It'd be interesting to know how much of that they put second to "Americans seem to like using our hardware as targets for firearms, reciprocating saws, spray paint, and garbage bags" in their list of corporate concerns.

Antisec was right.

The flip side of this laziness is that now, when my elected representatives tell me "these are just license-plate readers that don't record video", I have evidence to show them that's false.

If Flock had done a more competent job of securing their system, it would be harder to demonstrate this in a compelling way. To a technically-inclined person, it's obvious from the get-go that somewhere in Flock's pipeline, video is being recorded and archived, and is therefore vulnerable to misuse. But the more they're allowed to keep the implementation proprietary, the easier this is to sweep under the rug.

I really hate how Product Managers somehow get to take the reins of engineering teams instead of having to sell them product ideas.

It's madness, they often lack the technical skills and "optimise away" requirements surfaced by eng teams they don't comprehend or just don't like having to deal with.

The question is, why should they care at all? Will this hurt their business?

I always assumed Flock's security posture was like most other companies. It's nice to see confirmation.

I think I should add a "X'); DROP TABLE Cameras;--" bumper sticker to my car now.

Couldn't resist: https://github.com/EvanAnderson/whimsy/blob/main/Drop_Table_...

has been for a long time - there's a sound engineer who developed quite a following (and is fairly involved with local movement hackerspaces) who demo'd how easy it was to hack Flock cameras nearly a year ago: https://www.youtube.com/watch?v=uB0gr7Fh6lY

the Flock response has been 'it doesn't count if a Youtuber did it' lol: https://www.youtube.com/watch?v=0ADb-qQ5hMY

The devices are entirely open for all practical purposes - but worrying about individual cameras is silly, because they have no meaningful security at all around the API's to access all the cloud data - you can buy law enforcement credentials dirt cheap in dark web marketplaces to log in and track anyone/anywhere you want and access all footage.

My working assumption based on what I hear out of Flock is that they have a public feature set (mass license plate surveillance for LEO) and a covert feature set (even more mass surveillance, beyond license plates and privacy agreements, for intelligence communities).

Yep. Clown show.

> The hackers said they were able to access the Android system on the camera, and found two partitions—sections of its hard-drive, essentially. A few of these were unencrypted, the hackers said, including one called “vendor” and another called “media.” The latter contained an encryption key that unlocked another part, which contained much of the media—think, the videos and stills—the camera took.

> In early 2025, security researcher Jon “GainSec” Gaines reverse engineered a Flock license-plate reader and documented flaws that could be used to gain root-level access. After Gaines disclosed his findings, the company acknowledged the findings but downplayed their severity, writing that the flaws required physical access to the device and that even someone who gained access to a camera “would still not be able to gain access to footage” because images remained on the device only briefly after being transmitted to the cloud.

Source: https://www.404media.co/hackers-stole-flocks-camera-software...

It is bad.

But think the real danger in Flock is the aggregate data, tracking between camaras. So if someone hacks a single camara, they probably don't get much, unless it is pointed right at someone, which is bad. Aren't they selling these as should be pointing at traffic? If they are pointing right at people, like at playgrounds, then they are being installed illegally to begin with ?

Is this an older model? I could see them turning off or using weak encryption on media if the hardware couldn't keep up with the amount of data they were writing.

> all that data is literally there for any unauthorized person to walk up and take it.

All that data about ... license plates if you're willing to steal/damage private property. Seems like it would be a lot easier to setup your own ALPR.

I poked around in the boot partition. The kernel is ancient!

Linux version 3.18.71-perf-gaf770dc

Thanks. Few saw that post: https://news.social-protocols.org/stats?id=49726577

do the articles have significantly different information/coverage to warrant two submissions?

The images were deleted the moment they were uploaded. But the record in the log files persisted. The camera doesn't have enough memory to store that many data.

That same NH law perhaps more importantly limits ALPR use to law enforcement officers.

Flock has over 80% of the US market.

You've seen this level of attention on a market leader before: on Microsoft, on Adobe, and others.

This is one of the most interesting comments on here.

Hints at unauthorized, illegal mass surveillance riding on top of authorized (but also possibly illegal) mass surveillance

Can you provide more details? Do you mean 100 public cameras anyone can access?

Assuming the point of these cameras is security (and not just surveillance for stalker cops), being able to upload replacement footage would subvert that entirely. This has been a feature of many spy and cops/robber movies.

I’m sure the first approach has been ingesting vehicle registration data into Flock servers so that your ID photo pops up when your license is captured.

It seems the inevitable next step would be post-processed facial recognition (checked against those ready-for-the-taking ID photos) in their OS Investigator platform.

Commented something similar at the same time. I hate weasel wording like this. There is nothing that prevents this data from being used that way now or in the future.

edit: And to be clear, the cameras specifically recognize and record people for a reason. This does not appear to be a fault in the system. One reason might be off-camera facial recognition.

Yeah, you could potentially MITM them with a rogue cell tower, I suppose. I'm curious about the researchers still having the device. They could also see all the cloud endpoints that were being accessed. Are they secure?

"Axon is Flock but worse" will be the next big fight as police departments are pulling a fast one and saying "we got rid of Flock" by switching to Axon.

