Christine Bax is an artist and writer. She lives and works in Milan and The Hague. With a clear and original tone of voice she writes about art, film and theatre in connection to political, cultural and social phenomenons. Her texts are a good example of how art can clarify complex systems and structures. In ‘When traffic lights speak…’ Christine pictures the (un)real status quo of the world of hacking and cyber security.

Imagine. It’s early in the morning. You’re biking to work. You stop at a traffic light. And the traffic light blinks at you. Are you even fully awake? You blink your eyes. Yes. The light blinks back.

Perhaps you’re in a movie scene from The Italian Job, just at the moment when a bunch of hackers break into the traffic control center of the city of Turin. In the middle of the room is a computer that regulates all traffic lights in the city, through a system of complex radio signals and video cameras. But you’re an extra in this movie so you have nothing to do with the control room. All you get to see are the sand-colored stones that lead you past the crossroads to your job, or to school, or wherever you’re heading in this morning rush hour. The viewer knows what is about to happen, but you don’t – not yet. The radio tapes in the control room sing ‘Bip! Bip! Bip!’ and suddenly their rhythm changes to ‘Bop-da! Bop-da! Bop!’ The hackers grin at each other, while you yawn and think about your coming day. The air is still cold and damp. Your movements are on automatic pilot. And then it starts.

In The Italian Job, the center of Turin is full of cars from the late 1960s – Mini Coopers, and a bunch of little Fiat 500s and 600s. In Dutch we call those old cars koekblikken, ‘cookie cans’, because they’re small and have a sweet look in their headlights. And between the cookie cans drives a convoy of robust windowless military trucks, guarded by grim-looking policemen on motorbikes who carry Kalashnikovs under their arms like it’s the morning newspaper. They’re transporting enormous amounts of gold.

And that’s what it’s all about for the clever thief Charlie Croker. The gold, I mean, not the Kalashnikovs. The audience is on Charlie’s side, because it’s crystal clear that he is a good-natured thief. Some sort of Robin Hood of the 1960s. He has a boyish grin. He just entered the control room, outsmarting everyone. All traffic lights in downtown Turin are dancing on the crazy rhythm of the radio signals. They flash on and off like a disco. The drivers of the cookie cans shoot forward, nearly crashing into each other. And each driver thinks he’s in the right because they all had a green light.

‘Cretini,’ shouts a woman from her car window, ‘cosa credete di fare!’

She raises her fist in the air, not sure who to blame. No one yet realises that the traffic lights have been hacked. Instead, they shout at each other and make rude hand gestures.

In the middle of the honking chaos is a cab. And inside the cab is a dull-looking man.

‘What’s happening?’ the dull man asks the driver.

‘It’s another traffic jam,’ says the cab driver. ‘It gets worse every time.’

The dull man looks worried and irritated. His tinted glasses hide his eyes. His hairline is square shaped and shiny like it’s stuck to his head with glue. His suit is bulky and cheap and there’s something undefinably dusty about him. Never, not even for a second, does he show emotions that make human life interesting. No passion, no love, no sense of aesthetics, no poetry… His movements are rigid. He is robot-like; the personification of the big bad establishment that our dear Charlie Croker likes to outsmart. The traffic around the cab is getting a bit dangerous now. But the dull man has worse things to worry about.

‘Dammit!’ he hisses. ‘We’ve lost the convoy.’

