Connect with us

The Online Technology

How a ‘NULL’ License Plate Landed One Hacker in Ticket Hell

News & Analysis

How a ‘NULL’ License Plate Landed One Hacker in Ticket Hell


Joseph Tartaro never meant to cause this much trouble. Especially for himself.

In late 2016, Tartaro decided to get a vanity license plate. A security researcher by trade, he ticked down possibilities that related to his work: SEGFAULT, maybe, or something to do with vulnerabilities. Sifting through his options, he started typing “null pointer,” but caught himself after the first word. NULL. Funny. “The idea was I’d get VOID for my wife’s car, so our driveway would be NULL and VOID,” Tartaro says.

The joke had layers, though. As Tartaro well knew, and as he explained in a recent talk at the Defcon hacker conference, “null” is also a text string that in many programming languages signifies a value that is empty or undefined. To many computers, null is the void.

That set-up also has a brutal punchline—one that left Tartaro at one point facing $12,049 of traffic fines wrongly sent his way. He’s still not sure if he’ll be able to reregister his car this year without paying someone else’s tickets. And thanks to the Kafkaesque loop he’s caught in, it’s not clear if the citations will ever stop coming.

Null Set

In his Defcon talk, Tartaro played up the idea that he had initially hoped a NULL plate might get him out of tickets—that, once fed into the database of offenders, the violation quite literally would not compute. But he says now that pranks weren’t actually his initial focus. If anything, he was surprised that the California DMV website let him register NULL in the first place.

That first year as a NULL driver was uneventful. But when it came time to register again in 2017, the DMV website no longer accepted NULL as an option. “It broke the website,” Tartaro says. Specifically, the site told him that the license plate and Vehicle Identification Number he had entered were invalid. But Tartaro was still able to use a reference number to renew. He didn’t think much more of it.

He also didn’t think much of the ticket he got in early 2018, for not having the appropriate registration sticker on his license plate. Tartaro suspects someone scraped it off to use on their own car. He thought about fighting it, but the fine was only $35, so he decided to just pay it and move on with his life.

Real Life. Real News. Real Voices

Help us tell more of the stories that matter

Become a founding member

Then came the citations. Dozens of them, deposited in bulk to his mailbox. Parking violations, stand-stop violations, fines of $37, $60, $74, $80, from Fresno to Rancho Cucamonga. “I’ve never been to Fresno,” Tartaro says.

Nor had Tartaro gone on a statewide, parking-related crime spree. Instead, by paying that $35 ticket, it appears that a database somewhere now associated NULL with his personal information. Which means that any time a traffic cop forgot to fill in the license plate number on a citation, the fine automatically got sent to Joseph Tartaro.

The tickets were for Hondas, Toyotas, Mercedes. (Tartaro drives an Infinity.) At one point, Tartaro says, he received two tickets written at Cyprus College within hours of each other—for two different vehicles. He would have had to swap the registration during his lunch break. Worse yet, the incoming citations seemed to apply retroactively.

“I have tickets from 2014,” Tartaro says. “I didn’t have the plate back then.”

Citations ‘R’ Us

The fines were all sent by a private company called the Citation Processing Center, which, well, processes parking citations. But calling them, Tartaro says, proved fruitless.

“I reached out to this company, and they’re basically saying that I have to prove without a doubt that these hundreds of tickets aren’t mine. Trying to speak to a manager went nowhere,” says Tartaro. “He’s like, you’ve got to mail all these back to us.”


Source link

Subscribe to the newsletter news

We hate SPAM and promise to keep your email address safe

Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

To Top