DriveTir is proposing a 90-day pilot with the City of Boston: real-time license plate scan alerts, owned by the civilian, not a third-party broker. One feature. One city. Proof of concept.
DriveTir is not a shipping product. It is a proposal for a focused 90-day pilot in Boston that does one thing: sends you a push notification the instant your license plate is scanned by a public camera. Who scanned it, where, and why — owned by you, not a data broker.
Every number below is sourced and public. We refuse to inflate stakes to sell a platform. These are the real, verifiable baselines for the problem DriveTir is built to reduce.
U.S. drivers ages 16+ who had contact with police during a traffic stop in 2022. This is the most recent complete national data.
Highest annual total on record. A meaningful share begin as routine traffic enforcement. It is the single deadliest front door to a fatal police encounter.
Over five years of NYT reporting, roughly 1.5 per week, with $125M+ paid in wrongful-death settlements tied to traffic stops since 2016.
Share of U.S. adults who own a smartphone. The distribution channel for a civilian-side app already exists in every pocket. No hardware to deploy.
In the spring of 2025, the Boston Police Department quietly ran a 30-day pilot of Flock Safety's automated license plate reader (ALPR) network. Within weeks, public records requests and ACLU pressure forced the city to decommission the cameras and end the pilot.
The objection wasn't that license plate scanning is useless. It was that the data flowed only in one direction. It flowed toward police, toward federal agencies, and toward third-party data brokers, with no civilian-side visibility, no consent, no recourse. Residents had no way of knowing when, where, or why their vehicle had been tracked.
Meanwhile, 88 Massachusetts law enforcement agencies still use Flock or similar ALPR systems today. The surveillance didn't stop. It just went back to running in the dark.
The privacy story of DriveTir is that there is almost nothing about you worth subpoenaing, breaching, or selling. We do not copy, mirror, or aggregate the city's license plate scan data. We pass a narrow, read-only query and deliver a push notification. That is the whole product.
A worst-case DriveTir breach exposes a list of plate numbers that people asked to watch. That's it. No location histories, no identities, no biometrics, no images. Compare that profile to the breach surface of the systems DriveTir sits next to. That contrast is the pitch.
We are not asking Boston to buy a platform. We are asking for 90 days to prove that one feature — a civilian-owned license plate scan alert — can change the conversation about public safety surveillance in America.
What we're asking Boston for: A letter of intent from the Mayor's Office and BPD to authorize the pilot. A technical point of contact for read-only API scoping. A 90-day evaluation window with structured input from local stakeholders.
What Boston gets: A low-risk opportunity to evaluate civilian-side transparency in ALPR systems. A controlled, constructive response to prior ALPR pilot concerns. And a proof of concept the city can assess before any broader commitment.
What residents get: For the first time, a push notification the moment their plate is scanned by a public camera — with the why, the where, and a clear path to ask questions or dispute.
This is a 90-day pilot proposal. Every detail is negotiable with the right partners at the table.
This pilot does not introduce new cameras or surveillance. It provides civilian-side visibility into ALPR systems already in use across Massachusetts.
If the pilot shows no value, it ends. Ninety days. A clear evaluation window. No permanent commitment from the city.
These answers are written the way they would be cross-examined — not the way they would be marketed. If something is a real commitment, it is named. If something is still being finalized, it is named honestly.
No new cameras. No new sensors. No new tracking. The pilot provides civilian-side visibility into ALPR infrastructure cities already operate.
Critics have raised a second concern: that civilian-side visibility could normalize ALPR systems. DriveTir's position is that these systems exist today and will continue to expand with or without this pilot. Civilian access to information about one's own scans is a harm-reduction measure, not an endorsement. DriveTir takes no position on whether ALPR networks should be expanded, does not lobby for expansion, and does not sell services to ALPR vendors.
No plate scans. No movement history. No location trails. DriveTir performs a read-only query against the city's existing alert layer and delivers a notification.
What is retained: a minimal audit log required for oversight review. The audit log records that an alert fired and to which hashed user ID — it does not record the plate, does not record a precise location, and does not record a granular timestamp. Per-alert records are purged within 72 hours; afterward only aggregated daily counts are retained for reporting. The audit schema is published publicly and held in a repository with third-party commit access.
Operationally, communication flows one way — from the city's alert bus to the registered driver's phone. There is no reverse channel and no officer-facing DriveTir interface in the pilot.
Legally: DriveTir, like every company, is subject to lawful legal process. Warrants and subpoenas can compel disclosure of data the company holds. That is why DriveTir's architecture is designed to hold as little as possible. Phone-to-plate bindings are stored using client-side encryption with keys held by the user — DriveTir cannot decrypt them without user cooperation, modeled on the Signal architecture. DriveTir publishes quarterly transparency reports, maintains a warrant canary, challenges subpoenas that exceed lawful scope, and notifies users of legal process affecting their account where permitted by law.
No. The pilot is notification-only. The Phase 1 mobile app requests no microphone access, no camera access, and no contacts access. Location permission is requested only while the app is in use, never "always." The permissions manifest and, for the pilot, the client source code are published publicly for audit.
A third-party security audit of the Phase 1 app is completed before public launch, with the audit report published in full. Features shown in the longer-term roadmap (Phase 3) are not part of this pilot and will not ship without separate approval, separate counsel review, and state-by-state legal compliance.
