Having hardcoded credentials is a sign of total incompetence. In this case at least it wasn't a password, but an API key which can be used to request credentials (stored in plaintext) which look like they'd get you access Flock's servers. Not quite as bad as a hardcoded admin password, and it's not clear what you'd be able to do if you did authenticate successfully as a camera, but its worrying enough. There have been enough vulnerabilities found in Flock's systems that it's pretty clear they aren't concerned about their security and it's plainly obvious that they don't care at all about our privacy or security.
Even if we decided that this level of mass surveillance on the American public was acceptable to us, Flock Safety/Flock Group as already demonstrated that they can't and shouldn't be trusted to implement it.
I too am appalled by the inefficiencies of the bureaucracy of the Gestapo. A serious threat to the state and the people could take days to reach the correct authorities. Only zhast month a smuggler escaped zhe guards, no doubt an agent of foreign intelligence.
East Germans also wouldn't criticize the Statsi as a show of loyalty, and nobody would read about a security failure in the state news. So the story must be told by one of its characters. :-)
I for one welcome the incompetence. Godspeed to whoever is able to deploy a build to the whole device fleet that burns SoM boot protection fuses to an image that doesn't do anything hard bricking their entire network.
oversights like these are what eventually lead to situations like in 'Watch Dogs' and 'Cyberpunk' where you have these one click exploit that can break every tech and surveillance gadget in sight
If you want to know what a "Vulnerability Disclosure Policy" (VDP) would look like if its main purpose is to claim we have VDP and create an appearance of responsible security posture, but not really to learn about vulnerabilities - read Flock's VDP.
They sincerely welcome your vulnerability disclosures, except in cases where you have to "interact" with the device/service or download its data. Other than that TINY carveout, everything is okay.
Oh, if the vuln about configuration and hardening "preferences" like SSL/TSL - Sorry, not interested.
And also, infrastructure vulnerabilities like DNS config - no no, try harder.
I know what you're thinking..ha ha...but we are good guys. You can still report vulnerabilities in the above categories, but the onus is on you to convince us that we should care about them. It is only fair.
This looks like a pretty reasonable policy to me all things considered. And no, I'm no fan of Flock. But they do run security cameras for the cops, they can't just say go ahead, go wild on all our customers' cameras. The lawyers would throw a fit.
The carveouts for stuff like configuration and DNS are entirely reasonable. Have you ever been behind a security@ email before? You get a lot of BS reports of that sort.
The TLS/SSL and DNS carveouts are pretty normal. There are a million security options for those services and enabling them all would often mean denying access to anyone running a browser/client more than a few weeks old. Documenting them all would be a PITA so most policies simply prohibit them entirely.
Testing against customers is also a common prohibition for obvious reasons.
Hm... not normal in my experience. Not enabling a config is not a vulnerability in itself. If not enabling something means a security guarantee is broken (Eg: videos are accessible) then it is a vulnerability, and typically included in VDP, atleast VDPs that are in good faith.
There are a lot of theoretical vulnerabilities in various encryption algorithms used by TLS/SSL/DNS. There are also older protocols that have known vulnerabilities but yet don't present a realistic threat to most types of services. I've worked for more than one company that had to decide whether disabling an algorithm and blocking 5-10% of your customers was worth the tradeoff. Having these debates with researchers is tedious.
That said, there are numerous options that should be enabled and several protocols that should be disabled. It just isn't worth the spam you get if you allow submissions for these type of issues.
> Oh, if the vuln about configuration and hardening "preferences" like SSL/TSL - Sorry, not interested.
> And also, infrastructure vulnerabilities like DNS config - no no, try harder.
It's understandable. If you have or manage a website you will receive daily emails (the kind that start with 'Hello sir') about automated scans finding low-hanging fruits like that, pretending a bounty payment.
It'd be interesting to know how much of that they put second to "Americans seem to like using our hardware as targets for firearms, reciprocating saws, spray paint, and garbage bags" in their list of corporate concerns.
This is pure laziness aka “reduced time to market” on the part of Flock.
It takes time and effort to think through proper secure boot architecture and to implement key management in a way that doesn’t kill developer productivity.
Their product managers, though, should have realized that setting these up in unsecured public spaces means that their threat model really does include local physical access to everything.
Using off the shelf hardware and software stacks all but guarantees attackers have tools at their fingertips to exploit said physical access.
Given all the recent exploits hitting the kernel, there’s a good chance that there exists an exploitable over-the-air vulnerability present in their WiFi/bluetooth stack, too.
The flip side of this laziness is that now, when my elected representatives tell me "these are just license-plate readers that don't record video", I have evidence to show them that's false.
If Flock had done a more competent job of securing their system, it would be harder to demonstrate this in a compelling way. To a technically-inclined person, it's obvious from the get-go that somewhere in Flock's pipeline, video is being recorded and archived, and is therefore vulnerable to misuse. But the more they're allowed to keep the implementation proprietary, the easier this is to sweep under the rug.
Exactly. It helps they also control who can even run for office in any meaningful way. Nobody fights the left harder than Democrats. Good luck finding a representative that is against data centers, flock, Israel, congressional stock bans and pausing and regulating AI, views overwhelming popular with the majority of the actual American public.
Funny. In my experience, nobody fights the “leftists” harder than the Democrats. I think the Republicans fight the Democrats harder than anyone else, and aside from the “leftists”, no political group seems to really fight the Republicans.
You are misunderstanding basic political terminology then, if you think it's somehow odd that leftists are against Democrats. Democrats and Republicans are both capitalists and liberal in the classical sense, both of which leftists oppose.
>Good luck finding a representative that is against data centers, flock, Israel, congressional stock bans and pausing and regulating AI, views overwhelming popular with the majority of the actual American public.
That is rapidly becoming Democratic party orthodoxy. At the very least there are a sizable number of Democrats who fit that.
Don't know why you're getting downvoted, but hackernews is very anti-democratic in nature. One thing politicians quickly realize, especially local ones, is that you do have to be accountable to voters at the end of the day. One or two bad stories is enough to sink a local race too, or at minimum require a massive spend to overcome the negativity.
Local politics is where you understand how effective a handful of people can truly be.
Happy to read people are understanding the true power they have collectively instead of as individuals.
My problem is that Claude kept screaming across several sessions that it echo'ed a default password for a local, ephemeral development container into a session across SEVERAL sessions.
I get dinged continually for a vendor supplied container that writes an appropriately scoped access key to disk in plain text on startup (we are working to eliminate it but it requires migrating to an entirely new way of doing things the vendor only released earlier this year and I got derailed by other priorities).
So like if established enterprises using off the shelf scanning software are breathing down my back about this...what the actual hell is happening inside flock that this was fine. Lol.
It’s not laziness, it’s hyper focus on compliance. CJIS is the policy maintained by the FBI that handles information security, which is derived from standards built around paper.
Adding more weirdness, the details get worked out by each state.
My guess is they encrypted whatever is criminal justice information (license plate hotlists, etc) or protected by local laws (DMV data) and left the rest to make it easier to deploy and service. Remember pictures of you or your car taken in public are not protected or in scope.
Police tech is garbage and usually driven by federal grant spending. So it’s going to be interesting to see how Flock and Axon grow the business as it turns into a service model.
Any breach of security on a system like this is a big flashing red-alert to me.
