Flock Safety Cameras: Security Concerns in Mass Surveillance Infrastructure

Have you been noticing those small blinking red lights on the side of the road when you're driving home in the evening? They're easy to miss at first—a quick flash on a utility pole, a box mounted near an intersection, a steady pulse along a residential street. Then you start seeing them everywhere. You might have wondered what they are, or assumed they were some kind of traffic or municipal sensor. In many places, they're something else: automated license plate readers—part of a rapidly expanding network that tracks every vehicle that passes by, 24/7, often with no warrant and no individual suspicion required.

Those blinking lights belong to systems like the ones built by Flock Safety—one of the largest providers of this kind of surveillance infrastructure in the United States. Once you know what to look for, the scale of it is hard to unsee. Here's what's behind those lights, and why the security and privacy implications matter. We've cited primary sources throughout so you can see who said what; for a clear visual explainer, we recommend Addy LaMarr's video on the subject (linked in Sources).

Flock Safety has quietly become one of the largest surveillance infrastructure providers in the United States. Their Automated License Plate Reader (ALPR) cameras are deployed across thousands of neighborhoods, cities, and police departments—creating an interconnected web of vehicle tracking that operates 24/7 without warrants or individual suspicion.

As of 2024–2025, Flock operates cameras in over 4,000+ cities across 40+ states (by some counts, 5,000+ communities in 49 states), with their network capturing billions of license plate scans annually. [Wikipedia] Each camera captures not just plates but vehicle make, model, color, distinguishing features, and precise timestamps—building a comprehensive movement database. Flock also offers Condor PTZ cameras that record and track people, not just vehicles, including facial recognition–capable systems. [404 Media]

In late 2025, 404 Media reported that Flock had left at least 60 of its AI-enabled Condor cameras exposed to the open internet—livestreams and admin panels with no password or login. Anyone could watch feeds (playgrounds, parking lots, streets), download up to 30 days of video, and change settings. The exposure was discovered by YouTuber and technologist Benn Jordan and shared with security researcher Jon "GainSec" Gaines; 404 Media verified by having a reporter stand in front of a camera in Bakersfield while colleagues watched the feed remotely. [404 Media] [SFist, Jan 6, 2026]

Flock called it "a limited misconfiguration on a very small number of devices" that had been remedied; the company did not say how many devices were affected. [404 Media] Security researchers and investigative journalists have raised broader concerns about Flock's infrastructure:

• Data Access Controls: Reports indicate inconsistent access logging and limited audit trails for who queries the ALPR database and when.
• Network Sharing: Flock's "Hot List" and inter-agency sharing features allow data to flow between jurisdictions with varying privacy policies.
• Retention Policies: While Flock claims 30-day retention, police departments can request extended storage, and "flagged" vehicles may be retained indefinitely.
• Physical Security: Cameras deployed on public infrastructure may be vulnerable to tampering, interception, or manipulation. Independent research has documented some Flock ALPR models being compromisable in under 30 seconds via a physical button sequence.

From a security research perspective, ALPR networks also present theoretical attack surfaces: network interception if transmission isn't encrypted end-to-end; credential abuse from shared logins or weak authentication; firmware exploitation on IoT devices; data poisoning via adversarial inputs (spoofed plates, reflective materials). [Medium] [Flock] We encourage responsible disclosure for any specific vulnerabilities discovered.

Beyond technical vulnerabilities, ALPR networks raise fundamental privacy questions:

• Dragnet Surveillance: Every vehicle is scanned, not just those suspected of crimes—inverting traditional investigative principles.
• Location Tracking: Aggregated ALPR data can reconstruct detailed movement patterns, revealing sensitive information about individuals' lives.
• Mission Creep: Systems deployed for crime prevention often expand to other investigative or administrative uses beyond their original purpose.
• Chilling Effects: Knowledge of pervasive tracking can make people think twice about ordinary movement—where they drive, when, and how often.

In June 2024, a Norfolk, Virginia judge ruled that collecting location data from ALPR cameras constitutes a Fourth Amendment search and cannot be used as evidence without a warrant. [Wikipedia] The ACLU and EFF have long documented ALPR overreach and litigate for stronger safeguards. [EFF]

Ecosystem integration: Companies like Palantir market platforms that integrate this kind of technology into broader data-fusion and analytics. Palantir's Foundry is described in the company's own documentation as a data-integration backbone that connects "all types of source systems" (structured, unstructured, semi-structured) into a unified environment; Gotham is used by law enforcement for intelligence and decision-support. [Palantir, Foundry data integration] Reporting has documented law enforcement use of Palantir to combine license plate reader data with other sources—e.g. the LAPD's use of Palantir systems for ALPR and vehicle tracking. [BuzzFeed News] When fusion platforms pull in ALPR feeds, hot lists, and other datasets, dispersed camera networks can function as a single searchable dragnet. Analysts have framed the combination of Flock-style ALPR with Palantir-style fusion as a "digital dragnet" that expands the scale and reach of mass surveillance; there is no indication that Flock and Palantir are directly integrated, but agencies may use both. [PowerMentor] [Take Back Our Tech]

Related: Mass surveillance and who controls the infrastructure are themes we've written about elsewhere. Our post Anthropic, OpenAI, and the Government walks through how vendors respond when governments pressure them—and why bulk collection and domestic surveillance matter for risk and civil liberties. The same questions of scale, access, and accountability apply to both AI and physical surveillance networks like Flock.

While completely avoiding ALPR surveillance is nearly impossible in urban areas, there are steps individuals and organizations can take:

Bottom Line

Flock Safety cameras represent a broader trend: the privatization and rapid expansion of surveillance infrastructure. Unlike government systems subject to constitutional constraints, private surveillance companies operate in regulatory gray zones. Security isn't just about protecting data—it's about ensuring technology serves human values. As surveillance systems proliferate, understanding their vulnerabilities and implications becomes essential for informed civic participation.

We encourage responsible disclosure for any specific vulnerabilities. This article is for educational and awareness purposes; we do not endorse illegal interference with surveillance systems or unauthorized access to data. The links below are the primary sources so you can see exactly what was reported and when.