Friday, September 20, 2019

A hacker by the name of Droogie decided to mess with the Automatic License Plate Reader systems that issue traffic fines. from that alone you ought to expect this backfired on him colossally

Droogie (a name Joseph Tartaro made up for himself as a teen) had decided to experiment with the "NULL" plate, after checking with California's DMV and finding it surprisingly available. "Registration went through fine," he said, "no bugs or anything," leaving him without any "high expectations of the DMV website."

“The idea was I’d get VOID for my wife’s car, so our driveway would be NULL and VOID,” Tartaro says.

He secured the plate and set out to check "is it possible to be ‘invisible’ to citations? What happens when a police officer does a search for my plate 'NULL', would it not return any data? If they file a citation, would it cause an issue?"

That first year as a NULL driver was uneventful. But when it came time to renew in 2017, the DMV website no longer accepted NULL as an option. “It broke the website,” Tartaro says. Specifically, the site told him that the license plate and vehicle identification number he had entered, knows as the VIN, were invalid. But Tartaro was still able to use a reference number to renew. He didn’t think much more of it.  Unluckily for Droogie he had provided an address for all those unassigned tickets to get sent to, $12,000 dollars worth, at first. More followed

He also didn’t think much of the ticket he got in early 2018, for not having the appropriate registration sticker on his license plate. Tartaro suspects someone scraped it off to use on their own car. He thought about fighting it, but the fine was only $35, so he decided to just pay it and move on with his life.

Then came the citations. Dozens of them, deposited in bulk to his mailbox. Parking violations, stand-stop violations, fines of $37, $60, $74, $80, from Fresno to Rancho Cucamonga. “I’ve never been to Fresno,” Tartaro says of the California city.

Nor had Tartaro gone on a statewide, parking-related crime spree. Instead, by paying that $35 ticket, it appears that a database somewhere now associated NULL with his personal information. Which means that any time a traffic cop forgot to fill in the license plate number on a citation, the fine automatically got sent to Joseph Tartaro.

The tickets were for Hondas, Toyotas, Mercedes vehicles. (Tartaro has an Infiniti.) At one point, Tartaro says, he received two tickets written at Cyprus College within hours of each other—for two different vehicles. He would have had to swap the registration during his lunch break. Worse yet, the incoming citations seemed to apply retroactively.

“I have tickets from 2014,” Tartaro adds. “I didn’t have the plate back then.”

Even through all this, Tartaro remained mostly unconcerned. The CPC was just a private company; he could keep working with the DMV to void the fines as they came in, which was an annoyance but not a catastrophe. He had successfully registered his car the previous year despite CPC citations piling up. But just days before Defcon, according to Tartaro, he says he received a notice that the California DMV would not let him renew his registration unless he actually paid some of those fines.

“Now that the DMV is enforcing these tickets that are falsified, it changes everything,” he says. “At the moment, I cannot reregister my vehicle without paying the tickets. But I can’t pay the tickets because it admits guilt, and the minute I admit that it opens me up to all the other tickets. I’m basically in a really bad situation.”


  1. This proves that artificial intelligence will never be able to surpass organic stupidity.

  2. This one needs to go to the State Supreme Court. And I think Joe Tartaro should sue the State of California!