If it could lead an attacker to get ANY of their data... Persons, places, events, etc is pretty damning stuff to be exfiltrated.
Stalking/Domestic Violence, blackmail, timed robberies, you name it... That data shouldn't really be in anyone's hands in my opinion, but in anyone's hands (good guys / bad guys) it's pretty powerful.
Getting persistent access to Flock's internal network is a high-priority item for every US adversary, who doesn't want free intel collection on the movements of persons of interest? Knowing who the FBI and local cops are monitoring in is the counter-counter-intelligence cherry on top of a self-inflicted dragnet surveillance cake.
Any entity with access to flock servers can virtually stake-out anyone/everyone driving past Flock camera to monitor their movements. In a hot war, this would provide actionable data to support assassination via road-side bomb/drone strikes.
It's a red-alert to you and me, but Flock won't care. People already don't want these cameras in their cities, but police departments buy them anyway. What does it matter if there's one more reason you don't want them?
That's why you or I would care, but that doesn't answer the question of why they would.
Large companies tend to be amoral. Unless it affects them monetarily (possibly indirectly) they're not going to care. Given what they do to make money, I don't see any of these things hurting them.
Apparently police are accessing the network via their personal devices. I highly doubt their security practices online are any better than this. I wouldn't be surprised either to see things that chinese manufacturers do such as intentional back doors.
Overall this goes from disappointing to fairly repugnant.
Allegedly you can buy credentials on the darkweb to perform national searches. Might explain why some of the logged reasons for recent searches were “LMAO”
The normal explanation is plenty, unless you’ve never met, read about, or heard anyone talk about, law enforcement officers (who are human beings - for better and for worse).
How many of us have had coworkers who put something like that into a commit message? And that's a message that's at least notionally supposed to be helpful to you or your coworkers, rather than existing purely for the purposes of oversight you don't want in the first place.
I would expect law enforcement coworkers to understand the law, department procedure, and public requests for their data. That’s expecting too much from the academy, I guess.
Those that fail to meet standards should be fired to spare the taxpayers from the lawsuits coming from AI-assisted complainants.
It’s also too much for Flock’s YC-funded technology to implement a field filter that rejects “LMAO” as a valid request.
At the very least, your local staff’s nationwide stalking credentials being harvested by phishing and abused by others should carry criminal negligence penalties. Governments should pass that liability onto this YC-funded startup company.
This meme will not die, and here you can see it blossoming into something even weirder.
There is one (1) case in the literature, back in the early 2000s, where a department rejected a candidate as overqualified based on a cognitive assessment; the rejected applicant took that department to court and lost.
That's it; that's all the evidence.
Against that: most police departments around the country administer written tests with general cognitive components for which there is a floor score and no ceiling (the POST, the NTN, &c). And virtually no departments --- none I'm aware of --- administer IQ tests.
From all this, we've now got "a federally protected right"?
Many moons ago, I was involved in the technical side of volunteer work for domestic violence victims escaping abusive relationships with e.g. law enforcement (cops), who even fifteen years ago had sweeping powers to track and stalk their victims. Things like actual anonymous burner phones and the ability to e.g. create new email accounts without government identification were critical to the process of getting these people out safely, or alive, without fear of retaliation.
I can't even imagine how difficult this job must be nowadays, with bullshit like Flock spanning hundreds of police departments participating in their nationally-linked database. I have zero sources for what I'm about to say, but my instinct is that the political machines (expanding powers hidden behind "think of the children") behind how technology is evolving today has gotten people killed.
Quite potentially, yes. Their name is already mud among many voters, if they're shown to be treating data insecurely then that's another reason why local governments might consider terminating contracts with them.
They want the good, bad and ugly to flock to them as it were and vaporize them so Axon and Motorola Solutions can just pick up right where they left off. And people will just ignore or forget it because it's not the same company.
Is there any recent example of a company getting breached and its data exfiltrated, where the business was actually hurt? I predict we'll get a standard boilerplate "We take security very seriously" press release, a narrative that blames the evil hackers entirely and not the company's negligence, and then that will be that.
I really hate how Product Managers somehow get to take the reins of engineering teams instead of having to sell them product ideas.
It's madness, they often lack the technical skills and "optimise away" requirements surfaced by eng teams they don't comprehend or just don't like having to deal with.
Do you feel like an inadiquate imposter or something? I'm assuming you work in software.
Watch some engineers in other disciplines and you soon recognise that many of them have about the same responsibility as a software engineer. Design is design.
Or read about engineering failures like flight QF32 (mostly a success story):
A paperwork review showed that the required signatures were missing from 131 out of 138 retrospective concessions issued between 2009 and 2011
Australian Quantas, with a UK Rolls Royce engine on an Airbus, with engines maintained in Aussie.
Safety is now often made up of interlocking: regulations, standards, quality systems, safety management systems, insurance, international legal contracts. Certified engineers and signatures are usually only a very small part of those systems.
Certification matters less than you might think across international borders.
Perhaps I'm a cynic, but beliefs in certification seem so irrational to me. What is it? Jealous desires for status? Desire to have guilds/gatekeepers? Complete misunderstanding of how safety occurs in "real" engineering?
>Safety is now often made up of interlocking: regulations, standards, quality systems, safety management systems, insurance, international legal contracts. Certified engineers and signatures are usually only a very small part of those systems.
I mean, you make my point. At no point did I say engineers are the only required component, but without the responsibility of an engineer signing off on its technical adequacy we have loads of historical proof that people end up dead far more often.
That is your belief, but I've never seen that belief backed by fact.
Most open source software disowns liability in CAPS in the license. Yet somehow FOSS like Linux gets used for safety critical infrastructure.
Microsoft would love certification requirements for engineers - that would kill open source to their conpetitive benefit.
Do you honestly think if we required Microsoft Certified Professionals to sign the internals of Microsoft OS then Windows would be more secure or reliable?
The bigger issue is that signatures and criminal consequences hardly matter across jurisdictions.
The capitalist issue is that businesses want scapegoats when things go wrong. That would be the outcome of signatures: engineers as fallboys for systemic failures across organisations.
Note how often pilots are blamed for accidents due to the design of planes.
It is just an idealistic belief based on feelies that software certification would achieve the goals you imagine it would.
Signatures are an anachronism: from an alien past.
International business uses different mechanisms for safety.
Our world is intertwined complexity. You somehow think that the buck should stop at engineers?
If engineers signed off on everything then we'd have no more disasters like New Orleans floods?
Who signed what for the Grenfell towers tragedy? Which engineers were reprimanded? Did they decide that more signatures would help prevent future disasters?
Your conclusion seems at odds with your evidence: the quote you reference indicates that a professional engineer was meant to examine the 'retrospective concessions' and did not. The result was that no qualified engineer was taking responsibility for their quality. Fixing the process meant getting credentialed engineers to assess and incur liability for the solutions, which is how the professional engineering licensure system is supposed to work.
That’s because computers are Turing complete anything is technically possible and comes down to the time quality cost triangle. Most management thinks they can optimize that triangle by squeezing the living bejesus out of their teams.
3.18.71-perf-gaf770dc is a Qualcomm Android vendor kernel from roughly late 2017. The 3.18 branch went fully EOL in 2019, so nothing after that was ever backported to it.
2017 was also the year Flock was funded and founded and went through the YConbinator cohort.
