Flock becomes the CVE authority for its own license plate readers and cameras

The CNA role itself is common. Zach Edwards, a security and privacy researcher, is dubious about Flock holding it, but he adds that many vendors, including some offering similar products, are already in the program ^[11]. Katie Moussouris of Luta Security made the case for vendor-run CNAs: "Vendors make sense as CNAs for their own products if they can be trusted to maintain accurate records. They know the code, they can confirm the flaw, and they can tie the record to affected versions and the fix," she said ^[17].

The same job carries the risk. "A vendor in the CNA role writes the description and often sets the severity score, so an immature vendor may inaccurately represent an issue, either through ignorance or in a misdirected effort to downplay it," Moussouris said ^[16]. Edwards called CNAs "essentially grading their own homework" ^[15].

Flock has one documented decision of this kind, and it predates the role. Researchers last year reported multiple defects in its license-plate reader and gunshot detection system. Flock submitted them for inclusion in the National Vulnerability Database but deemed them not material because they require physical access ^[7]. "These cameras sit on poles on public streets," Moussouris said ^[8]. Flock's disclosure policy also disallows physical attacks in testing ^[9]. On the sources' account, the class of flaw Flock has already graded as immaterial is a class its policy tells researchers not to probe.

The policy also reserves the right to hold back publication if Flock decides disclosure would create a safety risk to law enforcement or the public ^[10]. Moussouris said: "The latter may lead to an abuse in their authority and control of CVEs unless they embrace a more mature customer-safety-first stance of timely, transparent, and accurate vulnerability disclosure" ^[18]. CyberScoop reports there are relatively few norms for how CNAs operate, because responsibility comes down to each participating vendor ^[12].

Flock's own account is short. Chris Castaldo, its chief information security officer, said the authority "allows us to move faster when researchers report findings, eliminate confusion from duplicate or conflicting vulnerability entries and give our customers a single, trusted source for security information about our products" ^[3]. Flock declined to answer CyberScoop's questions or make an executive available, and referred the outlet to a blog post ^[5]. It published its disclosure policy in August and recently created a security advisories page for newly discovered and confirmed vulnerabilities ^[6].

In our view, the physical-access ruling and the withholding clause are the two places where a Flock record could depart from what a city needs. Moussouris set a test that anyone can check: "The measure of Flock as a CNA is whether its records give cities, police departments, and the public enough detail and accuracy to let people track specific risks by product version, the nature of the vulnerability, and ideally how to mitigate or fix it" ^[13]. CyberScoop also notes that Flock's business has drawn public and legal scrutiny over privacy and multiple reports of police abusing the technology, and that this scrutiny could cloud how researchers view it as a CNA ^[4].

Edwards noted that activists have already done technical teardowns of Flock's products. He expects some researchers to keep disclosing Flock vulnerabilities without coordinating with the company ^[14].