Hackers Figured Out How Flock Camera Systems Actually Work By Pulling One Apart

If you've ever wondered exactly how easy it is to hack Flock cameras, the results are in, and it seems they're pretty darn vulnerable to hacking attempts. For the past couple years, several hacking groups have targeted Flock cameras and other Fourth Amendment-breaking automatic license plate readers (ALPRs) and proven their security vulnerabilities time and again. In some cases, Flock cameras have been found to be streaming live and archived video over the open internet, and in others, it took only about 30 seconds to gain access to a camera's stored footage after getting the box open.

Another recent hacking attempt has caught the public's attention, revealing the extent of the cameras' so-called encryption (spoiler: it's not good) and showing how much data ALPRs capture daily. The initial report of this hacking attempt — covered together by Wired and 404Media — details how the hackers acquired a Flock camera, cracked open its shell, and made a nearly perfect copy of the data inside.

The hacking collective behind this recent hacking attempt is known as stegan0gram, and the members represent just a small fraction of the people around the United States who keep vandalizing these ALPRs tracking our every move. Stegan0gram is taking things a step further, though. In an interview with 404Media, one of the hackers discussed "liberating" the hardware and reverse engineering it. The anonymous agent laid our their philosophy, asking "Why just destroy them when we can reverse engineer them and find the secrets of those spying on us?"

A good question, indeed, stegan0gram. With cities all over the country ditching the ALPR laughing stock that is Flock Safety in favor of companies like Axon, which collect similar data and give law enforcement agencies unfettered, warrantless access to it, such secrets are well worth uncovering.

Flock cameras and cameras from companies like Axon are called ALPRs, which would imply that what they do is, you know, automatically read license plates. However, the term is something of a misnomer. Despite Flock Safety's claims that their network of over 100,000 spy cameras doesn't track individuals or any information other than a car's "signature," it's been known for some time that these privacy-eroding cameras are capturing more than just plates. The recent hack by sten0gram shows that ALPRs are capable of surveilling the public in much scarier ways.

When the hackers opened up their camera and looked inside, they found some data unencrypted, including a section of the camera's memory bank titled "media," inside which was stored an encryption key that opened up previously encrypted data. In effect, a company that sells your location, driving patterns, and life story to law enforcement, including Immigration and Customs Enforcement, hid the key to their house under the welcome mat.

With the newly decrypted data, the hackers had access to records of over 50,000 vehicles, including over 1.5 million images. The camera's highlights also clearly showed that the technology knows how to detect individuals, license plates, and bicycles, in addition to motor vehicles. The collective also found that the camera had logged bumper stickers, license plate frames, and other graphics, likely misidentifying them as plates.

What doesn't seem to happen inside the camera is also notable. From when stegan0gram could determine, Flock cameras don't actually read license plates locally. Nor do they build a car's signature, using data like make, model, color, and identifying features. Instead, these operations are likely done on Flock's own servers after the data is transferred from the camera.

The reason we know so much — perhaps anything at all — about how ALPRs function, what data they gather, how incredibly widespread they are, and how troubling their security is, has nothing to do with transparency from the companies making millions spying on us. In reality, companies like Flock and Axon try to keep mum in public. Flock cameras even come with guidance for police agencies on how to own the narrative surrounding these creepy cameras so that they can get them installed in cities without getting push-back from the citizenry. Much of what we know about how ALPRs function is thanks to the tireless work of people who take issue with law enforcement being allowed unilateral access to what ought to be protected data.

This push-back isn't all coming from one area or group, either. DeFlock.org has been one of the most constant presences in ALPR education and awareness. This website maps Flock cameras across the country and started in 2024 as the passion project of a curious software engineer. It's irked Flock's mission so sorely that Flock CEO Garrett Langley publicly called the site and those who support it a terrorist organization. Recently, MapQuest jumped on the DeFlock bandwagon and started showing Flock cameras on its own maps.

Hackers like the stegan0gram collective, GainSec, and Benn Jordan have been instrumental in bringing the mysteries of ALPRs to light. The next time you see a Flock camera while driving down the road, take a second to appreciate the hard work of the people who taught you how to look for them, and if you have strong feelings about spy cams logging your car's every movement, consider writing to your city government, who could be persuaded to drop Flock and other ALPRs entirely.