Hackers Cracked a Flock Camera, Copied 3 Weeks of Its Data

A hacker collective calling itself stegan0gram pulled a Flock Safety license-plate camera off a roadway pole, cracked open its onboard storage, and recovered the encryption key meant to protect three weeks of surveillance footage. A joint report from 404 Media and WIRED, published this morning, lays out in granular detail what one of these cameras actually records, and how little stood between a determined outsider and all of it.

• 21 days of activity logs covering roughly 50,200 unique vehicles
• Around 1.6 million images captured in that window, averaging near 3,300 vehicles a day and peaking at 4,454
• 27,321 recovered video clips, including 11 that captured people rather than license plates
• Data shared with 404 Media, WIRED, and the transparency nonprofit Distributed Denial of Secrets

How did a locked camera get cracked open?

Flock Safety says removing one of its cameras is illegal, and that didn't stop it from happening. Once the unit was off the pole, the collective found the camera runs on Android and its storage is split into separate partitions, the same way a laptop hard drive might carve out sections for the operating system, applications, and user files. Two of those partitions, one labeled "vendor" and one labeled "media," turned out to be unencrypted. The media partition held something it shouldn't have: the encryption key for the partition that actually stored the video. Recover that key, and the footage that Flock had described as protected by on-device encryption opens right up.

RelatedEFF: Cops Searched 19,000 Flock Cameras for 'LMAO'

What was actually inside three weeks of surveillance data?

The scale is the part that's easy to undersell in a headline. Roughly 50,200 distinct vehicles, captured across 1.6 million images, means each vehicle generated about 28 photos on average, and some generated well over 100. That's not a single drive-by snapshot; it's a running log of how often a car passes a fixed point, at what times, and in what company. Daily volume ran close to 3,300 vehicles on a typical day and hit 4,454 on the busiest one the hackers logged. Multiply that by however many cameras a single Flock deployment runs in a city, and you get a rough sense of the tracking density these networks are built for, one camera at a time.

Why did the camera log people, not just plates?

Flock markets these units as automated license plate readers, but the recovered clips show the software also runs person detection. Eleven of the 27,321 recovered clips captured a person instead of, or alongside, a vehicle. In one case the camera mistook an American flag patch on a motorcyclist's saddlebag for a license plate and cropped it accordingly, a small error that says something bigger: the computer vision doing this classification at scale is far from perfect, and its mistakes still get logged, stored, and potentially searched. That question lands one day after our own reporting on an EFF audit that found police running 19,000-plus Flock searches under justifications as thin as "LMAO". Between sloppy classification going in and sloppy oversight coming out, the middle of that pipeline, the actual security of the stored data, turns out to be just as loose.

1. Recent weeksCamera physically removed from its roadway mount. Flock says this is illegal.
2. Recent weeksStorage copied, encryption key recovered from the unencrypted media partition. Unlocked the video partition.
3. Recent weeksMaterial shared with 404 Media, WIRED, and DDoSecrets. For independent verification.
4. Sept 16, 2026Joint 404 Media / WIRED report published. First detailed public look inside a live unit.
5. Sept 16, 2026Flock responds, calls the removal illegal. Says no vulnerability report was filed.

What does Flock Safety say?

Flock's position is that pulling a camera off a pole is a crime regardless of what it exposes, and the company pointed reporters toward its formal vulnerability disclosure process rather than addressing the partition layout directly. Asked about the specific gap, Flock said "we received no report through that process," pushing responsibility back onto the hackers for not disclosing responsibly before going public. That's a fair process complaint, but it doesn't touch the substance: an unencrypted partition holding the key to an otherwise-encrypted archive is a design choice, not a disclosure failure, and it would have been just as exploitable by someone who filed a report first.

RelatedCities Ditch Flock Cameras, Then Buy Axon's Instead

Our take

The interesting failure here isn't that someone stole a camera. It's that the camera's own security model had a floor-level gap sitting one partition away from the thing it was supposed to protect. Flock sells police departments on a promise of controlled, encrypted surveillance data. That promise is only as strong as its weakest partition, and this one turned out to be unencrypted by default. A system that quietly detects people, not just plates, and stores the mistakes alongside the successes, needs a security bar higher than "illegal to physically access," because physical access clearly wasn't the hard part.

Original analysis by GenZTech, based on the joint 404 Media and WIRED investigation.