state, in gallons, and the state was billing you for it.

You have been paying a mileage tax your entire driving life. You just paid it at the pump, and the pump never told you.

That meter has stopped.

It stopped slowly, then all at once. The federal rate is 18.4 cents per gallon and has not moved since 1993, when a gallon of gas cost about a dollar and the internet was a rumor that primarily benefited the porn industry. Inflation has done to it what inflation does. By one estimate its real effectiveness has fallen by more than eighty percent. Meanwhile the fleet got dramatically more efficient, which is to say the meter began under-reporting the same trip, and then a growing share of vehicles stopped buying the metered substance altogether.

Figure 4

The Meter Stopped

The federal gasoline tax, frozen at 18.4 cents per gallon since 1993, shown at its face value, at its inflation-adjusted value, and at what it buys once highway construction cost growth is counted.

Sources: Peter G. Peterson Foundation (18.4 cents bought 55 percent less in 2025 than in 1993); Union of Concerned Scientists (gas tax revenue buys less than one quarter of what it did in 1993 against road costs).

The result is not a rounding error. The Highway Trust Fund spent $26.7 billion more in fiscal 2024 than it collected from the drivers who are supposed to fund it, by the Eno Center for Transportation’s accounting of Treasury data. Projections put the cumulative highway-account shortfall above $270 billion across 2025 to 2034. Congress has papered over the gap by transferring roughly $275 billion from the general fund since 2008, which is a polite way of saying that the great user-pays system of American infrastructure is now substantially funded by people who may not drive at all. The Government Accountability Office has kept federal highway funding on its high-risk list for over a decade. This is not a controversial finding. It is the rare fact on which the Tax Foundation and the Union of Concerned Scientists agree.

Figure 5

Life Support

The Highway Trust Fund no longer lives on its meter. One scale across all three bars, in billions of dollars.

Sources: Peter G. Peterson Foundation, 2025 (transfers; projected shortfall to 2036); Eno Center for Transportation analysis of FY2024 Treasury data. Cash accounting shows a $13.5B gap; excluding $6.1B in general fund interest credits, the true user-pay deficit is $26.7B, the figure the manuscript now adopts.

We have a road-funding system whose meter no longer measures the thing it charges for. And when a meter stops, you have exactly two choices. You can guess, or you can fix the meter.

For twenty years, we have been guessing.

The blunt instrument

The guess, in some three dozen states, is a flat annual fee on electric vehicles: roughly thirty-four charge battery-electric drivers directly, and the count reaches thirty-nine once fees on all alternative-fuel vehicles are included.

The logic is intuitive and the execution is indefensible. A flat fee is a bad tax for the same reason a flat grocery bill would be a bad way to buy groceries. It charges the retiree who drives four thousand miles a year exactly what it charges the delivery driver who puts on forty thousand. It bears no relationship to pavement wear, congestion, or road use of any kind. It is not a user fee. It is a membership charge, levied for the offense of owning the wrong kind of car.

New Jersey now imposes a $250 annual registration tax on electric vehicles. Colorado, to its considerable credit, did something more careful: it built a Road Usage Equalization Fee that scales upward over time, from a few dollars toward roughly $96 by fiscal 2031-32, explicitly designed to approximate the gas tax an equivalent driver would have paid. Colorado is trying to rebuild the meter. Most states are trying to bill around it.

And this is where the politics of the moment invite a mistake that would cost this argument its credibility.

Say the fair-share argument correctly

It is tempting, and increasingly popular, to frame the problem as freeloading. Electric vehicle drivers took the subsidies, the reasoning goes, and now they use the roads without paying for them. Time to pay their fair share.

Half of that is true, and the half that is false will get you destroyed in a committee hearing.

The subsidies were real and they are now history, which is worth stating precisely because precision is the whole point of this paper. The 2022 Inflation Reduction Act offered up to $7,500 for a new electric vehicle and $4,000 for a used one, and those credits were written to run through 2032. The One Big Beautiful Bill Act, signed on July 4, 2025, terminated them for purchases after September 30, 2025. The federal subsidy era for electric vehicles opened around 2008 and closed at the end of last September. Whatever the fair-share argument is now, it is no longer an argument about clawing back an active incentive.

And then there is the inconvenient arithmetic. In thirty-six states, according to analysis by the Union of Concerned Scientists, electric vehicle drivers already pay more in annual fees than comparable gasoline drivers pay in gas taxes. The flat-fee “solution” did not close a gap. In most of the country it overshot, and created a new one pointing the other way. Electric vehicles account for roughly two percent of miles traveled today and are projected to reach somewhere between three and eight percent by 2030. They did not drain the Highway Trust Fund. The cost of building highways, which has more than tripled in twenty years, did that.

Figure 6

The Overshoot

The flat-fee “solution” did not close a gap. In most of the country it created a new one, pointing the other way.

Sources: Atlas Public Policy analysis cited by the Union of Concerned Scientists, 2025; N.J. P.L. 2024 registration fee; Colo. Rev. Stat. road usage equalization fee schedule; UCS for EV share of miles traveled.

Call them freeloaders, and in thirty-six states, you have insulted the one driver at the pump who is already paying more than his share. Say it into a microphone, and you will spend the rest of the hearing explaining the arithmetic instead of making your case.

Now here is the version of the fair-share argument that is both true and far more powerful.

The electric vehicle did not break the gas tax. It merely declined to participate in the pretense.

For decades we all paid a mileage tax through a proxy, and the proxy was already failing for everyone. The hybrid driver underpaid. The efficient sedan underpaid. The heavy truck, which imposes pavement damage rising steeply with weight per axle, has been undercharged for as long as anyone has bothered to run the numbers. The gasoline tax was never charging any of us for road use. It was charging us for fuel purchases and hoping the two stayed close. The electric vehicle is simply the first vehicle for which the proxy returns zero, which makes it the diagnostic, not the disease.

The fair share is not a fee levied on a technology. The fair share is a per-mile charge, adjusted for weight, that every vehicle pays according to the roads it actually uses. Fair to the electric driver who is currently overpaying in thirty-six states. Fair to the gasoline driver whose meter has been quietly under-reporting his neighbor’s trips for thirty years. Fair to the trucking firm, which will not enjoy it. It is not a new tax. It is the tax we already have, finally measured correctly.

Which brings us to the reason we have not done it.

The obstacle is not the meter. It is the credential.

Four states now run statewide voluntary road usage charge programs: Hawaii, Oregon, Utah, and Virginia. At least thirty more are studying or piloting one. Hawaii’s went live for electric vehicles in July 2025 at eight dollars per thousand miles, capped at fifty dollars, verified by odometer reading. The federal government has been funding these experiments since 2016.

After a decade of pilots, every serious analysis lands on the same three obstacles: administrative feasibility, privacy, and equity. And the first two are locked in a fight.

The most accurate way to charge for road use is to know precisely which roads a vehicle used, and for that, the obvious instrument is GPS. It measures mileage exactly. It allocates miles across state and jurisdictional lines automatically, which matters enormously, because a per-mile charge that cannot distinguish an Oregon mile from an Idaho mile is not a road funding system at all. GPS solves the engineering problem completely.

It also proposes that every American install, in the vehicle they use to attend their church, their union hall, their doctor’s office, and their attorney’s office, a device that reports where they went. When Minnesota ran focus groups on mileage-based user fees, participants said they felt watched. They asked, reasonably, why the state did not simply raise the fuel tax and leave them alone.

