The Threat Had a Badge

Sometimes the person with the keys is the problem.

Most people picture a stranger in a hoodie. One of the best-known traffic signal attacks on record came from inside the building.

INDEPENDENT EVIDENCE

In August 2006, the City of Los Angeles was bracing for a labor action by its traffic engineers. Managers planned to block engineers from making changes to the traffic system while it lasted.

It didn't work. On the night of August 21, hours before the action began, two senior engineers at the city's traffic control center logged in and sent commands that disconnected the signal boxes at four busy intersections. One was near Los Angeles International Airport. Prosecutors said the pair used a supervisor's login and changed the codes so nobody else could undo the damage.

It took four days to get the system fully working again. No accidents were reported. In 2008, both engineers pleaded guilty to a felony charge of illegally accessing a city computer.

No hacker broke in. No password was cracked. Two people with real access used it in a way nobody planned for.

Now look at your own corridor. Who can reach your controllers today? Your engineers, yes. But also the contractor who installed the new signals three years ago. The vendor with a support login. The technician who left last spring. The laptop that plugs into the cabinet on maintenance day.

Every one of those is a door. Some should be open. Some should have closed a long time ago. Most agencies can't say which is which, because nobody keeps that list in one place.

Core idea: Whoever can reach the controller can run the intersection.

Ask your team: If someone who left our agency last year still had a working login to our signal system, how would we find out?