Hackers Breached a Flock Camera, Exposing How the Surveillance System Works
A hacker group removed a Flock automatic license plate reader camera from a roadway and extracted its internal data, revealing the device also detects people, not just vehicles. The files were shared with 404 Media and WIRED for analysis.
A hacker collective calling itself stegan0gram removed a Flock Safety automatic license plate reader camera from above a roadway and created a near-complete copy of its stored data. The material was shared with 404 Media and WIRED, as well as the transparency nonprofit Distributed Denial of Secrets.
The hackers recovered an encryption key stored on the device, unlocking videos of thousands of vehicle detections, though much of the camera's most sensitive storage remained encrypted and inaccessible.
What the analysis found
The joint analysis showed that beyond vehicles, license plates, and bicycles, the camera's software explicitly detects people, recording their position in the image and a confidence score for the detection. A single passing vehicle can generate dozens of images. Recovered logs spanning roughly 21 days showed the device photographed about 50,200 vehicles and produced roughly 1.6 million images.
When WIRED tested the extracted detection models, they reliably identified people. Out of 27,321 short video clips recovered from the device, the models detected people in 11 clips, all showing motorcyclists. The software also sometimes misidentified bumper stickers or other graphics as license plates, in one case cropping an American flag patch on a motorcyclist's saddlebag as if it were a plate.
Flock maintains its cameras do not perform facial recognition, and no evidence was found of such capability being actively used.
Context and reaction
Across the US, several people have previously been arrested for tampering with Flock cameras, and some towns have already announced plans to stop using them. The company's network, which in some cases grants access to more than 2,000 agencies, has previously drawn controversy over data use in immigration-related searches.
A Flock spokesperson said unauthorized removal and tampering with a camera is illegal, and urged the hackers to report any vulnerabilities through the company's official disclosure process.
