A 23-year-old university student halted four Taiwan High-Speed Rail trains for 48 minutes on April 5 by transmitting a high-priority “General Alarm” signal, according to local media reports.
How the attacker impersonated TETRA beacons
Local reporting says the suspect, identified only by his surname Lin, used software-defined radio (SDR) equipment bought online to intercept and decode TETRA (Trans-European Trunked Radio) parameters. Lin then programmed those parameters into handheld radios and—together with transmissions from the devices—sent a high-priority “General Alarm” message that the network treated as genuine.
The police later found that the signal had been sent from a radio beacon that hadn't been assigned for duty. When THSR checked the physical device and found it present, investigators concluded a plausible scenario was unauthorized cloning of the beacon.
What happened on the tracks: four trains, 48 minutes, emergency braking
The emergency signal triggered established procedures: four trains were brought to a halt and remained stopped for a combined period of 48 minutes on April 5. THSR runs a single 350 km two-way line along Taiwan’s western coast, with trains reaching up to 300 km/h; the network carries 81.8 million passengers a year and receives financial support from the state.
Why the attack succeeded: long-lived parameters and layered verification bypassed
Reports state the TETRA system had been in use for 19 years and that its parameters were apparently not rotated during that time. That lack of rotation, the reporting says, allowed the attacker to bypass seven verification layers. Those procedural and configuration issues are central to how the impersonation and subsequent emergency-signal transmission succeeded.
Investigation, seizure, arrest and charges
After THSR examined network logs and CCTV footage, police traced activity to the suspect’s residence. Officers seized 11 handheld radios, an SDR, and a laptop. Police arrested Lin on April 28; he was released on NT$100,000 (about $3,280) bail and faces prosecution under Article 184 of the Criminal Law, which carries a maximum penalty of 10 years imprisonment. A 21-year-old accomplice is reported to have provided Lin with some critical THSR parameters that enabled the attack.
Lin’s lawyer told authorities the transmission of the emergency signal on April 5 was accidental; the authorities have described that claim as unconvincing.
How THSR, the police, and Taiwanese politicians are responding
- THSR: Examined TETRA logs, identified an unassigned beacon as the apparent source, and alerted police when cloning became a plausible explanation. The operator’s review of logs and device assignments is the primary operational response reported.
- The police: Used CCTV and network logs to locate the suspect, seized equipment, and made an arrest on April 28; the investigation produced enough evidence for charges under Article 184.
- Taiwanese politicians: Some lawmakers criticized the bodies responsible for negligence, according to reports, pointing to the long interval without parameter rotation and the resulting exposure.
The incident is compact in its facts but wide in implications: a single individual, using commercially available SDR gear and decoded, long-running radio parameters, was able to trigger emergency braking across a major national transport artery. The logs, the seized radios, and the arrest have moved the case into the criminal-justice system, while the operational findings—an unassigned beacon appearing in logs and parameters untouched for 19 years—frame the immediate technical and managerial questions THSR and oversight bodies will need to address.
For the original reporting, see BleepingComputer: Student hacked Taiwan high-speed rail to trigger emergency brakes.
