Matt Gush/Shutterstock Add Jalopnik on Google: Google Discover Flock cameras are everywhere these days, whether you like it or not. Something tells us you probably don't, as it's one of the few things liberals and conservatives have united over. While the topics of how police are misusing Flock cameras and the unimaginably huge number of pictures they take are well trodden by now, we were curious as to how easy it is for a potential bad actor to hack one of Flock's automated license plate readers. We should be clear that this will not be a how-to guide on hacking Flock cameras, nor do we encourage such illegal activities. But to answer the big question posed up top: It looks like it is indeed pretty darn easy to hack Flock cameras, according to those who claim to have done it. But if you ask Flock about it, they'll tell you that while findings are legitimate, the situation with real, on-duty cameras isn't quite that straightforward and that the Flock system has never suffered a real breach. Back in November 2025, cybersecurity pro and lifelong hacker Jon "GainSec" Gaines published a white paper on GitHub detailing Flock's vulnerabilities, which were explored in a YouTube video by Benn Jordan. The long and short of it is that after Gaines, uh, gained physical access to a Flock camera device purchased online secondhand, a simple procedure consisting of button presses, connecting to a network, and terminal commands gave him access to the camera's internal data and allowed him to "install whatever the hell you want on it." As one would gather from the title of Jordan's video, this process takes less than 30 seconds, and the things a malicious party could do with this level of access are only limited by their own imagination. But wait, there's more Gorodenkoff/Getty Images Another concerning discovery (discussed at 7:09 in the video) was Flock not requiring multi-factor authentication (MFA) with all of its police department clients. You're probably familiar with multi-factor (or two-factor) authentication as that thing where you have to verify your identity by putting in a code texted or emailed to you when logging into a new online service, or logging into an existing service on a new device. Flock said that 3% of its law enforcement customers declined to turn on MFA, and it took until August 2026 for it to release an update that mandated its use across the board. What's more, despite Flock claiming that Flock cameras only save images of license plates and all data and footage is always encrypted, Jordan caught the camera he tested saving pictures of himself, even when there were no plates in view (11:45 in the video). At 12:09, he also reports not having to "crack or decrypt a single thing" in the whole process of verifying Gaines' research. Another hacker group did it, too Max Acronym/Shutterstock Jordan's video is thorough and goes on to show how researchers used "dorking" to expose API keys that granted access to private data such as live patrol car locations, officer info, and "hot list" license plate records. A "TEMPEST attack" can apparently expose video feeds from several feet away via electromagnetic leakage. Oh, and Flock hardware is said to run on a very old version of Android that doesn't even get security updates anymore. More recently, hacker collective stegan0gram conducted a similar exercise, taking down an active Flock camera (very illegal, do not try at home) and copying the data within. They were apparently able to access an on-device encryption key and a bunch of data, which was shared to 404 Media and Wired for an investigation. They also discovered software that "explicitly detects people," despite Flock cameras being officially billed as automated license plate readers. As for the next natural question of, "Okay, but are bad actors actually hacking Flock cameras and doing bad stuff?" at 3:08 in his video, Jordan allegedly found what appeared to be access to the Flock system offered for sale on a Russian-language "semi-private community" on the dark web. A translation of the post revealed text advertising "license plates, background checks, and vehicle tracking!" plus "direct police accounts in key U.S. regions" and "nationwide access." Flock's response Tigarto/Shutterstock In direct response to Gaines' white paper, Flock published a blog post saying that it's been in contact with Gaines, has registered the vulnerabilities discovered appropriately, and then chose to highlight the following sentence: "Overall, none of the vulnerabilities detailed in the report have an impact on our customers' ability to carry out their public safety objectives." In case you're confused, "customers" in this context refers to the police. As if that wasn't tone deaf enough, Flock continued, "Exploitation of these vulnerabilities would not only require physical access to a device, but also require intimate knowledge of internal device hardware." Unrelated but related: Stealing a car also requires physical access to said car, plus "intimate knowledge of internal device hardware," but that's not a legit reason for, like, Toyota to stop making car doors that lock. Later in January, Flock came out with another post saying that its system has never fallen victim to a real breach. "No, Flock's cloud platform has not been hacked," the post read. "There has not been a leak of Flock information. Flock's cloud infrastructure has never been compromised. There has never been an incident in which customer data was accessed or exfiltrated by an attacker." The post went on to shout out Gaines' paper again and talk about how it's continuously improving to prevent hacks and data breaches — but not before calling the vulnerabilities Gaines found "theoretical" and "immaterial." Who to trust? Justin Sullivan/Getty Images In March, Flock's recently-hired Chief Information Security Officer and NSA alum Chris Castaldo published a Flock blog post that addressed Jordan's November 2025 video head-on: "Flock's Product Security and Offensive Security teams evaluated the information submitted by this individual and determined that all of the findings were previously discovered by Flock's cybersecurity team and were already fixed or planned for engineering sprints throughout the remainder of 2025. While the findings were legitimate, they were all of low severity. Meaning the risk to customers or customer data was near zero." He also says Gaines' device in question "was never deployed to a customer and never received any standard software or security updates that happen automatically when a device is registered with our cloud. Had this individual not prevented it from connecting to our cloud, most of their findings would have been moot. As the device would have applied pending updates that would have fixed known issues." Unrelated but related: Late last year, at least 60 of Flock's Condor police surveillance cameras suffered a brief breach during which live feeds became accessible on the open internet, password free. In a short blog addressing that incident, Flock said the issue was down to an "isolated configuration issue" that affected "a very small number of Condor video devices."
+27 others
