Hackers who physically dismantled a Flock Safety license-plate camera extracted an encryption key and most stored files, allowing review of thousands of detections. Analysis shows the device explicitly logs people as well as vehicles, license plates and bicycles, recording location and confidence for person detections. Recovered logs from about 21 days included roughly 50,200 vehicle records and nearly 1.6 million images; some sensitive data remained encrypted. Flock denies using face recognition and says tampering is illegal, while municipalities and researchers continue to raise security and privacy concerns.
Hackers Dismantle Flock Camera, Extract Encryption Key — Files Reveal It Detects People
(Chip Somodevilla/Getty Images)
Hackers physically dismantled a Flock Safety license-plate reader, copied most of the data stored on the unit, and provided the extracted files to journalists — revealing new details about how the company's cameras record vehicles and people.
What the Hackers Found
404 Media reported that a group calling itself stegan0gram recovered an on-device encryption key that unlocked video and image files containing thousands of vehicle detections. Recovered logs covering roughly 21 days showed the device photographed about 50,200 vehicles and produced nearly 1.6 million images.
“Why just destroy them when we can reverse engineer them and find the secrets of those spying on us?” one member of the collective said.
What The Files Reveal
Analysis of the extracted data indicates the camera's software explicitly detects people in addition to vehicles, license plates and bicycles. For person detections the system logs the person's approximate location within the image and a confidence score for each detection.
The device captures a rapid burst of photos when motion is detected: a typical passing vehicle generated about 28 images, while some events produced more than 100 frames.
Much of the most sensitive storage on the device, however, remained encrypted and inaccessible to the researchers, the report said.
Face Recognition And Errors
404 Media reported it found no evidence that the camera contained an active face-recognition system beyond default Android operating-system features, which did not appear to be in use. Flock has long maintained its cameras do not perform face recognition.
The plate-detection software sometimes produced false positives, at times mistaking bumper stickers or other graphics for license plates. One example cropped an American flag patch on a motorcyclist's saddlebag and treated it like a plate.
Official Response And Context
“The unauthorized removal and tampering of a Flock camera is illegal,” a Flock spokesperson said, adding that the company had not received a vulnerability disclosure and did not have sufficient details to assess the claims.
Earlier, in early 2025, a security researcher publicly documented vulnerabilities in a Flock camera that the company said required physical access to exploit. Law-enforcement officials reported multiple arrests nationwide related to alleged tampering with Flock units, and several municipalities have announced plans to discontinue their use.
Flock operates more than 120,000 cameras under contracts with about 7,000 law-enforcement agencies, according to The New York Times. The company’s website says it does not disclose specifics about individual contracts, camera counts, locations, or deployments; it points readers to customer agencies for local policy and deployment details.
Why This Matters
The incident highlights the privacy and security risks posed when networked surveillance devices are physically accessible. Even when parts of the device remain encrypted, extracted logs and an unlocked archive can reveal extensive tracking data — including when a system is logging people and assigning confidence scores. The episode has renewed debate over oversight, data retention, and the deployment of automated license-plate readers by police agencies.
Help us improve.
