DriveTir is proposing a 90-day pilot with the City of Boston: real-time license plate scan alerts, owned by the civilian, not a third-party broker. One feature. One city. Proof of concept.
DriveTir is not a shipping product. It is a proposal for a focused 90-day pilot in Boston that does one thing: sends you a push notification the instant your license plate is scanned by a public camera. Who scanned it, where, and why — owned by you, not a data broker.
Every number below is sourced and public. We refuse to inflate stakes to sell a platform. These are the real, verifiable baselines for the problem DriveTir is built to reduce.
U.S. drivers ages 16+ who had contact with police during a traffic stop in 2022. This is the most recent complete national data.
Highest annual total on record. A meaningful share begin as routine traffic enforcement. It is the single deadliest front door to a fatal police encounter.
Over five years of NYT reporting, roughly 1.5 per week, with $125M+ paid in wrongful-death settlements tied to traffic stops since 2016.
Share of U.S. adults who own a smartphone. The distribution channel for a civilian-side app already exists in every pocket. No hardware to deploy.
In 2025, the Boston Police Department quietly ran a 90-day pilot of Flock Safety's automated license plate reader (ALPR) network across 45 cameras. After public records requests and sustained pressure from the ACLU of Massachusetts, the city declined to extend the contract. It never publicly explained why.
Then it started again. In January 2026, BPD began a new ALPR pilot with Motorola Solutions. In June 2026, it began a second one with Axon. By August 2026, the pace of those changes had raised a public question at City Hall: how a surveillance ordinance written in 2022 applies when the vendor changes every few months.
The objection wasn't that license plate scanning is useless. It was that the data flowed only in one direction. It flowed toward police, toward federal agencies, and toward third-party data brokers, with no civilian-side visibility, no consent, no recourse. Residents had no way of knowing when, where, or why their vehicle had been tracked.
Across Massachusetts, more than 25 municipalities have rejected or canceled ALPR contracts since late 2025 — sixteen of them in August 2026 alone — while officers in at least three departments face investigation for misusing the systems to track people they knew personally. The vendor keeps changing. The civilian side of the ledger stays empty.
In 2022 this city passed one of the strongest municipal surveillance ordinances in the country. It is binding, it is in effect, and it already says most of what DriveTir would ask for. What it does not do — what no ordinance yet written does — is tell the driver.
DriveTir assumes the City of Boston follows its own ordinance. Nothing on this page suggests otherwise, and nothing in this proposal depends on the answer. We are not auditing anyone.
The observation is narrower, and we think harder to argue with: even flawless compliance is invisible from the driver's seat. A resident cannot read an impact report they never knew was filed. They cannot check a use policy they have never seen. Every safeguard in the ordinance is real, and every one of them is legible only to the institutions that already have access.
That is not a failure of the ordinance. It is the outer edge of what an ordinance can do on its own. The remaining distance is about one notification wide.
Vendors change faster than policy does. Boston has evaluated ALPR technology from three different providers since 2025. Notification written into any one vendor's contract leaves with that contract. Written into the ordinance or the procurement standard, it survives the switch — which is the difference between a pilot and a standard.
The next filing window is the one that counts. Formal sessions ended July 31, 2026 without a driver privacy law, so the live question is no longer how to amend a bill in motion — it is what language gets written into the version refiled for the 195th General Court, which convenes in January 2027. Bills get drafted in the months before that, not after. A city that has already tested civilian notification is a far more credible voice in that drafting than a vendor's proposal. Boston has led on surveillance policy before — this is the same seat.
The principle is already conceded. H.3755 permits warrantless access in an emergency, but requires notice to be filed with the Attorney General within 48 hours. The Legislature has therefore already accepted that suppression must be logged and disclosed to someone. DriveTir's entire argument is that the driver belongs on that list.
Sources · Boston Municipal Code Ch. 16-63 · Massachusetts H.3755 (194th General Court), status verified September 2026 · Massachusetts legislative calendar, formal sessions ended July 31, 2026 · Boston Globe · ACLU of Massachusetts. H.3755 has never been law and did not pass; nothing on this page describes it otherwise.
The privacy story of DriveTir is that there is almost nothing about you worth subpoenaing, breaching, or selling. We do not copy, mirror, or aggregate the city's license plate scan data, and we cannot query it. The city sends a one-way notice; we deliver it to the phone that asked for it. That is the whole product.
