Fixed cameras

A blog post by Micah Lee, based on a dataset published by DDoSecrets from a collective called stegan0gram, describes security flaws in a Flock ALPR camera. The camera ran Android 8.1 with a security patch level from 2018-06-05, missing years of updates. The firmware contained a hard-coded API key for Flock’s backend service, presumably allowing credential retrieval for any camera. Logs revealed the camera’s location in Wauwatosa, Wisconsin.

Craig Harriman filed a third lawsuit in Aroostook County Superior Court against the town of Houlton, Maine, alleging officials have not released public data from surveillance cameras removed earlier in 2026. The filing follows multiple Freedom of Access Act requests and two previous court appeals. Harriman seeks the immediate production of remaining records, including emails about the town’s facial recognition video surveillance system, and written explanations for any withheld documents. The town previously depleted its legal budget in 2025 handling FOAA lawsuits.

Fort Wayne Police Chief Paul Smith announced that the department canceled its subscription with Flock Safety, taking the license plate reader system offline. City Council had voted against renewing the contract for 36 cameras. The federal government allowed the grant that funded the program to close early without penalty. FWPD-controlled data stored in the Flock system was deleted, and Flock began removing cameras from locations throughout Fort Wayne.

On August 27 the Milford Board of Aldermen voted, after a meeting lasting more than four hours, to pause the use of most of the city’s speed, red-light and Flock license plate reader cameras. The mayor confirmed all speed cameras were turned off. Most Flock readers were disabled, including units on Gulf Street, Woodruff Avenue, Woodmont Avenue, Broad Street, Anderson Avenue, Merwin Avenue and the Boston Post Road; 14 remain active at the city’s borders, including I-95 and Route 15. The board also created a Public Safety and Technology Review Committee to review camera systems, contracts and vendors twice a year. The police union filed with the state labor department seeking a cease-and-desist and requested a hearing for September 8. Governor Lamont had earlier asked towns to pause new camera installations pending a POST Council review.

The Narragansett Town Council voted 5-0 on August 3, 2026, to cancel the town’s Flock Safety license-plate camera contract effective immediately. The town solicitor had not completed a review of the cancellation penalty at the time of the vote; Council President Alexander Menzies estimated the town may lose roughly $12,600 for the final contract year, to be paid from forfeiture funds. The three remaining cameras on Boston Road, Point Judith Road, Woodruff Avenue, and near the Dillon Rotary are to be removed from service. The police chief had asked the council to delay the vote, and a civil liberties group urged removal.

In August 2026, the Florida Department of Transportation revoked all existing approvals for automated license-plate-recognition systems installed by local law-enforcement agencies in state rights-of-way and stopped approving new requests. Agencies were given 30 days to remove the cameras, after which FDOT said it would remove any that remained. The department cited “concerning reports of misuse, data privacy concerns, and surveillance schemes” and “the recent exponential increase in deployments along our roadways.” Governor Ron DeSantis had said that without oversight the cameras threaten privacy. The order applies only to the State Highway System. WUFT reported on August 31, 2026 that all of Putnam County’s Flock cameras were being discontinued. No removal cost or refund figure was reported.

In August 2026 the Boston Globe reported that Littleton, Massachusetts officials had voted in May to shut down six Flock cameras on public roads, and that police later discovered Flock had restored power to the cameras without notifying the town. The department ordered the cameras remotely powered down and confirmed a Flock work order was in place to remove them from utility poles as soon as possible. Techdirt described it as the second time Flock had activated a system a town had voted to shut down. Techdirt also reported that an audit by the South Carolina Secretary of Transportation found more than 200 unpermitted Flock cameras operating on public roads. The Globe reported that Cambridge, Massachusetts terminated its Flock contract after two cameras were installed without notification following an earlier removal. No public cost figures were reported.

In August 2026, Business Insider reported that Flock Safety cameras generated 1,427 alerts to the Roseville, California, police department in 2023 and 2024 for vehicles flagged as stolen or tied to felonies, and that a department analysis found 71% of those alerts came from the software misreading the plate. Records showed a 9 read as an 8, and the department reported bad reads to the company dozens of times over four years. Flock said its cameras read more than 96% of characters correctly in optimal conditions and blamed Roseville’s older hardware, higher camera mounting and rear-only capture. No alert led to a stop or arrest because officers must verify plates before acting. The city has spent roughly $450,000 on Flock products since 2020 and continues the contract.

