It's As Effective As Attempts To Halt Any Other Crime, Then...

Two young men convicted over the cyber-attack that crippled Transport for London (TfL) in 2024 had long histories of cyber-offending and were both known to law enforcement bodies, the BBC has learnt.

What a shocker. 

Owen Flowers, 18, from Walsall, and Thalha Jubair, 20, from east London, pleaded guilty on Monday to carrying out the attack. The breach disrupted TfL services for months, affected the personal data of millions of people and left all 28,000 TfL employees needing to reset their passwords in person.

It left me unable to top up my Oyster card online for a fortnight, it could only ne done at the machines in Tube stations, and I was unable to check the balance.

The BBC has discovered the authorities made frequent attempts to curb Flowers and Jubair's offending - raising questions over the effectiveness of such interventions with young cyber-criminals.

Locking the little shits up where they had no access to computers should have been the first option. not the last, 

Experts have told the BBC the case also indicates that perpetrators of cyber-attacks often do not appear to understand the real world consequences of their actions.

Or could it be that they just don't care, like all criminals? 

The National Crime Agency (NCA) says it highlights the need for its officers to be given additional powers.

Of course they do.  

... the BBC has learned Flowers initially came to the attention of police shortly after he turned 16 years old. In October 2023 he was caught carrying out low-level cyber-crime and visited by West Midland's Regional Cyber Crime Unit prevent officers. Police say that during the visit Flowers did not engage with officers and was given a cease and desist order to deter him from further offending.

Why the soft touch?  

During the investigation, NCA officers uncovered evidence that computer systems belonging to two US healthcare organisations, SSM Health and Sutter Health, had also been infiltrated and damaged. Flowers later pleaded guilty to offences relating to those hacks. He is still wanted in the US. After being charged, Flowers was released on bail under strict conditions. He breached those conditions twice, in March 2025 and May 2025.

Jubair has 22 previous convictions in total and began offending at 14 years old. He is also wanted in the US in connection with cyber-crimes that allegedly stole and extorted $87m (£66.1m) from victims.

They should just let the Americans have them both, they have no patience with this sort of thing and sentences are far more realistic. 

Both Jubair and Flowers have been diagnosed with autism and the court heard that Jubair has depression and a severe mood disorder.

How convenient. 

TfL Need To Beef Up Their Cyber Security

The news that TfL had suffered a cyber attack barely made headlines. I read it, but didn't think it would affect me, as they said it wasn't going to affect passengers. 

Until, of course, my Oyster card ran low, and I needed to top it up online. And found I couldn't.

Transport chiefs in London are restricting access to a photocard portal for Oyster 60+ and other travel concessions after a cyber attack. The incident, which first became public on Monday evening, has largely not affected people who use the transport system in the capital.

But the transport bosses have now decided to temporarily restrict access to the photocard portal, which allows customers to apply for travel concessions, including the Zip Photocard, 16+ and 18+ Photocard and the 60+ Oyster photocard, as the investigation continues into the cyber targeting.

It also prevents people wanting to top up their balance online from doing so. As I found out. The only way to do it is at a shop. They didn't exactly advertise this, I had to find out from Twitter. 

In an updated statement, Shashi Verma, TfL’s Chief Technology Officer, said: “There remains no impact to our public transport services and no evidence that any customer data has been compromised.

“However, as part of the measures implemented to deal with the ongoing cyber security incident, we have temporarily restricted access to customer journey history for pay as you go contactless customers, as well as limited access to some live travel data via apps, TfL Go and the TfL website, including next train information and the TfL JamCams.

“In addition, we have made the decision to temporarily restrict access to the photocard portal, which allows customers to apply for travel concessions, including the Zip Photocard, 16+ and 18+ Photocard and the 60+ Oyster photocard.

“We apologise for any inconvenience that these temporary changes will cause to some customers and are working to bring these back online as quickly as possible.”

All that money the London Mayor gives TfL and where does it go? Not on cyber security, it seems.  

And on Friday morning  I got an email. Ooh, I thought, they've fixed it! That is, until I opened it:

So much for 'no evidence that any customer data has been compromised' Shashi. Looks like you found some after all. Good job you kept looking, eh?

Goin’ Underground

London’s busiest Tube stations will soon be available to explore virtually using Google Street View. Transport for London (TfL) has said more than 30 stations will be added to the online service, in the hope of allowing passengers to better plan their journeys.

It's about time! 

The images will be collected by a small team organised by Google between 10am to 4pm to avoid peak hours, using a backpack camera. Google's blurring technology will then be applied to the imagery, which is designed to automatically blur identifiable faces before publishing. The images will be launched throughout 2024, allowing passengers to get a better sense of the layout of the stations when planning journeys, as well as identify key facilities such as toilets and help points.

A great use of technology, and not a government grant or incentive in sight. 

You've Got Enough Problems, TfL...

...don't compound them by hiring signwriters from the 'Grauniad'.

"Don't Tell 'em Your Name, Pike!"

Signs of increasing stroppyness with officialdom among the population are increasing, with 'Times' columnist Hilary Rose's account of being stopped by the police while driving in London.

Had she committed an offence? Were they checking for valid tax and registration?

Not quite:

A woman in a reflective jacket stuck her head through the window and thrust a card at me. “Thank you for taking the time to provide Transport for London with this important information,” it read. Eh? Transport for London? What information? Since when do the police pull you over so you can have a chat with TfL?

Since now, it seems. The TfL employee didn't like being challenged on this, either, as petty officialdom seldom does:

When I queried this, the surveyor got stroppy. “The police have the authority to pull you over,” she snapped. True, but that's not the point. When pushed, she admitted that I didn't have to answer their questions (so I didn't), but how many people are going to make a fuss?

Once upon a time, not many. But the comments are cheeringly obstreperous, with suggestions for the best ways of zero cooperation and data sabotage.

TfL state that they will be operating 230 of these roadside surveys across Central and North London; so if stopped, tell 'em where to go. It's the only 'transport advice' these people understand...