A temporary traffic sign on the 405 Freeway in Los Angeles was reportedly hacked earlier this month to display a link to a pro-Iran website. The incident, first noticed near the Santa Monica Boulevard exit, has prompted an ongoing investigation by state transportation officials and highlights rising tensions within Southern California's large Iranian American community.
Real estate broker Payam Shirazi spotted the unusual message, "www.goorkan.info," while driving north from Irvine for a business meeting. Shirazi, recognizing "goorkan" as the Farsi word for "gravedigger," took a photo of the sign. When he visited the website, he found images of Iranians in the U.S. and Canada who had protested against the Iranian government and supported the war the U.S. and Israel launched earlier this year. The site described a campaign to "identify and punish traitors to the homeland," according to screenshots Shirazi reviewed. Shirazi recognized several people pictured on the site.
The California Department of Transportation (Caltrans) spokesperson Colleen Park stated in an email that the sign was initially placed for a pavement rehabilitation project in the Sepulveda Pass. Caltrans was alerted to the "unauthorized message" on September 15, and an agency contractor promptly removed it. Park also confirmed that a "field investigation of the message and access history is ongoing."
The database of photos and names of protesters was later removed from the website. It was recently replaced with language accusing activists supporting the war of being part of an "Israeli intelligence project," though specific evidence was not cited.
Emel Karsaz, an Iranian woman living in the Los Angeles area, previously featured on the website, told the California Post that she was shocked to find her name, photograph, and personal information shared online. She has since filed a report with the FBI. The FBI's Los Angeles office did not respond to a request for comment regarding the report.
Los Angeles is home to the largest Iranian diaspora outside of Iran, and the community here has grown increasingly polarized in recent years. This incident comes amid heightened tensions and competing narratives, where a vocal segment of the Iranian American community has joined forces with Trump-aligned far-right activists to wage campaigns against other Iranians. Canadian researchers last year linked Persian-language online influence campaigns to Israel, which they said stoked pro-war sentiment in the diaspora and amplified Iranian opposition figure Reza Pahlavi. This dynamic has previously led to online smear campaigns and even the detention and deportation of some Iranian families by the Trump administration.
The incident on the 405 also occurs during a period fraught with warnings of potential cyber interference, particularly since the U.S. and Israel attacked Iran in February. An Israel-based cybersecurity firm attributed a March cyberattack that forced Los Angeles’ transit system, Metro, to shut down parts of its network to an Iranian operation. Metro officials have maintained their investigation is ongoing and that the source of the breach remains unconfirmed. Federal authorities have also pointed to Iran-linked hackers as potential culprits in recent breaches of municipal water systems in Minnesota in July and cyberattacks on energy tankers bound for Texas in August.
This type of online activity and its unsettling appearance on a local freeway sign underscore the complex intersection of global political conflicts and their very real, local impact on Southern California residents. The ongoing investigations by Caltrans and the FBI will determine the extent and perpetrators of this unusual digital intrusion.
