This talk details the speakers' protracted efforts to obtain the technical specifications for proprietary train ticket barcode systems in the United Kingdom and Slovenia using Freedom of Information (FOI) laws. The presentation contrasts the open, EU-mandated UIC standard with the closed, proprietary systems used domestically in both countries.
The UK case study outlines the speakers' battle against the Rail Delivery Group and various nationalized rail operators, who refused to release the specifications, citing a "prevention of crime" exemption. The speakers methodically debunk this claim by explaining the security principles of the RSA cryptography used in the tickets, leading to a series of failed appeals and an eventual court tribunal against the Information Commissioner's Office.
The Slovenian case study follows a similar request to Slovenian Railways for their modified UIC-based standard. This process devolved into absurdity, with the railway making demonstrably false claims about system security (such as offline validators being insecure). The appeal involved a court-appointed "subject matter expert" who proved technically incompetent. The saga culminated in the speakers discovering that the "secret" public key for domestic tickets was identical to the one for international tickets, which the railway had already provided to them. The talk highlights the bureaucratic incompetence and institutional resistance faced when seeking technical transparency from public bodies.
Using Freedom of Information to Uncover Train Ticketing Secrets
00:01:19 The Goal: Understanding Ticket Barcodes: The talk explores using Freedom of Information (FOI) laws to obtain the specifications for proprietary train ticket barcodes, driven by curiosity, security research, and the desire to build open-source tools.
00:01:56 Open vs. Closed Standards: The presentation contrasts two main types of tickets: the open, EU-wide UIC standard (used by Deutsche Bahn) and the proprietary, difficult-to-obtain UK Rail Settlement Plan (RSP) standard.
00:03:05 Hacking the UK System: Reverse engineering revealed that UK tickets use RSA cryptography where the entire ticket is the signature. This means the public key is required to decode any information, but not all keys were publicly known.
00:06:31 The UK Privatization Mess: A detailed history of UK railway privatization explains why FOI laws apply. Although the ticketing body (Rail Delivery Group) is private, many train operators have been re-nationalized, and because they use the ticketing standard, the documents fall within the scope of FOI.
00:16:25 UK Request Denied for "Security" Reasons: The FOI requests were refused by UK rail operators, who claimed that releasing the specifications would enable criminals to create counterfeit tickets, citing a "prevention of crime" exemption.
00:21:03 Flawed Arguments and Technical Illiteracy: The speakers systematically refuted the security claims, noting that RSA cryptography prevents such forgery. In response, one operator's legal team dismissed the foundational RSA paper as an irrelevant "47-year-old academic paper."
00:28:01 Escalation to Court: After the Information Commissioner's Office upheld the refusal, the speakers filed a formal appeal to a court tribunal to compel the release of the documents.
00:30:16 Case Study 2: Slovenia: The focus shifts to Slovenia, where the national railway uses its own proprietary system based on the UIC standard. An FOI request was filed to obtain its specifications.
00:41:46 Slovenia's Absurd Security Claims: Slovenian Railways refused the request with several bizarre arguments, including that it would enable "hacking through a barcode" and, most alarmingly, that their offline ticket validators cannot verify signatures and would accept fraudulent tickets.
00:58:44 An Incompetent "Expert": The Slovenian appeal process involved appointing a subject matter expert (at the speaker's expense of β¬1,000). The expert's final report was deeply flawed, demonstrating a complete lack of technical understanding by, for example, attempting to scan an Aztec barcode with a QR code reader.
01:10:29 The Key Discovery: After years of legal battles, the speakers discovered that the "secret" domestic public key that Slovenian Railways fought to protect was the exact same public key used for international tickets, which the railway had already given them voluntarily.
01:13:36 Key Takeaway: The experiences in both countries show that public bodies and information commissioners often lack the technical expertise to handle complex requests, leading them to accept flawed security arguments and create years of bureaucratic delays to avoid transparency.