Security flaw

Flock Safety sent an email to Connecticut police departments warning of a security incident. A malicious actor published a website showing the location of more than 300,000 Flock devices. Flock said the data was unlawfully accessed from a third-party map service and that no images, video or sensitive law enforcement data was exposed. Ledyard Police Chief Ken Cruetz asked the town council to sever the contract. Records show Flock knew about the vulnerability for almost nine months but did not notify customers until the website appeared.

Hackers from a collective calling itself stegan0gram removed a Flock Safety camera above a roadway, copied its storage, and recovered an encryption key stored on the device. The recovered logs and videos showed the device captured 1.6 million images of 50,000 vehicles in 21 days, and its software explicitly detects people as well as vehicles, license plates, and bicycles.

A blog post by Micah Lee, based on a dataset published by DDoSecrets from a collective called stegan0gram, describes security flaws in a Flock ALPR camera. The camera ran Android 8.1 with a security patch level from 2018-06-05, missing years of updates. The firmware contained a hard-coded API key for Flock’s backend service, presumably allowing credential retrieval for any camera. Logs revealed the camera’s location in Wauwatosa, Wisconsin.

On September 3, 2026, a Boston Police Department drone crashed onto a parked Mazda 3 in Brighton, damaging its rear windshield and trunk and leaving the aircraft in pieces on private property. The crash occurred less than a week after the department began operating its Drone as First Responder program, which it had announced on August 28 in partnership with Motorola Solutions and BRINC. BRINC collected the wreckage. The car’s registered owner, a 42-year-old Brighton man, was not home at the time. Under 14 CFR § 107.9, the FAA requires remote drone pilots to report any accident causing more than $500 in property damage within 10 days. The program began operating in the final weekend of August.

Security researchers Jon Gaines and Benn Jordan demonstrated that a physical button sequence on Flock Safety cameras activates a diagnostic Wi-Fi hotspot, often protected by the default password “security.” This allows root access via Android Debug Bridge in under 30 seconds, enabling footage extraction, malware installation, and credential theft. Additionally, over 60 Flock cameras were found streaming live footage with no authentication, exposing 30 days of archived video. Flock operates over 100,000 license plate readers across the U.S.

In March 2026, a report stated that stolen police logins are exposing Flock Safety’s automated license plate readers to hackers. A DEA agent was found to have used a local officer’s password to access the camera system without authorization. Flock Safety lacks robust internal protections, and many agencies fail to enforce multi-factor authentication. Lawmakers are demanding immediate accountability and reform. Data from these cameras covers approximately 70% of Americans, raising privacy and security concerns.

An automated license plate reader system flaw in Ventura County, California, allowed federal and out-of-state agencies to query local ALPR data in violation of state law. The Ventura County Sheriff’s Office audited the system on Feb. 11 and found over 364,000 searches by out-of-state agencies between Feb. 19 and March 19, 2025. Other agencies reported similar access: Port Hueneme logged 798,000 out-of-state queries, Oxnard two, Ventura two. The feature called ‘National Lookup’ had been inadvertently enabled. Oxnard suspended its Flock system; others continued using it with new safeguards.

404 Media reported that at least 60 of Flock Safety’s AI-enabled Condor cameras were exposed to the open internet, allowing anyone to watch live feeds, download 30 days of video archives, and change settings without any password or login. The exposed cameras included views of playgrounds and parking lots. Flock Safety said the flaw was a limited misconfiguration on a small number of devices and has since been remedied. The affected Condor Live cameras are not the same model as the license-plate reader cameras used by San Francisco and Oakland police.

On the evening of December 5, 2025, the Eugene Police Department ended its contract with Flock Safety effective immediately, citing vulnerabilities and limitations affecting operational needs, data security requirements and community expectations. Springfield police announced about an hour later that their cameras would be covered pending removal; Springfield had said in September it would not turn on its 25 cameras, budgeted at $77,000 per year and funded by a $93,000 Oregon Criminal Justice Commission grant, until a community discussion took place. Eugene’s chief later confirmed a Flock camera had been turned on after the city ordered the cameras shut down in October. Eugene’s $342,000 two-year contract was funded by a state grant. City staff removed 55 of Eugene’s 57 cameras by December 19.

