It’s no secret that a network of about a hundred high-definition roadside cameras across Uzbekistan constantly monitors license plates and their occupants, sometimes thousands a day, to detect potential traffic violations. This surveillance is used to catch things like cars running red lights, drivers not wearing seat belts, and vehicles driving at night without a license. Yesterday, Techrunch analyzed the system’s flaws. According to it, the driver of one of the most monitored cars was tracked for six months between the eastern city of Chirchik, the capital of Tashkent, and nearby Eshonguzar, often several times a week.
How did the publication know this? Because the data from the extensive license plate tracking system is publicly available online.
Security researcher Anurag Sen discovered that a license plate tracking system was left open online without a password, allowing any outsider to access its data. It’s not clear how long the tracking system has been out there, but data from the system suggests that its database was created in September 2024 and traffic monitoring began in mid-2025.
The incident provides a rare glimpse into how such national license plate tracking systems work, the data they collect, and how they could be used to track the whereabouts of millions of people across the country.
And as the United States ramps up its nationwide deployment of license plate readers, the security and privacy risks associated with mass surveillance of vehicles and their owners are also growing. Many of these devices are being provided by surveillance giant Flock. Earlier this week, independent news outlet 404 Media reported that Flock had publicly exposed dozens of its license plate cameras to the internet, allowing a reporter to see what Flock’s cameras were tracking in real time.
Anurag Sen discovered that Uzbekistan’s license plate tracking system had been left open earlier this month and shared details of the security breach with TechCrunch earlier this month. Sen told TechCrunch that the system’s database shows the exact locations of the cameras and contains millions of photos and raw video of passing vehicles.
The system is operated by the Department of Public Security of the Ministry of Internal Affairs of Uzbekistan in Tashkent. The department did not respond to emails seeking comment about the security breach in December.
Representatives of the Uzbek government in Washington and New York also did not respond to TechCrunch’s requests for comment. Uzbekistan’s computer security team, UZCERT, also did not respond to the alert about the system, only sending an automated message acknowledging receipt of the email.
The surveillance system remains open to the internet.
The system calls itself an “intelligent traffic management system” from Maxvision, a Shenzhen-based company that makes internet-connected traffic technology, border control systems, and surveillance products. A LinkedIn video says the company’s cameras can record “the entire violation process” and “display violation and passage data in real time.”
Maxvision exports its security and surveillance technology to countries around the world, including Burkina Faso, Kuwait, Oman, Mexico, Saudi Arabia, and Uzbekistan. TechCrunch analyzed data from the open system and identified more than a hundred cameras located in major cities across Uzbekistan, as well as at busy intersections and other key transit routes.
Techrunch reported that it had mapped GPS coordinates and found banks of license plate readers in Tashkent, the southern cities of Jizzakh and Karshi, and the eastern city of Namangan. Some of the cameras are located in rural areas, such as along the once-disputed border between Uzbekistan and Tajikistan.
A map of the southern city of Karshi in Uzbekistan shows red dots indicating the locations of license plate readers across the city.
The cameras can be found in more than a dozen locations in Tashkent, the country’s largest city. Some of the cameras are even visible on Google Street View.
Some of the cameras are branded by Singaporean camera manufacturer Holowitz and capture images in 4K resolution.