That is the impasse. Accuracy demands location. Consent forbids it. Two decades of pilots have been circling this contradiction, and it is treated in the literature as a tragic and permanent tradeoff.

It is not permanent. It is an artifact of asking a camera and a GPS receiver to do a job that belongs to a credential.

Ask precisely what the state needs to know in order to bill a vehicle correctly. It needs to know that this specific vehicle, verifiably this one and not a cloned plate, accumulated a certain number of miles within a certain jurisdiction during a certain period, and that the owner qualifies for whatever rate applies to it. Notice the shape of that requirement. It is an attestation, not a diary. The state needs a trustworthy total, not an itinerary.

A cryptographic vehicle credential can produce exactly that. It can attest, unforgeably, that this vehicle drove this many miles in this state, and it can do so without transmitting or retaining a single coordinate of where the vehicle went. This is not speculative technology. It is the same architecture that lets you prove you are over twenty-one without showing a bouncer your home address. The vehicle proves the claim. It does not narrate the trip.

The privacy problem in road usage charging has been framed as a fight between accuracy and freedom. It is not. It is a design failure. We reached for a tracking device because we had never built the vehicle a real credential, and a tracking device was the only tool that could reconstruct, by surveillance, what the vehicle should have been able to attest to on its own.

And the same credential closes the gap every pilot program privately admits. Today, road usage charge pilots cannot bill out-of-state drivers, who use the roads and contribute nothing. That is precisely the problem from Pillar One, seen from the other side. The vehicle whose paperwork says Montana while its wheels say California is the same vehicle a road usage charge cannot invoice. One credential. Two revenue holes. Same hole, really, viewed from two ends.

You cannot means-test what you cannot identify

Now the objection that ought to matter most, and the one this paper takes most seriously.

Any per-mile charge raises the specter of hurting the people least able to absorb it: the low-income driver, the rural resident, the worker whose commute is long because housing near work is unaffordable. If a road usage charge is a flat rate per mile, it is regressive, and honest analysts say so plainly.

Two responses, one empirical and one structural.

The empirical response is that the gas tax is already regressive, and worse than most people assume. Lower-income households tend to drive older, heavier, less efficient vehicles. They are, right now, paying more fuel tax per mile than the household with the new hybrid. Data from the Oregon and Utah pilots found that many rural residents, the constituency most reflexively assumed to lose under per-mile charging, would actually pay less than they do today, because their older vehicles are currently being punished by the fuel-consumption proxy. The regressive system is the one we have.

The structural response is the one nobody makes, and it belongs at the center of this paper.

We know how to build progressive rates into an essential service. Utilities do it with lifeline rates. Transit agencies do it with reduced-fare programs. Every one of those mechanisms requires the same precondition: a reliable, verified link between an eligible person and the account being charged. You cannot discount a bill you cannot bind to a payer.

That is what the license plate has never been able to do. It is a public identifier that cannot verify anything about itself, which means every relief program built on top of it must be administered by paperwork, applications, and after-the-fact refunds, the sort of friction that reliably ensures the people who most need relief are the least likely to receive it.

A verified vehicle credential, bound with consent to an eligibility status and nothing more, allows the discount to apply at the rate, automatically, at the moment of the charge. No application. No refund cycle. No requirement that a working parent take an afternoon off to prove poverty to a counter clerk.

Identification is not the enemy of equity here. Identification is the precondition for it. A system that cannot tell vehicles apart can only charge them all the same, and charging everyone the same is the definition of a regressive tax.

What the road actually costs

There is one more thing an honest meter does, and it is the reason this pillar matters beyond the balance sheet.

The gas tax hid the price of driving inside a purchase you made days earlier, in a currency you did not associate with roads, at a rate you never noticed. It is difficult to design a more effective way of making a cost invisible. When Minnesota surveyed its drivers, fewer than one in four could accurately describe how the fuel tax worked. They were paying it constantly and understood it not at all.

A per-mile charge, especially one that can vary by weight, by time of day, and by corridor, does something the gas tax structurally cannot. It makes the cost of a trip visible at the moment of the trip. That is not a punishment. That is information, and it is the same information every other market gives its participants as a matter of course.

Given that information, some drivers will drive anyway, and they should. Some will consolidate two errands into one. Some will discover that the 8:15 trip downtown, priced at what it actually costs the public in congestion and pavement, is worth less to them than the train. Every one of those small decisions returns something to the commons: a lane, a minute, a curb, a breath of air. Congestion is not a natural phenomenon. It is what happens when a scarce good is given away at a price of zero and rationed by queue instead.

And the revenue does not disappear into a general fund. It can be seen. Oregon and Minnesota already publish maps showing drivers the projects their money built. A road usage charge is the rare tax that can show its work, and the research on public trust is unambiguous that showing the work is what earns consent.

Which returns us, as everything in this paper eventually does, to the question of who is driving. You cannot charge a vehicle by the mile if you cannot be certain which vehicle drove them. You cannot discount the fare for a driver you cannot verify. You cannot price a corridor, or a curb, or a peak hour, against a plate that anyone can counterfeit with a wad of chewing gum.

The meter did not fail because we lacked a way to count miles. Odometers have existed since before the plate did. The meter failed because we never built a vehicle identity worth billing.

The obstacle is not the meter. It is the credential.

Andrew Sachs

Calvin Lawrence is a retired, disabled veteran. He lives in South Carolina, roughly seven hundred and fifty miles from the nearest New York toll gantry. He does not drive in New York. He has not driven in New York. New York, nevertheless, sent him a bill for $174.27 in tolls, and then, when he failed to pay for trips he never took, added some $1,200 in fees.

Mr. Lawrence had done nothing wrong. Years earlier he had surrendered a license plate, as the law requires. Someone else, somewhere, put those characters on a car and drove through toll gantries with them. The cameras worked flawlessly. They read the plate exactly as it was presented. The system then did precisely what it was built to do: it looked up the name attached to that string of characters and mailed the bill to the honest man.

He is not an anomaly. Joseph Jackson had a personalized plate stolen and received $317.25 in toll bills for a car he never drove.

Here is the uncomfortable thing to notice. Every camera performed correctly. Every database returned the right answer to the question it was asked. The failure was not in the enforcement technology, which has become extraordinary, but in the premise underneath it: that a photograph of a plate constitutes proof of a vehicle’s identity. It does not, and it never did. What we have built is a billing system of remarkable sophistication resting on an assertion no one has verified since 1901.

If your plate were duplicated tomorrow, the machinery would come for you with the same efficiency. Your only defense would be to prove a negative, and you would have to do it on your own time, at your own cost, against an agency that has your name and a photograph of what appears to be your car.

The leak

Now the scale.

Nobody publishes a reliable national ledger of what toll authorities are owed and what they fail to collect, which is itself a finding. But wherever an auditor has opened the books, the picture is the same. New York’s cashless conversion left $276.3 million in unpaid Thruway tolls, by the State Comptroller’s accounting. The Pennsylvania Turnpike comes up short by $150 million to $180 million a year against the $1.5 to $2 billion it is owed, a leakage rate above ten percent, which in any other revenue business would constitute an emergency.

Figure 7

The Leak, Where It Is Audited

Three documented holes in cashless tolling. Each one is an identity failure with a revenue symptom.

