Hackers removed a Flock Safety camera from a roadway, copied its internal data, and shared the files with 404 Media and WIRED, providing an unprecedented look at how the surveillance system operates.
According to the joint investigation, the hackers recovered an encryption key stored on the device that unlocked videos of thousands of vehicle detections. While much of the camera’s most sensitive storage remained encrypted, the analysis revealed that the device’s software explicitly detects not just vehicles and license plates, but also people and bicycles. A typical passing vehicle generated about 28 images, though some produced more than 100. During 21 days of recovered activity, the camera photographed roughly 50,200 vehicles and generated about 1.6 million images.
The camera’s computer-vision software sometimes isolated bumper stickers and other graphics on vehicles. In one case, it cropped an American flag patch on a motorcyclist’s saddlebag as if it were a license plate. When tested against video clips from the device, the detection models identified people in 11 clips, all showing motorcycle riders.
Flock has described its cameras as protected by on-device encryption. However, the hackers accessed the Android system on the camera and found unencrypted partitions, including sections called “vendor” and “media.” The latter contained an encryption key that unlocked another partition holding much of the video and still-image data.
The camera itself does not appear to read license plates or identify vehicle make, model, and color—that processing occurs on Flock’s servers. Images are sent to Flock over the cellular network after being selected and cropped by the device.
Flock insists its cameras do not perform face recognition. WIRED and 404 Media found no evidence of face-recognition capabilities beyond those included by default in the Android operating system, which did not appear to be enabled or in active use.
According to the source material, in early 2025, security researcher Jon “GainSec” Gaines reverse engineered a Flock license-plate reader and documented flaws that could provide root-level access. Flock acknowledged the findings but downplayed their severity, stating that the flaws required physical access to the device and that even someone with camera access “would still not be able to gain access to footage” because images remain on the device only briefly after transmission to the cloud.
The breach occurs amid growing controversy over Flock’s national network, which allows more than 2,000 agencies—including police departments, colleges, airports, and federal offices—to search cameras across the country. Recent reporting has revealed that local police performed lookups on behalf of Immigration and Customs Enforcement in areas that banned such cooperation, and that a Texas officer searched nationwide for a woman who self-administered an abortion. The hacker collective, calling itself stegan0gram, said they aimed to “reverse engineer them and find the secrets of those spying on us.”
Key facts
- Hackers recovered an encryption key from a Flock camera that unlocked videos of thousands of vehicle detections
- The camera’s software explicitly detects people, vehicles, bicycles, and license plates
- During 21 days of recovered activity, the camera generated approximately 1.6 million images
- A typical vehicle generated about 28 images, though some produced more than 100
- The camera’s data is accessible to more than 2,000 agencies nationwide, including police departments, colleges, airports, and federal offices
- Flock’s servers, not the camera itself, perform license plate reading and vehicle identification