405 Freeway Sign Hacked to Show Pro-Iran Site
Earlier this month a temporary traffic sign on the 405 Freeway in Los Angeles was altered to show a link to a pro‑Iran website. The incident, discovered by a real‑estate broker, prompted a quick removal and a field investigation by Caltrans. The event highlights growing cyber‑security threats and d…
By Felo News Desk · Published
A temporary electronic message sign on the 405 Freeway in Los Angeles was discovered early this month displaying a link to a pro‑Iran website. The sign, placed near the Santa Monica Boulevard exit for a pavement rehabilitation project, had been altered to show the URL www.goorkan.info, a site that promotes a campaign against Iranian dissidents.
Discovery and Immediate Response
Real‑estate broker Payam Shirazi was driving north from Irvine to Los Angeles for a business meeting when he noticed the unusual message on the sign. Recognizing the Farsi word “goorkan,” meaning “gravedigger,” he photographed the display and visited the site. The website featured images of Iranian Americans and Canadians who had protested against the Iranian government and supported the U.S. and Israel’s military action earlier this year. The site also called for the punishment of those it labeled as traitors to the homeland.
Caltrans spokesperson Colleen Park confirmed that the sign had been installed for a maintenance project in the Sepulveda Pass. She said the agency was alerted to an “unauthorized message” on September 15 and that a contractor removed it shortly thereafter. Park added that a field investigation of the message and access history was underway.
Content and Changes on the Website
After the sign was removed, screenshots taken by Shirazi were shared with The Times. The website’s database of photos and names of protesters was later taken down and replaced with new language accusing activists who support the war as part of an “Israeli intelligence project.” No specific evidence was cited. The removal of the original content and the shift in tone suggest a rapid attempt to re‑brand the site following the exposure.
Reactions from the Iranian American Community
Emel Karsaz, an Iranian woman living in Los Angeles who had previously appeared on the website, told the California Post that she was shocked to see her personal information displayed. She has filed a report with the FBI. The FBI’s Los Angeles office has not yet responded to a request for comment.
The incident comes amid heightened tensions within the Iranian American community, which has become increasingly polarized. Persian‑language online influence campaigns linked to Israel have amplified pro‑war sentiment in the diaspora and promoted Iranian opposition figure Reza Pahlavi, the son of the deposed shah. These campaigns have also fueled smear efforts and contributed to the Trump administration’s detention and deportation of some Iranian families.
Broader Cyber‑Security Context
Since the U.S. and Israel launched a military operation against Iran in February, there have been multiple warnings of potential cyber interference. An Israel‑based cybersecurity firm attributed a March cyberattack that forced Los Angeles’ transit system to shut down parts of its network to an Iranian operation. Los Angeles Metro officials said their investigation was ongoing and that they had not yet identified the perpetrators.
Other federal investigations have pointed to Iran‑linked hackers in breaches of municipal water systems in Minnesota (July) and cyberattacks on energy tankers bound for Texas (August). These incidents underscore the growing threat of state‑backed cyber operations targeting U.S. infrastructure and political communities.
While the California Department of Transportation has removed the unauthorized content and is investigating the breach, the incident raises questions about the security of temporary electronic signage and the broader implications for political messaging in public spaces.
Officials have not yet determined whether the hack was part of a coordinated effort to influence public opinion or simply an opportunistic act. The investigation will likely examine the technical aspects of the sign’s software, the source of the content, and any potential links to foreign actors.
In the meantime, residents and commuters on the 405 Freeway can expect the sign to remain offline until Caltrans confirms that the system has been secured and that no further unauthorized messages can be displayed.
As the situation develops, authorities will likely provide updates on the investigation’s findings and any actions taken against those responsible for the hack. The incident serves as a reminder of the vulnerability of public infrastructure to cyber threats and the importance of safeguarding political neutrality in public messaging.
What Happens Next?
Caltrans and the California Department of Transportation will continue their investigation into the unauthorized message and the potential breach of the sign’s software. The FBI remains involved, and the incident may be part of a larger pattern of cyber interference linked to Iranian actors. The outcome of the investigation could lead to changes in how temporary electronic signs are secured and monitored across the state.
For the Iranian American community, the incident highlights the ongoing struggle over narrative control and the risks of being targeted by foreign influence campaigns. It also underscores the need for vigilance and cooperation between community leaders and law enforcement to protect personal information and civic spaces from manipulation.
Overall, the hack of the 405 Freeway sign is a stark illustration of how cyber‑security intersects with political activism, and it signals that public infrastructure can become a battleground for competing narratives in an increasingly digital world.
Key facts
- Temporary traffic sign on the 405 Freeway was hacked to display a pro‑Iran website
- The sign was removed after Caltrans was alerted to an unauthorized message
- The website promoted a campaign against Iranian dissidents and later shifted to accuse pro‑war activists of Israeli ties
- Iranian American community members, including Emel Karsaz, reported personal data exposure and filed FBI complaints
- The incident occurs amid heightened cyber‑security threats linked to Iranian actors targeting U.S. infrastructure
- Investigations by Caltrans, the FBI, and other agencies are ongoing to identify the perpetrators
Why it matters
The incident demonstrates how easily public signage can be hijacked to spread political propaganda, raising concerns about cyber‑security and the integrity of public messaging. It also reflects the deepening polarization within the Iranian American community amid broader geopolitical tensions.
Frequently asked questions
How was the traffic sign hacked?
The sign’s software was likely compromised, allowing an unauthorized message to be displayed. Caltrans is investigating the technical details.
What is the website that was displayed?
The URL shown on the sign was www.goorkan.info, a site that promoted a campaign against Iranian dissidents.
Are there any charges filed yet?
No charges have been announced. The FBI is investigating the incident and may pursue legal action if responsible parties are identified.
Sources
- [1] latimes.com — originally reported as “Traffic sign on 405 hacked to display pro-Iran website”
