Uzbekistan's extensive national license plate surveillance system has been found openly accessible on the internet, exposing a vast network of roadside cameras and sensitive vehicle data. Security researcher Anurag Sen discovered that the system, which tracks millions of vehicles and their occupants, was left unprotected by a password, raising serious privacy and security concerns.
Across Uzbekistan, a network of approximately one hundred high-resolution roadside cameras continuously scans vehicles' license plates and their occupants, often thousands of times a day. These cameras are designed to detect potential traffic violations, such as cars running red lights, drivers not wearing seatbelts, or unlicensed vehicles operating at night. The system's capabilities were starkly illustrated by the tracking of one highly surveilled vehicle over six months, as it traveled frequently between the eastern city of Chirchiq, the capital Tashkent, and the nearby settlement of Eshonguzar.
Discovery of the Security Lapse
Sen uncovered the exposed Uzbek license plate surveillance system earlier this month (December), sharing details of the security lapse with TechCrunch. While the exact duration of the system's public exposure remains unclear, artifacts within the system indicate its database was established in September 2024, with traffic monitoring commencing in mid-2025. This incident offers a rare glimpse into the operational mechanics of national license plate surveillance systems, the extensive data they collect, and their potential for tracking the whereabouts of millions across an entire country.
The exposure also underscores the significant security and privacy risks inherent in the mass monitoring of vehicles and their owners. This revelation comes at a time when the United States is rapidly expanding its own nationwide array of license plate readers, many of which are provided by surveillance giant Flock. Earlier this week, independent news outlet 404 Media reported that Flock itself left dozens of its AI-powered cameras publicly exposed to the web, enabling a reporter to watch themselves being tracked in real time by a Flock camera. Similar incidents of exposed license plate readers in the U.S. have been reported by Wired and TechCrunch in previous years, some remaining accessible for years despite warnings to law enforcement agencies.
System Operators and Technology Provider
The surveillance system is operated by the Department of Public Security within Uzbekistan's Ministry of Internal Affairs in Tashkent. Despite multiple attempts by TechCrunch to solicit comments regarding the security lapse during December, the Ministry did not respond. Representatives of the Uzbek government in Washington D.C. and New York also failed to respond to inquiries. Uzbekistan's computer emergency readiness team, UZCERT, acknowledged receipt of an alert about the system with an automated reply but provided no further comment.
The system identifies itself as an "intelligence traffic management system" by Maxvision, a Shenzhen, China-based company specializing in internet-connected traffic technologies, border inspection systems, and surveillance products. In a video on LinkedIn, Maxvision highlights its cameras' ability to record the "entire illegal process" and "display illegal and passing information in real-time." According to its brochure, Maxvision exports its security and surveillance technology globally, including to countries like Burkina Faso, Kuwait, Oman, Mexico, Saudi Arabia, and Uzbekistan.
Geographic Reach and Technical Capabilities
TechCrunch's analysis of the data within the exposed system identified at least a hundred cameras strategically positioned across major Uzbek cities, busy junctions, and other critical transit routes. GPS coordinates revealed clusters of license plate readers in Tashkent, the southern cities of Jizzakh and Qarshi, and Namangan in the east. Some cameras are even located in rural areas, including routes near the once-disputed parts of the borders between Uzbekistan and Tajikistan. In Tashkent, the country's largest city, cameras are present at over a dozen locations, with some visible on Google Street View.
The cameras, some of which watermark their footage with the name of Singaporean camera maker Holowits, capture video footage and still images of vehicles violating rules in 4K resolution. The exposed system allows access to its web-based interface, which includes a dashboard enabling operators to examine footage of traffic violations. This dashboard provides zoomed-in photos and raw video footage of violations, as well as surrounding vehicles. (TechCrunch redacted license plates and vehicle occupants prior to publication.)
