The Camera That Watched Everyone and Protected Almost Nothing

Somewhere on an American roadway last month, a hacker collective calling itself stegan0gram did something refreshingly analog: they climbed up, took a Flock Safety license-plate camera off its pole, and carried it away. No phishing email, no zero-day, no months of patient social engineering — dear reader, they used a ladder and the working theory that a company selling "secure" surveillance to your town council might be overselling the secure part. They were right.

Fifty Thousand Cars, a Million and a Half Photos, One Very Findable Key

Inside the camera's Android internals, the hackers found unencrypted storage partitions, one labeled "vendor" and one labeled, with almost touching honesty, "media." The media partition held the encryption key. Flock has spent years assuring cities its footage is protected by on-device encryption, and it is — the same way a house is protected by a lock whose key is taped to the front door. Recovered logs from just 21 days on a single camera showed roughly 50,200 vehicles, 1.6 million images, and 27,321 video clips — one device, three weeks, one town, and one presumes several thousand people who never applied to be in this dataset.

The gate was locked. The key was left in the gate.

It Was Never Just Reading Plates

Flock's public pitch is narrow and defensible: license-plate recognition, installed by the thousand on American streets. The recovered code tells a rounder story — the software explicitly detects people and bicycles too, logging exactly where a person stands in frame and how confident the algorithm is that it found one. It also, in the tradition of surveillance systems everywhere, gets things wrong with real enthusiasm, misreading a motorcyclist's American flag patch and a car's bumper sticker as license plates. No facial recognition turned up on the device, a fact Flock will presumably lead with, the way a burglar leads with having only taken the TV.

Even now, the company's marketing describes this as license-plate technology. The code disagrees.

The Statement That Answered a Different Question

Asked about an unencrypted encryption key sitting on a device bolted above public roads nationwide, Flock's response was that removing and tampering with a Flock camera is illegal — true, and also not a rebuttal to anything the hackers actually found, which makes it the institutional equivalent of catching a shoplifter and responding with a lecture on the store's return policy. DDoSecrets co-founder Emma Best was blunter, calling the find proof of "a fundamental problem with mass surveillance technology." The hackers, asked why they'd bothered, offered a mission statement no vendor selling "trust us" as a security model wants to hear: "Why just destroy them when we can reverse engineer them and find the secrets of those spying on us?"

And yet — as if this were not enough — they say they're publishing exactly how they did it, so the next group won't need a grudge. Just directions.

The camera watched 50,200 cars and however many bystanders in three weeks. It took one crowbar and one weekend to find out it couldn't watch its own back.

Sources: 404 Media — Hackers Stole Flock's Camera Software, Revealing How the Company Tracks Cars and People · The Hill — Hackers rip down Flock camera, steal its data, share findings with media