Hackers Got Inside a Flock Camera. Its Data Shows How the System Works

Flock's security claims are undermined by a hacker's ability to extract an encryption key, revealing the camera's detection of people.

Hackers successfully breached a Flock automatic license plate reader (ALPR) camera, gaining access to its stored data and an encryption key. This allowed them to recover thousands of vehicle detection videos and images. The hackers, part of a collective named stegan0gram, shared the data with transparency groups and media outlets, which conducted an analysis. The recovered data revealed that Flock's camera software explicitly detects people, not just vehicles and license plates, and can capture dozens of images per vehicle, generating over a million images in a few weeks. While some sensitive storage remained encrypted, the analysis showed the camera's capabilities and raised further questions about its widespread use and data sharing among over 2,000 agencies nationally. The breach follows previous security researcher findings and highlights ongoing public concerns and activism against surveillance technology.

The unauthorized access to Flock's camera data provides a rare, direct look into the device's operational software and data handling. It confirms that the system, beyond its primary function of license plate recognition, also actively detects and logs individuals, a capability not widely disclosed. This revelation challenges Flock's public statements about the system's focus and privacy safeguards, suggesting a broader surveillance scope than previously understood by the public and potentially regulators.

This incident amplifies concerns about the security and privacy implications of widespread ALPR deployment, particularly Flock's extensive national network. The ability for hackers to bypass on-device encryption and extract sensitive data, even if limited, signals a potential vulnerability that could be exploited by malicious actors. It also underscores the ongoing tension between law enforcement's desire for surveillance tools and public demand for privacy, potentially leading to increased scrutiny, legislative action, or further community opposition to such technologies.