And he’s right about that. Somewhere, out of sight, Charlie Croker is smiling. His hair is wavy, straw-blonde and messy. His eyes are twinkling. His plan is starting to work…

Every time city traffic gets hacked, newspapers refer to this famous movie scene. ‘Just like in the 1969 classic The Italian Job’[1], newspapers wrote in 2014, when a team of researchers from the University of Michigan[2] hacked into more than a hundred traffic light systems. They found all sorts of faults in the security. Unencrypted radio signals. Factory default usernames. A debugging port that was easy enough to crack that any bored teenager with too much time on their hands could do it. ‘Remember that scene from The Italian Job’[3], said the newspapers about two LA hackers who broke into the traffic control system, creating a symphony of honking chaos[4]. ‘The spectacular scene from The Italian Job, in which traffic lights are manipulated so as to cause traffic to run wild, suddenly seems a lot closer to the truth’[5], commented a reporter in 2014, when the Argentinian security researcher Cesar Cerrudo came across security systems that were unencrypted and didn’t have any authentication. Cerrudo also found out that it’s relatively easy to make the system think that a full road is empty or an empty road full. But instead of going for the gold, like Croker, Cerrudo went to the authorities to inform them.

‘I had an interesting discussion,’ Cerrudo says in his research report[6], ‘with someone from the US Department of Transportation (US DOT). He wasn’t really worried about these vulnerabilities. He said ‘we have worse things to worry about.’

The dull man with the tinted glasses doesn’t care about the chaos around him either. He’s focused on the gold. He jumps out of his cab, a gun hidden in his breast pocket. He chases Charlie Croker. In the meantime, you’re still blocked in the traffic jam. I guess you’re not too happy about being stuck like this. There are cookie cans all around you. Left, right, back and front. Imagine swinging open your car door and stepping out, free at last. Imagine taking a stroll through the streets.

‘It’s like walking through a street with all the windows and doors wide open, and (it) can enter all buildings and look around’, writes an anonymous ‘cyber security expert’[7] on his blog. He’s not talking about the city of Turin. He’s talking about Shodan, a search engine for the internet of things. This platform allows you to search for specific types of devices and find them all over the world. Shodan shows these devices’ vulnerabilities. It shows if they have default passwords or no password at all. On Shodan, you can find objects like smart TV’s, fridges, garage doors, car washes, a water park. A hotel Champagne cooler. More than 100.000 industrial control systems, including that of a nuclear power plant. And many, many vulnerable webcams across the globe.[8] In 2013, security consultant Dan Tentler was able to use Shodan to locate a traffic light controller that required no login credentials. Instead, a warning message was written in capital letters, saying: ‘DANGER! DO NOT USE WHILE CONTROLLER IS BEING USED FOR TRAFFIC CONTROL OR SERIOUS DAMAGE, INJURY OR DEATH MAY OCCUR!!!’[9] And just like Cerrudo, Tentler notified the U.S. Department of Homeland Security about this lack of security.[10]

But if the whole Shodan thing made you fear a nuclear explosion, or acid floating through your swimming pool, or even worse, losing the bubbles in the Champagne in your digitally controlled Champagne cooler… relax. It’s still cool. Dan Tentler formulates it as follows: ‘The fact that somebody is basically shining a flashlight into a dark room shouldn’t be the part people are afraid of. The part people should be afraid of is the fact that some genius decided to take, for example, a five-megawatt hydroelectric plant in France, put its control computer on the Internet and allowed everybody that knew about the IP address to connect to it and make changes to this dam, with no encryption or authentication to speak of’.[11]

So, you’re walking through the streets. It is dark outside. And because you’re not some evil genius – I hope – you’re carrying your pocket flashlight. And if you’re curious, which is only natural, you might open a window here and there. Or a can, to see if it contains cookies. Or a door. And when you open that door, and you see a parking garage in the German city of Wolfsburg. Or you see a woman in a wheelchair, in a nursing home in a small rural town in the United States, who needs intensive care. So, her nurse watches her through a webcam in her living room that, unfortunately, has no password. The woman knows she is being watched by her nurse, but she doesn’t know that you’re watching her as well. If you have the least bit of decency, you walk on and leave her be. But in the end, all those open doors and windows are tempting. You open another one, and another one. More objects and people are behind them. You’re crossing this digital town like Calvino’s Invisible Cities. Imagine searching vulnerable webcams and finding yourself on your computer screen, sitting in your room, staring at the screen.

