Hacker Collective Cracks a Flock Camera to Find a Trove of Images and Videos

Flock Safety has long assured communities that its automated license-plate readers securely handle the massive volume of images they collect. A hacker collective has now put that claim to the test – with disturbing results.

As TechRadar’s Alex Blake reports, members of a collective called stegan0gram removed a Flock camera from above a roadway and made a near-complete copy of the data stored inside it. The hackers shared the material with 404 Media and the nonprofit Distributed Denial of Secrets, which passed it to WIRED. Journalists from 404 Media and WIRED then jointly analyzed the files.

What they found should alarm every community that has installed these cameras.

• The camera’s logs showed that it had generated about 1.6 million images of approximately 50,200 vehicles over 21 days. The device held 27,321 short video clips. The hackers also found an encryption key stored on the camera that unlocked a partition containing much of the media.

That finding appears to conflict with Flock’s prior assertion that even someone with physical access to a camera could not obtain its footage because images remain on the device only briefly and are protected by encryption.

The analysis also revealed that Flock cameras detect more than license plates and cars.

• Software on the device explicitly detects people and bicycles. It can sometimes misidentify bumper stickers and other graphics as license plates. The journalists found no evidence that facial recognition was in active use, but the ability to detect and categorize people underscores how much more these devices can capture than their familiar description as “license-plate readers” suggests.

Flock responded that removing and tampering with a camera is illegal. The company said it had not received the hackers’ findings through its “vulnerability-reporting process” and lacked enough information to assess their claims.

PPSA does not condone the theft or destruction of surveillance equipment, but the findings expose a fundamental problem: Once governments deploy cameras that indiscriminately collect information about millions of innocent people, that information becomes vulnerable to official misuse, theft, and security failures.
​
Communities should demand warrants, strict limits on collection and retention, independent security testing, and transparent audits before allowing Flock or any other company to turn their roads into a searchable surveillance network. The alternative is the growing number of communities that are realizing that a database that does not exist cannot be hacked.

Button Text