But you would have thought that by 2021 when Andreessen Horowitz funded them or at least by 2025 [1] when both further funded them, someone would have actually done some minor due diligence. Coincidentally too, 2025 was when the flock surveillance matrix went up all over the country almost immediately.
We constantly hear that the magic of tech funding lies in the people, not even the product/service. These types of things always seem to uncover that that is effectively just a lie to cover up the ulterior motives of setting up a tyrannical surveillance matrix all around you … to protect the children, of course.
In an ideal world they'd have people whose job it is to monitor upstream activity in the components used in the firmware and maintain this. Sounds like they did not have that.
To be fair if you could SLTS support by CIP (which is designed for things like this) you have 4.19 at least still maintained. 4.4 might still be too but I'd have to check
I don't think you misunderstood, I think they're talking out their arse. Modems don't run Linux, they run RTOS operating systems. ShannonOS in the case of the Pixel 6 with a exynos modem
same, but i'm not sure how that's related to my comment. workarounds or alternate articles without significant new information are typically posted within the same submission, not separate ones.
has been for a long time - there's a sound engineer who developed quite a following (and is fairly involved with local movement hackerspaces) who demo'd how easy it was to hack Flock cameras nearly a year ago: https://www.youtube.com/watch?v=uB0gr7Fh6lY
My working assumption based on what I hear out of Flock is that they have a public feature set (mass license plate surveillance for LEO) and a covert feature set (even more mass surveillance, beyond license plates and privacy agreements, for intelligence communities).
The devices are entirely open for all practical purposes - but worrying about individual cameras is silly, because they have no meaningful security at all around the API's to access all the cloud data - you can buy law enforcement credentials dirt cheap in dark web marketplaces to log in and track anyone/anywhere you want and access all footage.
> The hackers said they were able to access the Android system on the camera, and found two partitions—sections of its hard-drive, essentially. A few of these were unencrypted, the hackers said, including one called “vendor” and another called “media.” The latter contained an encryption key that unlocked another part, which contained much of the media—think, the videos and stills—the camera took.
> In early 2025, security researcher Jon “GainSec” Gaines reverse engineered a Flock license-plate reader and documented flaws that could be used to gain root-level access. After Gaines disclosed his findings, the company acknowledged the findings but downplayed their severity, writing that the flaws required physical access to the device and that even someone who gained access to a camera “would still not be able to gain access to footage” because images remained on the device only briefly after being transmitted to the cloud.
My passwords are in an encrypted block in a text file that can be unencrypted inline in an Emacs session with a keystroke sequence that looks like a cat just chased a mouse across the keyboard, and that's before entering the decryption password. To access it, an attacker would first have to learn Emacs. Pretty sure that's a post-quantum level of security.
They could use an LLM to lookup your HN posts and then to wrangle Emacs. Or just decrypt the text in another application - I doubt Emacs is the only platform for whatever crypto method you use. M-x rot13 ?
Oh, did I forget to mention the encryption is implemented in Emacs Lisp?
At some point, the attackers are just going to have to give up and start hitting me with a wrench. Joke's on them though - I'm an Emacs user, I like pain.
It's interesting and fun to implement this stuff; I totally agree. Emacs is amazing.
I worry people will get the wrong idea about security: The application used for decryption doesn't need to be the same as the one used for encryption, at least not for any serious attacker. That would be 'security through obscurity'. They need the encrypted text; they don't need Emacs.
More importantly, no matter who you are, that you implemented the encryption yourself (?) is a major flaw - unless you have a cryptography team that has matured the implementation over a decade or so. Nobody is good enough to do that by themself. As the saying goes, anyone can create an encryption routine that they can't break.
Maybe you do or did really believe those things - lots of people do. There's nothing wrong with it. Saying 'I was joking' is maybe true, maybe it's just using a very common tactic for covering.
It's a forever-fresh reminder about security versus your own government, but for malicious hackers and bots: the physical trip to visit you costs more than half their infrastructure.
Encryption matters, even if I would divulge everything long before the wrench appeared.
But think the real danger in Flock is the aggregate data, tracking between camaras. So if someone hacks a single camara, they probably don't get much, unless it is pointed right at someone, which is bad. Aren't they selling these as should be pointing at traffic? If they are pointing right at people, like at playgrounds, then they are being installed illegally to begin with ?
A network connected device that can be hacked is a small step away from being the first foothold into its server. The fact that on-device security is this atrocious suggests that their server is not any better quality, which means hacking it would probably not take much effort.
There are levels to defending against physical attacks, and Flock half-assed theirs by leaving the encryption key right on the file system, according to the reporting. Those more serious about security — like Apple — store keys in an "enclave" chip so it can't be easily extracted by an attacker doing the bare minimum
Apple did that… eventually. Early iPhones weren’t very secure. Apple only got serious after they dominated the market and reducing the theft value of iPhones became a priority.
Even the cheapest commodity encryption chips have had this capability for well over a decade now, Unlike Apple, Flock are not a hardware pioneer, not by a long shot.
The Android documentation has an example of how to use hardware keys, and a Chinese OEM (IIRC) was found using the example key provided by Android sample code - and yet that was more effort than Flock applied, since their ARM SoC support it.
i think this is actually good, because there are differences between the images they found, and security settings that the company claimed.
They had not admitted before to tracking people, but their software is clearly submitting them. They had not admitted before to looking at bumper stickers, but turns out they do.
I wonder if they could find all cars with Bernie Sanders bumper stickers within X blocks of a polling place.. I can imagine that (or similar queries) might be very useful in the wrong hands.
Is this an older model? I could see them turning off or using weak encryption on media if the hardware couldn't keep up with the amount of data they were writing.
As another commenter pointed out, any cheapo ARM core from the last 10 years could do the job Flock needs it to do, as long as it has a (very cheap and common) crypto engine strapped to it.
But, a question for you: even if it was the case that the hardware was the limitation, isn't that also an indictment of Flock? Selling something that cannot exist securely within the bounds of current technology? Or, at a minimum, bad chip selection leading to a compromised design?
I'm in the process of optimizing a bootolader for my various SoC/SBCs and even the cheapest, oldest least powerful SoC from 15 years ago can manage AES-CBC via crypto accelerator at 50 MiB/s. There's no excuse.
You can achieve 50MiB/s if that's all that you're doing. I've worked with some DSPs (TI's DaVinci line) where some operations would abort if DDR was overwhelmed.
For example, passing a frame of video (YUV) into the peripheral which can resize the overall image, would fail if the system was busy with other DMA transfers. You could attempt to resize again, but there were no guarantee that it would complete successfully. Your options are to reduce overall DDR utilization or drop frames. In an application like Flock's, dropping frames is likely something they need to avoid.
The system in question is doing similar tasks, and I don't think that what I'm suggesting is out of the question.
They can choose the SoC that would be able to fill the requirements. Eg. almost all Rockchip SoCs have NoC with configurable QoS on master ports (even the cheapest IP camera targetted SoCs that cost like 2-3$), or some other interconnect mechanism that can make it so that SDRAM controller gets tasks in some user selected priority order (eg. you deprioritize CPU in favor of camera interface and other things). This is not a new tech. It already existed when Flock was founded.
And in any case. Passing compressed video streams or pictures through HW encryption engine will not saturate 1.5+ GiB/s or whatever even the lousiest 16-bit DDR3 at 400MHz would give you, not even close. It would be like a fraction of a percent of total bandwidth.