Even if you would discover yourself like that, you wouldn’t be able to look yourself straight in the eye. Because this digital street goes only one way. The people behind the windows don’t see you. It might be a Godlike feeling. If you decide to speak to them, your voice comes out of nothingness. If you choose to suddenly blast music from their smart-speakers, they might think you’re a ghost or something. This one-way street offers nothing but a lonely walk. But soon that’s about to change…

What would a digital two-way street look like? My mother knew the answer long before I knew it. When it comes to technology, she knows what to expect and when to expect it. And when my mother’s expectations don’t fit to the reality, the technology is wrong, not her. When the TV doesn’t respond to the remote, it is a stupid remote. When her favorite CD’s were no longer playing music because they had scratches, they were ‘stupid CD’s’ and ‘why can’t they just think of something that makes music come through the air, you know’.

Also incredibly stupid, according to my mother, were the highways in France. Every summer holiday, she’d put my siblings, my dad and me in our blue Volkswagen Polo and head to France. But clearly the French highway network was ‘not functioning’, because in less than no time we stood still along with 30.000 other Dutch families packed in hot, sweaty cookie cans. The traffic jam on the Boulevard Périphérique lasted for hours, year after year, summer holiday after summer holiday. In my memory, all the moments we were stuck in the traffic jam are melted together into one blur of sweaty children’s feet, a roof window that wouldn’t open, and endless amounts of candy and packets of apple juice to keep our mouths shut and our brains from dehydrating (mother was convinced that dehydration started in the brain). And, of course, there was the yearly explosion.

But the summer of 2005 was different. In that year, my parents bought a ‘New Technological Device’. They spoke about it in capital letters and lowered their voices respectfully as if it might hear them. The Navigation System. It was very ‘Innovative’ and ‘Important’, they said. And us kids were of course not allowed to touch it with our sticky fingers. The holiday preparations were without nervous tension that summer. There was no drama about why on earth my dad wasn’t able to read a map. No yelling about how he in fact was able to read the map, if only mother would listen to him. Us children went to bed early that night. We stayed quiet, awake under the blankets, waiting for the usual explosion. But that year, there was no screaming downstairs and no slamming of doors. Without the explosion it felt as if something essential was missing, like a New Year’s Eve without fireworks.

The Navigation System offered us a range of voices to choose from. My mother picked a female voice called ‘Eva’. That early morning, Eva led us elegantly to the Belgian border, smoother and more efficient than my father was able to. Father, instead of reading the map, skimmed through some magazines. Then he shoved them aside. He leaned back, arms crossed over his chest, pretending to sleep. His attitude was of involuntary uselessness. How can a man care for his family, if they don’t even allow him to lead the way?! They had replaced him with a robot.

However, in the North of France he grew more attentive again. Eva’s warm voice suggested us a different road than my father with his questionable map-reading skills would have. He believed my mother was steering us in the wrong direction.

‘Stupid Eva,’ he commented.

‘Shhh!’ said my mother, ‘that’s not very nice!’

She quickly glanced at Eva, as if to see if dad’s comment had upset her somehow. But that didn’t seem to be the case.

‘In two-hundred meters, take the roundabout,’ said Eva’s pleasant voice, that was nearly cheerful but not too much. She was perfection. We passed Reims about an hour faster than we would have with my father reading the map. My mother started throwing proud glances at Eva that she didn’t even show us children when we came home by the end of the school year with our report cards.

However, her love for Eva evaporated all of a sudden when we reached the Boulevard Périphérique. Like every summer we were stuck between the cookie cans that reached as far as the eye could see. I believe I remember someone using their car’s hood to grill sausages. But that could also have been a heat-induced illusion.  My mother was not pleased.

‘You ought to have warned us, young lady,’ she said to Eva.

That specific tone made my neck-hairs rise. It was her report-card voice. The I’m-not-angry-just-incredibly-disappointed-in-you-tone. But unlike us children, Eva was not afraid to talk back.

‘In four hundred meters, take the exit,’ sang her soft voice.

