SFPD Drone Footage of a Police Chase Leaked Onto the Open Internet

Four Drones, One Suspect, Zero Security

A Skydio X10 quadcopter hovered roughly 200 feet over a San Francisco apartment complex just after noon on a Saturday last month, watching police chase a man suspected in what the San Francisco Police Department called an alleged "auto boost/strip" incident, the theft of car parts or other items from a vehicle, according to Wired.

The drone had already tailed the suspect's black SUV across the city, zooming in on the license plate and keeping the vehicle centered in frame until the driver pulled over, Wired reported. When he ran into the apartment complex and hid behind a parked car, a second drone arrived to track him from another angle after being pulled off a separate assignment watching two people near a McDonald's who had exited the suspect's car minutes earlier.

Four Skydio drones tracked the man within a single hour, according to police records reviewed by Wired. Officers eventually converged, two of them pointing weapons, and tackled him as more than half a dozen additional officers arrived.

The Leak

None of this was supposed to be public. SFPD, like most U.S. police departments, rarely releases drone footage even in response to public records requests, according to Wired.

Instead, security researchers Sam Curry and Maik Robert discovered that the footage was streaming live onto the open internet through Skydio's own website, Wired reported. The exposed feed included both color and thermal video from five SFPD drones, along with location metadata and the names and email addresses of the drone pilots operating them.

Anyone who found the public web address could watch it. No password. No hack. Just an open door nobody bothered to check.

The Debate

Privacy advocates have a legitimate complaint. A drone that can track a private citizen's license plate across a city, follow him into a residential complex, and keep visual custody through multiple hand-offs represents a surveillance capability most Americans have no idea their local police department has, let alone one that occasionally broadcasts unencrypted to the public web.

If SFPD can't keep five drone feeds off the open internet, what confidence should residents have that footage of law-abiding citizens sitting on their own porches, footage these drones inevitably capture while in transit to a call, is being stored and handled responsibly?

But the footage itself also shows the drones doing exactly the job they were bought to do: tracking an actual suspect in an actual crime without putting more officers or bystanders at risk in a ground chase. San Francisco has been debating whether drones reduce collision risk during pursuits since at least February 2024, when local outlet the San Francisco Standard examined whether drone-assisted chases would replace higher-speed car pursuits. Using unmanned aircraft to corner a suspect instead of running red lights at 60 miles an hour is a reasonable trade-off.

The problem isn't that police used a drone. The problem is that the department apparently had no functioning safeguard preventing that footage, and the pilots' personal contact information, from being visible to literally anyone with the right link.

What's Unresolved

Nothing in the available reporting indicates SFPD has announced an internal investigation into how the leak happened, disciplined anyone, or disclosed how long the feed was exposed before Curry and Robert found it. No breach notification, charge, or regulatory action has been reported.

That leaves basic questions open: How many other incidents, involving people never charged with anything, sat exposed on that same web address? Did Skydio, the drone manufacturer, or SFPD notify the public directly, or did the public only learn about it because two independent researchers went looking? Until San Francisco answers that, the question of who's actually watching the watchers remains unanswered.