Sources: N.Y. Office of the State Comptroller Thruway audits (2023, 2025); Pennsylvania Auditor General turnpike audit and revenue analyses; Comptroller analysis of 2023 data and MTA, “The urgent need for toll enforcement,” 2026. The unverifiable national estimate has been cut from the manuscript; these audited figures carry the argument.

Pennsylvania’s shortfall carries an especially instructive detail. Analysts attribute part of it to a simple fact: the state does not require a front license plate. Fewer surfaces bearing the identifier, fewer usable reads, more escaped revenue. The entire thesis of this paper is contained in that sentence. When the only thing standing between a public asset and free consumption is whether a camera can photograph a piece of stamped tin, the revenue depends on the angle of approach.

Within that leak sits a specific and growing category. New York’s ghost vehicles, the ones with the chewing gum and the smoked covers and the counterfeit paper tags, cost the MTA more than $21 million in bridge and tunnel tolls in 2023 alone, a figure that rose one hundred and forty percent from 2020, by the State Comptroller’s analysis. The city’s own investigators put the free-rider dynamic in terms no one can misread: vehicles with untraceable plates owed, on average, $667.68, against $268.08 for vehicles whose plates could be matched. And they paid less than a fifth of the fines they incurred.

Figure 8

The Ghost Premium

New York City investigators compared vehicles whose plates could be traced with those whose plates could not.

Sources: NYC Council task force sample audits (dollar figures); corroborated by MTA Ghost Plate Task Force enforcement data. Untraceable vehicles owe 2.5x more and pay under 20 percent of citations.

The MTA does not have a toll collection problem. It has an identity problem with a toll collection symptom.

It is not a driver. It is an industry.

There is a comfortable way to picture the ghost plate. A furtive individual, a roll of tape, a bad decision at a toll gantry.

That picture is obsolete. Investigative reporting, later borne out by federal charges, traced New York’s counterfeit temporary tags to organized supply networks: warehouses in Georgia and New Jersey fronting hundreds of shell dealerships that existed for no purpose but to print paper. One of them, a dealership that sold no cars, issued 8,602 temporary tags in a single year. That is roughly twenty-three vehicles a day, from a business that did not exist.

Figure 9

It Is Not a Driver. It Is an Industry.

Warehouses in Georgia and New Jersey, fronting shell dealerships that existed for no purpose but to print paper.

Source: S.D.N.Y. federal charges, May 2026, and the Streetsblog NYC ghost-plate investigation that identified the dealers.

Federal prosecutors eventually charged eleven dealers. By then, tags traced to these networks had been linked to some 1,200 incidents, including six homicides, and to millions of dollars in unpaid city and state obligations.

Consider what that supply chain tells you. A market that sophisticated does not form around a product with a high probability of detection. It forms around a product that works. Somebody ran the numbers, correctly, and concluded that a fraudulent identity for a motor vehicle is a durable good with excellent margins, because the state’s ability to test that identity is close to nonexistent. The temp-tag warehouse is not a criminal aberration. It is a rational business, and its business model is the 1901 password.

What the cloak covers

Which brings this pillar to the ground where it actually matters, and where I want to be careful with you.

A vehicle that cannot be identified is not merely a vehicle that does not pay. It is a vehicle that cannot be held responsible. Registration is the mechanism by which a car is bound to a person, and insurance is the mechanism by which harm caused by that car is made whole. A fraudulent plate severs both bindings at once. The car becomes, as former New York City Traffic Commissioner Sam Schwartz observed of the term itself, essentially an illusion. It moves through the world consuming roads, occupying curbs, and occasionally striking people, while remaining connected to no one.

The consequences are not hypothetical, and neither is the arithmetic underneath them. In 2023, 15.4 percent of American drivers carried no insurance at all. One in three was either uninsured or underinsured. The rate ranges from 5.7 percent in Maine to 28.2 percent in Mississippi. When one of those vehicles causes a collision, the cost does not evaporate; it lands on the injured party, on the insured driver’s premium, and on the hospital. New York’s own enforcement authorities report that fraudulent plates routinely cloak vehicles that are unregistered, uninsured, or stolen, and that such vehicles have figured in hit-and-runs, robberies, and shootings.

Figure 10

Driving Bare

When one of these vehicles causes a collision, the cost lands on the injured party, the insured driver’s premium, and the hospital.

Source: Insurance Research Council, Uninsured and Underinsured Motorists 2017-2023 (published 2025).

Now here is the careful part.

This is the point in a paper like this one where the author reaches for a grieving family and asks you to stop thinking. The move is familiar because it works. It is also the single most reliable way that surveillance systems get built in this country, and anyone who has watched a legislature respond to a vivid tragedy knows exactly how the rest of the story goes. I am not going to make that argument, because it would be an argument for cameras, and cameras are what we already have.

The honest version is quieter and, I think, more damning. The uninsured hit-and-run is not primarily a story about a bad person. It is a story about a system that made anonymity cheap. We built a road network on an identifier that costs nothing to forge, and then expressed dismay that some of the people using it forged it. The family that cannot recover damages, the driver whose premium absorbs someone else’s collision, and Calvin Lawrence paying $1,200 for trips he never took are all standing at different exits of the same design flaw. There is no villain required. The plate did this.

Oklahoma, quietly

Which is why the most interesting thing in this pillar is not happening in New York.

Since 2017, Oklahoma has cross-referenced plate reads against the state insurance department’s database to identify uninsured vehicles. Insurance coverage is a fact about a car that a camera cannot see and a driver can easily misrepresent. The state does not attempt to see it. It verifies it, against an independent record, and it purges the underlying data within one hundred and eighty days.

Look closely at what that program is and is not. It is not a dragnet that retains everyone’s movements in case they become interesting later. It is a bounded check with a defined purpose and a deletion clock: does this vehicle satisfy a condition the law requires it to satisfy, yes or no, and then forget. It answers a question rather than compiling a history.

That is what verification looks like when it is designed rather than accumulated. It is also, not incidentally, the shape of the thing this paper is arguing for. Note too that the states with real-time electronic insurance verification tend to have lower uninsured rates than the states without it, which is the certainty principle again, arriving from a different direction. The uninsured driver responds to the likelihood of being noticed, not to the size of the fine he expects never to pay.

And Oklahoma achieved that with a camera and a database. Imagine the same bounded logic with a credential the vehicle cannot forge.

What the enforcement century bought us

Set the three pillars side by side and the pattern is impossible to miss.

To catch the Montana Ferrari, California assembled a task force, subpoenaed dealerships, and charged fourteen people, while Montana’s luxury registrations kept climbing toward eight thousand a year. To catch the ghost plate, New York ran dozens of operations, made hundreds of arrests, and issued tens of thousands of summonses, and the plates kept coming. To catch the uninsured driver, most states wait for a collision.

Each of these is a heroic effort to reconstruct, after the fact, a fact the vehicle could have attested to continuously, cheaply, and without a police officer, a subpoena, or a photograph of anyone’s movements.

We did not fail to enforce. We enforced magnificently, at extraordinary cost, against a credential engineered in 1901 to be trivially defeated by a leaf.

Everything above is a diagnosis. This is the part where a paper like this one typically produces a product brochure.

So let us begin with the failures, because they are more instructive than the promises, and because any serious reader is already reaching for the obvious objection: if we replace a piece of stamped tin with a computer, have we not simply built a more expensive thing to hack?

Yes. Sometimes exactly that.

