Hackers Got Inside a Flock Camera. Its Data Shows How the System Works

In a recent security breach, hackers gained access to a Flock surveillance camera system, revealing how the technology operates. Flock has marketed its cameras as protected by on-device encryption, but the hackers were able to bypass this security by copying the camera's storage and recovering an encryption key stored on the device. This allowed them to access videos of thousands of vehicle detections.

The hackers shared the stolen data with investigative journalists 404 Media and the transparency nonprofit Distributed Denial of Secrets, which then analyzed the material. While most of the camera's sensitive storage remained encrypted and inaccessible, the joint analysis revealed that the software running on the device explicitly detects people, vehicles, license plates, and bicycles. The camera can capture dozens of images of a single passing vehicle, generating over a million images in total.

The hackers emphasized that their actions were not just about destroying or removing the cameras, but about reverse engineering them to uncover potential privacy concerns. Multiple individuals have already been arrested for allegedly tampering with or sabotaging Flock cameras across the country. Some towns have even announced plans to stop using Flock cameras, while others have taken measures like creating fake cases to lure potential vandals.

The camera system photographs passing vehicles and sends the images and other data to Flock's servers, where the system processes license plate information and vehicle characteristics. However, the data also includes images that can potentially reveal sensitive information about individuals. In Alpharetta, Georgia, WIRED found that records from Flock cameras were accessible to over 2,000 agencies, raising concerns about privacy and data security.

The incident has sparked a national conversation about the use of Flock cameras and automatic license plate readers (ALPRs) in communities. Concerns have been raised about data privacy, misuse of the systems by law enforcement agencies, and the potential for abuse. The hackers' actions have shed light on the vulnerabilities of these systems and the potential risks associated with their widespread deployment.