‘Now listen to me!’ demanded my mother. ‘You were supposed to warn us for-’

‘-and continue onto Porte de Bercy.’

‘Don’t interrupt when I’m talking to you!’

‘In four hundred meters-’

My mother did her ‘Pah!’ sound, which was usually the ultimate execution. Her face radiated betrayal. Not that Eva cared a single bit about it. My dad seized the opportunity. He took the map from the glove department. His whole face lit up.

‘Let me think of a clever way out…’ he said.

‘You?!’ my mother hissed.

And the fireworks began. Finally, this felt like a real holiday.

The French highways led us past dusty suburbs. Past high rises and ancient villages. We strolled through cathedrals where statues of saints looked down upon us with their glass eyes and where the air was thick and serene from the stillness of time. The summer house was surrounded by green meadows. Dried flowers hung on the walls, copper pots and pans in the kitchen. In the living room sat a comfortable armchair with embroidered cushions. Perhaps it had belonged to the previous owner, who had lived here all his life. And when he passed away his children turned the house into a tourist resort. It could have been a story like that. The house looked so old and left behind in some way. We tourists were just passing through. Maybe the previous owner had died in that same armchair in which my little sister was now sitting, telling jokes and drying her bathing suit. Whether it was dying or telling jokes, that chair didn’t care, just like the lamps in my house don’t care whether it’s light or dark.

But in the digital city, objects have been stripped of their main attribute of object-ness: indifference to what’s around them. Instead, they’re starting to notice things. And that means that my mother’s deepest wish is currently being realized: to communicate with things and have them listen and do what you say. The last few years, she has come to find technology less and less ‘stupid’. The heater goes on before she gets home, so her house is never cold. She can ask Siri for the best recipe for pasta sauce, and with sheer delight she tells me that ‘what Siri suggested wasn’t that bad’, like it was a suggestion from an old, trustworthy friend. In a few years, my mother may be able to tell her car to ‘drive me here and there’. And maybe, somewhere in a corner of the digital city, there is Eva who will apologise for that time she did not warn about the traffic jam on the highway, which my mother will then accept benignly with her typical ‘Pah!’ because she has the memory of an elephant and never forgets any wrongdoings.

It’s a cozy crowd, on that two-way street in digital city. The radio and the ventilation system are chatting about today’s weather, while the smart alarm clock is wondering if it’s nearly time for a cup of coffee. People and things are talking to each other about people and things. And the two-way street also has its own new forms of traffic light hacking. One that caught my eye last year (August 2020) was that of the Dutch security researchers Rik van Duijn and Wesley Neelen. They had reverse-engineered an app that gave bicycles the green light. If you have it on your phone, you’ll never have to wait for the traffic light again[12]. At that time, there were about 550 smart traffic lights in the Netherlands, and some had started experimenting with ‘green-light apps’, that warned the light when a bicycle was approaching. But, Rik and Wesley wondered, could it also tell the traffic light that multiple bikes were coming?

‘Just like in The Italian job’ was written in at least eight different newspapers, when they made their hack public. Personally, I think it’s more like that song, ‘9 million bicycles in Beijing’, because that’s about as many as their script told there were approaching. Which resulted in eternally green traffic lights. Of course, Rik and Wesley kindly informed the authorities about this security defect, just like Dan Tentler and Cesar Cerrudo did. And I’m sure that the next in line will act just like them. And then we’ll all live happily ever after, just like in any other good story.

