Flock Safety Camera Hack Reveals How the System Tracks Vehicles, People and Bicycles

Flock camera hacked A hacker created a near-perfect copy of the data stored on a Flock Safety camera and shared the files, revealing new details about how the company’s surveillance system tracks vehicles and people. 404 Media and WIRED analyzed the material in a joint investigation.

Hackers recovered encrypted Flock camera data

The breach provided an unprecedented look inside systems that Flock says are protected by on-device encryption. The hackers copied the camera’s storage and recovered encryption keys stored on the device, allowing them to unlock videos of thousands of vehicle detections.

The hacker shared the material with 404 Media, while the transparency nonprofit Distributed Denial of Secrets shared the data with WIRED. The two outlets then examined the recovered files.

Although much of the automated license plate reader’s most sensitive storage remained encrypted and inaccessible, the analysis showed that the software running on the device was designed to detect people as well as vehicles, license plates and bicycles. The camera could generate dozens of images of a single passing vehicle. The software also isolated bumper stickers and other graphics, including an American flag patch attached to a motorcycle’s saddlebag.

Flock’s computer vision system analyzes more than license plates

The recovered logs showed that Flock’s computer vision software tracks a range of visual details beyond license plate numbers. The system can identify vehicle characteristics such as color, make and model while also capturing images of passing vehicles and other objects.

Flock cameras send photographs and other data to the company’s servers, where the information becomes part of a searchable, time-stamped record. Local agencies that own or access the cameras can search those records, and in many cases other police departments can search them through Flock’s national network.

In Alpharetta, Georgia, a WIRED investigation found that the city’s Flock camera records were accessible to more than 2,000 agencies. Those users included police departments, universities, an airport and the federal General Services Administration’s Office of Inspector General.

Flock’s nationwide camera network faces growing scrutiny

The national network is a major selling point for Flock, but it has also become a source of controversy. 404 Media reported that local police officers conducted investigations across the nationwide network on behalf of Immigration and Customs Enforcement, including in areas that prohibit cooperation with ICE.

The publication also reported that license plate data was transferred across state lines. 404 Media also reported that police in Texas searched Flock cameras across the country for women who had obtained abortions themselves.

Those reports have fueled a national debate over whether communities want Flock cameras and automatic license plate readers operating in their neighborhoods.

Why the hackers reverse-engineered the camera

The camera theft and software dump suggest that some people are no longer satisfied with simply destroying or removing Flock cameras. Multiple people have been arrested across the country on suspicion of tampering with or interfering with the devices. In response, several towns announced that they would stop using Flock cameras, and in one case, the local police departments stopped using them as well.

One person even made a 3D-printed fake Flock camera case to lure potential vandals.

“Why just destroy it when you can reverse engineer it and find out the secrets of those who are spying on us?” one hacker from the group, who calls himself Steganogram, said in an interview. “We liberated and disarmed the on-site hardware and proceeded to reverse engineer the cameras and associated solar power equipment.”

The hackers said they accessed the Android system on the camera and found two partitions, or sections of the storage. Some were unencrypted, including partitions called “vendor” and “media.” The media partition contained an encryption key that unlocked another section holding much of the footage captured by the camera, including videos and still images.

For Steganogram, the answer to whether communities want Flock cameras is clear: no.