Iran International
A hacked freeway sign in the heart of Los Angeles’ Iranian community directed drivers to a website threatening opponents of the Islamic Republic, in what cyber and security experts describe as a psychological operation designed to spread fear.
The digital sign on Interstate 405, near Westwood's Persian Square, briefly displayed the address of Goorkan, a Persian-language site that publishes names, photographs and personal information of people it identifies as opponents of Iran's government.
"It touches the heart of the diaspora and sends a message. We can touch you wherever you are. The sophistication is irrelevant. The message is chilling," said Roger Macmillan, an Iran and terrorism specialist and former director of security at Iran International.
Who carried out the intrusion has not been publicly established, and US authorities have not confirmed a link to the Revolutionary Guards.
Three cyber and security experts told Iran International that the incident shows how a simple intrusion can intimidate a community far from the people who carried it out.
A simple hack, a powerful message
The intrusion looked unsophisticated next to the capabilities of Russian and Chinese operators, said Amin Sabeti, a cybersecurity researcher who specializes in Iranian cyber operations.
"It's not that sophisticated hacking. It's more about the propaganda," Sabeti said.
The attackers did not need to disable a transport network or break into a secure system. Putting a web address on a public sign beside one of the largest Iranian communities outside Iran was enough.
Sabeti said the effect falls hardest on ordinary Iranians who attend protests and keep public social media accounts. Finding their photograph or their details on a threatening website leaves them wondering who is watching and what it may cost them.
"It's more about creating chaos amongst the diaspora," he said.
Emel Karsaz, an Iranian-born Los Angeles resident, told the New York Post she reported the matter to the FBI after finding her name, photograph and personal information on the site, and that she had also received threats on social media.
The California Department of Transportation confirmed that an unauthorized message appeared on the sign and said it had instructed a contractor to restore normal operations. A review is under way.
The crudeness offers no comfort, Macmillan said.
"That the hack itself is unsophisticated doesn't reassure me. If anything it confirms what this operation was actually for," he said. "Sophistication was never the point. Fear was."
Tehran has long used intermediaries and loosely affiliated actors to intimidate its opponents abroad, Macmillan said, which lets it benefit from such operations while keeping its own involvement out of view.
How vulnerable was the freeway sign?
It appears to have been a straightforward compromise of a badly secured system, said Annie Fixler, director of the Center on Cyber and Technology Innovation at the Foundation for Defense of Democracies.
"This incident is 100% about intimidation," Fixler told Iran International.
Without the investigation's technical findings, she suspected the sign had an unsecured internet connection that let the attackers change what it displayed.
"It is deeply disturbing for those that saw the message but that is probably the extent of what the hackers could do with that access," she said.
The ease of it points to a larger problem with internet-connected public infrastructure, she added.
"The incident itself is not a big deal but the fact that so much of our systems are unprotected or misconfigured such that even low level hackers can do damage is the main take away. We need to be taking security seriously."
A familiar cyber playbook
The sign follows a run of cyberattacks on American infrastructure that experts have read as demonstrations of reach rather than attempts at damage.
In August, Iran International reported that attacks on water and wastewater facilities in at least seven states appeared aimed less at crippling infrastructure than at unsettling the public.
Federal authorities opened an investigation and did not publicly attribute responsibility, though US media reported that officials considered Iran the leading suspect.
Fixler described the tactic at the time as perception hacking: gaining limited access to a system, then publicizing it to suggest a far larger capability.
Los Angeles follows the same pattern with a narrower audience.
A wider campaign against dissidents abroad
The hack comes with renewed warnings about Iranian operations against opponents abroad.
On September 15, US, British and Dutch authorities issued a joint advisory that Iranian state cyber actors had deployed spyware known as Chosen Brick against dissidents, activists and journalists. The malware can pull communications and contacts from an infected device, exposing not only the target but everyone they know.
The same month, the Islamic Republic promoted a platform called Alaj, meaning remedy in Persian, which asks the public to identify and report opponents living abroad. Iranian state media say it has identified and monitored 1,600 people, 600 of them through public submissions.
It publishes names, photographs and, in some cases, further personal details, and lists measures that could follow, including asset freezes and restrictions on consular and citizenship services.
No operational connection between Alaj, Goorkan and the freeway sign has been publicly established.
"Treating it as trivial because the hack was crude would be a mistake," Macmillan said.