Two hacks, and what they teach

In 2022, a group of security researchers led by Sam Curry turned their attention to Reviver, the company that pioneered the digital license plate, the electronic display that replaces the metal plate and shows the registration on a screen. They obtained super-administrative access to the company’s back end. From there they could see the GPS location of every plate on the system and the personal information of the owners attached to them. Reviver patched the flaw within about a day, which is to its credit, and which is entirely beside the point.

In 2024, a researcher at IOActive named Josep Rodriguez took the physical approach. He removed a digital plate, accessed its hardware, and reflashed its firmware over Bluetooth. He could then make the plate display any registration number he liked. A driver so equipped could show a legitimate number while parked and a stolen one at a toll gantry, or display a plate belonging to someone else entirely and let the tickets fall where they may.

Read that again. The proposed solution to the counterfeit plate is a plate that can be counterfeited by software, silently, from a phone, at any moment, with no visible modification whatsoever.

The 1901 plate at least requires chewing gum.

This is not an argument against modernizing the credential. It is an argument for understanding what a credential is, and the digital plate reveals that most people, including a good many legislators, have not yet drawn the distinction that matters.

Display is not verification

The Texas legislature, to its lasting credit, commissioned an independent study of alternative vehicle registration technologies, conducted by researchers at Texas State University rather than by anyone with a product to sell. Its central contribution is a taxonomy, and the taxonomy is the whole argument.

The report sorts these technologies into two categories. There are display tools, which present information to a human or a camera: the metal plate, the digital plate, the electronic registration card. And there are verification tools, which independently confirm a claim against a trusted record: automated plate readers checking a database, and radio-frequency identification credentials answering a cryptographic challenge.

A display tool shows you something. A verification tool proves something. These are not adjacent capabilities. They are opposites in every respect that matters, and the entire crisis in this paper stems from a century of asking a display tool to do a verification tool’s job.

Seen through that lens, the digital plate is not a second factor at all. It is the first factor with a screen. It is still public, still static in the only sense that counts, and still unbound to the vehicle beneath it. What the software added was not security but a remote interface: the ability to change what the plate says without a screwdriver. A reflashable screen bolted to a bumper is not a credential. It is a forgery device with a subscription.

Figure 11

Display Is Not Verification

The taxonomy at the center of the Texas legislature’s independent study of registration technology. A reflashable screen bolted to a bumper is not a credential.

Source: Texas State University study of alternative vehicle registration technologies, commissioned by the Texas legislature; author’s rendering of its taxonomy.

The Texas study reached a further conclusion that ought to be printed on the wall of every transportation committee room. Among the alternatives examined, cryptographic radio-frequency credentials appeared least vulnerable to compromise, and radio-frequency readers raised fewer privacy concerns than plate-reading cameras. But no system, the report says plainly, is entirely unhackable.

I want to sit on that sentence, because it is the one the vendors will ask you to skip.

Three factors, and the one everybody forgets

Strip the marketing away and a workable architecture has three parts.

The first factor is the visible plate, and it stays. It is the username: readable by humans, by cameras, by a police officer at a distance, by a witness to a collision. Nothing in this paper proposes taking it off your car. A username is not a defect. A username used as a password is.

The second factor is a cryptographic credential, something the vehicle possesses and cannot be photographed out of it. In practice this is a passive radio-frequency chip, embedded in the plate itself or in a windshield or headlamp tag, that carries a unique cryptographic identifier and answers a challenge from an authorized reader. The relevant standards are not exotic. Tolling-grade radio-frequency identification runs on ISO 18000-6C, a specification older than most smartphones. Manufacturers of these credentials, and here I am reporting their claims rather than endorsing them, describe chips that hold no personal data at all, only a key that means nothing except to the database that can verify it. United States Customs has used radio-frequency credentials at land border crossings for years. This is not a technology awaiting invention. It is a technology awaiting a decision.

The third factor is physical binding, and it is the one that gets left out of nearly every proposal, including some now in front of legislatures.

Consider why it matters. A cryptographic chip in a plate proves that the plate is authentic. It proves nothing whatsoever about which car the plate is bolted to. Steal a genuine credentialed plate from a genuine credentialed car and hang it on your own, and you have defeated the entire system with a screwdriver, exactly as you would have in 1901, only now with the state’s cryptographic seal of approval attesting that the lie is true.

Binding closes that gap. The credential is tied to the vehicle identification number, or a second tag is embedded in the windshield or headlamp assembly, or the record carries the make, model, and color, so that the reader can ask a question the thief cannot answer: is this credential on the vehicle it belongs to? Malaysia’s newest tolling platform illustrates the principle at scale, pairing radio-frequency identification as the primary detector with plate-reading cameras and three-dimensional scanning, so that the credential, the plate, and the physical shape of the vehicle must all agree before a transaction clears.

Three factors: what the vehicle claims, what the vehicle possesses, and what the vehicle physically is. Any two can be defeated. Defeating all three at once, invisibly, at highway speed, is a different order of problem than gluing a leaf to a character.

Figure 12

Three Factors, and the One Everybody Forgets

The workable architecture: the plate remains the public username; the credential proves possession; physical binding answers the question a thief cannot.

Author framework, after the Texas study’s findings and Malaysia’s multi-factor tolling deployment. Illustrative.

The cameras are not safer, they are only older

Before anyone concludes that the credential is the risky path and the camera is the prudent one, examine the incumbent with the same skepticism.

A researcher recently found more than seventy plate-reader cameras belonging to a major surveillance vendor sitting on the open internet, streaming live footage, protected by no password at all. Not encrypted poorly. Not protected. In Milwaukee, an officer was charged with using the same plate-reader network to track a person he had been involved with, and the department cut its authorized users from roughly three hundred and seventy to one hundred. In Denver, a woman named Chrisanna Elser was summonsed for a package theft on the strength of a plate-reader hit, and cleared only because the cameras on her own vehicle proved she had never stopped.

The camera network we have already deployed, at public expense, in thousands of jurisdictions, is insecure, abusable, and capable of confidently accusing the innocent. It fails in the worst possible way: it produces a guess with the emotional authority of a photograph.

And this points at the deepest difference between the two architectures, the one that should decide the matter.

A camera makes an identification. It looks at a thing and asserts, probabilistically, what that thing is. When it is wrong, as it was about Ms. Elser, the error is invisible to the system and expensive to the person. There is nothing to check. The photograph is the evidence and the evidence is the photograph.

A credential makes a verification. It asks a question with a right answer, and the answer is either cryptographically valid or it is not. When it fails, it fails loudly, in a log, in a way that can be audited afterward by someone who was not in the room. Verification produces a record of the question rather than a record of the person.

Design for the day it breaks

No one should promise you a system that cannot be defeated. The Texas researchers would not, and neither will I. The right question is never whether a security system can be broken. It is what happens on the day it is.

Here the difference is not incremental.

When a stamped metal plate is forged, nothing happens. No alarm sounds, no record is created, no authority learns of it. The forgery is indistinguishable from the original by design, because the original was never distinguishable from anything. There is no mechanism to revoke a plate that someone else has copied, because there is nothing to revoke; there is only a string of characters that two cars now display and a bill that goes to whichever name the state has on file. Ask Calvin Lawrence.

When a cryptographic credential is compromised, it can be detected, because a duplicate key presenting in two jurisdictions at once is a fact a database can notice. It can be revoked, instantly, everywhere, the way your bank kills a stolen card. It can be reissued. And the compromise leaves a trail that investigators can follow backward to the point of failure, which is precisely how the Reviver vulnerabilities were found, published, and closed, by researchers, in public, before either was exploited at scale.

