Hackers recovered roughly 1.6 million images from a stolen Flock Safety license-plate camera, raising questions about the security of devices that record vehicles on public roads. However, a former Secret Service cybercrime expert says the incident appears limited to the camera itself, with no evidence that attackers accessed the company’s broader cloud network.
Jason Brown, director of customer advisory and counter-fraud lead at threat intelligence firm iCOUNTER, said that distinction matters. Brown spent 25 years with the U.S. Secret Service, specializing in cybercrime.
“The biggest thing I keep hammering at home [is] that Flock was never compromised,” Brown said.
“So there’s never been a large dump of information out of their network.”
What Hackers Recovered From the Stolen Camera
According to WIRED, hackers removed the camera from above a roadway, then reverse-engineered the device to examine its contents.
They reportedly found both encrypted and unencrypted storage. An encryption key stored on the camera allowed them to unlock additional data.
The recovered logs covered approximately 21 days of activity. WIRED’s analysis identified roughly 1.6 million images, 50,200 vehicles and 27,000 short video clips.
“This was a situation where somebody physically had access to a camera because they stole it off of a pole, took it home, and then did backward engineering on that camera,” Brown said.
“That did not give them the capability to actually log into the cloud portion of Flock, and nothing in the cloud of Flock proper was accessed.”
The volume of recovered material nevertheless puts the camera’s data collection in focus. One device held weeks of records documenting passing traffic.
Flock Responds to Camera Tampering
Flock said “the unauthorized removal and tampering of a Flock camera is illegal.”
The company also pointed to its established process for reporting security weaknesses.
“Flock takes security seriously and maintains a public Vulnerability Disclosure Policy for security researchers to report potential vulnerabilities directly to us. We received no report through that process,” the company said.
Flock cameras photograph passing vehicles and record short videos. They transmit that material to the company’s cloud infrastructure for processing, where authorized law enforcement users can search it.
That connection makes the scope of any security incident consequential. In this case, Brown said physical access to the stolen device did not translate into access to the cloud system.
Earlier Camera Security Problems Draw Scrutiny
Meanwhile, Brown addressed an earlier security issue that temporarily left some cameras accessible over the internet.
He attributed that exposure to weak authentication controls and said the company addressed the problem. According to Brown, that incident also did not provide access to Flock’s cloud infrastructure.
“They are one-off situations and don’t show a larger problem for the Flock system that I’m aware of,” Brown said.
He also cited Flock’s report that approximately 97% of law enforcement agencies using its system now have multifactor authentication enabled.
Still, his assessment carries a qualification: He described the incidents as isolated based on what he knows about them.
Public Surveillance Fuels Privacy Debate
Beyond the technical questions lies a more personal concern: How should people respond when cameras record their movements through a community?
Brown argued that a Flock camera’s presence should not change how someone behaves in public.
“Should a person conduct themselves differently because a Flock camera is there? I would argue no,” he said.
He pointed to investigations in which the cameras helped authorities identify suspects across city boundaries.
“We’ve seen good uses of the technology, where individuals, a murder is committed in one city and the individuals responsible for it were identified by Flock cameras in another city,” he continued. “You know that that’s a positive, but we all have to understand that whenever we’re out in public, we do not have a reasonable expectation of privacy. We are in public. Anybody can take a picture of us at any time. It may not be the polite thing to do, but anybody can do it at any point in time.”
However, Brown said communities must decide for themselves whether to adopt the technology.
“The debate of do you have Flock in your community — that’s a debate for the community,” Brown added.
AI Adds Urgency to Third-Party Security
Brown said the stolen-camera incident also illustrates third-party and supply-chain risks “that many corporations would see.”
As artificial intelligence advances, he argued, companies need to address those risks with increasing urgency.
“The security posture of everything is changing by the minute,” he said.
For Brown, that means gathering intelligence and working with outside partners before a security incident exposes customers.
“We have [to] gather intelligence on what is happening with the third parties and then work with those third parties before the incident even occurs to ensure that they are secure, so our customers are ultimately secured,” he continued. “And in this day of AI, the speed and the veracity of that only increases by the minute.”
