Chief Technology Officer / Europe
Four decisions that cost something in the short term
- Technology employees
- 310
- Six direct reports; 74 contractors recorded separately
- 2026 technology budget
- €96m
- €58m capital and €38m operating expenditure
- Tolled motorway served
- 1,140 km
- Six concessions in Portugal, Poland and Spain
Decisions & consequences
01Replacing a tunnel control system I had once installed, without closing the tunnels
In 2020 the control system in the four tunnels on our northern Portuguese concession had been in service for twelve years. Its programmable controllers were no longer supported by their manufacturer, spare parts came from salvage, and two of the three engineers who understood its logic had retired. I knew the system well: as a Kvarnfjord project lead I had delivered it. The concession runs to 2039, so replacement was unavoidable. The question was how to carry it out under traffic.
The conventional method was to cut each tunnel over during full night closures, 26 in total, at an estimated €29.7 million. Our chief operating officer, Duarte Calvinho, preferred it: a closed tunnel is easier to test and the cost was lower. The alternative was to install the new system beside the old one, migrate subsystem by subsystem and run both in parallel, at an estimated €34.2 million and seven months longer. I recommended parallel migration. Full closures on that route meant diverting heavy traffic through two towns, losing toll revenue we estimated at €3.8 million and accepting contractual deductions. More importantly, I did not want fire scenarios commissioned in the hours between closures.
Kvarnfjord was one of four bidders. I declared my former employment to the chief executive and the audit and risk committee chair and took no part in scoring; another integrator was selected. We wrote the interface specifications and control narratives ourselves, so that Elvaran owns them.
The migration finished in November 2023, two months late against the revised plan, at €34.2 million. No tunnel was fully closed; we used 58 nights of single-lane running. During parallel running a mapping error started ventilation fans in one tunnel without cause. Nobody was hurt and traffic was unaffected, but the error showed that our tests had checked individual signals rather than complete scenarios.
What changed is that every Elvaran control-system tender now requires owner-held interface documentation and a supplier exit plan. What I would do differently is involve the fire service in writing the test scenarios from the first month of the programme, not the sixth.
Keeping the operational network disconnected after ransomware, while billing waited
On a Saturday in February 2022, ransomware encrypted servers on our corporate network: finance, document management and the back end of the customer account portal. The toll lanes and tunnel systems kept working, because they could run locally. But the files that carried toll transactions from the lanes to billing, and our settlement with electronic-tag issuers, passed through a shared directory service and two jump servers that the attackers had reached.
I disconnected every link between the business network and operational systems within three hours. The harder decision came on the third day. Chief financial officer Tomasz Werenik asked me to restore the transaction link so that account billing and tag settlement could restart; each day of delay added roughly €250,000 to unbilled revenue and strained relationships with issuers. The forensic team had not yet confirmed whether the attackers held credentials that worked on the operational side. I recommended keeping the link down until the jump servers had been rebuilt on a separate identity domain and the forensic review was complete. The chief executive supported that, and the board decided separately not to pay the ransom.
For eleven days, transaction files were moved by a controlled manual process, with checksums verified on both sides. Billing of €2.7 million was delayed by up to six weeks, and €0.31 million was eventually written off because some occasional users could not be charged within the contractual period. Total incident costs were €6.2 million. No operational system was found to have been compromised.
The €14.5 million segmentation programme that followed, completed in 2024, gave operational systems their own identity domain, monitored conduits and an inventory of 11,400 devices. Operational-technology security now reports to me through Agnieszka Rolewska and goes to the audit and risk committee every quarter.
What I would do differently happened before the attack. A separate operational identity domain was on my 2020 roadmap, and I agreed to defer it to fund the tolling renewal. I should have argued harder for it, and I should have rehearsed a manual transaction transfer before we needed one.
Converting a concession to free-flow tolling and declining to make the plates a product
In 2023 the grantor approved converting our interior Portuguese concession from nine barrier plazas to free-flow tolling with 31 gantries, a €41 million programme. Each gantry photographs number plates and reads electronic tags. Within a year the system would hold tens of millions of images showing where identifiable vehicles had travelled and when.
Our commercial director, Rui Mendanha, proposed retaining plate-read histories in pseudonymised form for three years, to build a traffic-analytics service for municipalities and logistics firms and to direct offers to drivers at our service areas. His team estimated €3 million to €5 million a year of income. The proposal was serious and carefully costed. With our data protection officer, Sofia Brandeira, I recommended against it. The images existed because the concession required us to charge tolls; using movement histories for a second, commercial purpose would have needed a legal basis we did not believe we had, and it would have changed how drivers and the grantor saw us.
The rule we adopted, approved by the executive committee, was narrow. Images and plate reads are used to charge and recover tolls and to handle disputes. They are deleted 120 days after a transaction is settled, unless it is disputed or in recovery. Traffic analysis uses aggregated, anonymised counts only. The trade-off was not only the forgone income: shorter retention meant that some late disputes had to be resolved with less evidence.
The gantries went live in June 2025. In the first twelve months unrecovered tolls were 2.4 per cent of transactions by value, against 3.0 per cent in the business case; foreign-registered vehicles accounted for most of the unrecovered amount. Image storage costs were about 40 per cent lower than the original design assumed. One complaint to Portugal's data protection authority was closed without findings.
What changed is that our retention rule is now the default for any new data we collect on the road. What I would do differently is open the retention discussion with the grantor earlier, because the older contract language assumed barrier tolling and took four months to interpret.
Building an asset register before buying a digital twin
Our coastal Portuguese concession returns to the grantor in December 2031. The contract requires pavements, structures and tunnel equipment to be handed back in a defined condition, and any shortfall is remedied at our cost. In 2023 our estimate of the handback works was €118 million, plus or minus €45 million. The uncertainty came from data: inspection reports stored as documents, pavement surveys from three contractors in three formats, and no single list of structures that every team agreed on.
A software supplier proposed a full three-dimensional digital twin of the concession for €17 million. Our investor-relations team liked it for the 2024 investor day, and Matthias Oberlein, who chairs the board's concessions and investment committee, asked why we would not take the more ambitious route. I recommended a smaller programme: one data model and register for every structure, component and inspection, with three-dimensional models only for the three tunnels where geometry matters to ventilation and equipment replacement. The register would cost €5.9 million. I gave up the visual centrepiece, and with it a story the company could have told investors two years earlier.
Between January 2024 and March 2026 the team loaded 2,340 structures and 61,000 inspection records, with a named owner for every field. By March 2026 the register was 96 per cent complete against the definition we had agreed with the engineering department. Inspectors now record defects directly against component identifiers. The handback estimate stands at €104 million, plus or minus €14 million, and it drives the 2027 to 2031 maintenance plan instead of sitting in a risk register.
What changed is that the engineering department, not my function, owns the content; we own the model and the platform. The three tunnel models are used every month by the ventilation and equipment teams.
What I would do differently is start from the handback clauses. We spent the first four months modelling attributes that the contract never tests, while two conditions the grantor will measure were missing from our first data model.