Hunting Flock Surveillance Cameras: A Deep Dive into Privacy Invasion and Public Outcry

Campus security is on to us. For the past 30 minutes, I’ve been doing laps around a satellite campus of a small Virginia university in the back of a conspicuously rigged-out Toyota Tacoma, a fat disc-shaped antenna magnet-clamped onto its roof and connected to a thick tube of cables that run into a black box by my side. In the front seat are two professional security researchers—call them hackers, if you want—who go by their online pseudonyms Koko and Hedge. Koko and Hedge’s work is all above board, but they still ask me to keep their legal names off the internet. In return, they agree to take me hunting for the cybersecurity world’s greatest enemy: the AI-powered mass-surveillance cameras that have popped up all over America.

We spot our prey, but still need to get the shot—and we’ve already been passed by one city police squad car and another campus cop. Hedge is riding shotgun and navigating, neck bent over two iPhones, the glow lighting his face from below. Koko is watching for cops and keeping an eye on the numbers flashing on a small, homemade device fastened to his windshield. “OK, around this corner,” Hedge says. “We’re going to pass it on the right.” In the back seat, I twist around, trying to line up my phone camera with a night vision scope Koko brought along.

Koko crawls through the intersection. I get the target—a Flock Safety surveillance camera perched above the sidewalk on a long black pole—in frame just as its infrared flash goes off. It’s invisible to the naked eye, but on the night vision scope it’s a blinding pulse of white light. I catch it all on video— but it also catches us: the truck I’m in, the license plate, and almost certainly me, glued to the back window, phone in hand.

Over the past few months, Flock Safety has gone from a little-known, quietly-expanding security camera company into public enemy number one for a vast political coalition. Flock’s critics, which include left-wing anarchists, suburban soccer moms, libertarian computer dorks, and hardline far-right secessionists, have all claimed that the company’s nationwide network of interconnected surveillance cameras violate Americans’ right to privacy in new and frightening ways. That grassroots anger has, in turn, made Flock a defining issue in the 2026 election cycle.

“Little cameras, watching your every move, to collect information about you without you even noticing,” Michigan Senate candidate Abdul El-Sayed said in a new campaign ad on the website X. “That’s all been part of a regime that’s been pushed by, well, this guy: who happens to be the guy I’m running against–Mike Rogers.”

Opposition to Flock has also crossed party lines. In July, Tennessee Republican Rep. Tim Burchett introduced the Protection Against Mass Surveillance Act, a single-page, simple bill that would bar the federal government from “purchasing or accessing” any “mass surveillance” technology, specifically mentioning Flock cameras and devices that use biometric or facial recognition features to profile people.

Flock, which has been around since 2017, primarily makes cameras known as Automated License Plate Readers, or ALPRs, which it then leases to cities, towns, and homeowners’ organizations, promising their clients an always-on, easily-searchable database of surveillance footage for stopping crime. There are many companies who make ALPRs, many of which offer similar services, but in the past few years, Flock has come to dominate both the market for this technology and the spotlight that it now commands. In some form or another, license-plate capture technology has been around for at least a decade—but privacy experts and security researchers have warned that the Orwellian capabilities and slap-dash vulnerabilities of Flock’s cameras represent a new, drastic security threat for everyday citizens like you and me.

Flock claims its cameras focus only on vehicles—but critics say they’re collecting so much more: giving the government tools to analyze identifying features on vehicles and pedestrians alike, creating profiles that can log everything from a bumper sticker on a car to the color of clothing a jogger wears. That data is held by a private company, which sells it to whoever is willing to pay. And once they have it, anything goes. Across America, rogue cops have used Flock data to stalk ex-wives and girlfriends, held families at gunpoint after faulty readings, and kept one woman in jail for 13 days before admitting that the cameras had led them astray. Mistakes happen in police work, of course, but security researchers also say Flock is barely bothering to secure their cameras: they’re easy to hack and exploit by anyone with the right gear. All this adds up to a systemic invasion of privacy that is causing sane and rational experts to use words in interviews like “panopticon” and “big brother.” The future is here, and our laws have yet to catch up. Flock did not respond to a detailed list of questions sent byRolling Stone.

“In the old days, it was just impossible to do these things,” says Andrew Crocker, a senior staff attorney at the Electronic Frontier Foundation who leads the privacy organization’s surveillance cases. “You couldn’t follow someone around 24 hours a day. That was just physically impossible. This technology makes that possible. It changes the relationship of surveillance to people in a really fundamental way.”

Crocker says Flock and other interconnected ALPRs give the government an enormously powerful tool. There are at least 131,000 ALPR cameras in the U.S., over 80 percent of which are owned by Flock. If you have access to Flock’s system, you can plug in a license plate number or even a description of a vehicle and see footage from many of those cameras, effectively telling you almost everywhere their car has been, and sometimes even who was inside it. You can tell what time they arrived somewhere and what time they left. Flock makes all of this information available to its customers at the push of a button, with no warrant or effort required, even if the target isn’t suspected of any crime at all.

And people, broadly, are pissed: hating Flock is one of the hottest trends on social media. Content creators from across the political spectrum are making guides on the best tools to cut down Flock cameras, blasting them off poles with shotguns, and dissecting every misstep the company makes.

