Hackers Extract Software from Flock Safety Camera, Exposing Tracking Capabilities
A group of hackers removed a Flock Safety camera, copied its storage and encryption key, and released data showing the device records vehicles, license plates, bicycles and people, prompting scrutiny of the company's surveillance network.
Hackers dismantled a Flock Safety camera mounted over a roadway, duplicated its internal storage and recovered an encryption key that unlocked thousands of vehicle detection videos. The material was shared with 404 Media and the transparency nonprofit Distributed Denial of Secrets, which passed it to WIRED for analysis.
The investigation found that, despite Flock’s claim of on-device encryption, the device stored unencrypted partitions containing the key and media files. Analysis of the recovered logs revealed that the camera’s computer-vision software not only captures license plates but also detects bicycles, motorcycles and pedestrians, generating up to 28 images per passing vehicle and, over a 21-day period, more than 1.6 million images of roughly 50,200 vehicles.
The software also occasionally misidentified non-plate graphics, such as bumper stickers or an American-flag patch on a motorcyclist’s saddlebag, as license plates. No evidence of face-recognition functionality was found beyond standard Android components, which appeared disabled.
Flock’s system uploads captured images to its servers, where license-plate reading and vehicle attribute analysis occur. Records from a camera in Alpharetta, Georgia, were accessible to over 2,000 agencies, including police departments, colleges and a federal inspector-general office. The company’s national network has been used for searches on behalf of immigration authorities and in a case involving a woman who self-administered an abortion.
In response to the breach, a Flock spokesperson said the removal and tampering of its cameras is illegal and emphasized the company’s vulnerability-disclosure policy, noting it had not received a report about the alleged weaknesses. The hackers, operating under the name stegan0gram, said they reverse-engineered the hardware to expose what they described as “secrets of those spying on us.”
Critics of the technology argue that the cameras’ capabilities raise privacy concerns, while some local officials have halted or reconsidered use of the devices after incidents of vandalism and arrests related to tampering.