Photo and video footages from traffic violation cameras in Uzbekistan discovered by foreign experts are the footages that are hosted on a test server where a system is being tested, and it is not a driver tracking system, officials of the Road Safety Service of the Interior Ministry said in a press briefing on Wednesday, commenting on an article published the day before by the American IT publication TechCrunch.

They denied claims that the system contained a vulnerability, which discloses personal data, and that allows vehicle tracking.

Chief of Central Computerized Control System Department, the Lieutenant Colonel Sukhrob Tursunov, , underscored that the authors of the story discovered a "sandbox" server where the operation of newly connected devices and systems is being tested in a test environment using "simulated materials," as well as the correct recording of newly introduced traffic violations (for example, for not wearing a seat belt, for a driver failing to yield to a pedestrian, etc.). The trial period typically lasts 10 days.

Violation reports are not generated from the materials available on the test server. They also do not contain personal data, only photographs of vehicles, a service representative noted. The vehicle registration number is not considered personal information, the Traffic police added.

Sukhrob Tursunov noted that traffic violation data—violation sheets, photos of violations, and videos typically 6-10 seconds long—are also accessible without a password, but only via a QR code or direct link, or through mobile apps. This is necessary so that the data can be verified by both the driver and other interested parties, such as the vehicle owner or a lawyer. The link is generated automatically, and it is impossible to find links to other violations by brute-force methods.

The photo and video recording system only records the moment of a traffic violation; it does not track the movement of vehicles, Sukhrob Tursunov underscored. The servers that record vehicle movements, store the reports and footage of the violations, and the test server are separate. The first is located in a "closed network" within Uzbekistan, inaccessible from abroad. Footage of violations is copied to a cloud server (cloud.yhxx.uz), where it can be viewed via a link upon receiving a violation notice.

The State Traffic Police reported that more than 5,000 traffic violation cameras have been installed across the country, including those installed by entrepreneurs, whose data is collected by the agency's Unified Automated Information System. The reference to "about 100 cameras" in the foreign publication's article confirms that the authors did not have access to the entire system, the service noted.

As for the camera installation locations, the coordinates and address are indicated in the photographs, as required by government regulations, as is the camera model. This data is public and is regularly updated in open sources, including online maps and radar detectors.

In Uzbekistan, not only the Chinese system mentioned by TechCrunch is used, but also Russian, Belarusian, and other systems—14 systems in total. All systems and devices undergo a three-stage assessment by the Cybersecurity Center before launch. Specifically, compliance with technical specifications is checked, after which a conclusion on the system's security level is issued. A certificate of conformity from the Standardization Agency is also required.

After receiving a complaint about a possible system vulnerability, the Cybersecurity Center conducted an investigation into the reported facts and found no confirmation, said Sukhrob Tursunov. Not only the test server but also associated systems have been secured.

The Center attempted to contact the author of the article, Zack Whitaker, using the contact information he provided in a letter (dated December 17), but received no response. This was also stated in a statement published on the Interior Ministry. The Traffic Police noted that they are ready to discuss all the details with the author if they can establish contact with him.