The Stoughton City Council voted unanimously on July 28, 2026 to terminate its contract with Flock Safety, ending use of five surveillance cameras after months of community opposition. The council ordered bags placed over the cameras and asked that all collected data be permanently deleted. The two-year contract total was $25,000, of which the city will still pay the remaining $12,500. The live feed camera pointed at the Cascade Falls apartment complex, which residents criticized as targeting a community of color.

Security researchers Jon Gaines and Benn Jordan demonstrated that a physical button sequence on Flock Safety cameras activates a diagnostic Wi-Fi hotspot, often protected by the default password “security.” This allows root access via Android Debug Bridge in under 30 seconds, enabling footage extraction, malware installation, and credential theft. Additionally, over 60 Flock cameras were found streaming live footage with no authentication, exposing 30 days of archived video. Flock operates over 100,000 license plate readers across the U.S.

The Los Angeles Police Department’s Office of Inspector General audited two months of Flock Safety stolen-vehicle hot-list alerts from August and September 2025. Of 498 alerts, 161 were false positives: vehicles the system flagged as stolen were not stolen. The remaining 337 alerts led to recovered vehicles, about one in three alerts wrong. The audit attributed the errors to hot-list data, not plate reads: recovered vehicles not cleared from lists, outdated theft reports and uncorrected data-entry mistakes. The OIG recommended suspending new ALPR camera deployments and contracts pending public input and a broader reassessment of vendors and data practices. LAPD’s three-year 2023 agreement for 138 pole-mounted cameras expired July 11, 2026 and was not renewed, with the department citing privacy and data-ownership concerns. At the July 15 Police Commission meeting, officials said they were negotiating a new contract giving the city ownership of all plate data.

On July 6 the Windsor Town Council voted 5-4 to keep the town’s 16 Flock Safety license plate reader cameras off and to end its contract. The council had voted 8-1 in February to pause the cameras while it tried to renegotiate contract language on resident data ahead of a May renewal. A resident’s public records request showed Windsor data was searched 590,000 times over nine weeks. If the contract is terminated early, the town will pay around $8,000. The cameras are to be taken down by the fall.

In July, Killingworth became the second Connecticut town to end its Flock Safety contract. The town, which has no police department and relies on a resident state trooper, installed four cameras along Route 81 the previous year. The first selectman told CT Insider the cameras had not added any value to local policing. Officials said the town was negotiating the end of the contract for financial reasons while also taking resident privacy concerns into account. The town had budgeted $14,600 for licensing the four cameras in the current fiscal year. Officials said the town will have to pay a fee to exit the contract but did not yet know the amount. The cameras were expected to be removed the same month.

On June 8, 2026, the Columbia Heights City Council voted unanimously to terminate its contract with Flock Safety. The city will pay out the final year’s $49,000 without receiving service. The contract, signed in May 2024, covered seven fixed cameras and five flex cameras. The city cited privacy concerns and the possibility that automated license plate reader data could be accessed by immigration enforcement or other outside groups. The cameras have been removed or covered with bags.

On April 17, 2026, the Florida Highway Patrol arrested Lindsey Isaacs, 23, on eight felony charges, including three counts of vehicular homicide, for an October 4, 2025 hit-and-run on I-4 that killed three people. A Flock camera had recorded her black Dodge Durango about three miles from the crash. A 911 caller had described a maroon Durango and gave a partial plate that did not match hers, and the struck vehicle bore maroon paint. She spent 13 days in jail. Prosecutors dropped the charges on May 22, 2026, the same day investigators arrested another driver whose maroon Durango had been repaired after the crash. Isaacs filed a federal lawsuit against FHP and two sergeants, alleging they claimed her undamaged vehicle showed crash damage and ignored evidence that would have cleared her. No settlement is reported.

On March 31, 2026 the Denver City Council voted 7-6 to approve a one-year, $150,000 contract with Axon for 50 fixed license plate reader cameras, hours after Flock Safety finished removing its more than 100 cameras from city streets. The council president broke a 6-6 tie. Denver had ended its Flock contract after public backlash over privacy and revelations that the company could share data with federal immigration authorities. Opponents on the council argued the vote came before the city’s surveillance task force had written guardrails. Axon had severed its API integration with Flock on July 24, 2025. In July 2026 Douglas County approved a nearly $22.8 million Axon package replacing its 50 Flock cameras with 100 Axon Outpost cameras plus drones.