Back in 1969, Charlie Croker is celebrating – singing, drinking, cheering, laughing, dancing. He and his crew fled into the Alps. Their van is full of gold – piles and piles of it. They race down winding roads, between the snowy mountain peaks[13]. Champagne flows freely. They’re celebrating the greatest robbery of the 20th century. Now they’ll never have to work again for the rest of their lives. They speed through the curves faster and faster. And they don’t have Eva to warn for what lies ahead of them. Her soft voice doesn’t alert them to the possible effects of high speed in combination with the weight of all that gold. ‘Look out!’ the viewer wants to shout. But the driver is already tipsy from the Champagne and high on adrenaline. He is not the brightest cookie in the can. The next curve is just okay, but the one after that is a hairpin turn. The van swings like a drunken sailor. It crashes into a pole and thunders towards the ravine. The driver slams the brake pedal, as hard as he can. But it’s just too late. The van balances on the edge of a ravine. You are watching the most literal cliffhanger in the history of cinema. This is the point at which the picture freezes and the credits begin, leaving the viewer in doubt whether the gold will pull the crew of hackers down into the ravine or if it will make them rich. Up until today, nobody knows. They can only imagine.

The essay When traffic lights speak… is part of the 12th edition of the Biennale dell’Immagine in Chiasso, Switzerland. Christine Bax’s exhibition is curated by Parsec and OTTN, and made possible by the Mondriaan Fund.

[1] Denver Nicks, ‘Hacking Traffic Lights Is Apparently Really Easy’, Time (2014). Quote: ‘In the 1969 classic (film) The Italian Job, Michael Caine and crew commit a major gold heist by hacking into the traffic light system of Turin, Italy, to cause a massive traffic jam, giving the robbers a perfectly synced path to escape through the gridlock.’
[2] Branden Ghena, William Beyer, Allen Hillaker, Jonathan Pevarnek, and J. Alex Halderman, Green Lights Forever: Analyzing the Security of Traffic Infrastructure, University of Michigan, 2014.
[3] Kristen Lee, ‘It’s Scarily Easy To Hack A Traffic Light’, Jalopnik (2016).
[4] Robert Mc Millan, ‘Two charged with hacking LA traffic lights’, Networkworld (2007).
[5] ‘Stoplicht hacken? Het is kinderlijk eenvoudig’, Het Parool (2014).
[6] Cesar Cerrudo, ‘An Emerging US (and World) Threat: Cities Wide Open to Cyber Attacks’, IoActive (2015).
[7] ‘Shodan and Censys: the ominous guides through the Internet of Things’, Kaspersky Daily,  published on February 29th, 2016. Quote: ‘In certain sense Shodan is like a guy who walks throughout the city and knocks on every door he sees. But instead of doors Shodan ‘knocks’ on every IPv4 address and instead of some city there is the whole world. If you ask that guy about a particular type of doors or about doors in a particular part of the city — he certainly would know something and would provide you the information: how many of those doors are there, who answers them and what do they say. Shodan gives you the same information about those IoT items: how are they called, what type are they, and is there a web interface one can use.’
[8] David Goldman, ‘Shodan: The scariest search engine on the internet’, CNN Business, published on April 8th, 2013.
[9] Newton Lee, Counterterrorism and Cybersecurity: Total Information Awareness, Springer: New York, 2013.
[10] YouTube video: ‘Drinking from the caffeine firehose we know as Shodan’, Defcon 20 – Dan Tentler, October 30th, 2013.
[11] Andrea Peterson, ‘The ‘Scariest Search Engine On The Internet’ Has Been Around For 3 Years And Is Used For Good’, ThinkProgress, published on April 9th, 2013. Web. December 14th,. 2015.
[12] Or, at least, the idea of those apps was that you’d have to wait much less. At that time, different Dutch cities experimented with ‘smart traffic lights’, that connected with traffic users. There were several apps in circulation that gave cyclists a green light. Rik and Wesley therefore do not want to say which app they used; after all, it could have been any of them. What does matter, to them, is that such systems can be vulnerable. They managed to convince the traffic light that fictitious cyclists were approaching. And whatever was being told, via a backdoor, the light believed it. The result is not really dangerous, but mostly annoying for other traffic users. You can, so to speak, make a fictitious Tour de France peloton ride around in circles, endlessly, and everyone else has to wait for it.
[13] They’re singing along with Quincy Jones’ Getta Bloomin’ Move On (The Self-Preservation Society)