The Eyes Above the Road

Flock Safety, Hacking Risks, Police Abuse and the Infrastructure of Mass Surveillance

By Ashton Seales

A camera appears beside a roadway.

It may be mounted on a black pole, attached to a traffic sign or powered by a small solar panel. It does not issue speeding tickets. It does not simply record an intersection in case something happens.

It photographs passing vehicles, attempts to read their license plates and uses artificial intelligence to catalog details such as vehicle color, make, model, body type, damage, temporary tags and other distinguishing features. Each observation is associated with a time and location and uploaded into a searchable cloud platform.

One camera may only document a single road.

Thousands of connected cameras can reconstruct a person’s movements across a city.

Tens of thousands, shared across jurisdictions, can create something much larger: a privately operated surveillance network capable of following vehicles across counties, cities and state lines.

Flock Safety markets that network as a public-safety tool. Its products can undoubtedly produce useful evidence during legitimate criminal investigations. But that narrow benefit cannot be allowed to obscure the system being constructed around it - an increasingly centralized collection of cameras, artificial intelligence, police databases, private surveillance feeds, drones, microphones and cloud infrastructure.

The question is no longer whether one license-plate camera can help solve a crime.

The question is whether Americans are willing to build a nationwide movement-tracking system first and establish meaningful constitutional safeguards afterward.

Flock Is Not Just One Kind of Camera

Public discussions about Flock often treat every device as though it were the same. They are not.

Flock now sells or operates a connected collection of license-plate readers, conventional video cameras, gunshot-detection sensors, mobile surveillance trailers, investigative software and drones. The company describes its platform as connecting “detection, investigation, and response” through license-plate recognition, video, audio detection and real-time coordination.

License-plate readers

Flock’s best-known products are automated license-plate readers, commonly called ALPRs or LPRs.

These cameras capture images of passing vehicles and extract searchable information from them. Unlike a red-light or speeding camera, an ALPR is not primarily designed to document a traffic violation. Its purpose is to identify, catalog and later locate vehicles.

The system can search more than a plate number. Flock advertises vehicle identification based on details including make, color and distinguishing characteristics. The ACLU says the system can catalog bumper stickers, scratches and other features, turning ordinary vehicle images into a searchable movement database.

These devices generally should not be described as continuously livestreaming video. They capture vehicle images and associated metadata, temporarily process or store the material on the device and then upload it through a cellular or network connection to Flock’s cloud environment. Flock materials state that its law-enforcement data is stored using Amazon Web Services, including AWS GovCloud for criminal-justice information.

That distinction matters for accuracy, but it does not eliminate the privacy concern. A searchable record that says a particular vehicle was at a specific location at a specific time can reveal far more about a person’s life than an ordinary traffic camera that nobody examines unless an incident occurs.

Live and recorded video cameras

Flock also markets fixed and pan-tilt-zoom video cameras. These are more like traditional surveillance cameras and can provide live and recorded video, digital zoom, remote camera controls and cloud-based access.

The company advertises AI alerts for people and vehicles and tools capable of searching recorded footage without manually watching hours of video. These systems are intended for continuous security coverage at locations such as streets, buildings, parks, intersections and parking areas.

These video products make the statement that Flock cameras “do not track people” increasingly difficult to apply across the company’s entire ecosystem. A license-plate reader may focus on vehicles, but Flock’s video systems specifically advertise people-detection alerts.

Audio detection

Flock also operates audio-detection technology intended to recognize sounds associated with emergencies, particularly gunfire. Such systems turn microphones positioned in public areas into automated alerting sensors.

Audio detection raises a separate set of questions: what the microphone can hear, what is processed locally, what is transmitted, how non-gunshot sounds are handled and whether future software updates could expand the system’s purpose.

A physical microphone may remain the same while its capabilities change through software.

Drones and mobile surveillance

Flock’s Drone as First Responder system is designed to launch remotely and send live aerial video to emergency personnel before officers arrive. Its mobile security trailers combine elevated cameras, remote monitoring and rapid deployment.

Drones may be justified during a missing-person search, active threat or disaster. But a drone integrated into a real-time policing platform can also be used for routine observation, protest monitoring or following individuals.

