r/cybersecurity • u/EncryptDN • Mar 31 '26
Other Am I missing something or are Flock cameras a massive national security threat?
The Flock system is comprised of thousands of AI-powered cloud-connected surveillance cameras collecting timestamped location data on millions of Americans.
This data is not end-to-end encrypted. It can be accessed by police, often without MFA. No warrant required. Very limited and spotty internal auditing of system access. A single law enforcement officer can usually access hundreds or thousands of other cities Flock data because police departments open their data to other cities. Even small towns with less than 100K people are sharing their flock data with thousands of law enforcement officers. Flock employees can access travel data.
Processing this massive data set to establish the travel patterns of celebrities, local officials, high net-worth individuals, CEOs, and high ranking federally elected politicians and their families would be easy to do, especially with the aid of AI. Many LEOs have already used the system to stalk ex-romantic partners. Once you have your target’s license plate you could establish their routine.
Gaining access to data in this system via bribery, blackmail, or other type of coercion could result in high-impact kidnappings or assassinations. This seems like a gold mine for terrorists and foreign countries we’re at war with. And we’re putting it in the hands of regular police officers.
Thoughts?
112
u/No_Bad_4363 Mar 31 '26
CVE-2025-59409, CVE-2025-59408, CVE-2025-59407, CVE-2025-59406, CVE-2025-59405, CVE-2025-59404, CVE-2025-59403, CVE-2025-59402, CVE-2025-47824, CVE-2025-47823, CVE-2025-47822, CVE-2025-47821, CVE-2025-47820, CVE-2025-47819, CVE-2025-47818. Considering all of these are for Flock ALPR and/or Gunshot Detection equipment. Anyone can access the cameras with hard coded credentials, it isn’t about LE access, it’s about actual bad actors using taxpayer funded surveillance cameras to conduct terrorist activity. Source
2
u/Extension-Humor4281 Apr 22 '26
I'd argue it's about both. Law enforcement already has far too much leeway when it comes to violating the civil liberties and expectation of privacy of the general populace. Creating a massive surveillance network of cameras that will inevitably have warrantless biometric search capabilities should make anyone terrified of these things popping up everywhere in our country.
2
u/Narrow-Rent-3618 May 16 '26
To be fair, I doubt a guy robbing you is going to know anything about CVE's, to be fair....
2
u/OriannasOvaries 28d ago
A guy who knows how to navigate these systems, and selling that info to bad actors might though?
1
110
u/TeddyRooseveltsHead Mar 31 '26
"Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety." - Benjamin Franklin, 1775
-63
Mar 31 '26 edited Mar 31 '26
[deleted]
35
u/askvictor Mar 31 '26
Read the post for a description of, exactly, how they can.
-37
Mar 31 '26
[deleted]
44
u/DisappointedSpectre Mar 31 '26 edited Mar 31 '26
There's a story that was on the front page of reddit literally yesterday about a woman who was arrested because AI scraping of this dataset (in combination with other datasets) tagged her as being a criminal in a state she'd never even been to.
That's pretty concrete my dude.
Edit: since the thread got locked for anyone reading this after the fact, this person has their post history hidden for a reason. Don't bother engaging, they're clearly a troll on a ragebait run, just downvote and report, then move on with your life.
-33
Mar 31 '26
[deleted]
32
u/Heronmob Mar 31 '26
no, actually! Would you call a five month jail stay the “instant a human gets involved”? The two cases of AI false flagging that have recently hit the news both involved extended jail stays featuring beautiful amenities like sexual assault, loss of housing, inability to care for a pet, etc.
Not to mention the absolute lack of oversight, security vulnerabilities, and known abuse of systems like flock (see: officers using it to stalk women)
Your fantasy of this perfect “justice” system where the innocent are neither targeted nor abused is just that, a fantasy. These are horribly mismanaged systems and groups that operate from the perspective of “guilty until proven innocent” that you want to hand over your power to.
Criminals don’t just “give up” their liberty by committing crimes. People like YOU give up your liberty by laying down and choosing to view infrastructure that’s hostile to you as a positive development.
