Summary
- Flock Safety has been granted CVE Numbering Authority (CNA) status, meaning it can now assign CVE IDs and set severity scores for vulnerabilities in its own products.
- The company manufactures automated licence plate readers and AI-powered cameras used by law enforcement, and has faced recurring scrutiny over police misuse of its technology.
- Flock published a vulnerability disclosure policy in August and has created a security advisories page, but does not operate a paid bug bounty programme.
- Security researchers warn that vendor self-assessment creates a conflict of interest, particularly if organisational maturity is insufficient to assess impact accurately and impartially.
- Flock’s disclosure policy reserves the right to withhold publication if it determines disclosure poses a safety risk — a provision experts say could be abused.
What Has Changed
Flock Safety, the manufacturer of automated licence plate readers (ALPRs) and AI-powered surveillance cameras sold primarily to law enforcement agencies, has joined the global CVE Numbering Authority programme. As one of more than 550 CNAs, Flock can now assign CVE IDs, write vulnerability descriptions, and set severity scores for defects found in its own products. The company’s CISO, Chris Castaldo, said the arrangement would allow the company to respond faster to researcher reports, avoid duplicate entries, and give customers a single source of security information.
Why CNA Status Is Contested Here
CNA status is routinely granted to vendors and is a well-established mechanism within the vulnerability management ecosystem. Many organisations operate in this role responsibly. The concern with Flock is not the programme itself but the specific circumstances the company brings to it. Flock has faced significant public and legal scrutiny over privacy practices and documented instances of police misuse of its surveillance products. That history shapes how security researchers are likely to view the company’s self-assessments.
The Self-Grading Problem
When a vendor holds CNA authority, it writes the description and sets the severity score — roles that carry real weight in how organisations prioritise patching. Katie Moussouris, founder and CEO of Luta Security, told CyberScoop that the conflict of interest becomes tangible when a vendor lacks the maturity to assess its own flaws accurately. “A vendor in the CNA role writes the description and often sets the severity score, so an immature vendor may inaccurately represent an issue, either through ignorance or in a misdirected effort to downplay it,” she said. Flock’s handling of vulnerabilities reported last year illustrates the tension. Researchers identified defects in its licence plate reader and gunshot detection system. Flock submitted them to the National Vulnerability Database but classified them as not material, citing the need for physical access to exploit them. Moussouris noted the obvious counter-argument: “These cameras sit on poles on public streets.”
Policy Provisions Worth Scrutinising
Flock’s vulnerability disclosure policy disallows testing against live customer deployments, accessing law enforcement or investigative data, physical attack testing, denial-of-service testing, and social engineering. There is no paid bug bounty programme. Notably, the policy reserves the right to withhold publication if Flock determines that disclosure would create a safety risk to law enforcement or the public. Moussouris identified this clause as a potential risk to the integrity of the programme. “The latter may lead to an abuse in their authority and control of CVEs unless they embrace a more mature customer-safety-first stance of timely, transparent, and accurate vulnerability disclosure,” she said.
Researcher Confidence Is Already Fragile
Security researcher Zach Edwards noted that activists have already conducted technical teardowns of Flock products independently, and he expects some researchers to continue disclosing vulnerabilities without coordinating with the company. The CVE programme does not enforce consistent norms across CNAs — participation standards vary considerably, and some vendors granted CNA status have not publicly disclosed any vulnerabilities in their products in years. Whether Flock meets a reasonable standard will depend entirely on what it publishes going forward. “Only time will tell how Flock operates their CVE programme and if they issue CVEs for vulnerabilities publicly disclosed,” Edwards said.
The Benchmark Is the Record
Moussouris articulated the appropriate test clearly: the measure of Flock as a CNA is whether its records give cities, police departments, and the public enough detail and accuracy to track specific risks by product version, the nature of the vulnerability, and how to mitigate or fix it. Vendors can make sound CNAs when they know their own code, can confirm flaws, and tie records accurately to affected versions and fixes. Flock now has a security advisories page where newly discovered and confirmed vulnerabilities will be published. Whether that page produces timely, accurate, and complete records is the only question that ultimately matters.
Why it matters
Organisations procuring Flock Safety products — or evaluating any law enforcement technology vendor with CNA status — should understand that vendor-issued CVEs reflect the vendor’s own assessment of severity and impact. For Flock specifically, the combination of physical-access vulnerabilities in publicly mounted devices, a disclosure policy that permits withholding publication, and no bug bounty programme means security teams cannot rely solely on official CVE records to understand their exposure. Independent verification, active monitoring of researcher disclosures outside the formal CNA process, and contractual obligations around timely notification remain essential controls when the vendor is also the assessor.
What to do now
- Do not treat Flock-issued CVE severity scores as the sole basis for prioritisation decisions; cross-reference with researcher disclosures and the National Vulnerability Database.
- Monitor independent security researcher channels and public disclosures for Flock vulnerabilities that may be published outside the coordinated disclosure process.
- Review Flock’s published vulnerability disclosure policy and security advisories page to assess whether the level of detail meets your organisation’s risk tracking requirements.
- When procuring or renewing contracts with surveillance technology vendors, include contractual requirements for timely, transparent vulnerability disclosure regardless of CNA status.
- Assess whether physical access controls around publicly mounted Flock devices — such as ALPRs on street poles — are adequate given the company’s own characterisation of physical-access vulnerabilities as not material.
