On September 1, St. Lucie County commissioners voted 3-2 to stop authorizing automated license plate readers on county right-of-way, revoke the permits already issued, and inventory the devices. The county administrator's agenda report signed September 10 counted 52 devices in the permit files and three cameras at unpermitted locations, found by walking the permit records to the roadside. By the September 15 meeting the unpermitted count was at least 14, and staff said the search was not finished, according to CBS12. The WPEC report that went national on September 18 put it plainly: 66 known cameras, 14 with no permit, nobody claiming them.
Commissioner James Clasby: "Not knowing who they belong to, I think, is another issue." The remedy for the unclaimed ones, from interim administrator Mayte Santamaria, is a notice giving 30 days to remove the camera, and then a bag over it so it stops working.
Why the permit list and the device list diverged
These cameras are solar-powered, cellular-backhauled, and bolted to a pole. Installing one requires nothing from the network beside it. It touched the county only as a landlord, through a permit, and only when the installer chose to apply. So the permit file was a record of who asked, not of what was there.
The report says as much. The 52 came from records. The three came from checking those records in the field. The rest came from a source the report describes only as "crowdsourced data from various origins," reviewed to find "unknown or unauthorized installations." Each list the county added surfaced devices the previous list did not have, and the count went from three to fourteen in five days.
That is the ordinary condition of an asset inventory, not a surveillance scandal. The same divergence produces the VM in the subscription nobody reads, the vendor appliance left over from a project that ended, and the test instance that acquired a public IP. Every one was authorized by somebody at the time, by a process that recorded the authorization and not the device. It is the same reason a managed IT provider's console turns out to hold agents on machines nobody remembers enrolling. Procurement, installation and operation sat in different budgets, and the record that survived is whichever one was cheapest to keep.
The practice: reconcile, do not survey
The county's method is the whole method. Take two lists produced by different processes for different reasons, and treat every row that appears in one and not the other as a finding. Asking owners to identify themselves is what the 30-day notice does, and it produced nothing for the 14. Anyone who could answer was already in the permit file.
For an ordinary environment the pairs are:
- Cloud billing export against infrastructure-as-code state or the CMDB. Every billed resource ID that appears in neither is unowned until someone claims it.
- DHCP leases and switch MAC tables against the endpoint agent roster.
- Carrier invoices against physical assets. The cellular bill is the inventory for anything that backhauls over a modem, which is exactly the class of device that never asked the network owner for anything.
- External attack-surface scan against the DNS zone and load balancer configuration. Anything answering on a public address that no config file created.
Ownership is then inferred from behaviour rather than from asking. Flow logs show what a device talks to and when the traffic stops; a workday pattern names a team, a nightly one names a job. Cloud audit logs carry the identity that created the resource even when the tag is blank. Identity-provider sign-in logs show whose credentials it uses.
The cost is that the join keys do not match. Billing uses resource IDs, the CMDB uses hostnames, the carrier uses SIM numbers, and the first pass is a week of spreadsheet work that ends in a list of embarrassing rows. St. Lucie County's line that the search was not finished is what a first pass honestly looks like. The version that survives is a standing monthly diff of the same two exports, so that after the first pass each delta is small enough to close in an afternoon.
When no owner emerges, do what the county did: notice, then bag it. Move the device to a quarantine VLAN, put a deny rule on its security group, or suspend the SIM, and wait for someone to call. If nobody calls in 30 days, nothing depended on it. The risk is that something you did not know about stops working. That is also the information you were trying to buy.
What to check this week
- Export last month's cloud bill and count the resource IDs that appear in neither your state files nor your CMDB.
- Pull the current carrier invoice and match every active line to a device someone can point at.
- Take ten random entries from your external attack-surface list and name the person, not the team, who is paged if each one breaks. Count the ones you cannot.
- Check whether your cloud accounts can create a resource with no owner tag at all.
- Find the last unowned thing your team discovered and check whether its network path was cut or whether it is still running.
North InfoSec runs AI-assisted penetration testing and security assessments, including the reconciliation of observed inventory against records described above. northinfosec.com