Flock Camera Tear-Down Exposes Tracking

A Flock Safety camera was physically removed from above a roadway, its storage copied, and the resulting files handed to 404 Media and the transparency nonprofit Distributed Denial of Secrets, which passed them to WIRED. The recovered material offers a rare, granular look at what an automatic license plate reader actually records as traffic moves beneath it — and at how much of that activity is stored on the device before it ever reaches the cloud.

Flock has described its cameras as protected by on-device encryption. The hackers say they recovered an encryption key stored on the camera itself, which unlocked videos of thousands of vehicle detections. 404 Media and WIRED then analyzed the files as part of a joint investigation.

How the camera was taken apart

The group behind the removal calls itself stegan0gram. One of its members described the operation as a deliberate choice to reverse engineer rather than simply destroy the hardware. The collective says it took the camera and its associated solar equipment from the field, disabled them, and then worked through the software.

According to the hackers, they reached the Android system running on the device and found two partitions — essentially sections of its storage. Some partitions were unencrypted, including ones named “vendor” and “media.” The media partition held an encryption key that unlocked another part of the device, which contained much of the video and still imagery the camera had captured.

Not everything was reachable. The most sensitive storage on the license plate reader remained encrypted and inaccessible, so the picture the hackers obtained is partial rather than total. Even so, the recovered logs and files were enough for the two outlets to reconstruct how the device behaves.

“Why just destroy them when we can reverse engineer them and find the secrets of those spying on us? We liberated hardware in the field, disarmed them, and proceeded with reverse engineering of the cameras and associated solar equipment.”

— one of the hackers, from a collective calling itself stegan0gram

What the device records

The camera’s software explicitly detects people as well as vehicles, license plates, and bicycles. That human-detection capability tends to be left out of public discussion about Flock cameras. When the software spots a person, it records where they appear in the frame and how confident it is in the detection.

WIRED extracted the detection models from the camera’s files and ran them against test images and footage recovered from the device. The models detected people readily, including in a selfie supplied by a reporter. WIRED then ran the models across 27,321 short videoclips stored on the camera. Those clips were MP4 files, each roughly one to two seconds long, recorded at 1,024 by 768 pixels and without audio — separate from the higher-resolution still bursts the camera takes as vehicles pass.

The models detected people in 11 of the clips, all of them showing motorcycles. The low number is likely explained by the camera’s mounting position: above a roadway and angled down at traffic, where pedestrians would rarely walk into view.

Bursts of images per vehicle

When something moves into the camera’s field of view, the software fires off a rapid series of photographs. A typical passing vehicle produced about 28 images, while some vehicles generated more than 100. The camera switches between exposures to capture both the license plate and the wider scene, then scans the frames, selects and crops useful ones, and sends them with other data to Flock over a cellular connection.

Based on the recovered code, the camera itself does not appear to read the plate or determine a vehicle’s make, model, and color. That processing appears to happen on Flock’s servers. The camera’s job is to capture and transmit; identification happens elsewhere.

Flock’s system then makes those time-stamped records searchable by whichever local agency owns or has access to the cameras. In many cases, the company’s national network also lets police departments from across the country search those same cameras. In Alpharetta, Georgia, WIRED found that records from the city’s Flock cameras were accessible to more than 2,000 agencies, including police departments, colleges, airports, and the Office of Inspector General for the federal General Services Administration.

That national reach has been a selling point for Flock, and also a source of controversy. 404 Media reported that local officers performed lookups in the national network on behalf of Immigration and Customs Enforcement, including in places that barred cooperation with immigration authorities or the transfer of license plate data out of state. 404 Media also reported that a Texas officer searched Flock cameras nationwide for a woman who had self-administered an abortion.

Scale in the recovered logs

The camera’s logs show how much data a single unit can accumulate. According to the analysis, the logs covered about 21 days of activity across several periods. During those windows, the device photographed roughly 50,200 vehicles and generated about 1.6 million images.

• About 28 images for a typical passing vehicle, with some vehicles producing more than 100.
• Roughly 50,200 vehicles photographed across about 21 days of recovered logs.
• About 1.6 million images generated during those logged periods.
• Around 3,300 vehicles logged on a typical day, with a high of 4,454.
• More than 27,000 “no space left on device” errors recorded while saving full-resolution images.
• More than 12,000 liveness-check messages reading “Who’s a good boy?!” in the recovered logs.