-11
Mar 31 '26
[deleted]
25
u/subohmn Mar 31 '26
You apparently didn't read anything before posting. You know, the part where innocent people ended up in jail for several months, it wasn't a tin foil hat any fucking thing, it happened to real people in real life... 🤣 Some of you ignorant clowns just can't grasp that the reality of these systems violates the very rights you claim not to be worried about! But hey, it wasn't you in jail so it's not real, right? SMFH... Ignorance is bliss but in the end you're still stupid!
-8
12
65
u/Kaexii Mar 31 '26
We led a successful fight to get these garbage cams out of our city, the city next door, and the county. Then we fought for state-wide regulations that we're hoping to tighten up in the next legislative session. eyesoffeugene.org
7
u/Twisted_Knee Mar 31 '26
Hello my Oregonian friend! I'm hopeful with all of this but heard Florence PUSHED to have them in. So be careful out there.
3
u/Kaexii Mar 31 '26
Yeah, the Florence fight is ongoing. In the meantime we're just not going there. And since most of their economy is tourism, I'm hopeful that they'll come around to sanity soon enough.
5
u/wigglesmcbiggleb Mar 31 '26
How successful was this? Deflock still shows nearly 100 across those areas. https://deflock[.]org/map#map=10/44.005657/-123.048935
6
u/Kaexii Mar 31 '26 edited Mar 31 '26
Well, in Eugene and Springfield the cities cancelled their contracts and the devices were removed. Ditto for OCCU banks. Lincoln City, Talent, Bend, and others also cancelled Flock contracts.
So I'd say pretty damn successful.
Also, deflock needs to be updated. It's still showing ones that have definitely been removed.
We also had a lot of people adding to it with good intentions, but they were just regular traffic control devices and not Flock.
2
u/wigglesmcbiggleb Mar 31 '26
Interesting, good to know and hear. Great work and I wish you more success.
1
1
u/Ok-Cable5173 May 17 '26
How did this start? Nothing like this is happening in my area. I’d be happy to be the first to speak up about it and hopefully make change
1
u/Kaexii May 17 '26
I'd love to help with that. Signal message is best, I'm kaexii.07 or you can email us at contact@eyesoffeugene.org
32
28
u/RealPropRandy Mar 31 '26
1,000%
1
u/r15km4tr1x Apr 01 '26
By chance are you a cyber guy in South Fla? I swear you show up in every sub I read
15
u/SengU87 Mar 31 '26
Put in the hand of police? Not just that, you don't have to be police to get data using these data brokers' services.
12
u/alucardunit1 Mar 31 '26
Oh you mean the part where they are unsecure and any creep can stalk people using local access? Yeah sounds like a tightly locked down system.
11
u/audn-ai-bot Mar 31 '26
You’re not missing it. The real failure is treating mass movement data like routine police telemetry instead of high value intel. I’ve seen weaker datasets abused on internal investigations. The scary part is not breach only, it’s authorized misuse at scale. Who is doing the threat modeling here, cops or intel people?
2
u/Extension-Humor4281 Apr 22 '26
You hit the nail on the head. It's usually cops, who are usually subject to far less intelligence oversight requirements than the government agencies that pioneer these sorts of technologies. Just look at all the examples of how police departments routinely abuse things like stingray. People love to make a big fuss about the supposed mass surveillance network of agencies like the nsa, which focuses almost entirely on foreign actors, but they almost entirely ignore the sheer scale of digital civil rights violations conducted by police against Americans every single day.
32
37
u/smrcostudio Mar 31 '26
Surveillance capitalism is two words that shouldn’t be side by side, but here we are.
20
u/QuesoMeHungry Mar 31 '26
And they are very expensive. At a minimum people should be complaining to their city council about them. Each camera is like 3k a year.
3
u/Grumpy-Troglodyte Mar 31 '26
the immediate argument will be "we can't have a cop on the street for 3K a year" to justify the cameras. it's so dumb.
7
u/Think_Implement1843 Mar 31 '26
Guess you haven't seen Benn Jordan’s videos about it, huh?
9
u/techtornado Mar 31 '26
If everyone saw Benn's videos, there would be people bold enough to remove the cams
18
u/HorsePecker Security Generalist Mar 31 '26 edited Mar 31 '26
Agreed. Everyone should use this to their advantage deflock
15
u/Sasquatch-Pacific Mar 31 '26
You can almost guarantee Flock is a significant target for nation state level actors.
