A security researcher identified a Flock access token that could reveal a device’s location without requiring a login. After the researcher, Michael, published a map and analysis of Flock’s camera network, software developer Matt Bussell said the data showed 214,073 devices—far more than the 120,000 devices Flock has publicly acknowledged. Flock has responded with cease-and-desist demands, alleging that Michael disclosed sensitive, proprietary data and encouraging others to download it.
Analysis points to a larger Flock network
In a research paper published in September 2026, Michael explained how he discovered an access token that could be used to retrieve a device’s location without logging in. He notified Flock about the vulnerability, while also publishing a map intended to track the company’s devices.
Matt Bussell, founder of the software studio Tensorust, analyzed the map and reported that it exposed a network of 214,073 devices, rather than the 120,000 devices Flock has acknowledged publicly. In an analysis, Bussell suggested that the nearly 100,000-device difference likely represents Flock’s private camera network. He warned that this network may be operating without regulatory oversight.
“That’s more than Flock says out loud,” Bussell wrote.
Questions about transparency and oversight
Bussell told Ars that it is “concerning” that St. Lucie County has not investigated who owns the cameras. Michael’s map and analysis highlight gaps in the public understanding of how extensively Flock systems track people’s movements.
Bussell said Flock’s public statements did not appear to address residents’ concerns that their data may have been misused by unknown Flock camera owners.
“Flock’s lack of transparency is a recurring pattern. They seem to prioritize covering their network’s tracks over public accountability,” Bussell said. “My analysis suggests that this is a broader effort to limit visibility across operational capabilities, not just local camera placement.”
Flock demands removal of maps and research
As criticism grew, Flock moved to protect the owners of the personal cameras believed to be located in St. Lucie County rather than increasing public disclosure. After Michael published the map, Flock sent him cease-and-desist letters accusing him of breaking the law by openly encouraging others to download sensitive data.
“Inadvertently exposed credentials do not facilitate access to private systems or data,” Flock said.
Flock demanded that Michael withdraw the maps, data files, and research papers. The company also asked him to identify the person who received the data. Flock claims that Michael knew the information was confidential and proprietary and threatened to pursue statutory and punitive damages, as well as injunctive relief.
Source: arstechnica.com