Hackers Stole Flock's Camera Software and Exposed How It Tracks Cars and People Nationwide

Hackers physically yanked a Flock Safety license-plate camera off a roadway, copied its storage, and handed the haul to 404 Media, Distributed Denial of Secrets, and WIRED. A collective calling itself stegan0gram did the yanking. The published analysis is what the reporters could open from that dump.

The hackers pulled an encryption key off an unencrypted on-device partition labeled "media" and used it to unlock detection videos and stills. A lot of the camera's most sensitive storage stayed locked or inaccessible.

The on-device software looks for people, not just vehicles, plates, and bicycles. 404 Media and WIRED found no evidence of face recognition beyond unused Android defaults. People detections in the recovered roadway clips were rare because the camera pointed down at traffic, not because people-detection code is missing.

Recovered logs cover about 21 days of activity windows. In those windows the device photographed about 50,200 vehicles and generated about 1.6 million images. A typical day logged about 3,300 vehicles, with a high of 4,454. A typical pass produced about 28 images.

The camera runs an Android-like stack with about 20 Flock-built apps. Plate OCR and make, model, and color appear to run in Flock's cloud, not on the device. Logs also recorded more than 27,000 "no space left on device" errors and a heartbeat message, "Who's a good boy?!", about every two minutes.

In Alpharetta, Georgia, WIRED found city Flock records searchable by more than 2,000 agencies. Prior 404 Media reporting, separate from this dump, tied national-network lookups to ICE and to an out-of-state abortion search.

Flock said unauthorized removal and tampering is illegal, that it lacked enough detail through its vulnerability disclosure policy, and that researchers should file there. Critics of ALPR networks disagree on whether sabotaging cameras helps or hurts the policy fight. Physical theft remains illegal either way.

Some offers on this page may be paid placements or contain affiliate links.