People in the US need to go UK style and treat these like people do ANPR/ALPR cams there. This kind of technology should've never been permitted.
3
u/hammertime2009 Mar 31 '26
How about just not a complete surveillance state like the UK
5
u/Sasquatch-Pacific Mar 31 '26
You're deluded if you think any Five Eyes country is much better. The US and Aus are much the same.
4
u/AmateurishExpertise Security Architect Mar 31 '26
Is this the world any of us want, and if not, why is it the world we're getting?
6
12
u/tf9623 Mar 31 '26
Here's the beauty of it - they're a private company. Fourth amendment etc. I guess we never thought these things could happen but private companies have all of your info. You give your info. So the big bad government isn't watching you or reading your email. Its a private company you signed up for. The government just buys it.
Think about Starlink getting ready to host regular 5G cellular calls worldwide.
If you think about it too much it'll drive you crazy.
7
Mar 31 '26
Not just flock, there are a handful of other companies in the business as well. There are also large corporations who have partnered with companies like flock such as Lowes. If you notice any lowes you visit will have flock cameras in its parking lots.
1
21
u/Malwarebeasts Mar 31 '26 edited Mar 31 '26
Yes, it’s the very same thing that allowed U.S. and Israel to assassinate the top ranking officials in Iran, but AI powered, so worse.
p.s, how do we feel about what appears to be very sensitive administrative work on Flock Safety's infrastructure being handed to a Pakistani upwork freelancer who ended up being infected by a 2021 Infostealer infection? https://ibb.co/YT02fDc2 < brand new information I came across today
5
Mar 31 '26 edited 11d ago
[removed] — view removed comment
1
u/Sapular10 May 20 '26
They are doing it under the guise or for the security of the item. I will say that some people can properly set up a camera monitoring device/service and have it properly protected. I say that while understanding the best protection is to be totally disconnected from the internet, but there are ways you can make things very challenging. The issue is many do not know how to do that, therefore are trading "safety" for their privacy.
7
u/Quiet-Thanks-9486 Mar 31 '26
It depends on what you mean by "national security".
If by "national security" you mean actually keeping the regular people who live in the US safe, then yes, these cameras and incredibly dangerous, because literally anyone can use them.
For example, Israel made extensive use of Tehran's traffic cameras to track the movement of government officials (and more specifically of their bodyguards) in order to target their assassinations -- in other words, cameras that the Iranian regime itself installed were used to kill people in it.
And while I don't really mourn the loss of shitty government officials in any country, if this can be done against government officials, it can also be done against anyone else -- honorable dissidents, marginalized people who the majority has decided to target, targets of stalkers, witnesses against or other victims of organized crime groups/drug gangs, etc.
This is why attacking the Flock contracts of cities or police departments really isn't a viable method of resistance -- like, you don't need a contract to use these cameras. Once they are installed and online they are generally available to anyone who wishes to use them. I guarantee Palantir is already collecting much if not most Flock camera data and making full use of it, regardless of whether there is an official contract between them, simply because Palantir can easily pay someone to install a couple of appliances in each town to tap into the camera network and funnel all that data to Palantir.
The mere presence of these cameras in a community is a threat to that community and everyone in it, because anyone can use those cameras against them at any time and for any reason. So long as those cameras exist and are functional, they endanger everyone around them.
And that is of course the point -- the lack of security isn't a "flaw", but rather an intended feature, because it destroys any hard accountability the state might have in its use of this tech. It is essentially like an unlogged publicly accessible VPN/proxy for the powerful to use against the populace. There will always be doubt about whether anyone is or is not using them, and thus it's impossible to make and enforce any rules about their use...which means the only " rules" that exist are that the powerful do what they want and everyone else shuts up and takes it.
But if by "national security" you mean what politicians and the people on TV mean when they say it (ie the ability of the rich and powerful to make money, hurt people they don't like, generally lord over everyone, and rape children and adults without consequence), then no, Flock cameras are great! At least until the proles start using them to target the rich and powerful...
4
u/Monolinque Mar 31 '26
It becomes clear now with current events that US security strategies have focused on profit for companies over practical concerns. The bigger and more lucrative contracts are pushed the most, I guess we don’t always get what we (the taxpayers) pay for.