In a perfect world, yes, but this is a for-profit company and there's almost zero repercussion for doing it half-assed. They'd have to pay someone to implement it, and deal with the overhead and complexity.
Now they are in a position where they can sell new models with enhanced encryption and more features.
You don't think that because it's called a "license plate reader," that it only captures license plates, do you?
Flock cameras capture the make, model, color, and body style of vehicles. They capture bumper stickers and other decals, as well as potentially identifying dents and scratches. They capture accessories like roof racks, bike racks, trailers, and toolboxes.
The OP story covers some of this. There's more at:
The article says that Flock says "their cameras don't do facial recognition"
The cameras don't, but they don't say the system doesn't. They don't say facial recognition isn't a click away through another integration.
I would absolutely assume that any system that sends your image to LE is part of a facial recognition system in practice. We know now that the cameras do recognize people and intentionally transmits images of them, for later identification.
Commented something similar at the same time. I hate weasel wording like this. There is nothing that prevents this data from being used that way now or in the future.
edit: And to be clear, the cameras specifically recognize and record people for a reason. This does not appear to be a fault in the system. One reason might be off-camera facial recognition.
I’m sure the first approach has been ingesting vehicle registration data into Flock servers so that your ID photo pops up when your license is captured.
It seems the inevitable next step would be post-processed facial recognition (checked against those ready-for-the-taking ID photos) in their OS Investigator platform.
> According to our analysis, the camera’s logs recorded about 21 days of activity across several periods. During those windows, the device photographed roughly 50,200 vehicles and generated about 1.6 million images. On a typical day, it logged around 3,300 vehicles, with a high of 4,454.
Has there been any report about which state this camera was recovered in? New Hampshire has a strict 3 minute rule for non-hit plate data before the captured images and records must be deleted [1].
[1] (N.H. Rev. Stat. § 261:75-b) requires ALPR systems to delete non-hit plate data within 3 minutes
The images were deleted the moment they were uploaded. But the record in the log files persisted. The camera doesn't have enough memory to store that many data.
> The images were deleted the moment they were uploaded.
???
> VIII. Records of number plates read by each LPR shall not be recorded or transmitted anywhere and shall be purged from the system within 3 minutes of their capture [...]
But you're saying that these non-hit image captures were uploaded somewhere?
- Camera pre-checks the picture for quality and that there's something on there that they want
- Camera uploads picture to flock servers
- Camera deletes picture locally
- Rinse and repeat
I could actually see this being done by three jobs in parallel.
If there are a lot of images found on the camera then that's probably because the upload wasn't able to keep up with the amount of data that was created or they have a buffer of a few days or there's a cronjob that deletes these files every now and then...
Unless they actually use the camera also as the storage, which would be really stupid, but sometimes people to stupid things.
All these cameras do is pre-select the images that are worthy uploading. Everything else happens at Flock.
That's why they don't give anything about the camera's security.
The images are all from a public place, so no privacy expectations and what's theworst that could happen? Someone uploads their cat images or the pr0n collection?
Assuming the point of these cameras is security (and not just surveillance for stalker cops), being able to upload replacement footage would subvert that entirely. This has been a feature of many spy and cops/robber movies.
The point of these cameras is to deliver as many images of good quality as possible that show something of interest like a person, a car's numberplate and so on.
I almost guarantee you, if the camera even has a SIM-Card then it's pre-configured with all the necessary information to find and join the mobile core network via APN.
It turns on, joins the core network, gets handed an ip address and additional information like a servername/ip as its reporting endpoint, establishes the connection and starts taking pictures that it then sorts out and uploads.
That's pretty much it. No login credentials, no complicated protocols, nothing. The things is identified via IMEI, Mac or some other burned in "serial" and that's all that's necessary to make it happen.
So there are no credentials that could get lost, no technology that would be worth anything, access is being controlled on the network side and the images that are being taken are from a public place with no expectation for privacy.
The core system only has to be secure enough so that it doesn't get hacked via an open bluetooth tty or something and everything else is handled by the network it belongs to. That's why DNS manipulation and similar stuff doesn't get you anywhere.
Besides that, it has to be cheap and doesn't have to adhere to any security standards whatsoever. It's a pole with a mini camera and a solar cell that can just be vandalized by the next person that shows up.
Yeah, you could potentially MITM them with a rogue cell tower, I suppose.
I'm curious about the researchers still having the device. They could also see all the cloud endpoints that were being accessed. Are they secure?
Curious how/why all this negative attention is focused directly on the Flock brand (current example notwithstanding)?
Seems like if I were a competitor of Flock I'd be pretty happy right now and all this negative press is making them artificially cheap to buyout right now.
Motorola/Vigilant, Rekor, Leonardo/ELSAG, and Axon are huge companies making mint off the same thing and no once in 20 years have I seen this level of attention... not on the overarching issue of surveillance-state-ing, but of one particular company.
1) Flock developed a nationwide network to track innocent people, tried to get in as many places as possible, and handed law enforcement agencies carte blanche access with virtually no oversight. Their whole schtick was being the mass surveillance company, and striking fear into people's hearts, in order to prevent crime. Despite being founded in 2017, they quickly reached hundreds of thousands of cameras installed.
2) The US Executive branch formed concentration camps and a private army, and started using this nationwide mass surveillance network to track down any brown people with a Spanish accent to lock them up in dangerous squalid conditions and/or deport them with no trial. This is an immediate, nation-wide harm being done to millions of Americans, and this new company is enabling it.
I think I should start posting a reminder in Flock threads that Axon is a Flock competitor, is also engaged in mass surveillance, and is possibly even worse, but there’s rarely any mention of it. Journalists need to do some digging there. This shouldn’t just be a Flock story, or Flock will just get bought up or something and everyone will move on.
(The above should not be read as supporting Flock or discouraging further investigation.)
> The camera’s logs also show the camera struggling with storage. Its logs recorded more than 27,000 “no space left on device” errors while trying to save full-resolution images, along with tens of thousands of related errors, crashes, and reboots. At the same time, about every two minutes, code checked that the camera was still running and logged the message, “Who’s a good boy?!” More than 12,000 of those messages appear in the recovered logs.
"Axon is Flock but worse" will be the next big fight as police departments are pulling a fast one and saying "we got rid of Flock" by switching to Axon.
Axon is the default for the on-body camera system. The barrage of cop tv shows use them as part of their promotional relationships. Flock decided to not attack their market, in stead go for the adjacent space.
Axon (among others) has operations hubs for data fusion centers and other platforms for police like Evidence.com, so it’s an easy sell to departments.
Communities are starting to pivot to the wider issue, but a reason that this issue found purpose is that Flock is a more evocative target than “ALPRs”. I think it wouldn’t be a bad thing if “Flock” becomes the generic name.
While Axon's system should be under the microscope too I don't think they have the nation wide cloud that Flock is doing and requires specific agreements to share data. Maybe that is getting abused to form a national database but I imagine it was designed so say a county sheriff department and local city PDs could share resources. I don't think most people are that concerned about things like that (though they should be), it is the nation wide surveillance that creeps people out. That and the stalking of course and both systems can be used for that.
Axon and Motorola also do a lot more to court state agencies who have grand plans of monitoring some highway corridor so their buddies at DEA/CPB/SMD/whatever can tip them off and their "drug task force" can make a newsworthy bust.