America’s Great Flock Hunt began almost exactly one year ago, when Benn Jordan, a musician and technology YouTuber, released a video titled “Breaking the Creepy AI in Police Cameras.” In Jordan’s first video about Flock, he spent much of its runtime figuring out unique ways to fool the cameras’ license plate readers using his own AI programs. But his plain English introduction to what Flock Safety was actually doing is what connected with his audience. Today the video has 3.6 million views.

A few months later, he was back with a far more provocative take. Working with a security researcher going by the name GainSec, Jordan showed how Flock’s specific protocols and tech were immensely vulnerable to cyber attacks—some of which would let them tap right into the cameras’ live feeds—in a video called “We Hacked Flock Safety Cameras in 30 Seconds.” Jordan and GainSec found unsecured video feeds they could patch right into and watch, vulnerabilities that let them into back doors in Flock’s database and the camera’s code, and even unsecured databases of Flock’s users, down to the names and addresses of police officers using the system.

I started seeing other Flock videos around this time. They came across my feed, at first, through the fringes: 3D-printed gunsmiths, hard-line anti-fascists, weird black-pilled internet denizens, and even some crunchy far-right secessionists in the Pacific Northwest were suddenly all posting about these little black cameras on aluminum poles. Many of them were posting a map on a site called DeFlock.org, which showed the United States as an enormous constellation of lights—thousands upon thousands, with every dot on the map representing an ALPR camera. They were everywhere. To date, DeFlock has mapped more than 131,000 ALPR cameras in the United States, around 80 percent of which are owned and run by Flock Safety. The map, along with a searchable database called HaveIBeenFlocked.com, are the product of a massive public undertaking by a community of hackers who adapted an old A/V-club hobby into a service for the public good. They call themselves “wardrivers,” and for the past year or more, they’ve been fighting to track down every single Flock device active in the United States.

Wardriving, they explain, is a relatively simple concept: you pack your car with all the signal-receiving gear you can get and drive around seeing what you catch. Basically every device with a battery or power cable these days is emitting some kind of signal, mostly WiFi or Bluetooth. An extremely simple “wardriving” session, then, would be just traveling along a route and logging the raw number of WiFi and Bluetooth signals you pick up: phones, cameras, computers, cars, et cetera. For some people, that’s the whole hobby—there are online leaderboards of wardrivers competing to put up the most numbers, games that they can play by “capturing” digital territory on real-world maps. Both Koko and Hedge have designed their own specific devices that are tuned to detect Flock cameras as well as other ALPRs and surveillance devices. Doing that is more complex: it requires reading the MAC address—a sort of digital serial number—for a device their gear detects and cross-referencing it with a known list of MAC addresses used by Flock cameras’ manufacturers. (This is in imperfect science. There is one brand of Bluetooth-enabled CPAP machine and certain electric toothbrushes known to have similar MAC addresses to Flock cameras, so sometimes you get false positives if you drive too close to the house of a heavy snorer.)

“We mess with each other all the time,” Hedge laughs. “Usually when someone’s on the toilet, and we know they’ll be on their phone.”

“This stuff should be seen no differently than owning a firearm,” Koko says. “It all depends on the person wielding it.”

“So, anyway,” he says. “Want to go do some wardriving?”

Our first stop is the “most controversial,” Koko says: the Lowes parking lot. There are three Flock cameras there and several other non-Flock police cameras. Activists suspect that Flock’s data has been used to plan immigration raids, which frequently target hardware store parking lots where migrant day-laborers often wait for work. We drive around the lot slowly, parking next to one of the cameras to take some photos and video. It’s late in the day, and our gear isn’t picking up the camera’s signature, even though we can see it right there. This is interesting to Koko—he has a theory that some of Flock’s solar-powered cameras shut down their WiFi and Bluetooth signaling after dark to save power, uploading data only through the cell networks, which are much harder to detect.

“Before, you had more control over the data you put out,” Hedge says. People enjoyed a reasonable amount of privacy in public; they could use cash for purchases and paper tickets for transit. The CCTV footage that did exist was, at best, lazily reviewed by a manager somewhere if and only if there was an incident. Now, he says, the cameras are always on, always taking data. “It’s hard to avoid going to the grocery store.”

“The fact that they don’t have to get a warrant for [running a search of Flock’s data] is really shocking to me,” Crocker, the EFF lawyer, says. “The law has a hard time keeping up.”

“I feel like the presence of these cameras kind of undermines the idea that people are entitled to that freedom and their privacy,” Koko says.

“I mean, this is too little too late,” Koko says.

TRENDING STORIES

On the way back, we drive through a quiet intersection with one camera, facing south, already on the map. As we pull up at the stop sign, I spot something else. “Wait,” I say. “Isn’t that another one?” There’s a second camera, pointing north, affixed to the side of a telephone pole. “Is that on DeFlock?” Hedge asks. We pull out our phones to check. It’s not. Hedge taps away, dropping a pin in the map, putting the new camera in the system, rotating the icon so it shows the exact angle the lens is facing. He zooms out, and the new camera becomes another dot, one of two at that intersection, of a dozen in that town, of hundreds in that part of the state. If you go outside right now and drive around, chances are, you might find one, too. It’s a small comfort, I think, to at least know where these cameras are, to be able to see them for yourself. After all, they’ve already seen you.

Source link