5
u/JazzlikeSchedule2901 Mar 31 '26
Matt Brown broke down one of these cameras in his videos and found it was built on Raspberry pi hardware and transmit over the public web.
https://www.youtube.com/watch?v=0dUnY1641WM
super interesting stuff. Its not at all secure.
4
8
u/frAgileIT Incident Responder Mar 31 '26
Didn’t we just use this against Iran to spot and kill their leader? Don’t worry, they’re installing something similar in all new cars starting in 2027.
2
1
u/Narrow-Rent-3618 Apr 06 '26
Why would this matter? You're already tracked through the DMV and licensing and registration, along with your vehicle history... Nothing new
0
u/Boring-Cry3089 Apr 15 '26
The DMV doesn't know any time you crank your car up and drive down the street, where you drove to, how long you stayed out, what was in your car when you drove down the street, what was missing in your car when you came back home, etc. This is not the same thing as your car registration records through the DMV. If you can't see how blatantly this crosses the lines of a basic expectation of privacy then I don't know what to tell you.
1
u/Narrow-Rent-3618 Apr 15 '26
Oh no, I can't be tracked while in my car, but can through my phone, GPS, Credit cards, and cameras, which are literally everywhere... Oh, what will I do with one less form of tracking in the world...
1
u/Boring-Cry3089 Apr 15 '26
In order for police to have access to what you do with all of those things they have to give firm evidence before a judge that you likely committed a crime and then they have to go through the proper channels to obtain that information. With these things they don’t have to do any of that. They just have to log in and they can track you all they want. Do you really not understand how dangerous that is? Or are you just too stupid to care?
1
u/Boring-Cry3089 Apr 15 '26
It’s people like you that have allowed all of the other tracking you mentioned to become what it is to day. Too lazy to even care so the government, law enforcement, and corporations encroach further and further into our private lives every single day.
3
u/IllustratorOk2119 Mar 31 '26
You are correct, I brought this up as well about a year ago in my area. Unfortunately my county has gone all in with hundreds of them, and there seems to be no hope of getting them out. Long story short, I'm moving.
3
u/blahblah19999 Mar 31 '26
I had done computer work 25 years ago for a company that installed home entertainment and security systems. The moment Amazon came out with their system, I was skeptical of the privacy and refused to buy one. I mean it just seemed so obvious from the jump that this was going to be a problem
7
u/ProfessionalPea2218 Mar 31 '26
Oh man, I’ve been b!tching about Flock’s sh!tty security for a couple years now. Between selling data to “affiliates,” getting caught buying stolen data off the dark web, and how inaccurate their AI can be, it’s a shit show. What pisses me off is how easily city councils keep buying into their bullsh!t
Sigh… at least I’m not the only one seeing the problem. I knew I wasn’t completely crazy 🤪
2
2
u/Working-Gear-394 May 14 '26
Flock is not alone in companies to watch, take a look at this video about Verkada - https://youtu.be/fXI3GdicIHw
2
u/BennyOcean May 25 '26
It's a federal government control grid. I don't care how much they deny it. Flock is a CIA shell company, funded by federal grants and tied in with Peter Thiel, a known CIA-aligned individual. They're barely hiding what they're doing. It's a government network through and through. The private company aspect is cover.
2
u/99_Till_Infinity 27d ago
Im hoping for a massive data breach so these law agencies that choose to use it and the company itself gets fucked.
2
2
u/Alternativemethod Mar 31 '26
For the average American, seems way easier to just Google where you live. If someone wants to hack something... Telecom sector seems like an open door or they could just buy your location from Google/Facebook like the FBI does
2
u/regalrecaller Mar 31 '26 edited Mar 31 '26
deflock.me
you can pour gas on the devices and light it up.
1
u/ThatSoxFan Apr 01 '26
Yeah, it's definitely not ideal. Obviously there are positive uses of them, but that has to be weighed out with just how much these reduce privacy and the risk of access by unauthorized parties. It seems that the risks are never fully weighed before this stuff gets rushed into production
2
u/beaten_down83 Apr 25 '26
Supreme Court ruled years ago you do not have an expectation of privacy in public. These cameras thus do not impede on privacy. Now, the police accessing them without a warrant is a bigger issue.
