Court fines inventor over CSDD system vulnerability disclosure

Vidzeme Regional Court has found inventor Raimonds Skuruls guilty of exposing a security vulnerability in the Road Traffic Safety Directorate’s information technology system and requesting 1,000 euros for his work testing it, LSM reported, citing information obtained from the court. The court imposed a fine of about 4,290 euros.

Skuruls has filed an appeal with the Supreme Court, which has not yet decided whether to open cassation proceedings.

Last year, the Supreme Court sent the case for a retrial at Latgale Regional Court, saying the appellate court had failed to take into account findings in a June 20, 2023 decision. The Supreme Court said this had led to an unlawful worsening of the accused’s position.

An appellate court had ruled in 2022 that Skuruls had not created the vulnerability in the national register system for vehicles and their drivers, but had discovered it. The court also found that responsibility for maintaining information technology security and fixing the vulnerability lay with the Road Traffic Safety Directorate, not the accused.

The prosecutor’s cassation protest against the acquittal did not dispute the appellate court’s finding that there was no causal link between the accused’s criminal acts and the losses incurred.

The case began in November 2018, when the Road Traffic Safety Directorate and State Police said they had uncovered an unauthorised attempt to access the vehicle register and an attempt to extort money. The State Police’s Cybercrime Enforcement Unit opened criminal proceedings over an attempted disruption of an information system and attempted extortion for financial gain. Skuruls was detained and held in a temporary detention facility for several days.

Skuruls is a radio engineer and design engineer who previously received the Walter Caps Prize from the Latvian Academy of Sciences and the Latvian Patent Office for an invention.