I guess they can't claim any copy write / drm violations if they also deny it was their code.

Riiight?! This is a really strong defense for the white hats. Either it’s your code and you are egregious slime balls doing illegal things, or “some third party interfered and hacked your trains like you said and we fixed it you’re welcome”.

I hope evidence will be provided in court.

I'm not sure that's the smoking gun.

IIRC, there was some "konami" code to re-enable the train after disablement that was removed in a first-party update after the third-party repair company found the sequence.

And not related to the third-party locations, one of the trains had some code where if the year>2021 & month>11 & day>? then the train would disable itself; ultimately doing it in the wrong year because the train was off during november / december of that year. This is a little excessive for somebody random to do.

The 2021-11-?? date was the day the train was scheduled to be serviced (so the intention of the code was to brick the code after the service). Only by random chance it didn't work, because the train was in maintenance a bit longer, and the code didn't trigger in January 2022 because of the date checking bug.

That is completely nuts and irresponsible beyond belief.

> The ridiculousness of this defence makes it clear leadership was in the know.

https://kolejowyportal.pl/koleje-dolnoslaskie-odpowiadaja-ne... - this is from 2022-07-06. The train owner complains that they still didn't receive information from Newagg about what was fixed when unit had to be shipped to manufacturer after it refused to start.

So the issues with 3rd party servicing were publicly known well before the smoking gun was found in firmware.

Once this is proven false, they will blame the devs, just like VW did.

The dev. at VW was at least smart enough to keep the paper trail around. Lets hope the people working for this company did the same.

There's also a bunch of service people involved etc. (some "non-working" trains were sent back to NEWAG, and the people doing the maintenance had to know how to unlock them, etc.)

I wonder how they explain the "rogue dev" somehow clandestinely communicating the reset procedure to the manufacturer's shop.

It's the "you can't prove we did it" defense.

This gets penetrated by getting lower level employees to rat out their superiors.