Flock by contrast courts local PDs who will catch a package thief or two but they really just want to have the drag net at their finger tips so that when some more equal animal's cat gets stolen they can walk back in time and figure out the short list of who could've done it.
For those unaware, embedded devices usually have a "watchdog" timer that needs to be periodically reset ("fed"/"pet"/"kicked") when everything is operating correctly or else the device will reboot as a fail-safe.
This log message probably indicates when they're resetting the watchdog timer.
Cisco sells IP connected high def cameras. I was happy to stop working on that project, because it was clear that the target market was public facial recognition (targeted advertisement in malls, and other useless/creepy things).
Also, a reminder that ALPR abuse predates Flock. Flock has just made it more visible. About a decade ago I personally heard a cop let it slip that he had plate-stalked someone for the crime of saying mean things about his department on Twitter. The difference today is that more departments have access to these kinds of tools.
Fixed ALPRs aren't the only privacy problem, either. Many tow trucks have roving ALPRs that feed into big databases. The notion is that it helps them repossess cars that might be garaged at home. That data, however, is for sale to third parties.
They won’t have that sort of moment of self reflection until someone does something like use Flock infrastructure to stalk and assassinate the CEO of another YC company and then it will only be brief and fleeting before they double down on supporting this kind of egregious behaviour.
Let's just use Flock cameras to track all top-level YC people, publish everything we possibly can. Absolutely and utterly eliminate their privacy until they learn to respect ours.
I remember walking over a hill into a rave in the Utah desert that we'd set up and thinking that it actually was the cyberpunk dystopia that I had been hoping for.
That kind of stuff is around but maybe not evenly distributed or legible to large demographics.
Unfortunately, so is the rest of the vicious horrorshow, equally illegible and equally uneven in distribution.
Interesting that you frame it as "hoping" for a dystopia. Like even in our wildest imaginations we can't envision a future where society works for regular folks.
I'm sympathetic to the problem that folks like Mark Fisher have laid out, in which (to paraphrase) "it is easier to imagine the end of the world than the end of capitalism", and that indeed might be one way to understand my feeling.
I take your point; it makes sense.
"Regular folks" is doing a lot of work, though.
It may very well be the case that most of the material world which props up the idea of "regular folks" never was capital-R Real and insofar as the idea is a pleasant dream it is not a sustainable one.
Proximate to me, often "regular folks" entail white folks unproblematically living their lives around the norms of US hegemonic capital interests. When I hear Pat the Bunny sing "show me utopia, I will call it a jail" I understand the feeling. I was, afterall, raised by Christians who believed in David Byrne's picture of "Heaven" as a place where "nothing ever happens".
Those are the folks who have happily elected a few people to replace the Flock cameras here with Axon. Their vision of an ordered society is a bit chilling to me, despite the fact that they understand their project as both liberal and progressive.
As I understand it, deviations from those cultural norms are already "dystopic" to the "regular folks" I know- if we somehow lost our ability to transmute sand into computing power and dead plants into motive power and had to go back to living in the cliff side then we'd no longer really be human, despite the fact that their enchanted sand and holy oil is literally destroying the ecology of the entire planet.
This situation is, of course, already a distopia for the bands of Ute and Jicarilla Apache and Dine and Hopi and others living near me. And when I look at the kinds of technological survellience built into the material structures it feels easy enough to note that we already live in a dystopia. I have heard some specific dakota folks refer this situation to as post-apocalyptic and I am inclined to agree.
If we accept that we're already in a dystopia and, further, that much of the hegemonic culture's idea of a "utopia" has already been a holocaust for several other groups of people, then hoping for a "dystopia" in that sense might seem a bit more coherent.
Interesting to note that if you don't look like a car or a person, through "adversarial fashion" or some other visual trick, your image potentially won't leave the camera and won't reach the flock cloud for further analysis.
I wonder if they were able to find any of the Bluetooth signal-data these cameras are said to be obtaining from devices within its' vicinity. This in itself is wild, im glad they're coming down around where I am
The other day I was imagining that everyone can just own any device near them. I suppose this implies that we have the resources and access to a capable model
Tyranny of government invites terrorism from its constituents.
We have all heard the argument that when corporations intentionally make the legal option worse it drives otherwise law abiding customers to pirate the content instead because piracy provides a better service than paying the corporation for their kneecapped product.
I dont see how the same thing doesnt apply to governments.
The people tell you over and over they dont want to live under a surveilance police state. So natually the corporations and government work together to create a fascist police state and they expect the people to be good little slaves and simply sell their souls to their government.
Especially in the day of ai when they could just fake those images incredibly easily to frame someone. They dont need a patsy the next time they jfk someone they just find some sucker with a weak alibi from a list of potential suckers and then fake some cctv images and cell phone data and they can put you where ever they want to.
The only real defence is to buy your own body cam and document every moment of your life so you can have competing evidence.
At this point im surprised damaging the cameras is the only thing these activists are doing.
I wouldnt be surprised to see flock employees and corrupt politicians finding bombs under their cars. Which will likely be used to justify more cameras which will only intensify the terrorist activity.
The tree of liberty is long overdue for a good watering.
If your solution is revolution you misunderstood the problem, and you'll make it worse
We still have vestiges of democratic institutions we can use to constrain and controll the state.
The blood letting, pain and suffering you are calling for is much worse than the private power's attack on privacy, and destroys the one effective tool (what remains of your Republic) that you have to fight them
Instead of fighting to destroy your republic, struggle to protect and restore it
I feel like most of this was already known when someone here in Dallas figured out they had wifi connectivity you could connect and get access. I may not have the details exactly correct but I think someone got access then.
This is SOP for IOT devices. I am beginning to think we need to regulate this stuff, because it is ubiquitous. The device manufacturers do not have a culture of security.
There are much better ways of device enrollment; at a minimum they could require device activation that doesn't blindly use a token with no further checks.
I'm concerned about publicly accessible devices containing secrets also. These are not physically secure places to store keys, they are mounted on street lights where anyone with a ladder can get the key material out of the device.
* Privacy, civic trust, society if you get a chance!
This is the end product of tech leadership taking fat rips of disruption cocaine for the last 15 years. Flock Safety got VC money so that they could build a panopticon. There is nothing surprising about the fact that they did a hack job with terrible security; the fact that their service names are various types of alcohol is beyond parody.
Oh well, at least Flock Safety's IPO will be a critical cash infusion in the pursuit of building the torture nexus so that's cool.
> This camera is missing Android security updates for the last eight years.
Right. So expect thousands of Flock cameras to be hacked soon.
Possible perps include foreign intelligence agencies (Khamenei in Iran was tracked down for his assassination using Iranian traffic cams), stalkers, domestic violence perps tracking their victims, the list goes on....
Flock is a scourge on democracy. Flock is YC. But looks like they did YC nearly ten years ago. Who knows what their pitch deck looked like? If they pivoted since then to their current sinister incarnation? I don’t see any evidence that YC is still actively supporting them.
Benefit of the doubt: Funding them for a community/city-owned traffic camera type thing seems like it would have been a much more reasonable proposition than funding Flock for their current use case of allowing police to stalk their ex girlfriends or mistresses.
> In 2019, Flock signed their first police department deal with Jersey Village, Texas.
