Hackers Got Inside a Flock Camera. Its Data Shows How the System Really Works

Hackers ripped down a Flock camera above a roadway, made a near-complete copy of the data stored inside it, and shared the files with journalists, revealing in new detail how exactly Flock Safety’s cameras track the movements of both vehicles and people. The hackers tell 404 Media and WIRED they are also publishing details on how they managed to obtain the software, in the hopes that other people may copy them.

The breach provides an unprecedented look inside a system that Flock has described as protected by on-device encryption. The hackers were able to copy the camera’s storage and recover an encryption key stored on the device, which unlocked videos of thousands of vehicle detections. The hackers shared the material with 404 Media and the transparency nonprofit Distributed Denial of Secrets, which shared the data with WIRED. 404 Media and WIRED then analyzed those files as part of a joint investigation.

While much of the automatic license plate reader’s most sensitive storage remained encrypted and inaccessible, the joint analysis of the recovered data shows that software running on the device explicitly detects people as well as vehicles, license plates, and bicycles. The camera can produce dozens of images of a single passing vehicle and, according to several weeks of recovered logs, generated more than a million images. Its computer-vision software also sometimes isolated bumper stickers and other graphics, including, in one case, an American flag patch on a motorcyclist’s saddlebag.

The act of removing the camera and dumping its software shows that some people are not content with just destroying or removing the cameras. Across the country, multiple people have been arrested for allegedly tampering with or otherwise sabotaging Flock’s cameras. In response, some towns have announced that they are going to stop using Flock’s cameras altogether, and in one case, a police department even made a fake, 3D-printed Flock camera case in order to bait potential vandals.

Flock’s cameras photograph passing vehicles and send the images and other data to the company’s servers. There, Flock’s system presumably reads the license plate and can identify characteristics such as the vehicle’s color, make, and model. Flock then makes these time-stamped records searchable by whichever local agency owns or has access to the cameras. But in many cases, Flock’s system also allows other police departments from all over the country to search those cameras too, as part of the company’s national network. In Alpharetta, Georgia, for example, WIRED found that records from the city’s Flock cameras were accessible to more than 2,000 agencies, including police departments, colleges, airports, and, inexplicably, the Office of Inspector General for the federal General Services Administration.

This national network has been a selling point for Flock but also a deep source of controversy. 404 Media revealed that local cops were performing lookups in the national network on behalf of Immigration and Customs Enforcement, including in areas that banned working with immigration authorities or transferring license plate data out of state. 404 Media also revealed that a cop in Texas searched Flock cameras nationwide for a woman who self-administered an abortion. Those stories, among others, triggered a national conversation about whether people want Flock cameras, or automatic license plate readers more generally, in their communities.

And in the case of stegan0gram, the answer is clearly no.

404 Media and WIRED analyzed the camera’s contents. The device’s processor is similar to those used in midrange smartphones, and it runs about 20 Flock-built apps that handle everything from detecting motion and taking pictures to classifying objects, uploading data, and receiving remote updates.

According to the code, when something moves into view, the camera takes a rapid series of photos. A typical passing vehicle generated about 28 images, though some produced more than 100. The camera uses different exposures to capture both the license plate and the wider scene, then scans the images, selects and crops useful frames, and sends them with other data to Flock over the cellular network. The camera itself does not appear to read the plate or identify the vehicle’s make, model, and color. That appears to happen on Flock’s servers.

To test what the software could actually see, WIRED extracted the models from the camera’s files and ran them against test images and footage recovered from the device. The models readily detected people, including a selfie of a reporter. WIRED then ran them across 27,321 short videoclips stored on the camera. The clips were MP4 files, each about one to two seconds long, recorded at 1,024 by 768 pixels without audio. They were separate from the rapid bursts of higher-resolution still images the camera also takes as vehicles pass. The models detected people in 11 of the clips, all of them riding motorcycles. The small number is likely due to the camera’s position above a roadway, pointed down at passing traffic where pedestrians were unlikely to appear.

The tests also showed how broadly the camera’s license plate detector could interpret what it saw. In some cases it mistook bumper stickers, dealership frames, and other graphics for license plates and cropped them out as if they were plates. In one video of a passing motorcycle, the detector cropped an American flag patch on the rider’s saddlebag as if it were a plate.

A Flock spokesperson said in a statement: “The unauthorized removal and tampering of a Flock camera is illegal.” When asked specifically about the encryption key stored on the camera, the company added, “Flock takes security seriously and maintains a public Vulnerability Disclosure Policy for security researchers to report potential vulnerabilities directly to us. We received no report through that process, and based on the limited information provided, we do not have enough detail to assess the claims being made. If the individuals identified legitimate vulnerabilities, we encourage them to submit their technical findings through our vulnerability reporting process so our security team can review them and take any appropriate action.”

One of the hackers said, “Being investigated is a legit concern and something we are trying to avoid. I'm sure our actions have attracted some attention as it is, but we are careful and try to keep a low profile.”

