Hackers unlocked thousands of Flock detections with a key found on the camera itself

The key was on the camera. A group of hackers reportedly pulled a Flock unit off a roadway and copied its storage. From that same storage they recovered an encryption key, and it opened video of thousands of vehicle detections that Flock says on-device encryption protects ^[3][4]. Flock said it could not assess the claims without more detail ^[5]. Anyone who can reach a pole and remove a unit inherits what the unit stored, and the finding turns on that physical access ^[12].

The recovered files also carried software models that detect people, alongside vehicles, bicycles and license plates, according to the joint 404 Media and WIRED investigation ^[2]. The researchers found no evidence that face-recognition features were actively used ^[6]. So what the files show is a person class in an object detector, running on hardware sold to police for finding stolen cars and wanted suspects ^[1]. The retention schedules and search-audit language for these systems were written around plate reads.

In Washington, the argument is about who gets searched. The DC Police Union says it learned in July that Metropolitan Police Department Internal Affairs investigators had used Flock plate-reader data to track sworn officers under investigation without their knowledge ^[8]. The union filed a complaint and asked the department to stop, arguing that MPD lacked adequate controls for a system with that much surveillance capability ^[9]. The dates of the searches have not been reported. MPD defended the use, saying its position is that the use of plate-reader data in the misconduct investigation was appropriate, and said the labor dispute is headed to arbitration ^[10].

WIRED found that records from the city of Alpharetta, Georgia "were accessible to more than 2,000 agencies, including police departments, colleges, airports, and, inexplicably, the Office of Inspector General for the federal General Services Administration" ^[7]. So Alpharetta writes the retention, justification and audit rules, and more than 2,000 agencies can query the records those rules cover.

The hacker account reaches the public through the investigation and Flock has not confirmed it ^[5]. Nor does the reporting show the person-detection models being used to assemble histories of named individuals. The recorded harm alleged so far is the DC case, where the tracking was done with plate data by the officers' own department ^[8].

Malwarebytes, which wrote up both reports, argues that a network recording repeated sightings can expose where someone lives, works, worships or seeks healthcare. Match a person to a vehicle, it says, and vehicle tracking becomes person tracking in practice ^[13]. Its recommended controls include documented investigative justification before a search and independent security assessments covering key management ^[11].