Sen. Ron Wyden and Rep. Raja Krishnamoorthi sent a letter to the Federal Trade Commission urging an investigation into Flock Safety for not requiring multi-factor authentication on its license-plate camera platform. The lawmakers said stolen police logins had been shared online and a Russian cybercrime forum allegedly sold access to Flock logins. Flock said it enabled MFA by default for new customers in November 2024 and that 97% of its law enforcement customers have enabled it.

Security researcher Matt Brown found that more than 150 Motorola ALPR cameras were misconfigured and exposed live video feeds and vehicle data on the public internet without authentication. WIRED confirmed the exposure by analyzing data streams from 37 IP addresses across over a dozen U.S. cities, capturing nearly 4,000 vehicles in 20 minutes. Motorola Solutions confirmed the exposures and said it was working with customers to restore configurations and would add security hardening in a firmware update.

In January 2025, a security researcher bought a Motorola ReaperHD license-plate-reader camera on eBay and found that many identical live cameras were misconfigured to stream colour video, infrared video and vehicle data including plate numbers to the open internet, viewable in real time with no username or password. The researcher used text from a 404 error page to locate exposed devices; more than 150 appeared in a public internet-scanning tool, and roughly 170 unencrypted ALPR streams were reported found. A tool published on GitHub logs plates, make, model and colour from exposed cameras to a CSV with a vehicle image. Motorola confirmed the exposures and said it was working with affected customers to close the open access. The ReaperHD is a legacy device whose sales were discontinued in June 2022. No public remediation cost was reported.

On March 10, 2023, the city of Shreveport disclosed that its Real Time Crime Center cameras do not comply with state and federal law because they are insecure and vulnerable to hacking. Mayor Tom Arceneaux said on KEEL radio, “I don’t think they are useful for anything because they are capable of being hacked into. We will probably eat them or sell them for scrap.” Sources estimated between 50 and 90 cameras were installed under former Mayor Adrian Perkins’ administration. The system must be replaced, and city administrators were warned of the noncompliance before purchase.

An independent investigation by Kirkland & Ellis LLP found that a backup technician’s errors during a server migration caused the permanent loss of approximately 20.68 terabytes of Dallas Police Department data. The data included family violence and FUSION records. Only 3.26 terabytes were recovered from other sources. The report states the data is unrecoverable in its original format. The technician deleted archived data from cloud storage after incorrectly copying placeholder files to on-premises servers.

On April 5, 2021, the city of Dallas learned that a police employee had accidentally deleted 22 terabytes of digital case files while migrating data from a cloud-based archive to an on-premise server. Police recovered 14 terabytes; the remaining 8 terabytes are believed permanently deleted. The files included audio recordings, case notes, images and videos. The deletion affected prosecution of cases with offense dates before July 28, 2020. At least one murder trial was delayed. The police department attributed the deletion to human error and announced new safeguards, including requiring two employees for file migrations and a 14-day recycle bin.

In June 2019, U.S. Customs and Border Protection subcontractor Perceptics was breached in what CBP called a malicious cyberattack. Images of travellers’ faces and license plates, contracting documents and other data were made publicly available on the internet. About 184,000 traveller images from CBP’s facial-recognition pilot were compromised, and at least 19 were posted to the dark web. The attackers also obtained contractual documents, program-management documents, emails, system configurations, schematics and implementation documentation related to CBP license-plate-reader programs. Perceptics had downloaded sensitive CBP data from an unencrypted device and transferred it to the company’s network, violating DHS security requirements. Perceptics was suspended from federal contracts, subcontracts, grants and loans in June 2019; the suspension was lifted in September 2019. A September 2020 DHS Inspector General report found CBP did not adequately safeguard the data, though no federal networks were compromised.

The New York Police Department recalled nearly 3,000 Vievu LE-5 body cameras after one exploded on a Staten Island officer. Deputy Commissioner Jessica Tisch said the department would stop deploying the model, citing officer safety. The recall came two years into a $6.4 million contract with Axon, the device maker’s parent company. The NYPD hired an independent forensics investigator and explored replacement options, including the LE-4 and Axon Body Camera 2.