The plate on your car right now cannot be revoked. It has never been able to be revoked. If someone copies it tonight, you will find out when the bill arrives.

That is the choice on the table, and it has been mischaracterized from the beginning. It is not a choice between a secure old system and a risky new one. It is a choice between a credential that fails silently, permanently, and in favor of the forger, and a credential that fails loudly, recoverably, and in a manner that can be audited by the public.

Neither is perfect. Only one of them can be fixed.

Display is not verification.

Andrew Sachs

Now the objection, stated at its full strength, without the softening that authors of papers like this one usually apply before answering it.

A vehicle that can prove who it is can be found. A system that verifies your car at a toll gantry can, with a change of policy and no change of hardware, record that your car was at that gantry. Multiply the gantries. Add the parking garages, the curbs, the bridges, the border of every low-emission zone. What began as a credential becomes a map of your life: your church, your union hall, your clinic, your lawyer, your lover, your protest.

Civil liberties organizations have been saying this for over a decade, and they have been right about nearly all of it. Plate readers were sold as tools for finding stolen cars. They became databases holding the movements of tens of millions of people who have done nothing at all, retained for years, searchable by agencies the drivers never heard of. The American Civil Liberties Union’s Jay Stanley put the intuition in a form no focus group could improve on: most Americans would not accept a police officer standing on their street around the clock, writing down every time they drove past. We accepted precisely that, because the officer was replaced by a camera and the notebook by a server, and nobody was ever asked.

That is the honest statement of the danger, and this paper does not dispute a word of it.

But something has happened in the last two years that changes the shape of the argument, and almost nobody writing about vehicle identification has noticed it.

The revolt, and what it was actually about

Since the beginning of 2025, at least thirty American localities have canceled or deactivated their contracts with the country’s largest plate-reader vendor. Flagstaff. Cambridge. Eugene. Santa Cruz. More than fifty in the space of a year, most of them in a three-month cascade, out of a network exceeding five thousand agency contracts. When the vendor characterized the wave as a coordinated attack, the police chief of Staunton, Virginia declined to go along, and described what was happening in his city instead: residents raising concerns, and a government listening. He called it democracy.

Read the coverage of that revolt closely and you will find something that ought to reorganize this entire debate.

The cities are not abolishing vehicle identification. They are dismantling a particular business model. Officials cancelling these contracts have, in most cases, not sworn off plate readers at all. What they demanded, and what the vendor could not offer, was local control of the data, independent audits of who searched it, and hard limits on where it flowed. The objection was never that the state might learn which car passed a given intersection. The objection was that the record of that passage was retained indefinitely, pooled nationally, searchable by strangers, and accountable to no one in the community that paid for it.

The public is not anti-identification. The public is anti-dragnet.

Figure 13

The Revolt Is Not Against Identification

What officials demanded, and the vendor could not offer: local control of the data, independent audits of who searched it, hard limits on where it flowed.

Sources: NPR and municipal cancellation trackers, 2025-2026. A moving count as of September 2026.

That distinction has been available to us for years and we have consistently failed to hear it, because the surveillance industry and its critics have both had reasons to describe identification and surveillance as the same thing.

The other half of the evidence

Now put that beside a body of research from an entirely different field, conducted for an entirely different purpose, by people who had never heard of the plate-reader fight.

When Minnesota studied public attitudes toward mileage-based road charges, it found the expected resistance. Participants said they felt watched. They asked why the state did not simply raise the fuel tax and leave them alone. Fewer than one in four could accurately describe how the fuel tax they already paid actually worked.

Then the researchers asked what would make such a system acceptable, and the public answered with startling specificity. Charge heavier and more polluting vehicles more per mile. Make the equipment the government’s responsibility rather than the driver’s. And have the data protected not by the state that collects the money, but by an independent, non-governmental auditing firm. When Minnesotans actually tested a device built along those lines, seventy-one percent came away positive and seventeen percent negative.

Figure 14

The Terms of Consent

Council chambers rejected the dragnet. Focus groups accepted the charge, on conditions. Two populations, one answer.

Sources: N.H. RSA 261:75-b; Me. Rev. Stat. tit. 29-A §2117-A; Virginia 2025 session coverage; Alabama retention as compiled in state ALPR law surveys; MnDOT mileage-based user fee demonstration evaluation and NCHRP Synthesis 487 (71 percent positive, 17 percent negative after participants tested the system with privacy controls and independent auditing).

Set the two findings side by side.

In council chambers, communities rejected retained, pooled, unaudited vehicle surveillance while keeping bounded identification. In focus groups, drivers accepted road charging on the condition of independent audit, government-owned equipment, and no unnecessary tracking. Two populations, two decades, two entirely unrelated policy questions, and one answer.

The public has already told us what it will accept. It has told us twice. What it will not accept is a permanent record of its movements held by whoever bought the software. What it will accept is a system that answers a question and then forgets.

Privacy by design is not a concession this paper makes to its critics. It is the documented precondition of building the thing at all. Every road usage charge pilot that has ignored it has stalled. Every surveillance network that has ignored it is now being torn out of American cities, one council vote at a time.

An attestation is not a diary

The technical distinction that makes this possible was drawn back in Section IV, and it is worth restating in the language of law rather than engineering.

The state has a legitimate interest in knowing that a vehicle is registered, insured, and paying for the roads it uses. It has no legitimate interest in a chronological account of where that vehicle has been. These sound similar. They are not remotely the same, and the difference is the difference between a receipt and a wiretap.

A properly designed credential produces an attestation: this vehicle is valid, this vehicle accrued this many miles in this jurisdiction, this vehicle qualifies for this rate. It does not produce an itinerary. The chip carries a key, not a name and not a history. The reader asks a question and records the answer, not the driver.

Oklahoma has been operating on roughly this principle since 2017, checking vehicles against the insurance database and purging the underlying data within one hundred and eighty days. It is not a perfect model, but it demonstrates that a state can verify a condition and then deliberately forget the observation. That is a policy choice, not a technical limitation. It has always been a policy choice.

And the courts have begun to say so. The Supreme Court recognized this precise hazard in the 2018 Carpenter v. United States ruling, concluding that exhaustive movement records deserve constitutional safeguards; while a single coordinate may seem harmless, the collective history exposes a life that the isolated parts do not. The Massachusetts Supreme Judicial Court took that logic to the pavement in the 2020 case Commonwealth v. McCarthy. The court recognized that while a single camera hit is a banal fact, the systematic aggregation of those hits into a searchable history of a life transforms the mundane into a constitutional event. The transgression, the justices suggested, resides not in the act of seeing, but in the decision to remember.

The statute already exists

Here is the part that should interest any legislator reading this, because it means the drafting work has largely been done.

In 2022 California enacted Assembly Bill 984. Amid the ordinary machinery of authorizing digital license plates, the legislature wrote something remarkable. It generally prohibited those devices from containing GPS or vehicle location technology at all, with narrow exceptions for commercial fleets. It required that pilot-program devices carrying GPS be recalled. It added protections against employers using the plates to track employees, with civil penalties attached. And it provided, in language worth memorizing, that the Department of Motor Vehicles shall not receive or retain information about the movement, location, or use of a vehicle or a person.

The registration authority is forbidden from knowing where your car has been. That is not an aspiration in a white paper. That is California law, on the books, since 2022.

