Learn More

1. Cybersecurity Concerns

Thanks to independent researchers who took it upon themselves to ethically hack offline Flock devices, we have some insight into the security measures (or lack-therof) that Flock has gone to to protect the vast amount of personal data they collect on Americans. Below are some highlights from the published research report^[1] and a video by another researcher, Benn Jordan^[2] covering it, as well as Flock's official response.

The first half of the video shows a detailed account of some of the most basic security vulnerabilities found in the Flock systems, as well as demonstrates that their claims about image deletion and encryption are blatantly false. These are not small issues that can be fixed with guardrails or use-policies. In fact, Flock's security is so lacking that Oregon Senator Ron Wyden is urging the FTC to investigate Flock for "needlessly exposing Americans' personal data to theft by hackers, foreign spies, and criminals."^[3]

Here are some highlights from the report:

• One of the devices tested was running an old version of Android that stopped getting security updates in 2022. Finding #18 p. 40
• Buttons and ports are physically accessible on the underside of one of the LPR cameras. Executive Summary p. 11
• Pressing any such button 3 times will turn on the wifi hotspot where you can use the weak default password to connect via your phone or laptop. Finding #28 p.51
• Secure boot was disabled on all 3 devices tested. This opens up vulnerability to certain types of malware attacks, which can evade detection and give remote control to a bad actor, to execute during boot. Finding #1 p.16, Finding #12 p.34, Finding #21 p.44

This level of security is a joke and is a testament to a fundamental lack of organizational respect for the security and privacy of customer and public data.

Flock acknowledged and responded on their blog in May 2025^[4] to the initial public disclosure from the researchers and in Nov 2025^[5] to the published report. They made no attempt to discredit the research, thus legitimizing it and showing us that we can trust the information. The posts were mostly typical corporate speak but a few things stood out. The below quote, which appears in bold text on their blog, really speaks to their priorities:

Members of the general public, the ones who stand to lose the most in the event of a security breach at Flock, are not customers of Flock. So long as the customers (government agencies and private businesses) don't lose access to their tracking tools, everything else is an afterthought. But even then, one of the vulnerabilities was possible remote control by a bad actor, so their statement isn't even true. They blatantly lied to their customers.

Flock also tried to downplay the vulnerabilities in their blog posts, but they offered some weak examples:

LPR cameras are left unattended on the side of the road. It's reasonable to expect that anyone can get physical access to these devices, no Mission Impossible stunts required. Unless you consider ladders to require specialized skill and access.

2. Is Flock Effective?

coming soon

3. Transparency

coming soon