Flock Cameras: A Breach of Trust, Not Just Data

Quick Verdict: A Troubling Surveillance Ecosystem

Flock's surveillance camera system, while widely deployed across the U.S. with over 335,000 devices, is currently mired in a severe cybersecurity controversy. A recent unauthenticated flaw allowed a security researcher to map the precise locations of hundreds of thousands of cameras nationwide. Coupled with a history of insecure practices and questionable responses to vulnerabilities, Flock Safety presents a deeply concerning picture regarding data privacy, system integrity, and corporate accountability. Our analysis points to significant risks for both the public and institutions relying on these devices.

Introduction: The Promise vs. The Reality

Flock Safety markets itself as a solution for communities and law enforcement, providing automated license plate readers (ALPRs) and other surveillance tools. The sheer scale of its deployment, with over 335,701 cameras identified across the nation, suggests a compelling value proposition for its clients. However, the recent revelations brought forth by a dedicated security researcher, Joshua Michael, paint a starkly different reality. Instead of robust security and transparent operations, Flock's infrastructure appears to harbor significant vulnerabilities, and the company's reaction to their exposure raises serious ethical and operational questions. This isn't just about a single flaw; it's about a pattern that undermines public trust and potentially compromises sensitive information.

The Unauthenticated Flaw & Data Exposure: A Self-Inflicted Wound

In November 2025, security researcher Joshua Michael uncovered a critical unauthenticated flaw within Flock’s website. This vulnerability granted him an access token without requiring any login credentials, essentially a key to sensitive data without a lock. Michael leveraged this token to query ArcGIS, a third-party mapping and geospatial service that Flock utilizes. Through this query, he was able to extract a comprehensive database detailing the precise locations of 335,701 Flock devices scattered across the United States. This vast trove of data allowed him to construct and publish the “Flock Surveillance Map” website, making publicly visible the extent of Flock’s network – information that was clearly not intended for public consumption.

Critically, Michael acted responsibly, informing Flock of the security flaw on November 13, 2025. He explicitly stated that his testing was non-intrusive, limited to open, unauthenticated endpoints, and involved no unauthorized data modification or billing operations. Despite his proactive disclosure, Flock's initial response was a dismissive silence, followed by a generic acknowledgment after multiple attempts, promising “next steps soon” that never materialized. It wasn’t until January of this year, after Michael publicly published his findings and the surveillance map, that Flock finally addressed and patched the vulnerability. This delayed, non-responsive approach to responsible disclosure is deeply troubling and indicates a significant lapse in their security protocols and communication strategy. To further compound the issue, Flock has since claimed that its cloud platform has “never been hacked” and that Flock information has “never been leaked.” Michael strongly refutes these statements, asserting that exfiltrating a database of device locations directly contradicts the company’s denial. His assessment is stark: either Flock deliberately chose not to disclose the breach for fear of negative publicity (a transparency failure), or they were entirely unaware of the data exfiltration (a detection failure with potential national security implications). Both scenarios are profoundly concerning for a company dealing with sensitive surveillance infrastructure.

A Pattern of Security & Privacy Lapses: More Than an Isolated Incident

Unfortunately, the unauthenticated access flaw is not an isolated incident but rather part of a disturbing pattern of security and privacy oversights by Flock Safety. Previous investigations have revealed that Flock cameras stored encryption keys directly on the devices themselves. This fundamental security misstep allowed hackers to bypass protections and extract a staggering amount of data: over 27,000 video clips and 1.6 million images captured within a mere 21-day period from a single device. Such a flaw exposes not just metadata but potentially highly sensitive visual information.

Beyond technical vulnerabilities, there have been multiple documented instances of the Flock system’s misuse. Reports indicate that police officers have leveraged the system to stalk romantic partners, with at least 18 such cases unearthed across the U.S. in recent years. In another alarming incident, a car reviewer was mistakenly tracked due to a simple error in a police report, leading to him being “ambushed” and detained for an hour in a parking lot. These cases highlight not only the flaws in the system’s design but also the lack of adequate safeguards and oversight to prevent abuse by those with access.

Furthermore, Michael's research into the camera locations points to critical national security implications. He noted that the ubiquity of Flock cameras, combined with the exposed location data, could be exploited to track key personnel. Individuals working in defense or intelligence, including soldiers and civilians, could be observed traveling to and from 22 sensitive sites, such as Eglin AFB, CIA Headquarters, FBI Headquarters, Joint Base Andrews, and the Pentagon. The probability of someone living within a 20-mile radius of these critical locations passing a Flock camera and being recorded is alarmingly high, ranging from 57.22% to 93.94%. This level of exposure, now publicly mapped, poses a significant threat that Flock has yet to adequately address.

Flock's Response: Legal Tactics Over Transparency

Rather than engaging constructively with the security vulnerability or addressing the underlying concerns about privacy and data security, Flock Safety has chosen a different path. Following Michael’s public disclosure and the launch of his “Flock Surveillance Map,” the company, through cybersecurity firm Doppel, issued a trademark infringement complaint. Flock alleges that Michael’s use of the trademark “FLOCK SAFETY” without authorization may confuse its customers and has demanded the website be taken down. This legal maneuver appears to be an attempt to suppress information rather than resolve the core security issues. It’s particularly disingenuous given that Michael’s website includes a prominent pop-up upon access, clearly stating that it is not affiliated with Flock Safety. This response prioritizes reputation management through legal threats over transparent communication and genuine efforts to enhance security for their customers and the public.

