Hackers Tear Down a Flock Camera and Publish What It Actually Records

A hacker group calling itself stegan0gram ripped a Flock Safety camera down from above a roadway, cracked its storage, and handed the files to 404 Media and WIRED for a joint investigation. The material was also shared with the transparency nonprofit Distributed Denial of Secrets.

What they found: the camera logged roughly 50,200 vehicles and generated about 1.6 million images over 21 recoverable days, according to WIRED and 404 Media, with Clash Report adding that a typical day produced around 3,300 detections and the busiest day hit 4,454. A single passing car typically triggered about 28 images, sometimes more than 100, per The Hill and Clash Report.

How they got in

The hackers recovered an encryption key stored on the device itself and used it to unlock most of the stored video, according to Mashable and WIRED. They found two unencrypted partitions, one for vendor files and one for media, and said the camera runs on a processor comparable to a midrange smartphone executing about 20 Flock-built applications for motion detection, image classification, and remote updates.

Contrary to a common assumption, the camera itself does not read license plates or identify make, model, or color. Multiple outlets, including WIRED, Mashable, and The Hill, reported that this processing happens later, on Flock's own servers, after the device transmits cropped images over a cellular network.

The camera tracks people, not just plates

The recovered software explicitly detects people and bicycles alongside vehicles and plates, logging where a person appears in frame along with a confidence score, according to WIRED's analysis. WIRED tested the extracted computer-vision models against a reporter's selfie and against 27,321 stored video clips, finding people detected in 11 clips, all involving motorcycle riders, per Clash Report. Flock's own systems flagged an American flag patch on one motorcyclist's saddlebag, a level of detail The Hill, WIRED, and The New Republic all singled out.

Flock has said its cameras don't perform facial recognition, and the joint analysis found no evidence of active facial-recognition capability beyond features built into Android by default that did not appear to be enabled, according to Mashable and Clash Report. Separately, YouTuber Benn Jordan, who worked with 404 Media researchers, told PCMag that other Flock products, including pan-tilt-zoom cameras and drones, can zoom in on faces and that he personally found photos of himself in the network. That claim concerns Flock's broader camera lineup, not the specific device stegan0gram dismantled, and it has not been independently verified through the leaked data itself.

Flock's response

A Flock spokesperson told The Hill that removing and tampering with its cameras is illegal. The company said it maintains a public vulnerability disclosure policy and "received no report through that process," adding it lacks enough detail to assess the hackers' claims.

The case for the cameras

Flock's network exists because it works for the job it's sold for. The Hill notes that local jurisdictions can share ALPR data with other law enforcement agencies, creating a searchable network departments use to solve crimes and recover stolen vehicles. Trump said Sunday he "sort of" likes the cameras "because of law enforcement," acknowledging some people see them differently. A tool built to catch criminals will, by design, also photograph everyone else on the road.

The scale of that trade-off is where the pushback concentrates. The New Republic, citing a separate WIRED report, said cameras in Alpharetta, Georgia, a city of roughly 67,000 people, are searchable by more than 2,000 outside agencies, including police departments, universities, airports, and the GSA's Office of Inspector General. 404 Media reported in May that police in some jurisdictions ran Flock searches on behalf of federal immigration agents even where local rules restrict sharing data with outside agencies.

Where this goes next

Florida Gov. Ron DeSantis has said he worries the state could become a "digital AI surveillance state," and Rep. Thomas Massie (R-Ky.) introduced the Flock-Off Act this month to bar federal funds from paying for automated license plate readers and biometric surveillance cameras. Whether that bill advances, and whether Flock investigates or acts on the hackers' findings despite calling the removal itself illegal, remain open questions. Reported valuations of Flock also vary sharply across recent coverage, from roughly $4 billion to $8.4 billion, depending on the source and when the figure was cited, underscoring how fast the company's footprint and finances are both moving. Meanwhile, arrests for tampering with Flock cameras have already happened in multiple states, and at least one police department has planted a fake 3D-printed camera specifically to catch vandals, a sign the standoff between residents and the surveillance network isn't cooling off.