Uzbekistan’s enormous surveillance system, one of the most sophisticated in a nation that is both repressive and colorful in equal measure, was discovered exposed on the open internet without so much as a password, providing a rare look at its gathering of millions of bytes of information about ordinary people’s activities.
The platform processes plates 24/7, snapping high-resolution images of drivers and passengers, with thousands of vehicles’ worth of events logged each day on highways in major cities and along rural stretches. Now a security lapse has detailed just how granular that monitoring can be, including months-long travel history for one of the most closely watched vehicles as it moved between Chirchiq, Tashkent, and Eshonguzar.
How Uzbekistan’s nationwide license plate network works
The system is based on about a hundred banks of roadside cameras fitted with automatic license plate recognition, or ALPR, at intersections and arterial roads — that scan for tags on every passing vehicle. Just in Tashkent, there are over a dozen sites that now host clusters of cameras, with other deployments in Jizzakh, Qarshi, and Namangan, and alongside segments near the border with Tajikistan.
Footage is recorded in 4K, with still images and video watermarked in some instances by Holowits, a camera maker based in Singapore. The platform categorizes violations like running a red light, not using seatbelts, and nighttime operation of unlicensed vehicles, and matches that evidence with timestamps, GPS coordinates, and license plate reads. According to product documentation, as well as screenshots of the system in operation, this is an “intelligent traffic management system” offered by Maxvision — a Shenzhen-based company that exports road and border surveillance tech to governments around the world.
The result is a region-scale mesh of eyes that can call up the movements of a car in seconds: location history, driver imagery, and enforcement yields. For the police, it’s of obvious value — instant interdiction, automated fines, and quickly searchable incident archives.
The security lapse and what the exposure shows
Security researcher Anurag Sen uncovered that the administrative portal and the data store behind it were exposed sans authentication. Artifacts of this system show that it was a buildout that took time to come into form, as traffic ingestion only started months after the initial setup. The live, open copy allowed browsing the real-time camera feeds, plate hits, and detailed enforcement logs.
From the available data, it was possible to reconstruct travel patterns of a vehicle over a half-year period, including trips through the same “corridors” on certain weekdays. Those patterns, coupled with fixed-site cameras that record the same plates at predictable times, can provide clues to workplace locations, home neighborhoods, and daily habits.
Officials at the Department of Public Security within the Ministry of Internal Affairs did not respond to questions about how the exposure occurred, what privacy controls are in place for the system, how long data is retained, and when it would be made available for non-traffic investigations.
Privacy risks and the global context of plate tracking
Widespread plate tracking is not limited to Uzbekistan. The trend is spreading in the United States, where the size and scope of ALPR networks, delivered through cloud-connected readers and analytics — most commonly by Flock Safety — are growing swiftly within police departments. A report published last month by 404 Media found dozens of Flock cameras exposed on the public web, which showed some real-time tracking and vehicle images.
A previous investigation from Wired found more than 150 license plate readers in the U.S. leaking data online, highlighting how rampant misconfiguration and lax access controls still are.
Privacy advocates, such as the Electronic Frontier Foundation and the ACLU, have cautioned against the systems being used for wide location surveillance—yielding sensitive information about religious attendance, doctor’s visits, or political activity.
Accuracy estimates for ALPR systems tend to exceed performance in the wild, and false positives can lead to improper stops or fines. With people’s face imagery, high-resolution optics up the ante again, treading over plate-based tracking and into person-level identification—even if the driver is not the registered owner.
Who builds and operates Uzbekistan’s ALPR system
The Uzbek program seems to be centrally overseen by the Department of Public Security, though technology supply chains reach across borders. Maxvision sells the software used in the system interface (embedded below) called “intelligent traffic management,” which is advertised to deliver real-time infraction detection and analytics dashboards. Camera hardware credited on watermarks to Holowits indicates a multi-vendor rollout that is integrated in a consolidated, cloud-accessed platform.
The vendor model — hardware at the edge, plate recognition on-device or in the cloud, centralized storage, and bulk query tools — is now industry standard. That standardization is what makes scale easy, but it also concentrates risk: just one exposed portal can expose a country’s driving patterns all at once.
What must happen now to secure the exposed system
Locking down the platform is table stakes:
- Public removal from the internet
- Network allowlists
- Strong authentication
- Key rotation
- Immutable logging
- Independent review
In addition to the immediate fix, best practice is short retention periods and documented audit processes, as well as clear use restrictions that would limit non-traffic use without court supervision.
Transparent reporting — on how many plates are scanned, what percentage trigger hits, how many queries are run and by whom — can bring traffic safety aims into alignment with civil liberties. Without those guardrails, a system designed to catch speeders and red-light runners becomes an immutable database of human movements exposed not just to the good intentions of government officials but also to anything that can find its way through the next open door.
