FLOCK techtimes 100k cameras 53 cities
page 2 / 5
Mountain View, California. An ACLU-supported investigation found that a statewide lookup setting had been active on 29 of the city's 30 Flock cameras since installation, unbeknownst to the police department. Over 12 months ending December 2025, more than 250 agencies that had never signed a data-sharing agreement with Mountain View conducted an estimated 600,000 unauthorized searches of the city's plate data. A separate national lookup setting on one camera had also been toggled on without the city's knowledge — and Flock kept no records from that period, making it impossible to determine what left the system or where it went. The ATF, the Air Force, and the GSA Inspector General were among the agencies found to have accessed the data. The city council voted unanimously to terminate the contract.
San Francisco. In June 2026, the SFPD chief disclosed at a police commission meeting that a routine compliance audit had found the Northern California Regional Intelligence Center had queried San Francisco's Flock network on behalf of federal and out-of-state agencies — 299 improper inquiries over approximately one year. Upon discovery, SFPD turned off that access and opened an internal review. A class action lawsuit filed in San Francisco Superior Court in February 2026 alleges that out-of-state and federal agencies — including ICE, CBP, the FBI, and the ATF — had queried the city's cameras more than 1.6 million times in just seven months. California's ALPR Privacy Act explicitly prohibits sharing plate data with federal or out-of-state agencies without case-by-case authorization. The lawsuit seeks $2,500 per violation — exposure, across 1.6 million queries, in the billions.
Illinois. A state audit — triggered after Texas police used Illinois ALPR data to track a woman who had received abortion care in the state — found that Flock had allowed U.S. Customs and Border Protection to access Illinois cameras through an undisclosed pilot program. Flock stated its own leadership was unaware of the program. The audit found 47 agencies had to be removed from access. Illinois law explicitly prohibits sharing plate data for immigration or abortion-related investigations. Evanston terminated its contract and deactivated 19 cameras; Oak Park did the same.
Evanston's sequel. When Evanston canceled in August 2025 and ordered Flock to remove its cameras, the city later discovered that only some cameras had been taken down — and that Flock had reinstalled others without the city's permission, leaving them actively collecting data. Evanston sent a cease-and-desist. The cameras were not fully removed until early 2026.
Oxnard, California. Despite the city setting access to "California only," a vendor-based issue silently re-enabled a nationwide query feature, giving outside agencies access without the department's knowledge or approval. Oxnard suspended its program entirely.
"Flock Nova": From Plate Readers to People Files
The documented violations do not represent the outer boundary of what Flock's system is designed to do. Internal documents, Slack messages, and meeting audio obtained by 404 Media in 2025 revealed the company is building a product called Nova — described internally as a tool that would connect Flock's plate data with commercial data brokers offering people-lookup services, enabling police to "jump from LPR to person." Internal documents described Nova as drawing on 20 different data sources. Flock later said it would not include breach data after the reporting became public.
The ACLU characterized the Nova disclosure as making explicit what had always been implicit: Flock's longstanding claim that its cameras don't collect personally identifiable information was inaccurate, since license plates can be matched to registered owners via DMV databases. "With their new product," the ACLU wrote, "they make that falsity explicit, boasting that the new product will let police 'jump from LPR to person.'" EFF's Matthew Guariglia called it "precisely the kind of dystopian panopticon we've warned about."
Flock's AI capabilities are also expanding beyond still images. The company's cameras now deliver video clips and live feeds to law enforcement, with AI-driven natural language search enabling officers to scan footage for descriptions of vehicles and, potentially, their occupants — a capability the ACLU notes could encompass anyone in the camera's field of view.
Security Vulnerabilities Researchers Found — and Flock Refused to Fix
Flock Safety's cameras have been physically and digitally exploited in ways the company has been slow to acknowledge and unwilling to fund a formal bug bounty program to address.
Musician and engineer Benn Jordan, working with researcher John Gaines, demonstrated in November 2025 that with physical access to a roadside Flock camera, they could press a single button, connect over Wi-Fi, use standard Android developer tools to debug the device, gain root access, and install malware. Exposed USB ports presented additional attack vectors. These are not sophisticated exploits requiring state-level capabilities; they are techniques any determined hobbyist could replicate.