Cyber-crime

Taiwan cops say student's radio kit brought bullet trains to a standstill

Investigators spent weeks unravelling enthusiast's bedroom project

A university student in Taiwan is out on bail after being accused of interfering with signals sent to the country's high-speed rail network, bringing trains to a halt.

In a statement issued to local media, Taiwan High Speed Rail (THSR) confirmed that a 48-minute disruption to three trains on April 5 was caused by a rogue General Alarm signal of the kind triggered by specialized equipment used by train station staff.

This General Alarm signal was sent via a terrestrial trunked radio (TETRA) handset at Taichung Station. Staff followed protocol and engaged their emergency response plans, which in turn instructed trains to manually stop.

These devices are not the kind commuters usually carry around. Functioning much like walkie-talkies, they are typically used by station staff to communicate with one another and train drivers.

Given that these devices are most commonly used by station staff, officials initially assumed it was an inside job. 

Rail police and telecommunications investigators probed the case after station control room staff ruled out the possibility of official equipment having been stolen or misused by staff.

Taiwan's Major Criminal Cases Unit joined the investigation on April 13 after chief prosecutor Chang Chun-hui deemed the case a threat to transportation safety.

Over the course of two weeks, detectives concluded that the attack was likely carried out by the 23-year-old student, identified only by his surname Lin, who was described as a radio enthusiast.

According to statements reported by UDN, officials believe Lin exploited a vulnerability in the TETRA communication network and remotely triggered the General Alarm signal using unspecified electromagnetic equipment, which police said they found while searching his residence and workplace.

Following the raids, police seized seven radio devices, a laptop, two smartphones, and what appeared to be a software-defined radio (SDR) filter.

Officials said they believe the way Lin allegedly triggered the General Alarm was rudimentary and involved cloning signals using equipment he bought online.

Lin allegedly connected a radio to his laptop via an SDR filter, which captured the radio signal used by THSR, and configured his radio device to transmit the same signal, allowing him to trigger the General Alarm in a way that appeared to come from a station employee.

Police arrested Lin on April 28, and after questioning on April 29, concluded he was most likely behind the disruption. They released Lin on bail, convinced there was no need for further detention, setting the value at NT$100,000 ($3,183). ®