The technology itself does not enforce the boundary. Policy, law and meaningful external oversight do.

FlockOS and the investigative platform

The most consequential product may not be a camera at all.

FlockOS is the software layer that combines sensor data, searches, alerts and evidence across departments and locations. Flock promotes cross-agency visibility and the ability to connect incidents that cross jurisdictional boundaries.

That is the central issue.

A camera watches one location. A platform connects locations.

Once a vehicle appears repeatedly across a network, the system can help establish where it traveled, when it appeared and which jurisdictions observed it. The cameras become collection points for a centralized investigative tool operated not by the public, but by a private corporation.

A Private Company Between the Public and the Police

Flock is not a democratically accountable public agency.

It is a private surveillance vendor selling access to public agencies, businesses, schools, homeowners’ associations and other customers. Local governments may pay for the cameras, but the images, searches, software, security architecture and interagency connections run through Flock’s platform.

This arrangement creates an unusual transfer of public power.

Police traditionally needed their own personnel and resources to follow someone from one location to another. Large-scale physical surveillance was expensive, visible and difficult to sustain.

An interconnected ALPR system radically reduces that cost.

An officer can search historical records, establish where a vehicle appeared and request access from other participating agencies without physically maintaining surveillance on every road. Flock explicitly promotes the ability to locate vehicles and collaborate across jurisdictions.

The ACLU estimates that tens of thousands of Flock cameras have been installed in urban and rural areas and warns that the network uploads vehicle observations into a database searchable by participating law-enforcement agencies, often with inadequate oversight. It also reports that fewer than 1 percent of vehicles scanned are associated with suspected wrongdoing.

That means the overwhelming majority of the system’s subjects are not suspects.

They are ordinary people driving to work, visiting family, attending religious services, meeting a journalist, going to a political event, seeking medical care or entering the office of an attorney.

A license plate does not reveal a person’s thoughts.

A sufficiently detailed history of where that plate appears may reveal nearly everything else.

Researchers Found More Than a Theoretical Risk

Privacy concerns might be dismissed as speculative were it not for what independent researchers have demonstrated.

Cybersecurity researcher Jon Gaines, known as GainSec, documented dozens of reported security issues affecting the Flock ecosystem. In November 2025, Gaines said his formal research summary covered 45 issues, 44 of which he discovered, reported and disclosed himself.

His work was brought to a wider audience by musician, science communicator and investigative YouTuber Benn Jordan, working with Gaines and cybersecurity researcher Joshua Michael.

In Jordan’s video, “We Hacked Flock Safety Cameras in Under 30 Seconds,” the researchers demonstrated that physical access to a legally obtained Flock device could expose administrative functions and allow deep control over the Android-based system. The demonstration showed how an attacker with access to the unit could potentially transform surveillance hardware into an unauthorized camera, network foothold or malware host.

Jordan later documented publicly exposed Flock video feeds, including a camera reportedly aimed toward a playground and broadcasting online without proper access restrictions.

These were not merely social-media allegations. Multiple vulnerabilities affecting Flock components were subsequently recorded through the formal Common Vulnerabilities and Exposures process and published by the National Vulnerability Database.

Among them:

• CVE-2025-47822 documented improper access control on an on-chip debug interface affecting Flock LPR firmware, with potential consequences for confidentiality, integrity and availability.

• CVE-2025-59403 documented a lack of authentication on administrative endpoints in an Android application responsible for camera feeds on Falcon, Sparrow and Bravo devices. Those endpoints reportedly included functions for rebooting the device, collecting logs and enabling Android debugging.

• CVE-2025-59405 documented a cleartext monitoring-service API credential embedded in software installed on Falcon and Sparrow readers and Bravo edge-computing devices.

• CVE-2025-59406 documented another cleartext authentication secret embedded in a Flock application.

• CVE-2025-59407 documented a bundled Java keystore, its hardcoded password and a private key within software installed on multiple Flock device types.

A vulnerability does not automatically prove that every deployed Flock camera was compromised. Some findings required physical access, particular software versions or specific conditions.

