At the intersection of East Colfax Avenue and North Washington Street in Denver, people stood at a perfectly normal traffic light on a perfectly normal weekend. You pressed the button. The robotic voice responded. “The walk signal is on.” Pause. Then: “F*ck Trump. The walk signal is on. Trump kills children.” Residents had to pause for a moment. It took a second. Then almost everyone was enthusiastic. Many said it was exactly what they needed that day.
What had happened? Two newly installed crosswalk buttons on East Colfax Avenue - one at North Pearl Street, one at North Washington Street - were not yet officially in operation. They had power, but were still running on factory settings. Including a default password that, as Nancy Kuhn from Denver’s Department of Transportation and Infrastructure later admitted, can easily be found online. Someone found it. And used it. Daniel Pittman, a cybersecurity expert at the Metropolitan State University of Denver, was not surprised. He said this happens all the time. Default passwords, publicly accessible, known as a problem for decades - and yet the same story again and again. There are even websites that automatically search for devices with default credentials. Doorbells, baby monitors, traffic systems - everything is included. Defenders have to be perfect every time. The attacker only has to be right once.
In this case, someone was right once - and Denver had a weekend the neighborhood will be talking about for a long time. The message itself did not come out of nowhere. Shortly before, media had reported that US military investigators consider it likely that American forces were responsible for a strike on a girls’ school in Iran. The Pentagon has since expanded the investigation, a final conclusion is still pending. Whether the person behind the hack wanted to make that connection remains unclear. The traffic light made it anyway.
It is not the first time that public audio systems have been used for political messages. In October, Harrisburg International Airport in Pennsylvania broadcast a message over its loudspeaker system for about ten minutes - with pro Palestinian slogans and insults directed at Trump and Israeli Prime Minister Benjamin Netanyahu. Transportation Secretary Sean Duffy called it unacceptable at the time and pointed to disturbed travelers.
In Denver, most people simply liked it.
DOTI has since changed the passwords and does not expect a repeat. Police are investigating, but have not said whether anyone has been identified or whether charges are expected. Kaizen Blog has asked the Denver District Attorney whether criminal proceedings are planned - as well as the White House. Responses are still pending.
What remains is the image. A traffic light in Denver, freshly installed, still wrapped, with a default password and suddenly an opinion. Somewhere between vandalism and the spirit of the moment. The city has fixed the problem. The question the traffic light raised is still in the air.
Updates – Kaizen News Brief
All current curated daily updates can be found in the Kaizen News Brief.
To the Kaizen News Brief In English
