Across Uzbekistan, a network of approximately one hundred high-resolution roadside cameras continuously scans vehicle license plates and their occupants. These cameras process thousands of vehicles each day, searching for traffic violations such as running red lights, drivers not wearing seatbelts, and unlicensed vehicles operating at night.
In one documented case, the driver of a heavily surveilled vehicle was tracked over six months as he traveled between the eastern city of Chirchiq, through the capital Tashkent, and to the nearby settlement of Eshonguzar, often multiple times per week. This detailed tracking was possible because the country’s expansive license plate surveillance system was left exposed on the internet without a password.
Security researcher Anurag Sen discovered the security lapse, finding that anyone could access the system’s data. It is unclear how long the system was publicly accessible, but internal records show its database was established in September 2024, with traffic monitoring beginning in mid-2025. This exposure provides a rare view into how national license plate surveillance systems operate, the volume of data they collect, and their potential to track the movements of millions of people across an entire country.
The incident highlights significant security and privacy risks inherent in the mass monitoring of vehicles and their owners. This comes at a time when the United States is expanding its own nationwide network of license plate readers, many supplied by surveillance company Flock. Earlier this week, an independent news outlet reported that dozens of Flock’s own cameras were similarly exposed online, allowing a reporter to watch their own vehicle being tracked in real time.
Sen found the exposed Uzbek system earlier this month and shared details of the lapse. He reported that the system’s database reveals the physical locations of the cameras and contains millions of photos and raw video footage of passing vehicles. The system is operated by the Department of Public Security within Uzbekistan’s Ministry of Internal Affairs in Tashkent. The ministry did not respond to requests for comment during December. Representatives of the Uzbek government in Washington D.C. and New York also did not respond. The country’s computer emergency team acknowledged receipt of an alert but provided no further response. The surveillance system remains exposed to the web at the time of writing.
The system identifies itself as an “intelligence traffic management system” from Maxvision, a company based in Shenzhen, China, that manufactures internet-connected traffic technologies and surveillance products. The company states its cameras can record the entire process of a violation and display illegal activity and passing information in real time. According to its promotional materials, Maxvision exports its security and surveillance technology to countries worldwide, including Burkina Faso, Kuwait, Oman, Mexico, Saudi Arabia, and Uzbekistan.
Analysis of the exposed data revealed at least one hundred cameras across major Uzbek cities, busy junctions, and key transit routes. GPS coordinates show cameras in Tashkent, the southern cities of Jizzakh and Qarshi, and Namangan in the east. Some cameras are positioned in rural areas, including near once-disputed sections of the border between Uzbekistan and Tajikistan.
In the capital city of Tashkent, cameras are installed at more than a dozen locations, some of which are visible on Google Street View. The cameras, some branded with the name of Singapore-based manufacturer Holowits, capture 4K resolution video and still images of traffic violations.
The exposed system includes a web-based interface with a dashboard that allows operators to review footage of violations. This dashboard contains zoomed-in photographs and raw video of infractions, as well as images of surrounding vehicles.
The exposure of Uzbekistan’s national system is the latest in a series of security lapses involving road surveillance cameras. Earlier this year, a report indicated that more than 150 license plate readers in the United States and the real-time data they collected were exposed on the internet without security. Exposed license plate readers are not a new phenomenon. Reports from several years ago documented over a hundred readers accessible from the internet, with some systems exposed for years despite warnings from security researchers to law enforcement agencies.