Flock Safety Faces Scrutiny Over License Plate Data
Left 100%
Center 0%
Right 0%
2 left · 0 center · 0 right
What happened
In November 2025, cybersecurity researcher Joshua Michael found that Atlanta-based Flock Safety, which operates automated license-plate-reader cameras used by law enforcement, was publicly leaking device-location data through an unauthenticated access token that queried the company's ArcGIS records; he notified Flock three times starting November 13 and received a reply that it was "internally triaging" the findings. After downloading a December snapshot of those records, he published a January technical blog post—after which Flock closed the vulnerability—and a map of more than 170,000 cameras plus more than 130,000 accompanying devices, about 300,000 Flock devices nationwide, larger than the more than 120,000 cameras Flock had told the press it operates; The Intercept said cameras were present at six random Arizona coordinates on the map, and the dataset listed devices at FBI headquarters in Washington, in a cluster near Chicago O'Hare, and inside detention centers. The map was cited in a Senate Subcommittee on Crime and Counterterrorism hearing; Flock has stated that it "has never been hacked" and that there has not been a leak of Flock information, and after the map went live Doppel, saying it was working on Flock's behalf, filed a trademark-infringement complaint requesting the site be taken down. Separately, according to WIRED, hackers who physically stole a Flock camera reverse-engineered it and recovered about 1.6 million images, 50,200 vehicle records, and 27,000 short video clips covering roughly 21 days; former U.S. Secret Service cybercrime expert Jason Brown told FOX Business that incident did not appear to have accessed Flock's cloud network.
Sourcing check · Fully on the record · 4 articles
4 of 4 articles cite a named source for the story. It was on the record from the first report.
What these terms mean and how they're counted
- On the record · names a source 4 of 4
- On the record means the article cites a source by name for the story's main claim: a person, or an institution speaking officially, such as a company statement or a named agency's spokesperson. The opposite is an unnamed source. The count is how many of the counted articles cite at least one such source; the names are everyone named across them, each once however the articles spell it. Here: Sen. Josh Hawley, Benn Jordan, Virginia Ramsey, Dan Haley, Joshua Michael and Jason Brown
- Primary evidence · cites a document or data 2 of 4
- Primary evidence means the article cites a record you could check yourself: a court filing or ruling, a dataset or report, a recording or transcript, an official statement or press release, market data. A quote is not a document. The count is how many articles cite one. Here: on-record letter, dataset
- Credits another outlet 0 of 4
- The article says the story comes from another outlet's reporting (“first reported by Reuters”). Those articles relay the story; they are not independent confirmation. Here: Each article presents its own reporting.
- Unnamed sources 0 of 4
- The main claim is attributed to people who are not identified: “people familiar with the matter”, “officials said”. The count is how many articles do this.
- How it developed
- When the first report landed and whether it named anyone; when the first named source and the first document appeared. Here: First report Sep 24, 14:15 UTC by The Verge, naming its source. First document 3 hours later, from The Hill (on-record letter).
- Not counted 0
- Opinion, analysis and video pieces, and articles too short to assess. Every count above is out of the counted articles. An article republished under a new headline is one article.
This is about who is cited, not whether the story is true. Each source below says what it names. How we count
Omitted — what each side leaves out
Unpacked
Right-leaning coverage had not reported the Flock surveillance map or the fight to take it offline as of publication. Left-leaning coverage says a researcher mapped more than 170,000 cameras from Flock's own records and then received a trademark complaint seeking to remove the site. The company had told the press it operates more than 120,000 cameras. A reader of Fox Business would hear about hackers who reverse-engineered a stolen camera and an expert's assurance that Flock's cloud was not accessed.
The labels for data leaving Flock do not match. Left-leaning coverage quotes the researcher saying he "exfiltrated the data." Right-leaning coverage quotes an expert that there's "never been a large dump of information out of their network."
Did the trademark complaint actually take the map down, and does Flock still deny that its device list leaked?
Bottom line
You can read Fox Business on Flock and never hear that a researcher posted the company's own camera map; that account, including a later takedown demand, is only in The Intercept.
The receipts — 3 facts one side's coverage lacks
- A researcher published a map of Flock devices drawn from the company's own location records, then received a trademark complaint seeking to take the site down
- The map lists more than 300,000 Flock surveillance devices nationwide
- The map's findings were cited in a Senate Subcommittee on Crime and Counterterrorism hearing on Flock
The Left View
The Intercept frames the map as exposing a "sprawling" network that "tracks where everyone drives," quoting Michael that "foreign nations don't need to send spies" to follow soldiers, federal agents, and politicians. It treats Flock's no-hack and no-leak statements—issued after Michael had already pulled the device database—as incompatible with that download, quoting him that either the company "knew and chose not to disclose it for fear of bad press," a "transparency failure," or "didn't know I exfiltrated the data at all," a "detection failure with national security implications." The article also cites an ACLU report finding "a pattern of Flock regularly misleading or even lying about its business practices, safety record, commitment to privacy, and efforts to protect vulnerable populations," and presents the trademark complaint as an effort to force the map offline rather than resolve those charges.
The Right View
FOX Business, citing Brown, frames Flock-related security incidents as isolated and not a compromise of the company's cloud: he said "Flock was never compromised" and "there's never been a large dump of information out of their network," distinguishing physically stealing and reverse-engineering one camera from logging into Flock's cloud. He described that case and an earlier episode in which some cameras were temporarily reachable over the internet because of weak authentication—an issue he said was fixed and did not yield cloud access—as "one-off situations" that "don't show a larger problem for the Flock system that I'm aware of," and noted Flock's report that about 97% of using law-enforcement agencies now have multifactor authentication. On privacy, Brown argued that people "do not have a reasonable expectation of privacy" in public, that a Flock camera should not change how someone conducts themselves, and that the technology has had "good uses," including identifying murder suspects across cities, while calling whether to have Flock locally "a debate for the community."
Our Take (balanced)
The left's strongest argument is that a researcher using Flock's own records, later spot-checked on the ground, documented a device network larger than Flock's public camera count, and that the company's claim it "has never been hacked" and had no leak cannot be squared with an unauthenticated endpoint that yielded a national location database—Michael's fork between a "transparency failure" and a "detection failure with national security implications," reinforced by the ACLU's finding of a pattern of misleading statements. The right's strongest argument, via Brown, is that neither the stolen-camera reverse-engineering nor other "one-off" issues equal a breach of Flock's cloud or "a large dump of information out of their network," that public spaces carry no reasonable expectation of privacy, and that the same cameras have identified suspects across jurisdictions. The central unresolved tension is whether Flock's scale, the unauthenticated location-data exposure, and contested disclosure amount to a systemic surveillance and security failure, or a set of bounded incidents around technology that records what is already public and that communities may accept or reject.
2 sources
More stories
The week's bottom lines, in your inbox
One email a week: the five stories that mattered and what they actually mean. Free.