User Experience (Stakeholder Perspective)

From the perspective of various stakeholders, the 'user experience' with Flock's cameras is fraught with issues.

• For the general public: The experience is one of pervasive, unconsented surveillance with unclear oversight. The public map of camera locations, though created by a researcher, concretizes the feeling of being constantly monitored. The potential for misuse, from mistaken identity leading to detention to targeted stalking by authorities, erodes trust in both the technology and the institutions employing it. The lack of transparency from Flock exacerbates concerns about personal privacy and civil liberties.

• For law enforcement and other institutional clients: While the promise of enhanced crime deterrence and investigation is appealing, the reality presents significant liabilities. Relying on a system with known, critical vulnerabilities, where encryption keys are carelessly stored and massive amounts of data can be exfiltrated, puts their own operations at risk. The public backlash and loss of trust stemming from these security failures and documented misuses can severely damage community relations and the perceived legitimacy of surveillance efforts. Furthermore, the potential national security implications highlighted by Michael’s research could expose sensitive locations and personnel, turning a security tool into a potential national liability.

• For security researchers: The experience with Flock showcases the challenges of responsible disclosure. Michael’s repeated attempts to notify the company, followed by their delayed and then legally aggressive response, deter ethical hacking and vulnerability research, ultimately making systems less secure rather than more so.

Pros and Cons

Given the context, it's challenging to list 'pros' in the traditional sense for the end-user or the public, as the source content is entirely focused on the negative implications and security flaws. However, for a complete review, we can infer the intended benefits that lead organizations to adopt Flock, juxtaposed against the critical drawbacks.

Pros (Intended/Perceived by purchasers, not directly from source):

• Widespread Surveillance Coverage: The sheer number of deployed cameras (over 335,000) provides extensive coverage, which for purchasers (e.g., law enforcement, HOAs) can be perceived as a benefit for monitoring and crime deterrence.

Cons:

• Critical Unauthenticated Access Flaw: Allowed unauthorized access to system tokens and location data for hundreds of thousands of cameras.
• Massive Data Exposure: 335,701 camera locations nationwide were exfiltrated and mapped publicly.
• Poor Responsible Disclosure Handling: Flock exhibited significant delays and unresponsiveness to the researcher's initial reports, patching the vulnerability only after public disclosure.
• Insecure Device Design: Previous findings revealed encryption keys stored directly on devices, leading to the extraction of millions of images and thousands of video clips.
• Documented Instances of Misuse: Police officers used the system for stalking, and a car reviewer was wrongfully detained due to system errors and human oversight.
• National Security Implications: The ubiquity and exposed locations of cameras create a potential risk for tracking personnel near sensitive government and military sites.
• Lack of Corporate Transparency: Flock's denial of a 'hack' or 'data breach' contradicts the reality of data exfiltration.
• Legal Action Against Researchers: The company pursued trademark infringement claims against a security researcher for exposing flaws, rather than collaborating to improve security.

Comparison to Alternatives

The provided source content does not mention any specific alternative surveillance camera systems or providers. Therefore, a direct comparison table or discussion of specific alternatives is not possible based on the available information.

Buying Recommendation: Exercise Extreme Caution

Based on the detailed analysis of Flock Safety’s practices and the severe vulnerabilities uncovered, we cannot recommend the widespread adoption or continued uncritical use of Flock camera systems. The consistent pattern of security lapses, from storing encryption keys on devices to an unauthenticated flaw exposing camera locations across the country, demonstrates a worrying lack of fundamental cybersecurity diligence. Coupled with documented instances of system misuse and a corporate response that prioritizes legal threats over transparency and collaboration with security researchers, Flock Safety has eroded trust.

For communities, law enforcement agencies, and private entities considering Flock Safety, we strongly advise extreme caution. The risks to privacy, potential for abuse, and the demonstrated vulnerability of the system’s data integrity are significant. These factors raise serious questions about the long-term reliability and ethical implications of deploying such a system. Until Flock Safety demonstrates a profound and verifiable commitment to cybersecurity best practices, transparent communication, and robust safeguards against misuse, stakeholders should explore alternative solutions that prioritize security, privacy, and accountability.

FAQ

Q: What was the main security flaw discovered in Flock's system?

A: A security researcher found an unauthenticated flaw on Flock's website that allowed access to a token without login credentials. This token was then used to query a third-party mapping service, revealing the precise locations of over 335,000 Flock cameras nationwide.

Q: How did Flock respond to the discovery of this vulnerability?

A: Flock initially delayed responding to the researcher, only patching the vulnerability after it was publicly disclosed. Subsequently, the company issued a trademark infringement complaint against the researcher for publishing the map of camera locations, rather than addressing the core security issues or acknowledging the data exfiltration.

Q: Are there other known security or privacy issues with Flock cameras?

A: Yes, prior incidents include encryption keys being stored directly on devices, leading to the extraction of millions of images and video clips. There have also been multiple documented cases of police officers misusing the system to stalk individuals or for wrongful detentions based on incorrect reports.