They use a system called Mobiltrak. The first rollout in the 1990's put the sensors on utility poles along major routes, they could catch about 20% of traffic. It started out as FM commercial only, now it will do AM.
I wasn’t going to go into details, just wanted to spark people to investigate on their own
FM was first because FM is the easiest in the US. The IFs are almost always 10.7 MHz and the band is channelized in 100 kHz steps, with actual use mostly resulting in 200 kHz steps on the odd tenth. This means, for example, that all of the FM radio stations in Los Angeles end in an odd number after the decimal, 95.5, 101.1, 95.1, etc.
Since the IF is almost always 10.7 MHz the resultant LO is either 10.7 above or 10.7 below the RF, but ends up on an even tenth. An “above” LO for an FM radio tuned to 95.5 KLOS would be on 106.2 MHz, a frequency that is between two stations in the area, 106.3 and 106.7. So the LO can be seen easily as it is not covered by a station and is at least 100 kHz offset from the closest transmission. Similarly a “below” LO for a car radio tuned to KLOS would be on 84.8, outside the FM band completely (although inside the allocation for TV channel 6).
So, if you are in the Los Angeles area and pick up a solid CW carrier on either 106.2 or 84.8 MHz the probability is very high you have just picked up the LO of an FM radio tuned to 95.5 MHz FM, KLOS.
Doing AM is a little more difficult, as the IFs are not quite as predictable (although 455 kHz is probably most common), and the AM channels are a bit closer. On the good news side the common 455 kHz means the LO will always end up either between AM broadcast channels (every 10 kHz in the US) or outside the band. So that an “above” LO for KFI 640 will be on 1095 kHz, and a “below” will be 185 kHz. 185 kHz is outside the AM BCB, but 1095 is smack in the middle, and also between KDIS on 1110 kHz and KNX on 1070 kHz. Sounds good, but there is a station on 1090 out of Mexico, that can be heard in the daytime in LA. So, you have to separate the very low power LO leakage on 1095 kHz from the 50,000 Watt XEPRS just over the US/Mexico border and on 1090 kHz, only 5 kHz away.
Tracking SW radio LOs would be a similar problem to the AM BCB issue. The IF would be much more variable and the LO harder to see between tight radio channels. Still, I am sure it could be done, but it would be a lot of effort and probably only applied in a high value situation.
Their is a military type that pre-dates Mobiltrak that is HMMWV mounted and can control SINCGARS and VRC-103's and presumably integrates into the JTRS suite. With the control you not only can tell what freq a nearby unit is on, but tune in to it. JTRS integration would probably bring it a step further, where you could take your laptop, click on a nearby unit including enemy formations, and listen to what they are hearing.
Yeah, but now you are describing a cooperative system. Tracking LOs can be done without cooperation of the target radio.
T!