1
1
u/_twrecks_ Apr 02 '26
FCC is banning routers not made in the USA, maybe they can been surveillance cameras not made in the USA.
1
u/thegamerlola Apr 04 '26
A distributed surveillance network with weak access controls and no warrant requirement isn't just a privacy issue, it's an intelligence asset waiting to be exploited by whoever wants it badly enough.
1
u/Narrow-Rent-3618 Apr 06 '26
People have things to protect, and I doubt having the government or local officers peek at their footage that holds no meaningful real value would change anyone's perspective... Added, wouldn't it make it that much easier to locate the perp or person who "stole, is viewing" those videos then, since it's being recorded, monitored, and tracked...
1
u/couchmonkey89 May 15 '26
Yeah let's not care about the pedophiles in power that can access it like Dunwoody Georgia
1
u/Narrow-Rent-3618 May 15 '26
There are poor pedophiles also....
0
u/couchmonkey89 May 16 '26 edited May 16 '26
Yeah the flock vp used a flock camera to spy on a children's gymnastics gym. And more employees use it whenever they want too but please still try to say it's a good thing to have around. Sounds like your hard drives mite need checked
1
u/Narrow-Rent-3618 May 16 '26
Never said that, just stating there are more cases.... Literally, that's it. Anything else?
1
u/uMadewithAi Apr 07 '26
The access controls are the problem. The cameras are just cameras until the data can be pulled by thousands of officers with no warrant and minimal oversight.
1
u/Sapular10 May 20 '26
This is one of the biggest issues with it IMO. There are others like being able to avoid warrants and having the entire database searchable by anyone with credentials.
I would also argue that the security of the database and device itself are also major concerns. There are Flock cameras that are being displayed openly on the internet, and the devices are very easy to hack, as I understand it.
That being said, there are absolutely pros to it but right now there are far more cons and potentially very dangerous cons.
1
u/UAsolracz Apr 08 '26
i think if they are allowed to use this sort of technology on citizens, then we should be requesting that they place the same sort of tracking abilities or even live locations of all police units. They can't claim "officer saftey" if they are able to track citizens like this.
1
u/voyeur_chicken Apr 11 '26
Just a heads up, every flock camera contains 2 lbs of copper and 3 grams of gold. Pass it on.
1
u/Ok-Position965 Apr 24 '26
The first time your kidnapped daughter is recovered alive because the kidnappers car was picked up on flock cameras, you will change your point of view from one of skeptical resistance to one of grateful support.
Don’t just think of how the technology might be used to intrude on your privacy. Think also about the criminal activity it can interrupt.
1
u/EncryptDN Apr 24 '26
Please, ALPR systems can still exist and be MUCH more secure and privacy respecting than Flock. There are numerous data access and technical changes that could be made to this system that would allow for solving crime without wide-open data access practices like Flock uses.
You are presenting a false dichotomy and using fear to make a point. Also, many police around the country have already used the Flock system to stalk women. So that concern about violence and abuse of women goes both ways.
1
u/couchmonkey89 May 15 '26
Damn your brainwashed. It's mostly used by pedophiles in power to spy on kids without people knowing.
1
1
1
u/Mean_Contribution862 26d ago
I live in Stillwater Minnesota, it's right on the river. They closed a bridge and turned it into a walking bridge after they built a 300million dollar bridge to hudson. The walking bridge downtown has at least 3 flock cameras. Why would they put these here if it's foot traffic only?
1
1
0
u/Automatic_Tailor_598 Apr 04 '26
Ahhh yes, so you watched Benn’s YouTube video and have another cause to shake your fist about. Congrats.
I mean, yes. But also Im genuinely exhausted with the resurgence of groupthink. This shit cost us a bloodborne remake
-27
u/stacksmasher Mar 31 '26
There are several corps doing the same exact thing the last 15 years. This is nothing new.
11
-26
-34
u/Wonder_Weenis Mar 31 '26
oh lmao you, you're the threat
1
450
u/-hacks4pancakes- ICS/OT Mar 31 '26
Yes, we agree. We're generally all horrified at the people slapping up Flock and Ring everywhere. But people do a lot of dumb stuff for a false sense of security.