In January 2025, thieves cut an air brake hose on a BNSF freight train traveling through a remote part of Arizona and removed more than 1,900 pairs of unreleased shoes valued at over $440,000. Tracking devices placed inside some of the boxes helped authorities locate the suspects, according to The Associated Press.

This case formed part of a series of organized freight-train thefts investigated across the deserts of Arizona and California. Other Arizona cases near Hackberry, Kingman, and Seligman involved interrupted trains, follow vehicles, and rapid cargo removal, with goods valued in the hundreds of thousands of dollars.

The incidents showed how detection, field response, jurisdiction, and evidence must operate together across a large and sparsely populated freight corridor. They also demonstrated that a tracker only becomes useful through the communications, validation, jurisdictional handoffs, and field decisions that follow its signal.

Arizona expanded its institutional response in June 2026 when Governor Katie Hobbs signed SB 1452, as reported by Arizona's Family. The law creates a statewide cargo theft task force.

Its scope covers theft, diversion, fraudulent acquisition, and identity manipulation at any point along the supply chain, whether cargo is in transit by road or rail or held in a warehouse or distribution facility. This recognizes that cargo can be compromised at several points before reaching its destination.

The new task force provides a timely case for examining an operational problem with national reach. Tracking systems and automated analysis can identify anomalies earlier. Yet each alert still requires validation, authority, communication, intervention, and a record that other institutions can use.

Cargo security increasingly depends on the complete process from detection through disposition, including the handoffs among private operators and public agencies.

From Alert to Disposition


  • Arizona enacted a statewide task force covering cargo theft, diversion, fraud, deception, and identity manipulation across the supply chain.
  • Cyber-enabled cargo theft can compromise broker and carrier accounts before freight reaches the physical point of loss.
  • Tracking and automated detection create earlier alerts, while validation and coordinated intervention remain operational responsibilities.
  • Dispatch BPO provides an existing model for continuous exception management across drivers, equipment, customers, and records.
  • Effective cargo response requires an evidence trail connecting identity, authority, communications, action, recovery, and disposition.

Cargo Theft Across Digital and Physical Systems


Cargo theft losses rose sharply across the United States and Canada during 2025. Risk & Insurance, reporting CargoNet data, identified 2,646 confirmed cargo theft incidents, an 18 percent increase from 2024.

Estimated losses rose 60 percent to nearly $725 million. The average reported value increased 36 percent to nearly $274,000 as organized groups concentrated on higher-value shipments. CargoNet recorded 3,594 overall supply-chain crime events during the same period, almost unchanged from 2024.

Theft methods also moved deeper into the information systems used to arrange freight. An April 2026 advisory from the FBI's Internet Crime Complaint Center described criminals compromising broker and carrier accounts through spoofed emails, false websites, and remote-access software.

The attackers then used legitimate identities to post loads, alter contact information, manipulate bills of lading, and redirect partially unwitting drivers. The advisory also describes cross-docking and transloading, which can separate stolen goods from the vehicle and documents first associated with the shipment.

These schemes exploit the authority attached to ordinary logistics records. A familiar company name, carrier number, insurance document, dispatch instruction, or email address can appear valid while directing a shipment into a theft operation.

The Federal Motor Carrier Safety Administration advises companies to verify broker and carrier details through independent channels, compare truck and trailer information with the contracted carrier, preserve photographs, and stop transactions when destinations or identities become inconsistent. Those checks require staff who can interrupt an ordinary workflow before a false instruction becomes physical custody.

That guidance places identity verification inside the operating workflow. The FMCSA recommends recording drivers, tractors, trailers, license plates, and carrier information because those details may later support law enforcement.

The value of the record depends on when it was collected, who supplied it, how it was checked, and whether it remained connected to the shipment. Verified information available during release or redirection can shape the response; a list assembled after a loss primarily supports review.

Arizona's freight geography adds practical importance to this problem. The state's transportation system connects markets in Mexico, California, Texas, and the rest of the country.

