Hackers rip open a Flock camera; 50,200 vehicles in 21 days

A hacker collective called stegan0gram pulled a Flock Safety camera off a roadway, took it apart, and copied its software. Over 21 days of recovered logs, that one device had photographed about 50,200 vehicles and generated roughly 1.6 million images.

The group handed the files to 404 Media and WIRED. "Why just destroy them when we can reverse engineer them and find the secrets of those spying on us?" stegan0gram told the reporters. Inside the Android system they found unencrypted partitions, one of which held an encryption key that unlocked additional storage of video and stills.

The device runs about 20 Flock-built apps. One of the more consequential findings sits in the object-classification code: the software "explicitly detects people as well as vehicles, license plates, and bicycles," a capability 404 Media notes is typically overlooked in discussions around Flock cameras. In Alpharetta, Georgia, WIRED found that records from the city's cameras were accessible to more than 2,000 agencies, "including police departments, colleges, airports, and even inexplicably the Office of Inspector General for the federal General Services Administration."

The plate detector was also promiscuous about what counted as a plate. It cropped bumper stickers and dealership frames, and in one motorcycle video it cropped "an American flag patch on the rider's saddlebag as if it were a plate."

Flock's reply was terse. "The unauthorized removal and tampering of a Flock camera is illegal," the company said, pointing researchers to its public vulnerability disclosure policy for the sanctioned route.

Noel Pichardo, a former Pawtucket, Rhode Island police officer, offered a warning from inside law enforcement: "I think that type of vigilantism will only crystallize the police and the state at large in their belief that this tool is necessary." It lands during a heavy stretch of surveillance reporting from the same outlet, which earlier this month broke OpenAI's 'Project Lily' contractor operation.