Flock Said Its Cameras Couldn’t Be Cracked. Hackers Found 1.6 Million Images Inside One

Image Credit: Bruxton / Wikimedia Commons / CC0

Flock CEO Garrett Langley stood on a TED stage in April for a talk titled “Can a camera on every corner make us safer?” Flock has since expanded beyond license plate readers into video, drones, gunshot detection and other tools used by police departments around the country.

The hacker group stegan0gram removed a Flock camera from above a roadway, copied most of what was stored on it, and shared the files with 404 Media.

“Why just destroy them when we can reverse engineer them and find the secrets of those spying on us?” one hacker said. “We liberated hardware in the field, disarmed them, and proceeded with reverse engineering of the cameras and associated solar equipment.”

The hackers found an encryption key in an unencrypted section of the camera’s storage. The camera held 27,321 short video clips. Over 21 days, it photographed about 50,000 vehicles and generated roughly 1.6 million images.

What the Flock

In a 2025 security alert, Flock had said even somebody who reached one of its cameras “would still not be able to gain access to footage.”

Flock told 404 Media that “the unauthorized removal and tampering of a Flock camera is illegal.”

True. Someone stealing a surveillance camera for the data is unlikely to be stopped by the rule against stealing it.

Security researcher Jon Gaines found another weakness in Flock hardware. Software used on Falcon, Sparrow and Bravo devices exposed administrative functions without authentication. CISA later scored the flaw 9.8 out of 10.

With Great Power

With great power comes great responsibility.

In fall 2025, Kenosha County administrators reviewed Flock searches and found ones tied to then-Deputy Frank McGrath. The sheriff’s office says McGrath used Flock to track a coworker for a personal reason. He resigned, and another sheriff’s office took over the investigation.

Flock later said some California camera networks had been available to agencies outside the state during 2025. Older records did not show how those agencies had been given access.

Thirteen Days

Florida Highway Patrol was looking for a Dodge Durango after an October 2025 crash killed three people. A Flock search put Lindsey Isaacs’ black Durango on their radar.

Troopers arrested her.

Witnesses had described the crash vehicle as a different color. Isaacs’ attorney later presented speed analysis placing her Durango away from the crash when it happened. Flock has also said its own timing data should have sent FHP looking elsewhere: Isaacs’ SUV passed a camera about three miles from the crash only two minutes before the first 911 call.

Isaacs spent 13 days in jail.

FHP later arrested a different driver, and the charges against Isaacs were dropped.

Leave a Comment

Flipboard