Two years later, when the legislature considered a follow-on bill, its own committee analysis cited the Reviver hack by name, noted that researchers had obtained administrative access to plate locations, and raised the danger of an abuser using such a system to track a domestic violence victim to a shelter. The state’s own legislative record already contains the case against careless implementation. Nobody has to be persuaded that the risk is real. They have written it down.

What no state has yet done is apply that discipline to the credential and the reader at the same time, in the same statute, as a single architecture.

The six things a bill must say

Synthesized from statutes now in force across the country, here is what a serious vehicle identification law must contain. Every one of these exists somewhere. None exists everywhere.

1. Purpose limitation. The credential may be read only for enumerated purposes named in the statute. Maine restricts plate reader use narrowly, makes violation a crime, and specifically exempts toll enforcement, which proves that a bounded purpose and a working revenue system can coexist in the same sentence.
2. A short retention clock. Across the states, retention runs from roughly three minutes in New Hampshire to five years in Alabama. Maine holds at twenty-one days. Virginia fought through its 2025 session over twenty-one versus thirty, with reform advocates pressing for seven precisely because a shorter window narrows what outside agencies can obtain by warrant. Twenty-one days is a defensible anchor. Five years is a database waiting for a subpoena nobody anticipated.
3. No location technology in the consumer credential. Not restricted. Not policy-governed. Absent, as a matter of hardware, per California’s model. A capability that does not exist cannot be repurposed by a future administration, a vendor’s terms of service update, or a breach.
4. Data minimization at the registration authority. The agency that verifies your car may not receive or retain where it has been. California’s language is available for copying.
5. Pseudonymous keys, no personal data on the tag. The credential should mean nothing to anyone who intercepts it, and nothing to anyone without authorized access to the verifying database. The Texas study’s finding that cryptographic credentials present less privacy exposure than cameras depends entirely on this property.
6. Independent audit, published usage policies, and penalties with teeth. California requires published policies and prohibits data sales. Maine attaches criminal liability. Minnesota’s own residents asked for a non-governmental auditor. Give them one. An unaudited log is a rumor.

A reader who has followed the argument this far will notice these six requirements are not obstacles to the system this paper proposes. They are the system. Strip them out and you have not built a credential. You have built a tracking network with better branding, and the cities of Flagstaff and Cambridge will be waiting for it.

Policy first, hardware second

One final warning, from the only country that has attempted this at national scale.

Malaysia built the technology first. It deployed radio-frequency identification across a tolling network fragmented among competing concessionaires, with no single authority owning the system end to end. The result has been unreliable detection, driver confusion, and a public that associates the technology with malfunction. Singapore did the reverse. It settled the policy, the governance, and the accountable authority before it procured a single reader.

The lesson translates without modification. A state that issues a request for proposals before it passes a statute will get precisely what it asked for: hardware, owned by a vendor, governed by a contract, accountable to a procurement officer. The surveillance state in America was not enacted. It was purchased, one municipal purchase order at a time, and it is now being dismantled at council meetings by citizens who were never asked whether they wanted it in the first place.

Do not let procurement become policy. Write the law first. Then buy the reader.

The public will tell you what it wants, if you ask before you sign the contract.

There is a strip of land running along the edge of every commercial street in America. It sits at the exact point where the transportation network meets the destination, which is to say the point of maximum value in the entire system. In a dense city it is worth more per square foot than most of the buildings behind it.

We give it away for free, and we ration it by queue.

Donald Shoup spent a career explaining why this was insane, and he was right. He demonstrated that free parking is never free, that the cost is simply relocated into rents, prices, and the fuel burned by drivers circling the block. He proposed that we price the curb to achieve a target occupancy, capture the revenue, and return it to the neighborhood that generated it. The idea was correct, it has been validated everywhere it has been tried, and it changed the field.

Shoup got it half right.

What he identified was that the curb was mispriced. What has happened since he wrote is that the curb stopped being a parking space at all. It became the loading dock for the entire consumer economy, the boarding gate for ride-hailing, the staging area for food delivery, the right of way for the bus, the bike, and the scooter, the terminus for a package that a person ordered while standing on the sidewalk beside it, and, increasingly, the place where an autonomous vehicle decides to stop. The curb is no longer underpriced real estate. It is contested territory, claimed simultaneously by parties whose claims cannot all be honored, and adjudicated at present by whoever arrives first and is willing to be honked at.

The consequences are measurable. Research out of UCLA, measuring curb by curb along Santa Monica Boulevard, found that a space managed as a passenger loading zone moved roughly four times as many people per hour as the same space given over to parking. Four times. That is not an incremental efficiency. That is the difference between a street that works and a street that does not, achieved by changing nothing except who is allowed to use the space and for how long.

Figure 15

Four Times the Curb

Measured curb productivity on Santa Monica Boulevard: passenger loading spaces transported four times as many passengers per hour as parking spaces.

Source: Ryland Lu, UCLA curb productivity study of Santa Monica Blvd, West Hollywood (Table 22).

So price it. Manage it. Shoup himself, late in his life, observed that dynamic curb pricing would be adopted much faster than he had once expected. Cities are already building the maps: Hoboken has digitized its curb into a multidimensional inventory that can be allocated among delivery, ride-hailing, and micromobility by time of day.

Now try to enforce any of it.

The curb runs on the 1901 password

Every model of curb management that anyone has proposed, and every one this author has helped design, rests on a chain of inferences that begins with a photograph of a license plate.

Dynamic pricing requires knowing which vehicle occupied which space and for how long. Escalating duration pricing, which charges a delivery van almost nothing for four minutes and a great deal for forty, requires knowing that the vehicle at minute forty is the same vehicle that arrived at minute one. Loading zone enforcement requires distinguishing a credentialed commercial vehicle from a private car with its hazards on. Permit programs for residents, for contractors, for the disabled, require binding a privilege to a vehicle and confirming that the vehicle at the curb is the one entitled to it.

Every one of those requirements is an identity claim. Every one of them is currently satisfied by photographing a strip of stamped tin and trusting what it says.

Which means the entire architecture of curb management, the whole apparatus of pricing, allocation, and enforcement that the profession has spent fifteen years designing, inherits the vulnerability described in this paper. A curb priced against a forgeable identifier is a curb priced for the honest, and free for everyone else. Charge the delivery fleet by the minute and the fleet with counterfeit tags pays nothing, which does not merely cost revenue but actively rewards the operator who cheats with better access to the scarcest asset on the street.

The same failure runs through the garage. The industry has spent a decade removing gates and tickets, replacing them with plate recognition, and celebrating the reduction in friction. It is a genuine advance. It also means that the revenue integrity of a modern parking facility now rests entirely on the assumption that the plate at the entrance is a true statement about the vehicle behind it. Gateless is only as good as the credential, and the credential is from 1901.

What identification makes possible

Here is where the argument turns from defensive to constructive, because reliable vehicle identity does not merely protect the curb. It is the precondition for the model that fixes it.

The Parkonomics pricing thesis holds that the garage should be the affordable option and the curb the premium one. Today this is precisely inverted. The curb is free or nearly so, immediately adjacent, and enforced by chance. The garage costs money, requires a decision, and sits a hundred feet away. We have priced the scarce asset at zero and the abundant asset at market, and then expressed surprise that everyone fights over the scarce one.

Correcting that inversion requires charging real money at the curb, differentiated by duration, by time of day, by vehicle class, and by purpose. All of that is arithmetic. None of it is possible without knowing, reliably and continuously, which vehicle is there.

