In just a few taps and clicks, the tool showed where a car had been seen throughout the U.S. A private investigator source had access to a powerful system used by their industry, repossession agents, and insurance companies. Armed with just a car's plate number, the tool—fed by a network of private cameras spread across the country—provides users a list of all the times that car has been spotted. I gave the private investigator, who offered to demonstrate the capability, a plate of someone who consented to be tracked.

What DRN has built is a nationwide, persistent surveillance database that can potentially track the movements of car owners over long periods of time. In doing so, highly sensitive information about car owners can be made available to anyone who has access to the tool.

This tool, called Digital Recognition Network (DRN), is not run by a government, although law enforcement can also access it. Instead, DRN is a private surveillance system crowdsourced by hundreds of repo men who have installed cameras that passively scan, capture, and upload the license plates of every car they drive by to DRN's database. DRN stretches coast to coast and is available to private individuals and companies focused on tracking and locating people or vehicles. The tool is made by a company that is also called Digital Recognition Network.

The results popped up: dozens of sightings, spanning years. The system could see photos of the car parked outside the owner's house; the car in another state as its driver went to visit family; and the car parked in other spots in the owner's city. Each was tagged with the time and GPS coordinates of the car. Some showed the car's location as recently as a few weeks before. In addition to photos of the vehicle itself, the tool displayed the car's accurate location on an easy to understand, Google Maps-style interface.

"DRN provides a very powerful tool to private industries such as insurance, investigations and asset recovery. A powerful tool can be abused and such abuses would infringe on the privacy of Americans," Igor Ostrovskiy, a New York based private investigator with a firm called Ostro Intelligence, told Motherboard.

Even if you're not suspected of a crime or behind on your car payments, your location information may be included in this database—in fact, the vast majority of vehicles captured are connected to innocent people. DRN claims to have more than 9 billion license plate scans, according to a DRN contract obtained by Motherboard. And DRN has admitted that people who are not supposed to be allowed to use the tool have gained access.

In Motherboard's test, we found a person who consented to have their license plate entered into the DRN system. They then verified that the photos were of their car, and provided context of where the photos had been taken.

"Looks like that's in front of my house!" the person said. The photo also included part of the building the car was parked in front of. Motherboard granted the person anonymity to protect their privacy. "Creepy," they added.

Motherboard also obtained the results of a DRN search of a vehicle that was located primarily in a large U.S. city. These results were even more granular, showing their movements across the city on the highway, on smaller streets, and spotted in specific neighborhoods, too.

The data is easy to query, according to a DRN training video obtained by Motherboard. The system adds a "tag" to each result, categorising what sort of location the vehicle was likely spotted at, such as "workplace" or "home."

Do you work at DRN or Vigilant? Did you used to? Or do you have more information about license plate readers? We'd love to hear from you. Using a non-work phone or computer, you can contact Joseph Cox securely on Signal on +44 20 8133 5190, Wickr on josephcox, OTR chat on jfcox@jabber.ccc.de, or email joseph.cox@vice.com.

"If the scans are happening during the day, it's assumed that the vehicle is at a work location," a narrator says in the training video while demonstrating the tool. "If they were, say, in the evening, 6 p.m. to, say, 6 a.m., then this would show up as a residential location. It's assumed that the person's home."