> The slides you see here are from Langley's pitch at a venture conference one month before closing a $47M Series C round in November 2020. The following July, Andreessen Horowitz led a $150M Series D investment in Flock as a cornerstone of their American Dynamism practice. Additional slides are included from keynote and sales presentations used in 2023.
It’s not like this stuff wasn’t known to be a problem 10 years ago. We were already in Trump’s first term, it’s not like it was part of the early post 9/11 “secure everything” push. It was WAY after that.
The NSA spying scandal happened under Obama even! IMO that was the defining moment for electronic privacy as a real political issue; before that we were very much in post-9/11 state of exception mode.
It’s not an excuse, but gives some luxury of distance. We have a lot more hindsight now on how rotten things can become, so with that hindsight it’s easy to say that companies like Flock shouldn’t exist, or shouldn’t be invested in. Ten years ago required some more leaps in foresight that some people were making, I was, but even I didn’t think it would get as evil as it has.
Yes. Blame the pickaxe seller. Do not question the miners. Do not question the investors in the mining companies. Do not question the casual voter or internet commenter who thought all this was fine.
This isn't to say that flock not a scourge, but I think a lot of people (not saying you're one of them) could stand to look in the mirror here.
Back in ye olde dark ages of <checks notes> 2017, when YC was cutting Flock a check and when "big data" was the hot buzzword people of a certain bent couldn't get enough of this kind of stuff. Everyone was jacking off nonstop to the idea that we could just hoover up everyone's data ad then "efficiently" or "proactively" dispatch enforcement resources. People talked all sorts of big talk about stuff like cross referencing people's Home Depot spend with permit requirements, identifying small businesses that don't have healthy enough financials to be fully compliant, cross referencing invoices and delivery receipts to identify overloaded trucks, and generally finding all sorts of ways to fine the crap out of people for the pettiest of petty deviance. They considered this a noble goal.
Everyone's head was too far up their asses to look at the magic crystal ball called "history" and realize that a camera on every street corner watching who's going where all the damn time would be where it goes.
The system they log into is called DAVID(Driver and Automobile Information Database) which logs activity. If an officer access that information for unlawful purposes, they can be prosecuted. You probably wont believe it, but the reason you hear about cops stalking their ex's is because they got caught doing so.
It's always funny how such a "law and order" company not only lies through their teeth but also maliciously files false police reports. As in there's literally video evidence of them calling the police and telling the police things that are not happening.
It's also really annoying me that police departments around the nation are petulantly implying they were "forced" to do this because of lawlessness and silly-villain karens...also claiming, without the press even remotely challenging them, that they're disappointed because "we believe they work."
There literally isn't a single fucking shred of evidence that Flock cameras do jack shit, that isn't from a study Flock paid for, which heavily cherry-picked communities, particularly ones with very low crime rates where a Flock camera happened to be involved and the crime rate which was already low dropped by a couple crimes a year and resulted in a "200% reduction in crime."
That's also the biggest plot-hole in the first Star Wars movie. Princess Leia is supposed to be this righteous noble of the moral resistance and yet she STEALS the Death Star plans!
Then why bother using that language? The camera doesn't need rescuing, why not just "we took".
Also, is it really justified? Did we learn anything useful here that we didn't already know? There's more effective ways to push back against Flock, townships (like my own) are having plenty of success stories without stealing anything.
You don't think maybe it's just a little bit tongue-in-cheek? Maybe a reference to how the US Military sometimes goes into foreign countries saying we'll be greeted as liberators?
“I kept trying to explain in between haymakers that we were better than this and on top of that it wasn’t likely to be ruled on favorably as far as the courts.”
- Luke O’Neil https://flaminghydra.com/the-end-and-after-2/
Having hardcoded credentials is a sign of total incompetence. In this case at least it wasn't a password, but an API key which can be used to request credentials (stored in plaintext) which look like they'd get you access Flock's servers. Not quite as bad as a hardcoded admin password, and it's not clear what you'd be able to do if you did authenticate successfully as a camera, but its worrying enough. There have been enough vulnerabilities found in Flock's systems that it's pretty clear they aren't concerned about their security and it's plainly obvious that they don't care at all about our privacy or security.
Even if we decided that this level of mass surveillance on the American public was acceptable to us, Flock Safety/Flock Group as already demonstrated that they can't and shouldn't be trusted to implement it.
I too am appalled by the inefficiencies of the bureaucracy of the Gestapo. A serious threat to the state and the people could take days to reach the correct authorities. Only zhast month a smuggler escaped zhe guards, no doubt an agent of foreign intelligence.
I get the joke, but this is kind of why the security issue matters
Btw, Germans have no problem with pronouncing the letter L (before a vowel, anyway)
East Germans also wouldn't criticize the Statsi as a show of loyalty, and nobody would read about a security failure in the state news. So the story must be told by one of its characters. :-)
Exactly. The scary part isn't any single bug, it's the mismatch between the sensitivity of the system and the apparent security model
I for one welcome the incompetence. Godspeed to whoever is able to deploy a build to the whole device fleet that burns SoM boot protection fuses to an image that doesn't do anything hard bricking their entire network.
oversights like these are what eventually lead to situations like in 'Watch Dogs' and 'Cyberpunk' where you have these one click exploit that can break every tech and surveillance gadget in sight
If you want to know what a "Vulnerability Disclosure Policy" (VDP) would look like if its main purpose is to claim we have VDP and create an appearance of responsible security posture, but not really to learn about vulnerabilities - read Flock's VDP.
They sincerely welcome your vulnerability disclosures, except in cases where you have to "interact" with the device/service or download its data. Other than that TINY carveout, everything is okay.
Oh, if the vuln about configuration and hardening "preferences" like SSL/TSL - Sorry, not interested.
And also, infrastructure vulnerabilities like DNS config - no no, try harder.
I know what you're thinking..ha ha...but we are good guys. You can still report vulnerabilities in the above categories, but the onus is on you to convince us that we should care about them. It is only fair.
https://www.flocksafety.com/legal/vulnerability-disclosure-p...
This looks like a pretty reasonable policy to me all things considered. And no, I'm no fan of Flock. But they do run security cameras for the cops, they can't just say go ahead, go wild on all our customers' cameras. The lawyers would throw a fit.
The carveouts for stuff like configuration and DNS are entirely reasonable. Have you ever been behind a security@ email before? You get a lot of BS reports of that sort.
It's reasonable to not have a VDP for the reasons you mentioned. But not reasonable to have a useless one just so it appears they have a VDP.
Why can't Flock do a "customer setup" that is otherwise sandboxed from their systems and let the white hats go nuts on that?
Content is not the same as configuration and they could get valuable information if they cared.
The TLS/SSL and DNS carveouts are pretty normal. There are a million security options for those services and enabling them all would often mean denying access to anyone running a browser/client more than a few weeks old. Documenting them all would be a PITA so most policies simply prohibit them entirely.
Testing against customers is also a common prohibition for obvious reasons.
Hm... not normal in my experience. Not enabling a config is not a vulnerability in itself. If not enabling something means a security guarantee is broken (Eg: videos are accessible) then it is a vulnerability, and typically included in VDP, atleast VDPs that are in good faith.
There are a lot of theoretical vulnerabilities in various encryption algorithms used by TLS/SSL/DNS. There are also older protocols that have known vulnerabilities but yet don't present a realistic threat to most types of services. I've worked for more than one company that had to decide whether disabling an algorithm and blocking 5-10% of your customers was worth the tradeoff. Having these debates with researchers is tedious.