Pre-flagged high-risk stops: The city's computer-aided dispatch (CAD) system suppresses the DriveTir alert during confirmed felony warrants, active pursuits, AMBER/Silver alerts, and stolen-vehicle stops. If the CAD suppression feed is unavailable in a jurisdiction, the pilot does not launch there.
Stops that escalate in real time: If a routine stop becomes high-risk in the moment, the alert may have already fired. Three mitigations address this: (1) the alert content is limited to "your plate was scanned" — it does not include officer position, intent, or tactical information; (2) officers can suppress alerts in real time via the CAD terminal; (3) all alerts are logged for post-incident review by the oversight body.
DriveTir maintains a pre-built incident response protocol with pre-retained counsel. In the event of a serious incident during a stop where a DriveTir alert was active, the service is automatically suspended pending review, with findings published by the oversight body.
No. This is a 90-day pilot focused on a single notification feature with a limited group of opt-in participants.
The pilot MOU contains a hard sunset clause: the pilot terminates automatically at day 90 unless affirmatively extended by a public city council vote. Auto-renewal is contractually prohibited. Manager-level signatures cannot extend the pilot. The MOU template is published publicly so the sunset and no-auto-renew terms are visible to advocates before signing.
Success and failure criteria are defined in the MOU and signed before the pilot launches. Criteria include specific metrics: false-positive rate thresholds, adverse officer-safety incident count, user satisfaction scores, complaint volume relative to baseline, and audit-log compliance.
At day 90, the oversight body — not DriveTir and not the city alone — evaluates the pilot against those criteria. Both the criteria and the evaluation are published. If the pilot does not demonstrate value, it ends.
The city controls the underlying ALPR data and alert infrastructure. DriveTir does not own, store, or repurpose that data.
Oversight body structure: three seats appointed by the city, three appointed by an independent coalition of civil liberties and community organizations, one rotating academic chair. The board is funded by DriveTir through an independent budget line the company cannot revoke mid-pilot; the board may hire its own counsel and auditors. Members can be removed only for cause, by a supermajority of the board itself. The board has authority to compel disclosure of any DriveTir data practice and to suspend the pilot for material breach.
The final structure — including named coalition partners — is being finalized in partnership with prospective stakeholders and will be published in full before pilot launch.
DriveTir operates under SOC 2 Type II compliance, undergoes quarterly independent penetration testing, and maintains an active bug bounty program. In the event of a breach, affected users and the oversight body are notified within 24 hours, not at the statutory minimum. Because the architecture minimizes data held at rest (see storage FAQ), the blast radius of any breach is structurally limited.
DriveTir's architecture is designed to minimize the data held at rest so that any compelled disclosure yields as little as legally possible. DriveTir will challenge in court any subpoena or warrant that appears to exceed its lawful scope, and publishes quarterly transparency reports modeled on the Apple and Signal format. Foreign-government requests that bypass US judicial process are not honored.
DriveTir excludes capital from police vendors, data brokers, carceral-tech firms, ad platforms, and state-linked funds. The oversight body has visibility into the company's capital table and may flag investor classes that conflict with the mission. Investor disclosures are published annually.
DriveTir is structured as a Public Benefit Corporation with mission commitments that transfer to any acquirer. The charter prohibits acquisition by police vendors, data brokers, carceral-tech firms, or ad platforms. In the event of acquisition or wind-down, users receive advance notice, full data portability, and a default-delete of all user data unless explicit consent to transfer is given.
Phase 1 is the only thing we are asking you to fund, approve, or believe in right now. Phases 2 and 3 exist to show you where this goes if the pilot works. Nothing else ships until Phase 1 earns the right.
These mockups represent the target state for Phase 2. They are a design direction, not a live build. A constitutional-grade identity, consent, and asset linkage flow without the DMV-line feeling.
When the lights turn on, the window stays up, and a second one opens. A neutral, recorded, de-escalated traffic stop from the first handshake to the last signature. Five screens. Roughly two minutes. Zero ambiguity. These are design mockups, not a shipping product.
A dash-mounted 3-way conference. Driver, officer, and on-call civil rights attorney. The window stays up. A neutral one opens.
A fixed dashboard mount. An encrypted video handshake. The officer's badge, name, and reason appear on screen before anyone approaches the window. The driver can loop in an attorney with one tap, record both sides, and accept or dispute a digital citation without leaving the vehicle.
Phase 3 doesn't replace officers. It gives every stop a neutral, recorded witness that both sides can trust.
Every insured driver on your policy is covered by one plan. When your teenager gets pulled over driving home from practice, you get the alert the second the lights turn on, and you can conference into the stop live. Your child is never alone at the window. A parent, a partner, a co-signer. One tap, and you are there.
Across all three phases, DriveTir becomes the neutral connective tissue linking the DMV, insurance carriers, law enforcement, courts, and legal counsel. But none of this ships without Phase 1 proving the model first.
Driving record, vehicle info, license, registration
Driving history, policy, real-time authorization
Identity verification, ALPR feeds, authorizations
Virtual hearings, citation disputes, scheduling
On-demand counsel
I'm asking Boston to be the first city in America to treat its drivers as partners, not data points. Start small. Start honest. A single alert the moment a plate is scanned, owned by the civilian, not a third-party broker. Earn the right to build the rest, together.
Whether you're representing the Mayor's Office, a community stakeholder, or a Boston driver who wants in on Phase 1, there's a door here for you.