The camera was almost certainly running outside those logged periods, but older logs had been overwritten or could no longer be recovered from the device. The daily figures would also vary widely depending on where a camera is installed and how much traffic passes in front of it.

What the plate detector mistakes

The recovered software also shows how broadly the license plate detector can interpret what it sees. In some cases it treated bumper stickers, dealership frames, and other graphics as plates and cropped them out as if they were plates. In one video of a passing motorcycle, the detector cropped an American flag patch on the rider’s saddlebag as though it were a license plate.

Flock has said its cameras do not perform face recognition. WIRED and 404 Media found no evidence of face-recognition capabilities in the camera’s software beyond those included by default in the Android operating system, and those default capabilities did not appear to be enabled or in active use.

The on-device findings sit at one end of a system whose other end was described in August, when WIRED obtained frontend code for Flock’s police software — now called OS Investigate and previously known as Nightshift — and reconstructed portions of the tool. That software showed how Flock can combine camera records with police files and commercial data to identify drivers, surface vehicles that repeatedly travel together, and search for people based on patterns of movement.

The company’s response

Flock disputed the characterization of the incident. In a statement, a Flock spokesperson said: “The unauthorized removal and tampering of a Flock camera is illegal.” Asked specifically about the encryption key stored on the camera, the company added: “Flock takes security seriously and maintains a public Vulnerability Disclosure Policy for security researchers to report potential vulnerabilities directly to us. We received no report through that process, and based on the limited information provided, we do not have enough detail to assess the claims being made. If the individuals identified legitimate vulnerabilities, we encourage them to submit their technical findings through our vulnerability reporting process so our security team can review them and take any appropriate action.”

One of the hackers acknowledged the legal exposure. “Being investigated is a legit concern and something we are trying to avoid,” the person said. “I’m sure our actions have attracted some attention as it is, but we are careful and try to keep a low profile.”

The removal is not an isolated tactic. Across the country, multiple people have been arrested for allegedly tampering with or otherwise sabotaging Flock’s cameras. Some towns have announced they will stop using Flock’s cameras altogether, and one police department went as far as building a fake, 3D-printed Flock camera case to bait potential vandals.

In early 2025, security researcher Jon “GainSec” Gaines reverse-engineered a Flock license plate reader and documented flaws that could be used to gain root-level access. After Gaines disclosed his findings, the company acknowledged them but downplayed their severity, writing that the flaws required physical access to the device and that even someone who gained access to a camera “would still not be able to gain access to footage,” because images remained on the device only briefly after being transmitted to the cloud.

Noel Pichardo, a former Pawtucket, Rhode Island, police officer who became an outspoken critic of Flock after challenging his department’s use of the cameras, said he understands the activists’ frustration but worries that sabotaging devices could strengthen the case for them. “I think that type of vigilantism will only crystallize the police and the state at large in their belief that this tool is necessary,” Pichardo said. “The longer the state continues to ignore the groanings of their constituents who are against this type of surveillance, the more this will happen.”

Storage strain and log chatter

The camera’s logs show a device under pressure. The software recorded more than 27,000 “no space left on device” errors while trying to save full-resolution images, along with tens of thousands of related errors, crashes, and reboots.

At the same time, roughly every two minutes, code checked whether the camera was still running and logged the message, “Who’s a good boy?!” More than 12,000 of those messages appear in the recovered logs. When the camera did restart, another service left a final line in the log: “A reboot was requested! ¡Adiós, Amigos!”

The device’s processor is similar to those used in midrange smartphones, and it runs about 20 Flock-built apps handling everything from motion detection and photography to object classification, data uploading, and remote updates. Those apps generated the logs, the errors, and the informal messages that appear alongside the operational records.

Why this matters beyond one camera

The material does not show that Flock’s servers were breached, and the most sensitive storage on the device stayed encrypted and out of reach. What it does show is that a single camera pulled off a pole can yield images of tens of thousands of vehicles, logs documenting how the device sees people, and an encryption key sitting on the same hardware it protects. For communities weighing whether to keep license plate readers, that distinction — between what stays in the cloud and what a determined person can extract on the ground — may be the one that decides the argument.

The recovered logs also suggest a practical question for agencies that run these cameras: how long device-level data survives, and who can reach it with physical access alone. Whether the findings change any department’s procurement decisions is not yet known. But the people who took this camera apart have said they plan to publish how they did it, which could put the same inspection within reach of others.