Taiwan High Speed Rail TETRA radio spoofing halts trains

On the evening of 29 April 2026, Taiwan's Central News Agency reported that Taiwan High Speed Rail Corporation (THSRC) had filed a criminal complaint after its handheld radio system was used without authorization. At 23:23 on 5 April 2026, during the Qingming holiday period, the operations control center received a General Alarm sent from a handheld radio at Taichung station. Following procedure, three operating trains were brought to emergency stops, and delays across the network added up to 48 minutes. Normal service resumed after inspections.

THSR said that when the control center tried to contact the sender, the person gave contradictory answers and then switched the radio off. After checking that none of its own radios were missing, the company reported the case to police on 6 April and filed a formal complaint on 24 April. The Railway Police Bureau and the Criminal Investigation Bureau's electronic investigation unit took up the case under the Taoyuan District Prosecutors' Office.

The suspects

On 28 April, investigators searched three locations and detained a 23-year-old university student surnamed Lin, a radio enthusiast from Taichung. Police said he had used software-defined radio (SDR) equipment bought online to capture and analyze THSR's TETRA (Terrestrial Trunked Radio) signals, then programmed the recovered parameters into handheld radios so they could pass as legitimate THSR terminals. Radios, an SDR filter, a laptop and phones were seized. Lin told investigators he had sent the alarm by accident. He was released on NT$100,000 bail on the night of 29 April.

Prosecutors said the key parameters Lin could not obtain himself had been supplied by a friend. On 30 April they detained a 20-year-old man surnamed Chen, who was released on NT$80,000 bail. Both face suspected violations of Article 68-3 of the Railway Act (intruding into the core communication systems of railway facilities by exploiting vulnerabilities and interfering with them by electromagnetic means) and of the Criminal Code provisions on endangering public transportation and interfering with equipment.

Local coverage differed on some details: most reports, including CNA and THSR's own statement, cite three halted trains, while one Taipei Times article said four. How Lin obtained any encryption material has not been publicly established; researchers at Midnight Blue noted the network may have been unencrypted or protected by the weak TEA1 cipher.

Response

At a Legislative Yuan committee hearing on 30 April, legislator Li Kun-tse said the radio system had not been replaced since it entered service in 2007, 19 years earlier, and questioned whether its verification layers had ever had their credentials updated. Transportation Minister Chen Shih-kai said the ministry would deliver a review report within one month, and THSRC began reviewing radio security with Taiwan Railway Corp and metro operators. In September 2026 THSRC said it had reissued TETRA IDs on all handsets, added detection of suspicious registrations from different locations at short intervals, tightened handset custody rules and was building an identity authentication and encryption system.

Why it matters

The incident shows how legacy operational radio systems can become a safety-relevant attack surface. TETRA networks are widely used by railways, utilities and emergency services, and many run long-lived configurations. Here, cheap SDR hardware and leaked parameters were enough for an outsider to impersonate a staff radio and trigger emergency braking on a high-speed rail line.