That said, there are numerous options that should be enabled and several protocols that should be disabled. It just isn't worth the spam you get if you allow submissions for these type of issues.
Makes sense. Thanks.
> Oh, if the vuln about configuration and hardening "preferences" like SSL/TSL - Sorry, not interested.
> And also, infrastructure vulnerabilities like DNS config - no no, try harder.
It's understandable. If you have or manage a website you will receive daily emails (the kind that start with 'Hello sir') about automated scans finding low-hanging fruits like that, pretending a bounty payment.
It'd be interesting to know how much of that they put second to "Americans seem to like using our hardware as targets for firearms, reciprocating saws, spray paint, and garbage bags" in their list of corporate concerns.
Antisec was right.
This is pure laziness aka “reduced time to market” on the part of Flock.
It takes time and effort to think through proper secure boot architecture and to implement key management in a way that doesn’t kill developer productivity.
Their product managers, though, should have realized that setting these up in unsecured public spaces means that their threat model really does include local physical access to everything.
Using off the shelf hardware and software stacks all but guarantees attackers have tools at their fingertips to exploit said physical access.
Given all the recent exploits hitting the kernel, there’s a good chance that there exists an exploitable over-the-air vulnerability present in their WiFi/bluetooth stack, too.
The flip side of this laziness is that now, when my elected representatives tell me "these are just license-plate readers that don't record video", I have evidence to show them that's false.
If Flock had done a more competent job of securing their system, it would be harder to demonstrate this in a compelling way. To a technically-inclined person, it's obvious from the get-go that somewhere in Flock's pipeline, video is being recorded and archived, and is therefore vulnerable to misuse. But the more they're allowed to keep the implementation proprietary, the easier this is to sweep under the rug.
Don’t worry, your elected representatives won’t be bothered by trivialities such as facts either way.
They can be recalled and/or replaced, as many have who voted for data centers.
They fought against datacenters. Now they are running for local offices - https://www.theguardian.com/us-news/2026/sep/15/datacenters-... - September 15th, 2026
https://news.ycombinator.com/item?id=49375000 (citations)
Only a handful of states have any concept of a recall election.
Indeed, have to wait for elections when recalls aren’t an option. Elections arrive eventually.
Exactly. It helps they also control who can even run for office in any meaningful way. Nobody fights the left harder than Democrats. Good luck finding a representative that is against data centers, flock, Israel, congressional stock bans and pausing and regulating AI, views overwhelming popular with the majority of the actual American public.
My experience is that nobody fights the democrats harder than "leftists".
Funny. In my experience, nobody fights the “leftists” harder than the Democrats. I think the Republicans fight the Democrats harder than anyone else, and aside from the “leftists”, no political group seems to really fight the Republicans.
You are misunderstanding basic political terminology then, if you think it's somehow odd that leftists are against Democrats. Democrats and Republicans are both capitalists and liberal in the classical sense, both of which leftists oppose.
>Good luck finding a representative that is against data centers, flock, Israel, congressional stock bans and pausing and regulating AI, views overwhelming popular with the majority of the actual American public.
That is rapidly becoming Democratic party orthodoxy. At the very least there are a sizable number of Democrats who fit that.
Don't know why you're getting downvoted, but hackernews is very anti-democratic in nature. One thing politicians quickly realize, especially local ones, is that you do have to be accountable to voters at the end of the day. One or two bad stories is enough to sink a local race too, or at minimum require a massive spend to overcome the negativity.
Local politics is where you understand how effective a handful of people can truly be.
Happy to read people are understanding the true power they have collectively instead of as individuals.
Oh yeah, totally agree, the HN zeitgeist is what it is.
My problem is that Claude kept screaming across several sessions that it echo'ed a default password for a local, ephemeral development container into a session across SEVERAL sessions.
I get dinged continually for a vendor supplied container that writes an appropriately scoped access key to disk in plain text on startup (we are working to eliminate it but it requires migrating to an entirely new way of doing things the vendor only released earlier this year and I got derailed by other priorities).
So like if established enterprises using off the shelf scanning software are breathing down my back about this...what the actual hell is happening inside flock that this was fine. Lol.
It’s not laziness, it’s hyper focus on compliance. CJIS is the policy maintained by the FBI that handles information security, which is derived from standards built around paper.
Adding more weirdness, the details get worked out by each state.
My guess is they encrypted whatever is criminal justice information (license plate hotlists, etc) or protected by local laws (DMV data) and left the rest to make it easier to deploy and service. Remember pictures of you or your car taken in public are not protected or in scope.
Police tech is garbage and usually driven by federal grant spending. So it’s going to be interesting to see how Flock and Axon grow the business as it turns into a service model.
The question is, why should they care at all? Will this hurt their business?
Any breach of security on a system like this is a big flashing red-alert to me.
If it could lead an attacker to get ANY of their data... Persons, places, events, etc is pretty damning stuff to be exfiltrated.
Stalking/Domestic Violence, blackmail, timed robberies, you name it... That data shouldn't really be in anyone's hands in my opinion, but in anyone's hands (good guys / bad guys) it's pretty powerful.
Getting persistent access to Flock's internal network is a high-priority item for every US adversary, who doesn't want free intel collection on the movements of persons of interest? Knowing who the FBI and local cops are monitoring in is the counter-counter-intelligence cherry on top of a self-inflicted dragnet surveillance cake.
Any entity with access to flock servers can virtually stake-out anyone/everyone driving past Flock camera to monitor their movements. In a hot war, this would provide actionable data to support assassination via road-side bomb/drone strikes.
I mean... currently any cop can do that, and it's a lot easier to bribe a single cop than to break into flock network.
https://edition.cnn.com/2026/08/26/us/flock-kentucky-police-...
A single cop can do it 2000 times it seems before they get caught
And it's not a lone case: https://www.washingtonpost.com/technology/2026/08/02/how-pol...
.. with friends like these, who needs enemies
It's a red-alert to you and me, but Flock won't care. People already don't want these cameras in their cities, but police departments buy them anyway. What does it matter if there's one more reason you don't want them?
That's why you or I would care, but that doesn't answer the question of why they would.
Large companies tend to be amoral. Unless it affects them monetarily (possibly indirectly) they're not going to care. Given what they do to make money, I don't see any of these things hurting them.
Apparently police are accessing the network via their personal devices. I highly doubt their security practices online are any better than this. I wouldn't be surprised either to see things that chinese manufacturers do such as intentional back doors.
Overall this goes from disappointing to fairly repugnant.
Allegedly you can buy credentials on the darkweb to perform national searches. Might explain why some of the logged reasons for recent searches were “LMAO”
The normal explanation is plenty, unless you’ve never met, read about, or heard anyone talk about, law enforcement officers (who are human beings - for better and for worse).
How many of us have had coworkers who put something like that into a commit message? And that's a message that's at least notionally supposed to be helpful to you or your coworkers, rather than existing purely for the purposes of oversight you don't want in the first place.
I would expect law enforcement coworkers to understand the law, department procedure, and public requests for their data. That’s expecting too much from the academy, I guess.
Those that fail to meet standards should be fired to spare the taxpayers from the lawsuits coming from AI-assisted complainants.
It’s also too much for Flock’s YC-funded technology to implement a field filter that rejects “LMAO” as a valid request.
