Flock seeks to have security researchers' map of Flock cameras taken down
A vulnerability on the Flock website allowed a security researcher to access its third-party provider to download the locations and descriptions of over 300,000 Flock cameras. He also pointed out how the Flock system could be used to track personnel heading to and from sensitive sites like the Pentagon and the CIA Headquarters.
A security researcher named Joshua Michael discovered a vulnerability in Flock's website that allowed him to access a database of over 335,000 cameras without needing login credentials. Michael used this information to create a map of Flock cameras, which he shared on a website he named Flock Surveillance Map. Flock has now filed a trademark infringement complaint, seeking the removal of the website.
In November 2025, Michael queried ArcGIS, a third-party mapping and geospatial layer used by Flock, to retrieve a database of Flock devices. He informed the company about the security flaw in his email on November 13, 2025, stating that his testing was non-intrusive and did not involve bypassing authentication or modifying data.
However, Flock did not respond to his initial message, and it took him two more attempts to get a reply from a representative. Flock claimed to have fixed the vulnerability in January, but Michael had already exfiltrated the device location database before the fix. The researcher claims that Flock's website claims to have never been hacked or experienced a data breach, but Michael disputes this, stating that his actions prove otherwise.
He asserts that the failure to disclose the data exfiltration is either a transparency issue or a detection failure with potential national security implications. The researcher's findings raise concerns about Flock's cybersecurity and privacy measures, as the cameras have been found to store encryption keys directly on the device, allowing hackers to extract over 27,000 clips and capture more than 1.6 million images in a 21-day period.
Additionally, there have been instances of misuse by police officers, leading to stalking and detainment of individuals. While Flock has not commented on The Intercept's reporting, Michael received a trademark infringement complaint regarding the use of the "FLOCK SAFETY" term, leading to a request for the Flock Surveillance Map website to be taken down. Despite a warning pop-up on the website, Flock requested the removal of the site.
Written by urgent.news from Tom's Hardware's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