The Arizona State Freight Plan identifies highways, rail lines, border facilities, airports, and freight clusters as parts of one statewide network; Phoenix Sky Harbor moves more than 1,000 tons of air cargo on a typical day. A theft response may consequently involve companies and agencies located far from the place where the first anomaly appears.

More Business Articles

How SkyMall Rebuilt Its Business Around Distribution
Seatback of a Delta airliner, including SkyMall Magazine
SOC 2 Audits Create Vendor Lock-In for SaaS Startups
artistic representation of a cloud venture tied to its foundation
The Machine in the Office
artistic representation of an ai agent in an institutional office
How Payment Infrastructure Becomes an Acquirable Business
artistic representation of credit card payment rails

The Response Gap After Detection


Cargo moving through that network passes through a sequence of custodians, a carrier, a broker, a warehouse operator, at times a public agency, and each observes the shipment only while it holds custody, retaining a partial view of its identity and state.

Organized theft can exploit the gaps among those views by changing instructions, substituting identities, interrupting communications, or moving goods before discrepancies are reconciled. A response process must connect those partial views quickly enough to affect the shipment's outcome.

Automated detection can reduce the time required to notice a route deviation, unexpected stop, broken seal, temperature change, or altered instruction. During a 2026 cargo-theft discussion on The Security Shift, investigator Scot Walker described edge computing and artificial intelligence as increasingly useful for recognizing diversions in real time.

He identified the next constraint directly: "Getting people to respond to it is going to be a bigger challenge."

Response begins with classification. A route deviation may reflect theft, weather, traffic, an equipment problem, a customer instruction, or a fraudulent message. The responsible operator must compare the alert with the shipment plan, driver status, authorized contacts, cargo sensitivity, and current conditions before selecting an escalation path.

Premature escalation consumes public and private response capacity, while delayed escalation can reduce the chance of recovery.

Cross-border security programs already assign several of these functions to dispatch. The voluntary Customs Trade Partnership Against Terrorism requires participating highway carriers to maintain security procedures, verify trailer integrity, and define how seal changes are reported.

U.S. Customs and Border Protection guidance directs drivers to notify dispatchers about broken seals and requires carriers to document replacements and notify other responsible parties. The resulting record connects a physical change at the trailer with the people who observed, reported, authorized, and documented it.

Different events activate different authorities. A dispatcher may contact a driver, confirm instructions, notify a customer, or stop an internal release; a security provider may review video or send a mobile responder.

Law enforcement decides whether and how to exercise public authority, while the cargo owner and insurer retain separate interests in recovery, loss mitigation, and documentation. The process needs an identified owner at each stage and a defined condition for transferring responsibility.

Dispatch as Continuous Exception Management


Dispatch performs a continuing business process around freight in motion. It receives events, adds operational context, contacts drivers and customers, selects established procedures, coordinates field action, and records how the exception closed.

Business process outsourcing, or BPO, allows a carrier to assign this work to a specialized external team operating under the carrier's procedures and authority. Round-the-clock coverage turns individual alerts into a managed queue of operational decisions, and the structure already operates in Arizona freight.

JR Services, which supports JoyRide Logistics from its Arizona base, describes in its own case study a dispatch function that runs continuously: compliance and e-log monitoring combined with the booking, maintenance coordination, and customer response required to sustain a shipment. The documented service centers on operational communications, vehicle status, scheduling, and exception handling, capabilities adjacent to cargo security rather than a stated part of it.

The example shows how an external team can become embedded in daily carrier operations while the carrier retains control of the business. The dispatch provider accumulates familiarity with a carrier's procedures and equipment, its drivers and customers, and the routes and exceptions that recur across daily operations.

That accumulated context allows the team to interpret events that remain ambiguous inside an isolated tracking or monitoring system. It also creates a continuing record of how similar exceptions were handled.

Cargo security adds more participants and higher consequences to the same operating pattern. A suspicious event may require contact that spans commercial parties, the shipper, broker, and cargo owner, alongside security providers, insurers, and whichever police jurisdiction or federal investigator has authority over the incident.

The dispatch function can preserve continuity while responsibility moves among those organizations. It can also maintain the distinction between a pending alert, a confirmed incident, a recovery effort, and a closed case.

