Hackers Cracked Open a Flock Camera and Found It Watching People Too
The Story
A hacked Flock camera shows that the license plate readers on American roads also detect people, and its own logs counted 1.6 million images in just 21 days.
A collective calling itself stegan0gram tore a camera down from a roadway, copied its storage and found an encryption key sitting in an unencrypted partition, which unlocked thousands of vehicle detections.
That key undercuts what Flock told a security researcher in 2025, when it answered a disclosure by saying that even someone holding a camera could not reach the footage.
404 Media and WIRED found the device runs about 20 Flock apps on a midrange phone processor, firing roughly 28 photos at each passing vehicle and sending them over cellular for company servers to read.
The software also marks where people appear and how sure it is, and its plate detector cropped bumper stickers, dealer frames and an American flag patch on a motorcyclist's saddlebag as though each were a plate.
Neither outlet found face recognition in use, and the logs read less like a fortress than a tired appliance, with more than 27,000 no space left on device errors and a heartbeat message asking who is a good boy.
Flock answers that removing a camera is illegal, which leaves the harder question standing: a device that photographs 3,300 vehicles on an ordinary day holds its keys where a determined stranger can take them.
A collective calling itself stegan0gram tore a camera down from a roadway, copied its storage and found an encryption key sitting in an unencrypted partition, which unlocked thousands of vehicle detections.
That key undercuts what Flock told a security researcher in 2025, when it answered a disclosure by saying that even someone holding a camera could not reach the footage.
404 Media and WIRED found the device runs about 20 Flock apps on a midrange phone processor, firing roughly 28 photos at each passing vehicle and sending them over cellular for company servers to read.
The software also marks where people appear and how sure it is, and its plate detector cropped bumper stickers, dealer frames and an American flag patch on a motorcyclist's saddlebag as though each were a plate.
Neither outlet found face recognition in use, and the logs read less like a fortress than a tired appliance, with more than 27,000 no space left on device errors and a heartbeat message asking who is a good boy.
Flock answers that removing a camera is illegal, which leaves the harder question standing: a device that photographs 3,300 vehicles on an ordinary day holds its keys where a determined stranger can take them.
Why It Matters
The hack turns a company promise into a test, and the promise failed on a device anyone can reach with a ladder. Flock sells on device encryption, yet the key sat in a partition the hackers opened first, on a model bolted to roadsides in thousands of towns. Distributed Denial of Secrets published the files, and cofounder Emma Best told Straight Arrow News that such hardware is inescapably open to physical intrusion. The New Republic puts Flock at an 8.4 billion dollar valuation built on selling those records to police. Watch the No FLOCK Act, introduced September 15, which would withhold 10 percent of a state's federal transportation funding after a two year phase in.
Go Deeper
Read the original reporting at WIRED.
Read Full Story at WIRED →