When the camera did restart, another service left a final message in the logs: “A reboot was requested! ¡Adiós, Amigos!”

In 2021, around the time of Pichardo’s training, Flock offered Pawtucket police a free 60-day pilot. Seventeen cameras went up around the city as part of a regional test that also included Cranston and Woonsocket, according to records reviewed by WIRED. The rollout quickly drew criticism. The ACLU of Rhode Island accused the department of installing the cameras surreptitiously, after the pilot began without prior public input or notice to the city council. Pawtucket chief of police Tina Goncalves later apologized, saying that the department would “work better in the future” to communicate with the city council.

The pilot ended later that year, and in May 2023 the local TV news reported that Pawtucket was not moving forward with the installation. Pichardo believed the idea was a dead letter.

Within months, Pichardo’s questions would set off a chain of events that, he says, ended his career in law enforcement. They would also eventually place him, somewhat improbably, at the center of a backlash against Flock that unites large factions of the American left and right.

After resigning, Pichardo spent months trying to remain in law enforcement. He applied to other police departments, private-security jobs, and campus police positions, including one at his alma mater, Salve Regina University. Some never responded. Others interviewed him before deciding not to move forward. An acquaintance who works in campus security at a local college eventually asked around and offered an explanation: "You're blackballed."

He found work instead as a caregiver for a person with intellectual and developmental disabilities.

Flock Safety’s latest search tools give police several ways to find people on camera, not just the license plates on their cars. The capabilities sit inside a suite of software now at the center of dozens of police stalking cases. WIRED collected and analyzed that software and created a mock-up of what officers see when interacting with the system.

Among the tools is an AI-powered watch list. An officer can cordon off an area of a city and make the cameras inside it run a continuous, automated search for anyone fitting a written description.

Experts who study automated screening and police technology say Flock has given its AI a job no technology does reliably. Flock’s system decides, out of sight of the department using it, which descriptions of a person an officer may search for—and no screen operating at that scale is accurate, the experts say. Further, nobody outside the company can measure how often it is wrong, or in which direction. This puts users in a bind: The company itself warns officers that results may be inaccurate or incomplete and should not be relied on alone but puts the “risk of any inaccuracies” on the officer running the search.

Some of those decisions experts find harder to defend than others. Flock’s system scores an officer’s written description against several categories of sensitive content, including race and religion, and “political, social, and cultural expression” is the only one that will not stop a search.

WIRED sent Flock a detailed description of each of its findings along with 16 questions. The company responded with a written statement saying its search tools are built to help police find relevant information “while maintaining clear safeguards around how the technology can be used.” Queries are evaluated against its content policies, it says. The statement does not describe how its AI model was built, what instructions it works from, or what separates one verdict from another.

Data flows in both directions. When the software flags a search, it sends Flock the language the officer used, the category and confidence score the model assigned it, and whatever the officer did next, whether continuing, dismissing, or disputing the warning. Flock’s statement does not address how long those records are kept, who inside the company can see them, and whether they are used to evaluate or improve the moderation system.

Police abusing investigative tools is not new. A 2016 Associated Press investigation found officers running database searches on exes and people they found attractive, with police employees at state agencies and dozens of the nation’s largest departments fired, suspended, or forced to resign, more than 325 times from 2013 through 2015. WIRED reported in 2023 that Immigration and Customs Enforcement employees and contractors had been investigated at least 414 times since 2016 for misusing sensitive government databases and found hundreds more allegations against Customs and Border Protection employees this year, among them officers who queried databases to track down women they wanted to date, monitor family members, and follow colleagues’ phones.

A police commander who oversees special investigations at a Southern California police department, and who requested anonymity because he’s not authorized to speak, says the possibility of abuse is not unique to Flock or surveillance technology. New technologies routinely create opportunities for both legitimate use and for misuse, he says. The real question is “whether the technology gets implemented with strong guardrails, active oversight, auditability, and consequences for any misuse.”

Sources:

Hackers Got Inside a Flock Camera. Its Data Shows How the System Really Works
https://www.wired.com/story/hackers-flock-camera-data-shows-how-system-works/

This Is Flock’s AI Search Tool for Cops
https://www.wired.com/story/flock-ai-search-user-interface/
https://public.flourish.studio/visualisation/30141059/?full

The Cop Who Took On Flock
https://www.wired.com/story/the-cop-who-took-on-flock/

Across US, police officers abuse confidential databases
https://apnews.com/general-news-699236946e3140659fff8a2362e16f43

ICE Records Reveal How Agents Abuse Access to Secret Data
https://www.wired.com/story/ice-agent-database-abuse-records/

CBP Workers Allegedly Used Government Databases to Spy on Exes, Crushes, and Colleagues
https://www.wired.com/story/cbp-workers-allegedly-used-government-databases-to-spy-on-exes-crushes-and-colleagues/

Collection of previous posts:
https://imgur.com/a/ayDHbed
-