Cybersecurity expert: CSDD lawyers' stance echoes the Skurul case

A recent cyberattack on Latvia's Road Traffic Safety Directorate (CSDD) has revived public memory of the case involving radio engineer and inventor Raimonds Skurul. In autumn 2018, Skurul discovered a serious authorization vulnerability in CSDD's State Register of Vehicles and their Drivers and reported it to the agency, while also requesting compensation for preparing a technical description of the flaw. This action later led to a criminal case being opened against him on suspicion of extortion.

Expert commentary

On the program "Spried ar Delfi," Kirils Solovjovs, head of "Possible Security" and a cybersecurity researcher, was asked whether there were parallels between the Skurul case and the current situation surrounding the CSDD cyberattack. He said he sees a direct connection mainly on a "karmic level" — suggesting a pattern repeating itself within the institution.

At the same time, Solovjovs was critical of the conduct of CSDD's legal department, describing it as displaying arrogance. No further specific details about the new cyberattack were shared during the discussion, but the comparison to the Skurul case suggests that industry experts still view the agency's approach to security issues — and to those who expose them — as problematic.

The Skurul case previously sparked wide debate about how state institutions should respond to good-faith vulnerability disclosures, and it became an example of a situation in which a person reporting a security flaw ended up under suspicion rather than being recognized for identifying the problem.