Flock Safety confirmed a data breach that exposed live video from a limited number of its Condor cameras to the internet, allowing unauthorized viewing, access to about a month of archived footage, and deletion of video. The breach was discovered by YouTuber Benn Jordan, who found publicly accessible camera feeds. Flock said the exposure came from tests for carrier compatibility and that it was corrected with security updates. Vero Beach Police Department, in Florida, confirmed it uses the cameras but said it wasn’t impacted.

404 Media reported that at least 60 of Flock Safety’s AI-enabled Condor cameras were exposed to the open internet, allowing anyone to watch live feeds, download 30 days of video archives, and change settings without any password or login. The exposed cameras included views of playgrounds and parking lots. Flock Safety said the flaw was a limited misconfiguration on a small number of devices and has since been remedied. The affected Condor Live cameras are not the same model as the license-plate reader cameras used by San Francisco and Oakland police.

Cambridge terminated its contract with Flock Safety on December 10, 2025. The City Council had first approved buying automated license plate readers in February; Flock installed 16 cameras in September. On October 20, the council voted unanimously to suspend police use of the cameras, citing concern that data sharing with federal agencies would violate the city’s sanctuary ordinance. The 16 cameras were deactivated and removed in late October. The city then said two additional cameras had been installed by Flock technicians in late November without the city’s awareness, during the pause. City officials described the episode as a breach of trust and ended the contract.

On the evening of December 5, 2025, the Eugene Police Department ended its contract with Flock Safety effective immediately, citing vulnerabilities and limitations affecting operational needs, data security requirements and community expectations. Springfield police announced about an hour later that their cameras would be covered pending removal; Springfield had said in September it would not turn on its 25 cameras, budgeted at $77,000 per year and funded by a $93,000 Oregon Criminal Justice Commission grant, until a community discussion took place. Eugene’s chief later confirmed a Flock camera had been turned on after the city ordered the cameras shut down in October. Eugene’s $342,000 two-year contract was funded by a state grant. City staff removed 55 of Eugene’s 57 cameras by December 19.

In late December 2025, technologist Benn Jordan and security researcher Jon “GainSec” Gaines found Flock Condor PTZ cameras exposed on the public internet. 404 Media reported that at least 60 Condor cameras were live-streaming without any authentication, along with 30 days of archived video; the feeds and admin interfaces were unencrypted and required no username or password. The access could have allowed changing camera settings, running diagnostics, viewing logs, deleting videos and remotely controlling the cameras. A 404 Media reporter watched himself on a live feed from his phone while standing in the street, and colleagues hundreds of miles away viewed the same link. Gaines reported finding 67 live feeds and debug web interfaces. Straight Arrow News reported one exposed camera captured children on a playground. No public remediation cost was reported.

On September 9, 2025 the Sedona City Council voted unanimously to cancel its contract for automated license-plate readers and remove them. South Tucson voted on February 17, 2026 to end its agreement. Staunton, Virginia announced it would cancel its Flock contract. KOMO reported that Mountlake Terrace, Washington ended a $54,000 agreement but remained responsible for the first year’s payment of $27,000 and was negotiating the balance, that Lynnwood terminated a $171,000 contract, and that cities ending grant-funded agreements early could be required to return funds to the grantor. NPR reported that privacy concerns and federal immigration access to local data were driving the cancellations.

On August 26, 2025, Evanston ordered Flock Safety to deactivate its 19 license plate reader cameras and issued a 30-day termination notice, effective September 26, after an Illinois Secretary of State audit found Flock had let U.S. Customs and Border Protection access Illinois camera data in violation of state law. Flock challenged the termination. In September the company reinstalled stationary cameras without city authorization, and the city covered the cameras pending removal. The five-year contract, approved January 8, 2024, at $48,500 per year, runs to January 29, 2029; the city paid the first two years and would owe $145,500 for the remaining three if the contract is upheld. As of March 2026 no lawsuit had been filed, the city had not paid its 2026 fee, and the final two cameras were removed after a RoundTable inquiry.

In June 2025, Illinois Secretary of State Alexi Giannoulias audited Flock’s license plate reader data sharing. The audit found U.S. Border Patrol searched Elmwood Park data 698 times in June 2025, 1,516 times in July 2025, and 862 times in August 2025. Police departments in Alabama, Arkansas, Colorado, Florida, Georgia, Kansas, North Carolina, South Carolina, Texas, and Virginia also searched the data for ICE. On August 25, 2025, the Secretary of State’s office announced the findings and that Giannoulias had ordered Flock to shut off Border Patrol access to all Illinois cameras. Flock revoked Border Patrol access nationwide by that month.

