Learn More

1. Cybersecurity Concerns

Thanks to independent researchers who took it upon themselves to ethically hack offline Flock devices, we have some insight into the security measures (or lack-therof) that Flock has gone to to protect the vast amount of personal data they collect on Americans. Below are some highlights from the published research report^[1] and a video by another researcher, Benn Jordan^[2] covering it, as well as Flock's official response.

The first half of the video shows a detailed account of some of the most basic security vulnerabilities found in the Flock systems, as well as demonstrates that their claims about image deletion and encryption are blatantly false. These are not small issues that can be fixed with guardrails or use-policies. In fact, Flock's security is so lacking that Oregon Senator Ron Wyden is urging the FTC to investigate Flock for "needlessly exposing Americans' personal data to theft by hackers, foreign spies, and criminals."^[3]

Here are some highlights from the report:

• One of the devices tested was running an old version of Android that stopped getting security updates in 2022. Finding #18 p. 40
• Buttons and ports are physically accessible on the underside of one of the LPR cameras. Executive Summary p. 11
• Pressing any such button 3 times will turn on the wifi hotspot where you can use the weak default password to connect via your phone or laptop. Finding #28 p.51
• Secure boot was disabled on all 3 devices tested. This opens up vulnerability to certain types of malware attacks, which can evade detection and give remote control to a bad actor, to execute during boot. Finding #1 p.16, Finding #12 p.34, Finding #21 p.44

This level of security is a joke and is a testament to a fundamental lack of organizational respect for the security and privacy of customer and public data.

Flock acknowledged and responded on their blog in May 2025^[4] to the initial public disclosure from the researchers and in Nov 2025^[5] to the published report. They made no attempt to discredit the research, thus legitimizing it and showing us that we can trust the information. The posts were mostly typical corporate speak but a few things stood out. The below quote, which appears in bold text on their blog, really speaks to their priorities:

Members of the general public, the ones who stand to lose the most in the event of a security breach at Flock, are not customers of Flock. So long as the customers (government agencies and private businesses) don't lose access to their tracking tools, everything else is an afterthought. But even then, one of the vulnerabilities was possible remote control by a bad actor, so their statement isn't even true. They blatantly lied to their customers.

Flock also tried to downplay the vulnerabilities in their blog posts, but they offered some weak examples:

LPR cameras are left unattended on the side of the road. It's reasonable to expect that anyone can get physical access to these devices, no Mission Impossible stunts required. Unless you consider ladders to require specialized skill and access.

Update 12/23/25: 404 Media and Benn Jordan covered another vulnerability: Flock camera live feeds streaming online for anyone to view.^[15] Benn appropriately called this "Netflix For Stalkers." In the 11-minute video, he shows footage of a family loading their Lowe's purchase into their truck, a man roller blading and then watching a roller blading video on his phone, a woman running on a trail alone, and children playing in a park unsupervised. Maybe the woman feels safe running that trail alone knowing that it has cameras, but I bet she would think twice if she knew who was really watching.

2. Is Flock Effective?

coming soon. you may need to clear your browser cache, and restart your phone to see the updated page when checking back for updates

3. Transparency - Flock

Flock says that they believe in transparency, but do they meaningfully practice it?

The first red flag is that Flock's website is blocked on the Wayback Machine. The Wayback Machine is an internet archive that takes snapshots of webpages at different times, allowing people to see old versions of webpages in case anything changes. When eyesoffgsp.org quotes Flock's blog to demonstrate their attitude towards something, Flock could later edit the blog and there won't be a good way to prove what they originally said. In contrast, the eyesoffgsp.org code is stored on GitHub, meaning anyone can see every change that was ever made to the website.

Speaking of Flock's blog, they posted a three part series on transparency. Here's how they introduce the series:

If they're trying to say that they want to make transparency easier so that officers can spend more time fighting crime and less time on FOIA requests, this is the worst way to say it. The connotations imply a loathing of transparency and a hint of disregard for the rule of law and constitutional protections. But there's still two more posts, so let's see if they double down or redeem themselves:

If they're trying to say that there used to not be an easy way to redact confidential info, this is the worst way to say it. It feels like coded language for an intent to make it easier for agencies to disclose as little information as possible in FOIA requests, when considering the context of how the search reason field has been used in the past, with thousands of examples of "investigation," "suspect," "donut," "asdf," and similarly vague or meaningless terms being revealed through FOIA requests.^[8][9]

In order to address those concerns, Flock went on to introduce a new feature: mandatory Offense Type drop-down selection. Now, if an officer is stalking his ex-girlfriend, instead of typing "inves" as the search reason, he will just have to pick a random crime from the drop-down to pretend to be investigating. This does little to help leadership monitor use of the system, but let's look at a solution that could.

An independent analyst used sample data to build a search anomaly dashboard (below).^[10] It graphs a user's historical search queries by hour and performs statistical analysis to flag suspicious search frequencies or other anomalies.

Building on this example dashboard, the system could then have automated alerts, or weekly user analytics reports sent to supervisors for review. It's not a very big ask for a multi-billion dollar company to think of or to implement something that an independent analyst can put together in their free time. Flock could have developed analytics and reporting features years ago, but instead they've been developing new products (something that actually generates revenue). It's also worth noting that law enforcement and council leaderships have not been demanding such accountability measures as customers.

It's easy to talk about transparency, but true values are imbued into all actions big and small, from decision-making to simple word choices. Flock has demonstrated that they are unable or unwilling to put transparency first.

Update 12/17/25: Flock tried to shut down the website of the independent analyst mentioned here, by falsely accusing them of phishing and trademark infringement.^[11]

Update 12/19/25: 404 Media reported back in May 2025 that Flock's upcoming product Nova uses breached data obtained from the dark web based on leaked information.^[12] This would mean that officers could perform a person search in Nova and receive information about them that was leaked in a data breach. Flock tried to gaslight everyone by explaining that the dark web data discussions only surfaced because some of the agencies in the beta program asked for the option but ultimately they decided not to pursue it.^[13] However, an independent researcher uncovered evidence that says otherwise.^[14] By inspecting the html code of the Nova front-end website, the researcher showcases data sources explicitly named "Dark Data" with fields for social security number, credit card number, IP addresses, and other sensitive types of personal information.

4. Useful Links