From Ars Technica · · 3m
Inside the Flock camera hack that exposed mass surveillance
Hackers dismantled a license plate reader and revealed how Flock's cameras track vehicles and people across America.
In brief
Hackers dismantled a license plate reader and revealed how Flock's cameras track vehicles and people across America. Flock cameras detect and record people as well as vehicles, and their data is shared with thousands of agencies nationwide, raising serious privacy concerns. Originally reported by Ars Technica.
Hackers dismantle Flock camera
A group called stegan0gram removed a Flock camera from a roadway, copied its data, and recovered an encryption key that unlocked thousands of vehicle detection videos.
The breach reveals hidden capabilities
Analysis shows Flock's software explicitly detects people, vehicles, license plates, and bicycles. The camera generated over a million images in recovered logs.
Cameras capture extreme detail
A single passing vehicle generates about 28 images, sometimes over 100. The system even isolated bumper stickers and an American flag patch on a motorcyclist's saddlebag.
National network shares data widely
Flock allows police departments across the country to search cameras in other jurisdictions. In one Georgia city, over 2,000 agencies could access the camera data.
Data used for controversial searches
Police have used Flock's national network to search for immigration enforcement on behalf of ICE and to track a woman who self-administered an abortion.
How the hack actually worked
The hackers accessed the Android system and found unencrypted partitions including one called media. That partition contained an encryption key unlocking the video storage.
Prior security flaws were downplayed
In early 2025, researcher Jon Gaines found flaws allowing root-level access. Flock acknowledged them but claimed physical access was required and footage couldn't be accessed.
The camera's processing pipeline
The device runs 20 Flock-built apps that detect motion, take photos, classify objects, and upload data. It doesn't read plates itself; that happens on Flock's servers.
Staggering volume of surveillance
In 21 days of recovered logs, the camera photographed roughly 50,200 vehicles and generated about 1.6 million images, averaging 3,300 vehicles per day.
People detection was active
The software explicitly detects people and records their location and confidence level. Tests found it detected people in 11 video clips, all of motorcyclists.
Misidentification creates false data
The license plate detector mistook bumper stickers, dealership frames, and graphics for plates. It cropped an American flag patch as if it were a license plate.
No face recognition found
Flock insists its cameras don't perform face recognition. Investigators found no evidence of active face recognition beyond Android's default capabilities.
Police software enables pattern tracking
Flock's OS Investigate software uses camera records plus police files and commercial data to identify drivers, find vehicles traveling together, and track movement patterns.
Flock downplays the vulnerability
The company called the camera removal illegal and said it received no vulnerability report. It encouraged researchers to use its official disclosure process.
“The unauthorized removal and tampering of a Flock camera is illegal.”
Sabotage sparks national debate
Multiple people have been arrested for tampering with Flock cameras. Some towns stopped using them, while one police department created a fake 3D-printed camera to catch vandals.
Critics worry sabotage backfires
Former Rhode Island police officer Noel Pichardo warns that camera destruction could strengthen police arguments that the technology is necessary for public safety.
“I think that type of vigilantism will only crystallize the police and the state at large in their belief that this tool is necessary.”
The main idea
Flock cameras detect and record people as well as vehicles, and their data is shared with thousands of agencies nationwide, raising serious privacy concerns.