Reliable identity also permits the thing the curb most needs, which is not merely a price but a discipline about time. A curb that charges an escalating rate by the minute converts the most contested asset in the city into a high-turnover public utility, one that serves the delivery driver who needs four minutes and refuses the commuter who wants nine hours. That is not a technology problem. It is an identity problem wearing a technology costume.

And identity is what turns the garage into something other than a warehouse for stationary cars. A facility that can verify a vehicle at the threshold, without a gate, a ticket, or a queue, is no longer a parking structure. It is a mobility hub: a place where a verified vehicle enters, a verified charging session begins, a verified fleet vehicle stages, a verified rideshare driver waits without idling at the curb. Every one of those functions is a credential check. The building already exists on nearly every block. What it lacks is the ability to know, with confidence, who has arrived.

Operations first, technology second

A necessary caution, and it is the one this author has spent a career repeating.

Nothing in this pillar argues that a city should buy readers. The Gateway Approach holds that operations come first and technology second, and the history of this industry is a museum of expensive hardware purchased to solve problems that were never operationally defined. A city that installs credential readers along a curb it has not yet decided how to allocate has not modernized anything. It has purchased a very precise instrument for measuring its own confusion.

The sequence is the same one Section VII demanded of the legislature. Decide what the curb is for. Decide who has priority, at what hour, at what price, and to what public end. Write it down. Then, and only then, ask what instrument can verify the claims that policy requires.

Identification is not a curb strategy. It is what makes a curb strategy enforceable, which is the difference between a policy and a wish.

Shoup taught the profession to price the space. He was half right, and the missing half was never a pricing question at all. We learned to charge for the curb. We never built a way to know who was standing on it.

A fair question has been waiting since the first page.

Why is a parking consultant writing about toll evasion, luxury tax fraud, the Highway Trust Fund, and the Fourth Amendment? These are not parking problems. There is no parking space in this paper until Section VIII.

The answer is that the parking industry got here first, and it has the scars to prove it.

The canary went into the mine voluntarily

Consider what parking uniquely is. Tolling meets the vehicle in motion, for a fraction of a second, at a gantry. Taxation meets it on paper, once, at purchase. Road usage charging meets it in aggregate, at the end of a billing period. Parking meets the vehicle at rest. Up close. Repeatedly. Every day. With money attached to the encounter.

Which means that when the industry decided, roughly a decade ago, to build its future on the license plate, it was the first to discover what the license plate actually is.

We went all in. We removed the gates. We threw away the tickets. We replaced the credential card and the transponder with a camera and a promise, and we called it frictionless. License plate recognition became the backbone of gateless parking, of ticketless entry and exit, of on-street enforcement, of permit verification, of scofflaw identification, of the entire modern revenue apparatus of an industry that handles tens of millions of vehicles a day.

We bet the revenue of an entire industry on a photograph.

Every operator reading this knows how that has gone. The exception queues, where an image the system could not resolve waits for a human to squint at it. The plate that reads correctly and belongs to no one. The plate that belongs to someone who was four hundred miles away. The vehicles that exit behind a paying customer because the camera saw a bumper and not a character. The chargebacks. The disputed citations, in which the operator’s evidence is a photograph and the driver’s defense is that anyone can photograph a plate, and the driver is right. The temporary tag that expires in a database somewhere and never expires on the car.

The tolling authorities are discovering these failures now, at the scale of a state. We discovered them years ago, at the scale of a garage, and we have been building expensive optical workarounds ever since rather than admit what the exception queue was trying to tell us.

It was not telling us that the cameras were insufficient. The cameras have become extraordinary. It was telling us that we had asked a camera to authenticate a credential that was never a credential at all.

The parking industry is the canary. We went into the mine first, and we did it enthusiastically, with a press release.

License plate recognition, redeemed

Nothing in this paper is an argument against license plate recognition. It is an argument that we have been using it wrong, and Section VI explains precisely how.

Recall the Texas taxonomy. A display tool presents information. A verification tool confirms a claim against a trusted record. License plate recognition is a verification tool. It has always been a verification tool. It has simply never had anything worth verifying, because the only thing it could check a photograph against was a database of photographs of the same forgeable string of characters.

Give that camera a vehicle carrying a real credential and something changes that operators will recognize immediately. The camera stops being the system of record and becomes what it should always have been: one of several factors, corroborating the others. The plate says ABC1234. The credential, answering a cryptographic challenge, agrees. The physical binding confirms the credential belongs to this vehicle and not to one parked three states away. Three independent factors, agreeing, in the time it takes to roll past a reader.

And the exception queue empties. Not because the camera improved, but because a bad read is no longer a revenue event. It is a corroboration failure that the credential resolves before anyone reaches for a photograph.

What disappears

Now permit a parking professional a moment of open pleasure, because what follows is the part of this argument I did not expect to arrive at when I started writing about ghost plates.

The meter disappears.

Not the price. The apparatus. The pole, the coin slot, the solar panel, the cellular modem, the maintenance contract, the collection route, the coin counting room, the vandalism, the receipt printer that runs out of paper on the second-highest revenue day of the year. All of it is infrastructure built for one purpose: to obtain, from a human being standing in the weather, a promise about a car.

The QR code disappears, and with it the sticker peeling off the pay station, and the driver squinting at a phone in the rain, and the twelve competing applications, each requiring an account, a password, and a credit card, each taking a cut, each abandoned by roughly a third of the drivers who start the process.

The ticket disappears. The gate disappears, which it mostly has already. The validation stamp disappears. The permit hangtag, that great artifact of twentieth-century access control, disappears.

What replaces them is nothing. A vehicle arrives at a curb or a threshold. A reader confirms it is what it claims to be. A session opens. The vehicle leaves. The session closes. The driver, who has done nothing and touched nothing, is charged the posted rate, and the municipality’s parking tax is collected at the point of sale, cleanly, at the moment of the transaction, without an audit.

And if the driver forgot their phone, it works.

If the driver has no phone, it works. If the driver has no bank account, no credit card, no application, no data plan, no English, no ability to stand at a pay station and operate a touchscreen in the cold, it works.

That is not a convenience feature. Read the last two paragraphs again and ask who, exactly, has been excluded from every parking payment system deployed in the last fifteen years. We built an access-control regime that quietly requires a smartphone and a payment instrument, and then we called it modernization and wondered why enforcement fell hardest on the people least able to absorb a citation. A credential the vehicle carries asks nothing of the driver at all. The equity argument in Section IV was that identification is the precondition for a low-income discount. The equity argument here is smaller and more immediate: identification is the precondition for not requiring a smartphone in order to park a car.

A text message before a ticket

One more thing becomes possible, and of everything in this paper it is the change most drivers would actually notice.

A vehicle stops in a bus zone. A loading zone. A street-cleaning lane at 7:58 in the morning. Today, that vehicle receives a citation, discovered under a wiper blade twenty minutes later, at a cost of somewhere between forty and two hundred dollars, for an infraction the driver would have corrected in ninety seconds had anyone told them.

With a verifiable vehicle identity and an opted-in account, the driver receives a text message.

Recall the finding that has surfaced in every pillar of this paper, from the tax cheat to the toll evader to the uninsured driver: behavior responds to the certainty of being noticed far more than to the severity of the punishment. A near-certain warning, delivered in seconds, at no cost, before any penalty attaches, is that principle expressed as public policy. It moves the bus. It clears the hydrant. It does so without a citation, without an appeal, without the municipal machinery of adjudication, and without extracting a hundred dollars from someone who made an honest mistake. And even the driver who gambled that no one would notice moves, before the bus is blocked, because now someone does. That is the entire point.

