In a joint investigation with transparency nonprofit Distributed Denial of Secrets, 404 Media and WIRED obtained a near-complete copy of the storage from a Flock Safety camera after hackers removed the device from a roadway and extracted its contents. The hackers recovered an encryption key stored on the camera itself, allowing them to unlock videos of thousands of vehicle detections.
While the most sensitive parts of the camera’s storage remained encrypted and inaccessible, analysis of the recovered data reveals that Flock’s software explicitly detects people as well as vehicles, license plates, and bicycles. According to several weeks of recovered logs, the camera produced more than a million images from passing traffic. Its computer-vision system also isolated bumper stickers and graphics — in one case capturing an American flag patch on a motorcyclist’s saddlebag.
Flock Safety has marketed its systems as protected by on-device encryption. The breach exposes a flaw in that claim: the encryption key was stored on the device itself, making the data recoverable by anyone with physical access. The hackers told the outlets they plan to publish details of how they obtained the software, encouraging others to replicate the attack.
The findings offer an unprecedented inside look at how Flock cameras operate in practice, going far beyond the company’s public descriptions of its technology.