DriveTir never reads the city's scan records. The city or its ALPR vendor, as the owner of that data, emits a one-way notice event to a device that has registered a plate: this plate, this time, this camera zone. We hold the plate and a push token. We cannot query the system, and we cannot look anything up. The flow runs outward only.
Alerts can be delayed, and that is by design. Where an active investigation, a felony warrant, a pursuit, an AMBER alert, or another documented safety exception applies, the notice is held. Every suppression is logged and counted, reported in aggregate to the oversight body, and disclosed to the driver once the exception lifts and the law allows. A delay is not a deletion. Suppression that cannot be audited is the thing we are trying to end, so we will not build it into our own system.
A worst-case DriveTir breach exposes a list of plate numbers that people asked to watch. That's it. No location histories, no identities, no biometrics, no images. Compare that profile to the breach surface of the systems DriveTir sits next to. That contrast is the pitch.
We are not asking Boston to buy a platform. We are asking for 90 days to prove that one feature — a civilian-owned license plate scan alert — can change the conversation about public safety surveillance in America.
Why the ordinance, and not a contract: Boston has evaluated three ALPR providers since 2025, and none of the contracts carried civilian notification. Anything written into a single vendor agreement leaves when that agreement does. The surveillance ordinance and the procurement standard are where a durable, vendor-neutral answer lives — which is why this proposal is addressed to the bodies that own them.
Either door works. This can begin as a Council hearing on civilian notification, or as a sponsored pilot through the Mayor's Office of New Urban Mechanics. We are not particular about the route. We are asking the city to test one question: whether telling a driver their plate was read makes the system more trusted without making it less effective.
What Boston gets: A low-risk opportunity to evaluate civilian-side transparency in ALPR systems. A controlled, constructive response to prior ALPR pilot concerns. And a proof of concept the city can assess before any broader commitment.
What residents get: For the first time, a push notification the moment their plate is scanned by a public camera — with the why, the where, and a clear path to ask questions or dispute.
This is a 90-day pilot proposal. Every detail is negotiable with the right partners at the table.
This pilot does not introduce new cameras or surveillance. It provides civilian-side visibility into ALPR systems already in use across Massachusetts.
If the pilot shows no value, it ends. Ninety days. A clear evaluation window. No permanent commitment from the city.
These answers are written the way they would be cross-examined — not the way they would be marketed. If something is a real commitment, it is named. If something is still being finalized, it is named honestly.
DriveTir is pre-product. Nothing below describes a system operating today. There is no app in the field, no resident data, and no signed agreement with any city. What follows is the set of commitments we are asking Boston to hold us to in writing, before a single resident enrolls — an oversight body with real suspension authority, audited suppression, published transparency reporting, and a hard sunset. We would rather be held to these in public than describe a company that does not exist yet.
No new cameras. No new sensors. No new tracking. The pilot provides civilian-side visibility into ALPR infrastructure cities already operate.
Critics have raised a second concern: that civilian-side visibility could normalize ALPR systems. DriveTir's position is that these systems exist today and will continue to expand with or without this pilot. Civilian access to information about one's own scans is a harm-reduction measure, not an endorsement. DriveTir takes no position on whether ALPR networks should be expanded, does not lobby for expansion, and does not sell services to ALPR vendors.
No plate scans. No movement history. No location trails. DriveTir performs a read-only query against the city's existing alert layer and delivers a notification.
What is retained: a minimal audit log required for oversight review. The audit log records that an alert fired and to which hashed user ID — it does not record the plate, does not record a precise location, and does not record a granular timestamp. Per-alert records are purged within 72 hours; afterward only aggregated daily counts are retained for reporting. The audit schema is published publicly and held in a repository with third-party commit access.
Operationally, communication flows one way — from the city's alert bus to the registered driver's phone. There is no reverse channel and no officer-facing DriveTir interface in the pilot.
Legally: DriveTir, like every company, is subject to lawful legal process. Warrants and subpoenas can compel disclosure of data the company holds. That is why DriveTir's architecture is designed to hold as little as possible. Phone-to-plate bindings are stored using client-side encryption with keys held by the user — DriveTir cannot decrypt them without user cooperation, modeled on the Signal architecture. DriveTir publishes quarterly transparency reports, maintains a warrant canary, challenges subpoenas that exceed lawful scope, and notifies users of legal process affecting their account where permitted by law.
No. The pilot is notification-only. The Phase 1 mobile app requests no microphone access, no camera access, and no contacts access. Location permission is requested only while the app is in use, never "always." The permissions manifest and, for the pilot, the client source code are published publicly for audit.