A dispatch-centered BPO service would need controls proportionate to that role. Client procedures must identify who may change a destination, approve a release, contact law enforcement, or disclose sensitive shipment information.

Quality review must test whether operators followed those procedures, and staffing plans must preserve coverage during surges, outages, and shift changes. The provider's value would rest on reliable execution across ordinary operations and rare high-consequence events.

Evidence as an Operational Output


Continuity requires a defined record. The incident history should trace the sequence of the shipment itself: the alert that opened the case, the parties and assets it involved, the checks performed against it, the decisions made and by whom, and the manner of its resolution.

The record becomes useful when each element remains connected to its source, time, responsible party, and governing procedure.

The evidence must preserve changes as the incident develops. A dispatcher may initially classify a deviation as a delay and later receive information indicating diversion. A customer may revoke an instruction, a driver may correct an earlier statement, or an investigator may add recovered evidence.

Amendment history allows later reviewers to see what each participant knew at the time of a decision without replacing earlier entries.

Different users require different portions of the record. A driver needs immediate instructions, a customer needs shipment status, a security provider needs enough context to respond, and law enforcement needs identities and evidence suitable for investigation. Insurers and counsel may later require a broader chronology.

Access controls and defined disclosure procedures permit each party to use what it requires without exposing more of the shipment, its value, the individuals involved, or the state of the investigation than that use justifies.

Structured evidence can improve aggregate analysis. Consistent fields, recording event type and response time in the same form each time, allow operators to compare incidents across customers and corridors rather than evaluate each case in isolation.

Narrative reports preserve context, while normalized records make recurring methods and operational delays easier to identify. Arizona's task force will need both forms of information to describe trends and assess enforcement outcomes.

This evidence process begins during ordinary operations. The baseline against which an anomaly is judged is established well before the anomaly occurs, through identity checks, dispatch acknowledgments, route plans, and seal and contact verification.

A route change carries different significance when the record already establishes the approved destination, responsible dispatcher, expected vehicle, and authenticated customer contact. Preserving those records as part of the workflow reduces the effort required to reconstruct a shipment after a loss and gives responders more reliable information during the incident.

Arizona's Coordination and Evidence Test


Arizona's task force formalizes the public side of this coordination problem. The legislative summary calls for six investigators, a prosecutor, a paralegal, support staff, and participation from federal, state, and local law enforcement.

Members must review intelligence, investigate organized and repeat offenders, handle referred cases, coordinate with industry, and identify emerging theft methods.

The task force must submit its first annual report by July 1, 2027, covering the task force's investigations and prosecutions, the theft trends and cargo recoveries observed, and any restitution, forfeiture, or policy recommendations that follow.

Producing those findings will require consistent information from incidents that originate across private companies and multiple jurisdictions. A carrier may hold the first dispatch alert, while brokers, warehouses, telematics providers, and insurers each retain their own partial record of the shipment, its instructions, the people involved, and the resulting loss.

Investigators must determine whether those records describe the same shipment and sequence of events. A useful case record must withstand scrutiny: stable identifiers, observations attributable to a specific person or system, communications that were authenticated rather than assumed, and a visible history of who was authorized to change an instruction and when that authority was exercised.

Cyber-enabled theft can move a load through compromised accounts, altered documents, an unwitting carrier, and a second vehicle before the legitimate company understands what occurred, making the timing and structure of the record material to recovery.

The institutional design must also preserve access boundaries. A carrier, a customer, an insurer, a security provider, and a law enforcement agency each require a different portion of the same record, and no single party requires all of it.

Arizona now has a public body for combining intelligence and measuring outcomes, while private dispatch teams and security operators remain responsible for continuous coordination, analysis, and intervention. The state's first task-force reports will show how effectively this information can be assembled after incidents occur.

The larger operational test will occur earlier, when a suspicious instruction, route change, or sensor alert first enters the freight system. Cargo security will depend on whether that signal becomes accountable action before the shipment disappears from view.

Sources


Article Credits

Portrait of Michael LeSane
Michael LeSane
Editor