A Computer With a Green Light

If someone can reach the controller, they can run the corner.

A traffic controller has software, a login and a network connection. That makes it a computer. It just happens to run an intersection.

Researchers have shown what that means. Twice.

INDEPENDENT EVIDENCE

In 2014, a team at the University of Michigan worked with a road agency in Michigan that ran just under 100 traffic signals. With the agency's permission, they tested the system. The radios linking the intersections sent everything unencrypted. The radios, the network switch and the controller still used factory default usernames and passwords. From more than half a mile away, the team joined the network and changed the lights at a real intersection on command.

When they told the controller's maker, the company answered that it followed the industry standard, and that the standard didn't cover security.

In July 2024, a security researcher disclosed a flaw in one maker's line of traffic controllers. The controller's web page could be opened without a password. Anyone who reached it could change light timing, load new settings, or put the intersection into four-way flash. He found about 30 of these controllers reachable from the open internet. The maker said these were older products and asked customers to contact it for guidance. In April 2025, step-by-step instructions for the attack were posted publicly.

One caution. Neither record describes a criminal taking over a city's signals. Nobody has shown that anyone abused the 2024 flaw. What these records show is simple. The door was open, and the people responsible didn't know it.

There's good news too. Remember the safety board in the cabinet? The Michigan team found it did its job. It blocks any attempt to give green to two directions that would collide. So the movie version, where hackers turn every light green, mostly stays in the movies.

But the researchers found a catch. An attacker could trip that safety board on purpose from far away. The intersection would drop into flashing red. And it stays that way until a technician drives out and resets it by hand. Do that across a city at rush hour and you can break signals faster than crews can fix them.

Core idea: A traffic signal is a computer standing on a street corner.

Ask your team: Which of our controllers, radios or cameras can be reached from somewhere other than the traffic center?