But physical-access requirements should not be casually dismissed when the devices are installed outdoors, sometimes on publicly accessible roadside poles. More importantly, the findings challenge any claim that these systems should be trusted simply because the company says they are secure.

A public agency considering a surveillance network should not ask whether the vendor promises cybersecurity.

It should demand independent evidence.

The Warning Reached City Hall

Jordan did not limit his concerns to YouTube.

He appeared before the Dunwoody, Georgia, City Council during its consideration of additional Flock services. Public concern, records obtained by local advocates and questions about security contributed to multiple delays in the proposed agreement.

Reporting on the meetings described concerns over data sharing, unauthorized access and whether private-camera information marked not to be shared had nevertheless become accessible to outside departments. A Flock employee’s access to a camera associated with the Marcus Jewish Community Center also concerned city leaders.

Jordan’s central recommendation was straightforward: cities should require an independent security audit before trusting a surveillance vendor.

That should not be considered a radical demand.

Cities routinely require engineering inspections before opening a bridge. They audit financial statements before issuing bonds. They require insurance, licensing and inspections from contractors performing physical work.

Yet local governments are being asked to install systems capable of reconstructing people’s movements while relying heavily on assurances supplied by the same vendor seeking the contract.

A police chief is not necessarily a cybersecurity expert.

A council member is not necessarily an artificial-intelligence auditor.

A sales presentation is not an independent assessment.

When Surveillance Access Becomes Personal

The danger is not limited to outside hackers.

A secure surveillance system can still be abused by an authorized user.

The Institute for Justice reported in April 2026 that police officers had used license-plate-reader systems to monitor romantic interests at least 14 times in recent years. The reported subjects included spouses, former partners and strangers who attracted an officer’s personal attention.

These incidents expose the weakness of a familiar defense: “Every search is logged.”

Logs can help establish what happened after misconduct is discovered. They do not necessarily prevent an officer from carrying out an improper search in the first place.

Accountability also depends on someone regularly examining the logs, recognizing suspicious behavior, investigating it and imposing consequences. The ACLU has warned that agencies and vendors frequently point to audit logs as a safeguard even when auditing is incomplete, inconsistent or reactive.

The ACLU’s current campaign against unregulated ALPR systems cites several other alarming examples:

Kansas police reportedly used license-plate-reader information in connection with a man who had written an opinion piece critical of the department.

A Colorado officer allegedly relied on a faulty Flock result to accuse a woman of theft and disregarded evidence indicating the system was wrong.

In another widely reported incident involving ALPR technology, a mother and her children were detained at gunpoint after their vehicle was wrongly identified as stolen.

Flock readers have also produced concerns involving immigration enforcement. Investigations found that local searches and interagency-sharing configurations allowed Flock information to be used in ways that communities and even some participating agencies did not fully understand. Flock later halted one federal pilot program after public controversy over how the network was being used.

A surveillance system can be abused for political monitoring, immigration enforcement, domestic stalking or retaliation against critics without changing a single line of code.

The same search box used to locate a stolen vehicle can be used to locate an ex-partner.

The difference is not technological.

It is the intention of the person typing the query; and whether anyone is watching them.

Artificial Intelligence Expands the Search

Flock and supportive officials frequently emphasize that its license-plate readers do not use facial recognition.

That is relevant, but incomplete.

A system does not need to identify a human face to track a person’s movements.

Most Americans travel in vehicles registered to themselves, relatives or employers. Identifying the vehicle, searching its distinctive characteristics and documenting it repeatedly can function as a practical proxy for tracking the person associated with it.

Flock has also developed AI-based tools that move beyond exact plate matching. The ACLU reported that Flock introduced functionality designed to identify driving patterns the software considers suspicious.

That changes the role of the system.

It is no longer only responding when officers enter a known plate associated with a specific crime. The algorithm itself can help decide which patterns deserve police attention.

Artificial intelligence does not eliminate human bias. It can automate assumptions and apply them across enormous datasets at a speed no human investigator could match.

A driver circling a block may be planning a burglary.

The driver may also be lost, delivering food, looking for an address, avoiding road construction or trying to calm a crying child.

