Hackers Reveal How Flock Cameras Really Track Cars and People
Freeman writes:
Hackers ripped down a Flock camera above a roadway, made a near-complete copy of the data stored inside it, and shared the files with 404 Media and WIRED, revealing in new detail how exactly Flock Safety's cameras track the movements of both vehicles and people.
[...]
The breach provides an unprecedented look inside a system that Flock has described as protected by on-device encryption.
[...]
The hackers shared the material with 404 Media and the transparency nonprofit Distributed Denial of Secrets
[...]
"Why just destroy them when we can reverse engineer them and find the secrets of those spying on us?" one of the hackers, from a collective calling itself stegan0gram, said in an interview. "We liberated hardware in the field, disarmed them, and proceeded with reverse engineering of the cameras and associated solar equipment."
[...]
The hackers said they were able to access the Android system on the camera and found two partitions-sections of its hard drive, essentially. A few of these were unencrypted, the hackers said, including one called "vendor" and another called "media." The latter contained an encryption key that unlocked another part, which contained much of the media-the videos and stills-the camera took.In early 2025, security researcher Jon "GainSec" Gaines reverse-engineered a Flock license-plate reader and documented flaws that could be used to gain root-level access. After Gaines disclosed his findings, the company acknowledged the findings but downplayed their severity, writing that the flaws required physical access to the device and that even someone who gained access to a camera "would still not be able to gain access to footage," because images remained on the device only briefly after being transmitted to the cloud.
[...]
A typical passing vehicle generated about 28 images, though some produced more than 100. The camera uses different exposures to capture both the license plate and the wider scene, then scans the images, selects and crops useful frames, and sends them with other data to Flock over the cellular network. The camera itself does not appear to read the plate or identify the vehicle's make, model, and color. That appears to happen on Flock's servers.According to our analysis, the camera's logs recorded about 21 days of activity across several periods. During those windows, the device photographed roughly 50,200 vehicles and generated about 1.6 million images. On a typical day, it logged around 3,300 vehicles, with a high of 4,454.
[...]
The software running on the camera explicitly detects people, something that is typically overlooked in discussions around Flock cameras. When it spots a person, it records where they appear in the image and how confident it is in the detection.To test what the software could actually see, WIRED extracted the models from the camera's files and ran them against test images and footage recovered from the device.
[...]
The models detected people in 11 of the clips, all of them riding motorcycles. The small number is likely due to the camera's position above a roadway, pointed down at passing traffic where pedestrians were unlikely to appear.The tests also showed how broadly the camera's license plate detector could interpret what it saw. In some cases it mistook bumper stickers, dealership frames, and other graphics for license plates and cropped them out as if they were plates. In one video of a passing motorcycle, the detector cropped an American flag patch on the rider's saddlebag as if it were a plate.
[...]
In August, WIRED obtained frontend code for Flock's police software, now called OS Investigate and previously known as Nightshift, and reconstructed portions of the tool. That software showed how Flock can use the records generated by its cameras, along with police files and commercial data, to identify drivers and surface vehicles that repeatedly travel together and search for people based on patterns of movement. The data provides a view of the other end of a system.
[...]
Noel Pichardo, a former Pawtucket, Rhode Island, police officer who became an outspoken critic of Flock after challenging his department's use of the cameras, says he understands the activists' frustration but worries that sabotaging devices could ultimately strengthen the case for them.
[...]
The camera's logs also show the camera struggling with storage. Its logs recorded more than 27,000 "no space left on device" errors while trying to save full-resolution images, along with tens of thousands of related errors, crashes, and reboots. At the same time, about every two minutes, code checked that the camera was still running and logged the message, "Who's a good boy?!" More than 12,000 of those messages appear in the recovered logs.When the camera did restart, another service left a final message in the logs: "A reboot was requested! Adios, Amigos!"
Read more of this story at SoylentNews.