Hackers Got Inside a Flock Camera

Your license plate and vehicle details are accessible to more than just local law enforcement.

Hackers gained unauthorized access to a Flock camera system by copying its storage and recovering an on-device encryption key. This allowed them to access videos and images of thousands of vehicle detections, including data on people, license plates, and even bumper stickers. While the most sensitive storage remained encrypted, the recovered data revealed the camera's computer-vision software explicitly detects individuals, contrary to some public understandings. The hackers, part of a collective named stegan0gram, shared the findings with media outlets and a nonprofit, prompting a joint investigation. This breach follows previous security researcher findings and has fueled existing controversies surrounding the widespread use and data-sharing capabilities of Flock's automatic license plate reader network.

The breach of Flock's camera system, particularly the recovery of an on-device encryption key, exposes the limitations of its advertised on-device encryption and reveals that the cameras actively detect people, not just vehicles. This suggests a broader surveillance capability than publicly acknowledged, impacting privacy perceptions and potentially civil liberties. The detailed logs and image data recovered, exceeding millions of images, highlight the sheer volume of data these devices collect and the granular level of detail they can capture, even misinterpreting bumper stickers as license plates.

This incident intensifies the debate around the necessity and ethics of widespread automatic license plate reader deployment. The hackers' ability to reverse-engineer the hardware and software, coupled with previous disclosures of security flaws, indicates a systemic vulnerability that could be exploited. As more communities grapple with the implications of such surveillance technology, the revealed capabilities and breaches will likely fuel calls for stricter regulation, outright bans, or more robust data security measures from both the public and policymakers.