Once an algorithm labels ordinary behavior as suspicious, police attention may follow before the person has done anything illegal.

The National Network Is the Product

Flock often stresses local ownership and local control.

But the value of its system grows because cameras and agencies are connected.

A single town’s database may show that a vehicle entered town.

A multi-state network may show where it came from, where it stopped, which route it took and where it went next.

Flock itself promotes cross-agency visibility as a central advantage.

That network effect means a local council is not merely voting on a few cameras.

It is deciding whether to attach the community to a much larger surveillance system.

Officials may believe their written policy prohibits certain searches. But the network’s practical reach also depends on software settings, mutual-sharing agreements, user permissions, federal requests, neighboring agencies, vendor employees and future contract language.

In Dunwoody, records reportedly showed that private camera data marked “do not share” had nevertheless been accessible to four other departments until the issue was corrected.

A safeguard that exists only as a checkbox can be removed by another checkbox.

Flock’s Own Claims Require Scrutiny

Flock says searches are logged, customers control their data, information is encrypted and privacy protections are built into the platform. It also says its products support enormous numbers of investigations and public-safety outcomes.

Those claims deserve to be presented.

They also deserve verification.

In July 2026, the ACLU published a detailed criticism accusing Flock of making misleading or false statements to local governments and the public about system capabilities and data practices. Among the disputes was whether Flock’s software could create maps revealing a vehicle’s movement history.

Meanwhile, cities have begun canceling, pausing or reconsidering Flock agreements amid concerns over transparency, immigration access, cybersecurity and police misuse. More than 80 municipalities had reportedly ended contracts by July 2026.

Douglas County, Colorado, decided to leave Flock after officials learned that a camera at a public open-space property had been accessible online. The sheriff said the incident damaged his trust in the company.

In Troy, New York, the dispute became so severe that the mayor declared a state of emergency to continue paying for the system after the council sought to stop payments. Residents objected that cameras had been installed without adequate public approval, while council members sought stronger limits on retention and use.

When surveillance becomes powerful enough that officials declare an emergency to preserve it, the public should pay attention.

The Data-Center Connection

Flock’s roadside cameras are only the visible edge of the system.

The actual power exists elsewhere; in servers, cloud platforms and data centers capable of storing, organizing, searching and sharing enormous quantities of information.

A license-plate image becomes useful for long-term surveillance only after it is uploaded, indexed and connected to other observations.

An AI camera becomes scalable only when computing infrastructure can analyze footage and compare patterns across time.

A drone becomes part of a coordinated surveillance system when its live video can be routed into the same software environment used by dispatchers, analysts and officers.

Flock states that cloud infrastructure, including Amazon Web Services, is used to store and protect its information.

This is where the debate over surveillance and the debate over data centers converge.

Communities are being asked to approve enormous data-center projects based on promises of jobs, tax revenue and technological progress. At the same time, police departments and private companies are deploying systems that generate growing quantities of images, video, audio, location records and AI-derived intelligence.

The cameras collect.

The data centers remember.

Without the server infrastructure, a camera is an isolated device with limited storage.

With cloud computing, artificial intelligence and interagency access, it becomes one node in a national surveillance architecture.

Data centers also impose physical costs on communities. The International Energy Agency projects that global data-center electricity consumption could approximately double by 2030, reaching around 945 terawatt-hours annually.

The public therefore bears risks on both ends.

Residents may face the environmental and infrastructure pressures associated with rapidly expanding data centers (electricity demand, grid construction, land use and sometimes substantial cooling requirements) while those same facilities support private systems that collect and analyze the public’s movements.

A community should not debate data-center construction solely in terms of megawatts and tax abatements.

It should ask what data will be processed there.

Who will own it?

Which surveillance and AI companies will use the capacity?

Will public agencies purchase services running through the facility?

What information will be retained, combined or sold?

Will the center support systems used for immigration enforcement, protest monitoring, predictive policing or mass location tracking?

The physical infrastructure and the surveillance applications cannot be treated as unrelated issues.

One supplies the eyes.

The other supplies the memory and analytical power.

