Correction EP009 · 13 October 2026

The speed cameras certified for software they cannot run

The claim

Slovakia found Russian backdoors in its new speed cameras, and the supplier says it was deceived.

What the record shows

Slovakia bought 279 speed cameras with about thirty million euros of EU money. Two were delivered and in test operation when the country's security authority, the NBÚ, found an undocumented module in the firmware that accepts text messages from twelve hardcoded Russian phone numbers and hands back a shell.

The module was not the only thing in there. Secure Boot was disabled. A second undocumented modem with a SIM slot sat on the outside of the casing. Two VPN tunnels carried fixed credentials, telnet and SSH answered with manufacturer logins, and live video ran without a password. The vendor's own source contains a developer's note: TODO!!! FIXME!!!.

The certification is the part that stops people cold. The device is certified for measuring speed by radar, and the file whose checksum matches that certificate physically cannot execute on it. It was built for x86 processors while the device runs ARM. Whatever produced the speeds was not the software that was certified.

Both units have gone back up the supply chain. The independent audit has not reported. The interior minister's public position was that the supplier deceived the ministry, and a fresh procurement is under way.

The volume is what makes this more than a curious purchase. The NBÚ alert is public and names the risks; the Slovak procurement office had already criticised the tender in June. Nine months before that, UK and allied agencies published a campaign against internet-connected cameras that had reached more than ten thousand devices since 2022. The cameras on poles are a fleet nobody has counted.

What it means if you run the estate

Certification answers a question about a document, not about the device in front of you. A certificate can describe software that never ran, on hardware that could not run it, while a second modem nobody documented sits on the outside of the box. Procurement is where this was decided, long before anyone in security saw a camera.

Check this on Monday

Pick one connected device bought in the last three years and try to answer three questions from the paperwork alone: what firmware revision is on it, what its certificate actually covers, and who signed the acceptance. If any answer needs a site visit, the record is the gap.

Sources

This entry accompanies the segment Certified, Genuine, And Still Not Yours. Watch the episode.