Flock files a trademark claim to remove a map built from its own exposed ArcGIS token

By Michael's account, the weak point was a Flock web page. He says the site gave out an access token without a login ^[6], and he presented that token to ArcGIS, the third-party mapping service Flock uses ^[7]. A credential served to an anonymous browser authenticates whoever loads the page. If it worked that way, Flock's device data in ArcGIS was as private as a public web page.

In his November 13, 2025 email to Flock, Michael wrote that "all testing was strictly non-intrusive, limited to open unauthenticated endpoints, and did not involve bypassing authentication, modifying data, or invoking any billable ArcGIS or Google operations" ^[8]. The reporting does not say what the token was scoped to, how long it stayed valid, or whether Flock's logs recorded his queries.

The inventory holds more than coordinates. It identifies equipment by model and, in some cases, by labels that point to sensitive locations ^[17]. The Intercept checked six randomly selected Arizona locations and found Flock cameras at each ^[16]. Six hits confirm the data was real where it was sampled. They say less about the rest. The map calls its data a December 2025 snapshot ^[14], about nine months old when it went public ^[2].

According to Tom's Hardware, Michael's analysis covers 22 sensitive sites, the Pentagon and CIA Headquarters among them ^[24]. It gives people living within 20 miles of those sites a 57.22% to 93.94% chance of passing a Flock camera ^[24]. That range is his model's output. For it to hold today, the December 2025 placements have to still stand where the map puts them. The route model behind the percentages also has to match how those residents actually travel.

Michael told The Intercept that Flock issued its no-breach statement "after I pulled their database of devices" ^[20]. "That leaves two possibilities," he said. "Either they knew and chose not to disclose it for fear of bad press, or they didn't know I exfiltrated the data at all. The first is a transparency failure. The second is a detection failure with national security implications." ^[21]

Doppel, which filed the complaint, is a cybersecurity company focused on social engineering defense ^[4]. Its complaint says the site uses the "FLOCK SAFETY" mark without authorization and may confuse customers ^[3]. It arrived one day after the map went live ^[1]. For a firm whose business is sites that impersonate its clients, it picked an odd target: the map greets first-time visitors with a pop-up saying it is not affiliated with or endorsed by Flock ^[5].