The Absence of Regulation Is a Policy Choice

The United States does not need to ban every license-plate reader, video camera or police drone to protect civil liberties.

There are legitimate uses for narrowly targeted technology.

A camera alert based on a plate connected to an active Amber Alert is fundamentally different from allowing thousands of officers to search years of ordinary travel without a warrant.

A drone deployed to locate a missing child is fundamentally different from routine aerial patrol over lawful demonstrations.

The problem is that many communities adopted these systems without first establishing enforceable boundaries.

At minimum, any government using Flock or a comparable system should require:

• A warrant for historical movement searches, with tightly defined emergency exceptions.

• A prohibition against searching people engaged in lawful political, religious, journalistic or protest activity.

• A prohibition against personal, romantic, retaliatory or immigration-related searches that are not authorized by law and local policy.

• Extremely short default retention periods unless specific data is preserved for a documented investigation.

• No automatic nationwide or statewide data sharing.

• Public disclosure of every participating agency and outside organization with access.

• Independent cybersecurity testing conducted by experts chosen by the government - not the vendor.

• Annual public audits of searches, sharing, false alerts, disciplinary incidents and policy violations.

• Automatic alerts for suspicious searches involving employees, elected officials, journalists, romantic partners or repeated queries without a case number.

• Meaningful criminal and employment penalties for intentional misuse.

• Public votes before cameras, drones, microphones or AI analytics are added or expanded.

• Clear contractual language preventing Flock from unilaterally expanding data use through revised terms of service.

• The right of residents to learn whether their vehicle was improperly searched after an investigation concludes.

• Independent environmental, infrastructure and civil-liberties reviews before public incentives are granted to data centers supporting surveillance or AI operations.

A system that cannot operate under those requirements may not be safe enough for government use.

We Should Not Have to Trust Everyone Forever

Supporters frequently argue that critics should trust local police.

That misses the point.

Constitutional protections are not accusations against every current officer. They exist because no institution should receive unlimited power based on an assumption that everyone who holds that power - today and decades from now - will always use it properly.

The officials approving these cameras will eventually leave office.

Police leadership will change.

Corporate ownership may change.

Contract terms will change.

Software capabilities will change.

Artificial intelligence will improve.

Political conditions will change.

Data gathered for one purpose can be repurposed for another.

A community may trust its current police chief not to monitor political opponents. It cannot guarantee that every future chief, officer, federal partner, vendor employee or hacker will show the same restraint.

We do not lock the courthouse because we believe every resident is a thief.

We lock it because valuable things require protection.

A record of an entire population’s movements is extraordinarily valuable.

It deserves more protection than a promise made during a sales presentation.

The Surveillance State Will Arrive Quietly

An authoritarian surveillance state rarely announces itself with a single dramatic law.

It arrives one camera at a time.

One police contract at a time.

One emergency exception at a time.

One database-sharing agreement at a time.

One promise that the technology is only being used against criminals.

Countries such as Russia have demonstrated how interconnected cameras, facial recognition, telecommunications records and centralized government power can be used to identify demonstrators, monitor political activity and suppress dissent.

The United States is not Russia.

But that does not mean it is immune from constructing similar technical capabilities.

The defining question is not whether today’s officials intend to create an authoritarian system.

It is whether they are assembling infrastructure that a future government could use as one.

Once cameras blanket the roads, drones patrol from above, microphones listen for classified sounds, private platforms combine the evidence and data centers preserve the results, meaningful anonymity in public becomes nearly impossible.

At that point, regulation will be more difficult because agencies will claim they cannot function without the system.

That is why rules must come first.

Before expansion.

Before permanent dependency.

Before the next vulnerability.

Before the next officer searches for an ex-partner.

Before the next journalist, protester, immigrant, political opponent or ordinary resident discovers that a machine has quietly documented every place they went.

Public safety matters.

So does the public’s freedom from constant suspicion.

We should demand independent audits, strict warrant requirements, short retention periods, transparent data-center agreements and enforceable limits on every surveillance system operating in our communities.

Because a free society should not require innocent people to prove they have nothing to hide.

It should require the government (and every private company operating on its behalf) to prove why it has the right to watch.