Throughout Uzbekistan, a community of a few hundred banks of high-resolution roadside cameras constantly scan autos’ license plates and their occupants, generally hundreds a day, searching for potential site visitors violations. Vehicles operating crimson lights; drivers not sporting their seatbelts; and unlicensed autos driving at night time, to call a couple of.
The driving force of some of the surveilled autos within the system was tracked over six months as he traveled between the japanese metropolis of Chirchiq, by means of the capital Tashkent, and within the close by settlement of Eshonguzar, usually a number of instances every week.
We all know this as a result of the nation’s sprawling license plate-tracking surveillance system has been left uncovered to the web.
Safety researcher Anurag Sen, who found the security lapse, discovered the license plate surveillance system uncovered on-line with out a password, permitting anybody entry to the information inside. It’s not clear how lengthy the surveillance system has been public, however artifacts from the system present that its database was arrange in September 2024, and site visitors monitoring started in mid-2025.
The publicity gives a uncommon glimpse into how such nationwide license plate surveillance methods work, the information they gather, and the way they can be utilized to trace the whereabouts of any one of many tens of millions of individuals throughout a whole nation.
The lapse additionally reveals the security and privateness dangers related to the mass monitoring of autos and their homeowners, at a time when america is increase its nationwide array of license plate readers, a lot of that are supplied by surveillance large Flock. Earlier this week, impartial information outlet 404 Media reported that Flock left dozens of its personal license plate studying cameras publicly uncovered to the online, permitting a reporter to look at themselves being tracked in actual time by a Flock digital camera.
Sen mentioned he discovered the uncovered Uzbek license plate surveillance system earlier this month, and shared particulars of the security lapse with information.killnetswitch. Sen instructed information.killnetswitch that the system’s database reveals the real-world places of the cameras, and comprises tens of millions of photographs and uncooked digital camera video footage of passing autos.
The system is run by the Division of Public Safety in Uzbekistan’s Ministry of Inner Affairs in Tashkent, which didn’t reply to emails requesting remark in regards to the security lapse throughout December.
Representatives of the Uzbek authorities in Washington D.C. and New York additionally didn’t reply to information.killnetswitch’s emails in regards to the publicity. Uzbekistan’s laptop emergency readiness crew, UZCERT, didn’t reply to an alert in regards to the system, apart from an automatic reply acknowledging receipt of our electronic mail.
The surveillance system stays uncovered to the online on the time of writing.
The system refers to itself as an “intelligence site visitors administration system” by Maxvision, a Shenzhen, China-based maker of internet-connected site visitors applied sciences, border inspection methods, and surveillance merchandise. In a video on LinkedIn, the corporate says its cameras can report the “whole unlawful course of,” and may “show unlawful and passing data in real-time.”
In keeping with its brochure, Maxvision exports its security and surveillance tech to international locations throughout the globe, together with Burkina Faso, Kuwait, Oman, Mexico, Saudi Arabia, and Uzbekistan.
information.killnetswitch’s evaluation of the information contained in the uncovered system revealed no less than 100 cameras situated throughout main Uzbek cities, in addition to busy junctions and different necessary transit routes.
We plotted the GPS coordinates of the cameras, and located banks of license plate readers in Tashkent, the cities of Jizzakh and Qarshi within the south, and Namangan within the east. A few of the cameras are situated in rural areas, comparable to on routes close to the once-disputed components of the borders between Uzbekistan and Tajikistan.
In Tashkent, the nation’s largest metropolis, the cameras will be discovered at greater than a dozen places. A few of these cameras are even seen on Google Road View.
The cameras, some which watermark their footage with the title of the Singapore digital camera maker Holowits, seize video footage and nonetheless photographs of autos violating guidelines in 4K decision.
The uncovered system permits entry to its web-based interface, which comprises a dashboard permitting operators to look at footage of site visitors violations. The dashboard comprises zoomed-in photographs and the uncooked video footage of violations, in addition to surrounding autos. (information.killnetswitch redacted the license plates and car occupants previous to publication.)
The publicity of Uzbekistan’s nationwide license plate studying system is the newest instance of a security lapse involving street surveillance cameras.
Earlier this 12 months, Wired reported that greater than 150 license plate readers round america and the real-time car knowledge they gather had been uncovered to the web with none security.
Uncovered license plate readers usually are not a brand new phenomena. In 2019, information.killnetswitch reported that over 100 license plate readers had been searchable and accessible from the web, permitting anybody to entry the information inside. Some had been uncovered for years, regardless of security researchers warning legislation enforcement businesses that these methods may very well be accessed from the online.
To securely contact this reporter, you’ll be able to attain out utilizing Sign through the username: zackwhittaker.1337