Enforcement stops being a revenue stream and becomes what the profession always claimed it was: a way to keep the curb working.

Fine the vehicle that ignores the warning. Fine it firmly. But send the warning first, because we can, and because the only reason we never could is that we had no reliable way to know whose car that was.

The discipline this requires

Everything I have just described is a payment and enforcement architecture built on a state-mandated vehicle credential. If you have read Section VII, you know exactly what it sounds like, and you are right to be uneasy. So let me state the constraints in the plainest language I can, because an industry that builds this carelessly will deserve what follows.

The credential is mandatory. The account is not. The vehicle must always be able to prove it is what it claims to be. Whether a driver chooses to attach a payment relationship to that proof is a separate decision, freely made, freely revoked. Cash must survive. Anonymous payment must survive. A credential that becomes a mandatory payment tether is not a credential. It is a leash, and every assurance in this paper becomes a lie on a delay.

The state validates. It does not collect, and it does not remember. The registration authority answers exactly one question: is this credential valid, yes or no. It does not learn where the vehicle stopped. It does not learn how long. It does not receive the transaction, and it does not keep the answer. California has already written this into law, and the language is available for copying.

The records live with an independent processor, and law enforcement needs a judge. Not the state. Not the operator’s cloud vendor. Not a national database pooled across five thousand agencies. An independent processor, contractually bound, publicly audited, holding parking transaction records that no law enforcement agency may obtain without a warrant signed by a judge. Not an administrative request. Not a subpoena. Not a vendor’s terms of service, quietly amended. A warrant.

Notice what that standard actually is. It is stronger protection than plate reader data enjoys in most of this country right now, where a location history of every driver in a city sits on a private server, searchable by agencies the drivers have never heard of, retained for years, obtainable with far less. The parking layer described here does not lower the privacy floor. It raises it, and it should be sold to the public on precisely that basis.

And it is, almost exactly, what the public asked for. When Minnesota’s drivers were asked what would make mileage charging acceptable, they specified that the privacy data be held not by the government collecting the money, but by an independent, non-governmental auditor. They designed this section before I did.

Where this goes next

The operational architecture, the transition path for existing plate recognition installations, the merchant economics against today’s payment processing costs, the municipal tax collection mechanics, and the question of what happens to the twelve parking applications currently on the average driver’s phone, all of that belongs in a companion paper written for the people who operate this equipment for a living. It is coming.

What belongs here is the reason a parking consultant wrote a paper about the Fourth Amendment.

The credential this paper describes is not a roadway policy that parking happens to benefit from. It is the thing the parking industry has needed for a decade, has known it needed, and has spent hundreds of millions of dollars building optical workarounds to avoid admitting. We tried to authenticate a vehicle with a photograph, because a photograph was all the vehicle would offer us.

We were the first industry to bet on the 1901 password. We should be the first to say, out loud, that it never worked.

Set them side by side one last time.

A Ferrari registered to a company in a state it has never visited. A sedan crossing a toll gantry with a leaf glued over one character. A delivery van paying nothing for a curb space it occupies all afternoon. An electric vehicle paying a flat fee bearing no relationship to the roads it uses. A hit-and-run driver who cannot be found because the plate on his bumper belongs to a car in another county. And a retired veteran in South Carolina, seven hundred and fifty miles from New York, opening a bill for $1,374 in tolls and fees for trips he never took.

Six scenes. One cause.

In every case, the state asked a vehicle to identify itself, and the vehicle lied, or told the truth and was not believed, or told the truth about the wrong thing. In every case the machinery downstream worked flawlessly. The cameras focused. The databases matched. The invoices printed. And in every case the answer was wrong, because the question was addressed to a strip of stamped metal that has never, in one hundred and twenty-four years, been capable of proving anything at all.

We keep treating these as separate crises, staffed by separate agencies, addressed by separate bills. The tax authority pursues the shell company. The tolling authority pursues the ghost. The insurance commissioner pursues the uninsured. The transportation department convenes another road usage charge pilot and stalls, again, on privacy. The parking director prices a curb that cannot be enforced. Each of them is fighting, in their own jurisdiction, with their own budget, the same hundred-and-twenty-four-year-old design flaw, and none of them can fix it alone because none of them owns the credential.

The credential is the common infrastructure. Everything else is a symptom with a letterhead.

What this paper is not asking for

It is not asking for more cameras. We have covered the country in cameras, and they are being ripped out of cities by residents who were never asked whether they wanted them. It is not asking for higher fines. The research is unambiguous and it has been unambiguous for decades: the evader weighs the certainty of being caught, not the severity of what happens if he is. We have spent a century turning up the severity dial while the certainty dial rusted in place.

It is not asking for tracking. The state has no legitimate interest in where your car has been, and the public has now told us twice, in focus groups and in council chambers, that it will not accept a system built on that premise. It has also told us, with unusual precision, what it will accept: bounded purposes, short retention, independent audit, no location technology, and no permanent record held by whoever won the procurement.

It is asking for something narrower and older than any of that. It is asking that a vehicle be able to prove it is what it claims to be.

The half that Shoup left

Donald Shoup showed a generation that the parking space had a price, and that pretending otherwise imposed the cost on everyone who never parked. He was right, and the profession is still catching up to him.

But pricing presumes identity. You cannot charge a vehicle you cannot name, exempt a driver you cannot verify, discount a fare for a household you cannot confirm, or free a curb you cannot enforce. Everything the reformers want, congestion pricing, curb management, mobility hubs, road usage charges that finally replace a broken fuel tax, low-income relief that arrives automatically rather than through an application nobody submits, rests on a foundation that was poured in 1901 and has never been inspected.

That is the half that remains. Not the price. The proof.

To the officials, and to everyone else

To the legislator: you are being offered, right now, by capable vendors, a device that will display your state’s registration on a screen. It is not what this paper describes. It is the 1901 plate with a subscription and a firmware vulnerability. Before you authorize any of it, write the statute. Name the purposes. Set the retention clock. Forbid the location hardware. Fund the independent auditor. Then, and only then, sign the purchase order. Your predecessors built the surveillance state one procurement at a time without ever holding a vote. You have the opportunity to do the opposite, and roughly one legislative cycle in which to do it before the vendors decide the architecture for you.

To everyone else: the bill for all of this is already arriving at your address. It is in your toll, which is higher because someone with a counterfeit tag paid nothing. It is in your insurance premium, which absorbs the collisions of drivers who were never registered. It is in the sales tax you paid on your own car while a McLaren two lanes over paid none. It is in the road that is not repaved, funded by a gas tax whose meter stopped years ago, and in the curb outside the shop you cannot park at because the space is occupied by a vehicle that will never be ticketed. None of that money vanished. It was quietly reassigned to you, because you are identifiable and they are not.

You lock your bank account behind two factors. You would not tolerate a bank that let anyone log in with a username painted on the side of the building.

Your car has been doing exactly that since April of 1901.

We gave the automobile a name and asked the world to take its word for it. For one hundred and twenty-four years we have paid for that courtesy, in leaked revenue, in unenforceable policy, in surveillance we built because we lacked a credential, and in bills mailed to the wrong man.

It is time we asked the car to prove it.