On April 8, 2025, the Scarsdale Village Board approved a $2.1 million contract with Flock Safety for automated license plate readers, live-view surveillance cameras and drone-as-first-responder technology, without public notice. Communications obtained by Drop Site News showed village contact with Flock dating to January 15, 2025. Residents began appearing at the April 22 board meeting, and a petition signed by 449 residents urged the board to pause the project and hold public forums. The village was notified in early July that its grant application for the project had been denied. On August 4 the police chief submitted a memo recommending against proceeding given the lack of federal funding, and the village cancelled the contract on August 6.

In June 2025, Morristown, Tennessee, police stopped a grandfather and grandmother as they drove to a doctor’s appointment with their 3-year-old granddaughter. The grandmother’s Ford Expedition carried a vanity plate reading ‘LOVEY’; a Ford F-150 reported stolen in Claiborne County carried a plate reading ‘L0VEY’ with a zero. A license plate reader treated the two as a match. Officers drew guns on the grandfather as he got out; the grandmother said a laser sight rested on her chest while she told officers there was a baby in the car. Officers found the discrepancy and released them. The Institute for Justice lists the case as a Flock camera ‘O’ for ‘0’ misread among at least 27 ALPR-error stops since 2018. No lawsuit or payment is reported.

On May 5, 2025, the Denver City Council voted down a two-year, $666,000 contract extension with Flock Safety. All council members present voted no, citing concern the cameras could be used for federal immigration enforcement. Mayor Mike Johnston’s office had asked the council to reject the proposal. The city said it would keep the camera system operating while it created a task force. The system photographed about 2 million license plates per month.

In February 2025, Flock Safety’s lawyers sent Will Freeman, creator of the open-source DeFlock map of automated license-plate readers, a letter demanding he cease and desist all use of the name “DEFLOCK” or any variation and refrain from adopting marks likely to cause dilution or tarnishment of the Flock marks. DeFlock crowdsources the locations of ALPRs from Flock and other companies to publicise the technology’s spread. The Electronic Frontier Foundation, representing Freeman pro bono, rejected the demand, writing that it had no legal basis and that the project sits well within its First Amendment rights, pointing to carve-outs in federal anti-dilution law for noncommercial use and for criticism or commentary on the mark owner. State of Surveillance later reported DeFlock had mapped about 90,000 cameras. No litigation or public cost was reported.

On February 8, 2024 Flock Safety issued a press release headlined ‘Flock Safety is Instrumental in Solving 10% of Reported Crime in U.S.’ The release analyzed crime-clearance data from 123 law enforcement agencies collected between April and June 2023. In March 2024, 404 Media reported the study was conducted by Flock employees with oversight from two academic researchers, one of whom said ‘I personally would have done things much differently’ and that the police data was ‘too varied and incomplete’ for meaningful statistical analysis. The researcher also said the two were brought into the study late in the process. The findings drew significant criticism from other criminologists.

On July 23, 2022, Española, New Mexico, police stopped a car driven by Jaclynn Gonzales, then 21, with her 12-year-old sister as a passenger, after a Flock Safety camera flagged the plate as belonging to a vehicle stolen from Rio Rancho. The plate ended in a 2, which the camera read as a 7; the two plates differed by one character. A sergeant ordered Gonzales out at gunpoint before dispatch had confirmed the plate. An officer asked the child whether she had weapons, handcuffed her and placed her in a patrol vehicle. Officers then checked the plate and VIN and found the mismatch. Both sisters sued the city in state district court on January 3, 2024. The Rio Grande Sun reported the city settled the case in June 2025, paying $20,000 to each sister, part of eight settlements totaling more than $1.3 million.

On December 22, 2021, New Hanover County Chief Financial Officer Lisa Wurtzbacher told commissioners that the sole-source contract with Flock Safety for license plate recognition cameras would not proceed. The county had approved the award on December 6, but later learned that Axon had a minority investment in Flock and that other vendors could integrate with Axon’s evidence.com. Wurtzbacher said the county would ‘change direction with this sole source contract and, instead, pursue bidding this service out.’ The contract was never signed.

The Lens investigation found that the New Orleans Real Time Crime Center cost at least $10.4 million since 2017, based on confirmed purchase orders and payroll records. The figure includes $6.1 million in spending on equipment and services from Cox and vendors Active Solutions, Motorola Solutions, and LaTech, plus $4.3 million in payroll for 26 employees from 2017 through July 2021. The Lens reported that the true total is likely higher because the city provided incomplete and inaccurate records, and the city said it could not isolate RTCC expenditures from other Homeland Security spending.