A third-party security audit of the Phase 1 app will be completed before public launch, with the audit report published in full. Features shown in the longer-term roadmap (Phase 3) are not part of this pilot and will not ship without separate approval, separate counsel review, and state-by-state legal compliance.
Pre-flagged high-risk stops: The city's computer-aided dispatch (CAD) system suppresses the DriveTir alert during confirmed felony warrants, active pursuits, AMBER/Silver alerts, and stolen-vehicle stops. If the CAD suppression feed is unavailable in a jurisdiction, the pilot does not launch there.
Stops that escalate in real time: If a routine stop becomes high-risk in the moment, the alert may have already fired. Three mitigations address this: (1) the alert content is limited to "your plate was scanned" — it does not include officer position, intent, or tactical information; (2) officers can suppress alerts in real time via the CAD terminal; (3) all alerts are logged for post-incident review by the oversight body.
DriveTir maintains a pre-built incident response protocol with pre-retained counsel. In the event of a serious incident during a stop where a DriveTir alert was active, the service is automatically suspended pending review, with findings published by the oversight body.
No. This is a 90-day pilot focused on a single notification feature with a limited group of opt-in participants.
The pilot MOU contains a hard sunset clause: the pilot terminates automatically at day 90 unless affirmatively extended by a public city council vote. Auto-renewal is contractually prohibited. Manager-level signatures cannot extend the pilot. The MOU template is published publicly so the sunset and no-auto-renew terms are visible to advocates before signing.
Success and failure criteria are defined in the MOU and signed before the pilot launches. Criteria include specific metrics: false-positive rate thresholds, adverse officer-safety incident count, user satisfaction scores, complaint volume relative to baseline, and audit-log compliance.
At day 90, the oversight body — not DriveTir and not the city alone — evaluates the pilot against those criteria. Both the criteria and the evaluation are published. If the pilot does not demonstrate value, it ends.
The city controls the underlying ALPR data and alert infrastructure. DriveTir does not own, store, or repurpose that data.
Oversight body structure: three seats appointed by the city, three appointed by an independent coalition of civil liberties and community organizations, one rotating academic chair. The board is funded by DriveTir through an independent budget line the company cannot revoke mid-pilot; the board may hire its own counsel and auditors. Members can be removed only for cause, by a supermajority of the board itself. The board has authority to compel disclosure of any DriveTir data practice and to suspend the pilot for material breach.
The final structure — including named coalition partners — is being finalized in partnership with prospective stakeholders and will be published in full before pilot launch.
Before any resident data exists, DriveTir commits to achieving SOC 2 Type II certification prior to public launch, to quarterly independent penetration testing, and to an active bug bounty program. In the event of a breach, affected users and the oversight body are notified within 24 hours, not at the statutory minimum. Because the architecture minimizes data held at rest (see storage FAQ), the blast radius of any breach is structurally limited.
DriveTir's architecture is designed to minimize the data held at rest so that any compelled disclosure yields as little as legally possible. DriveTir will challenge in court any subpoena or warrant that appears to exceed its lawful scope, and publishes quarterly transparency reports modeled on the Apple and Signal format. Foreign-government requests that bypass US judicial process are not honored.
DriveTir excludes capital from police vendors, data brokers, carceral-tech firms, ad platforms, and state-linked funds. The oversight body has visibility into the company's capital table and may flag investor classes that conflict with the mission. Investor disclosures are published annually.
DriveTir is structured as a Public Benefit Corporation with mission commitments that transfer to any acquirer. The charter prohibits acquisition by police vendors, data brokers, carceral-tech firms, or ad platforms. In the event of acquisition or wind-down, users receive advance notice, full data portability, and a default-delete of all user data unless explicit consent to transfer is given.
Phase 1 is the only thing on this page we are asking anyone to evaluate. The later phases are sketched deliberately thin, because they are not designed, not funded, and not proposed — and a city should not be asked to react to work that does not exist. Nothing beyond Phase 1 moves without separate approval, separate counsel review, and public review.
I'm asking Boston to be the first city in America to treat its drivers as partners, not data points. Start small. Start honest. A single alert the moment a plate is scanned, owned by the civilian, not a third-party broker. Earn the right to build the rest, together.
Whether you're representing the Mayor's Office, a community stakeholder, or a Boston driver who wants in on Phase 1, there's a door here for you.