Summary
- Researchers who recovered a Flock camera physically reverse-engineered its software and storage.
- The device detects people, vehicles, licence plates, bicycles, and incidental graphics such as bumper stickers and patches.
- Over several weeks of recovered logs, the camera generated more than one million images of passing vehicles.
- A critical encryption misstep: the decryption key for an encrypted partition was stored in an unencrypted partition on the same device.
- The finding raises procurement and due-diligence questions for any organisation or jurisdiction deploying Flock infrastructure.
What happened
Hackers who came into possession of a Flock Safety automatic licence plate reader (ALPR) camera conducted a joint analysis of the recovered hardware and software. Although the most sensitive storage on the device remained encrypted and inaccessible during much of the examination, they were able to extract and review significant data from the device, including weeks of operational logs.
More than a plate reader
The camera’s computer-vision software does considerably more than read number plates. According to the recovered data, the device explicitly detects people as well as vehicles, licence plates, and bicycles. It can produce dozens of images from a single passing vehicle, and over the period covered by the recovered logs it generated more than one million images in total.
Granular object recognition
The software’s object-detection reach extended to finer detail than most users or administrators would likely expect. The analysis found cases where the system isolated bumper stickers and other graphics — including, in one documented instance, an American flag patch on a motorcyclist’s saddlebag. Whether that level of granularity is intentional by design or an artefact of the underlying model is not stated in the source material, but the capability is present and was operating in the field.
The encryption problem
The most straightforward security engineering finding is the encryption architecture. One partition on the device was unencrypted, and that unencrypted partition contained the decryption key for an encrypted partition elsewhere on the same device. Security researcher Bruce Schneier, summarising the analysis, described this plainly as ‘pretty bad security engineering.’ The practical effect is that physical access to the device yields access to the encrypted data — negating the purpose of the encryption.
Context and limitations
The source material does not specify how the researchers obtained the camera, how representative this unit is of Flock’s current fleet, or whether Flock has been notified or has responded. There is no corroborating source material available at the time of writing. CISOs should treat the findings as directionally credible but should expect further detail to emerge.
Why it matters
Flock cameras are deployed by law enforcement agencies and, in some cases, by private organisations such as residential communities and corporate campuses. Any CISO whose organisation either operates Flock infrastructure or shares data with agencies that do should understand two risks. First, the surveillance footprint of these devices is broader than their marketing as licence plate readers implies — they are capturing and processing images of people and fine-grained personal attributes. That has privacy, legal, and reputational implications depending on jurisdiction and data-sharing agreements. Second, the encryption design means that physical compromise of a unit — whether through theft, loss, or a targeted attack — could expose a significant volume of imagery. If your organisation has contractual or policy obligations around surveillance data minimisation or encryption standards, this architecture may not meet them. Procurement and vendor assurance processes should account for the possibility that edge devices in the field carry similar design patterns.
What to do now
- If your organisation deploys or procures Flock cameras, review your data-handling agreements and understand what categories of data the devices collect beyond licence plates.
- Request documentation from Flock on their encryption architecture for edge devices, specifically whether decryption keys are stored on the same physical device they protect.
- Assess the physical security of any deployed units — if encryption is defeatable by physical access, tamper detection and secure mounting become more important controls.
- Review whether your privacy notices and data collection disclosures accurately reflect the full scope of what these cameras capture, including images of individuals and personal effects.
- Monitor for further technical disclosures from the researchers, as the source material indicates the analysis is ongoing and more detail may be published.