While Axon's system should be under the microscope too I don't think they have the nation wide cloud that Flock is doing and requires specific agreements to share data. Maybe that is getting abused to form a national database but I imagine it was designed so say a county sheriff department and local city PDs could share resources. I don't think most people are that concerned about things like that (though they should be), it is the nation wide surveillance that creeps people out. That and the stalking of course and both systems can be used for that.

Reminds me why a friend picked RCN over Comcast for his Internet. “They’re the more incompetent evil company.”

While highly unprofessional, the "Who's a good boy?!" status message makes me like them a tiny bit more

Also, a reminder that ALPR abuse predates Flock. Flock has just made it more visible. About a decade ago I personally heard a cop let it slip that he had plate-stalked someone for the crime of saying mean things about his department on Twitter. The difference today is that more departments have access to these kinds of tools.

Fixed ALPRs aren't the only privacy problem, either. Many tow trucks have roving ALPRs that feed into big databases. The notion is that it helps them repossess cars that might be garaged at home. That data, however, is for sale to third parties.

Teenagers are more easily manipulated into creating anti-social technology.

I remember walking over a hill into a rave in the Utah desert that we'd set up and thinking that it actually was the cyberpunk dystopia that I had been hoping for.

That kind of stuff is around but maybe not evenly distributed or legible to large demographics.

Unfortunately, so is the rest of the vicious horrorshow, equally illegible and equally uneven in distribution.

Because we got the gray box IBM version instead...

it seems like all the tech-fascists just read snowcrash and settled on that.

Late stage capitalism?

Correct. YC gotta wear their creations with pride.

Someone should sell branded black trashbags with a spraypainted penis on them.

We'll call it Cock Safety and help our community with patented JimmyHat technology to keep you safe and covered.

Don't have the pitch deck directly, but do have some of the "what things looked like then" at https://www.ycdb.co/company/flock-safety

The front page then had "All the footage is yours. Your neighborhood 100% owns the data. Flock Safety will not share, sell, or access your data."

Unfortunately, flock has been excluded from wayback, so can't see other views of that page.

{insert Darth Vader: I'm altering the deal. Pray I don't alter it any further.}

(+45m edit) https://bestpitchdeck.com/flock-safety appears to be the pitch deck from 2020.

> ...

> In 2019, Flock signed their first police department deal with Jersey Village, Texas.

> The slides you see here are from Langley's pitch at a venture conference one month before closing a $47M Series C round in November 2020. The following July, Andreessen Horowitz led a $150M Series D investment in Flock as a cornerstone of their American Dynamism practice. Additional slides are included from keynote and sales presentations used in 2023.

> ...

>Flock is a scourge on democracy.

Yes. Blame the pickaxe seller. Do not question the miners. Do not question the investors in the mining companies. Do not question the casual voter or internet commenter who thought all this was fine.

This isn't to say that flock not a scourge, but I think a lot of people (not saying you're one of them) could stand to look in the mirror here.

Back in ye olde dark ages of <checks notes> 2017, when YC was cutting Flock a check and when "big data" was the hot buzzword people of a certain bent couldn't get enough of this kind of stuff. Everyone was jacking off nonstop to the idea that we could just hoover up everyone's data ad then "efficiently" or "proactively" dispatch enforcement resources. People talked all sorts of big talk about stuff like cross referencing people's Home Depot spend with permit requirements, identifying small businesses that don't have healthy enough financials to be fully compliant, cross referencing invoices and delivery receipts to identify overloaded trucks, and generally finding all sorts of ways to fine the crap out of people for the pettiest of petty deviance. They considered this a noble goal.

Everyone's head was too far up their asses to look at the magic crystal ball called "history" and realize that a camera on every street corner watching who's going where all the damn time would be where it goes.

It’s not like this stuff wasn’t known to be a problem 10 years ago. We were already in Trump’s first term, it’s not like it was part of the early post 9/11 “secure everything” push. It was WAY after that.

10 years ago is no excuse.

The system they log into is called DAVID(Driver and Automobile Information Database) which logs activity. If an officer access that information for unlawful purposes, they can be prosecuted. You probably wont believe it, but the reason you hear about cops stalking their ex's is because they got caught doing so.

That's also the biggest plot-hole in the first Star Wars movie. Princess Leia is supposed to be this righteous noble of the moral resistance and yet she STEALS the Death Star plans!

I don't get the impression that anyone writing about this thinks it's legal. I think the argument would be that it's justified.

“I kept trying to explain in between haymakers that we were better than this and on top of that it wasn’t likely to be ruled on favorably as far as the courts.” - Luke O’Neil https://flaminghydra.com/the-end-and-after-2/

But we own the cameras

liberation is often used to refer to something that, while technically legal, the people that are subject to it did not agree to

> You should be able to own that if you're going to do something like this.

Um, are you saying the hackers should admit they broke the law? Or that Flock should righteously own the data they collect?

Either way, I d/c. Flock cameras are probably insecure, and their data is potentially dangerous.

Bad laws exist, and following them may be prudent at times, but the act of following them isn't a moral imperative.

Anything becomes permissible when you believe yourself to be “on the right side of history.”

And my privacy? The threat to democracy? Does Flock own that? Why is always the poors that need to own morality?