Across Uzbekistan, a network of about a hundred banks of high-resolution roadside cameras continuously scan vehicles’ license plates and their occupants, sometimes thousands a day, looking for potential traffic violations. Cars running red lights; drivers not wearing their seatbelts; and unlicensed vehicles driving at night, to name a few.
The driver of one of the most surveilled vehicles in the system was tracked over six months as he traveled between the eastern city of Chirchiq, through the capital Tashkent, and in the nearby settlement of Eshonguzar, often multiple times a week.
We know this because the country’s sprawling license plate-tracking surveillance system has been left exposed to the internet.
Security researcher Anurag Sen, who discovered the security lapse, found the license plate surveillance system exposed online without a password, allowing anyone access to the data within. It’s not clear how long the surveillance system has been public, but artifacts from the system show that its database was set up in September 2024, and traffic monitoring began in mid-2025.
The exposure offers a rare glimpse into how such national license plate surveillance systems work, the data they collect, and how they can be used to track the whereabouts of any one of the millions of people across an entire country.
The lapse also reveals the security and privacy risks associated with the mass monitoring of vehicles and their owners, at a time when the United States is building up its nationwide array of license plate readers, many of which are provided by surveillance giant Flock. Earlier this week, independent news outlet 404 Media reported that Flock left dozens of its own license plate reading cameras publicly exposed to the web, allowing a reporter to watch themselves being tracked in real time by a Flock camera.
Sen said he found the exposed Uzbek license plate surveillance system earlier this month, and shared details of the security lapse with TechCrunch. Sen told TechCrunch that the system’s database reveals the real-world locations of the cameras, and contains millions of photos and raw camera video footage of passing vehicles.
The system is run by the Department of Public Security in Uzbekistan’s Ministry of Internal Affairs in Tashkent, which did not respond to emails requesting comment about the security lapse during December.
Representatives of the Uzbek government in Washington D.C. and New York also did not respond to TechCrunch’s emails about the exposure. Uzbekistan’s computer emergency readiness team, UZCERT, did not respond to an alert about the system, except for an automated reply acknowledging receipt of our email.
The surveillance system remains exposed to the web at the time of writing.
... continue reading