At the very least, your local staff’s nationwide stalking credentials being harvested by phishing and abused by others should carry criminal negligence penalties. Governments should pass that liability onto this YC-funded startup company.
It’s a federally protected right to skip over law enforcement officers candidates because they rank too high on an aptitude or IQ test.
Reasonable people would expect what you expect. We are not reasonable people.
This meme will not die, and here you can see it blossoming into something even weirder.
There is one (1) case in the literature, back in the early 2000s, where a department rejected a candidate as overqualified based on a cognitive assessment; the rejected applicant took that department to court and lost.
That's it; that's all the evidence.
Against that: most police departments around the country administer written tests with general cognitive components for which there is a floor score and no ceiling (the POST, the NTN, &c). And virtually no departments --- none I'm aware of --- administer IQ tests.
From all this, we've now got "a federally protected right"?
Yes, that’s how court / legal precedent works - for better and for worse.
Feel free to consult an attorney.
Edit: I thought the case went further up - but, “persuasive precedent” for other jurisdictions now exists all the same.
Edit2: since I’m seeing the username of someone with a decent clue,
> and no ceiling
was there one on paper for the hiring standards of the dept in the case in question?
Does that matter?, if there’s no legal issue with using it as a disqualifying factor? - for any candidate - whether or not they even score well?
Many moons ago, I was involved in the technical side of volunteer work for domestic violence victims escaping abusive relationships with e.g. law enforcement (cops), who even fifteen years ago had sweeping powers to track and stalk their victims. Things like actual anonymous burner phones and the ability to e.g. create new email accounts without government identification were critical to the process of getting these people out safely, or alive, without fear of retaliation.
I can't even imagine how difficult this job must be nowadays, with bullshit like Flock spanning hundreds of police departments participating in their nationally-linked database. I have zero sources for what I'm about to say, but my instinct is that the political machines (expanding powers hidden behind "think of the children") behind how technology is evolving today has gotten people killed.
Quite potentially, yes. Their name is already mud among many voters, if they're shown to be treating data insecurely then that's another reason why local governments might consider terminating contracts with them.
Feels like their purpose is to test the boundaries, take the hits, and eventually sell off
They want the good, bad and ugly to flock to them as it were and vaporize them so Axon and Motorola Solutions can just pick up right where they left off. And people will just ignore or forget it because it's not the same company.
Is there any recent example of a company getting breached and its data exfiltrated, where the business was actually hurt? I predict we'll get a standard boilerplate "We take security very seriously" press release, a narrative that blames the evil hackers entirely and not the company's negligence, and then that will be that.
Would the DNC in the last US national election count?
was there really any meaningful fallout though?
I really hate how Product Managers somehow get to take the reins of engineering teams instead of having to sell them product ideas.
It's madness, they often lack the technical skills and "optimise away" requirements surfaced by eng teams they don't comprehend or just don't like having to deal with.
Because software engineering is not professional engineering.
Now, this doesn't always stops management, but when you have to have an engineering signoff it does make things a bit more difficult.
Do you feel like an inadiquate imposter or something? I'm assuming you work in software.
Watch some engineers in other disciplines and you soon recognise that many of them have about the same responsibility as a software engineer. Design is design.
Or read about engineering failures like flight QF32 (mostly a success story):
https://admiralcloudberg.medium.com/a-matter-of-millimeters-...Australian Quantas, with a UK Rolls Royce engine on an Airbus, with engines maintained in Aussie.
Safety is now often made up of interlocking: regulations, standards, quality systems, safety management systems, insurance, international legal contracts. Certified engineers and signatures are usually only a very small part of those systems.
Certification matters less than you might think across international borders.
Perhaps I'm a cynic, but beliefs in certification seem so irrational to me. What is it? Jealous desires for status? Desire to have guilds/gatekeepers? Complete misunderstanding of how safety occurs in "real" engineering?
>Safety is now often made up of interlocking: regulations, standards, quality systems, safety management systems, insurance, international legal contracts. Certified engineers and signatures are usually only a very small part of those systems.
I mean, you make my point. At no point did I say engineers are the only required component, but without the responsibility of an engineer signing off on its technical adequacy we have loads of historical proof that people end up dead far more often.
You believe signatures by engineers matter.
That is your belief, but I've never seen that belief backed by fact.
Most open source software disowns liability in CAPS in the license. Yet somehow FOSS like Linux gets used for safety critical infrastructure.
Microsoft would love certification requirements for engineers - that would kill open source to their conpetitive benefit.
Do you honestly think if we required Microsoft Certified Professionals to sign the internals of Microsoft OS then Windows would be more secure or reliable?
The bigger issue is that signatures and criminal consequences hardly matter across jurisdictions.
The capitalist issue is that businesses want scapegoats when things go wrong. That would be the outcome of signatures: engineers as fallboys for systemic failures across organisations.
Note how often pilots are blamed for accidents due to the design of planes.
It is just an idealistic belief based on feelies that software certification would achieve the goals you imagine it would.
Signatures are an anachronism: from an alien past.
International business uses different mechanisms for safety.
Our world is intertwined complexity. You somehow think that the buck should stop at engineers?
If engineers signed off on everything then we'd have no more disasters like New Orleans floods?
Who signed what for the Grenfell towers tragedy? Which engineers were reprimanded? Did they decide that more signatures would help prevent future disasters?
Your conclusion seems at odds with your evidence: the quote you reference indicates that a professional engineer was meant to examine the 'retrospective concessions' and did not. The result was that no qualified engineer was taking responsibility for their quality. Fixing the process meant getting credentialed engineers to assess and incur liability for the solutions, which is how the professional engineering licensure system is supposed to work.
That’s because computers are Turing complete anything is technically possible and comes down to the time quality cost triangle. Most management thinks they can optimize that triangle by squeezing the living bejesus out of their teams.
This reporting was done in collaboration with 404media. Here's the discussion for 404's article: https://news.ycombinator.com/item?id=49726577
Distributed Denial of Secrets has published the partition images: https://ddosecrets.org/article/flock-alpr-camera
I poked around in the boot partition. The kernel is ancient!
Linux version 3.18.71-perf-gaf770dc
3.18.71-perf-gaf770dc is a Qualcomm Android vendor kernel from roughly late 2017. The 3.18 branch went fully EOL in 2019, so nothing after that was ever backported to it.
2017 was also the year Flock was funded and founded and went through the YConbinator cohort.
But you would have thought that by 2021 when Andreessen Horowitz funded them or at least by 2025 [1] when both further funded them, someone would have actually done some minor due diligence. Coincidentally too, 2025 was when the flock surveillance matrix went up all over the country almost immediately.
We constantly hear that the magic of tech funding lies in the people, not even the product/service. These types of things always seem to uncover that that is effectively just a lie to cover up the ulterior motives of setting up a tyrannical surveillance matrix all around you … to protect the children, of course.
[1] https://www.flocksafety.com/blog/flock-safety-secures-major-...
In an ideal world they'd have people whose job it is to monitor upstream activity in the components used in the firmware and maintain this. Sounds like they did not have that.
It's almost as if they paid a contractor to design the hardware back in 2017 and put all the funding into marketing(bribes) since then. Shocker.
"It's only a problem if your definition of done makes it one".
Interesting that they are a YC Company. Does yC do any ethics vetting of saying "No, let's stop fascism before it spreads?"
YC does no meaningful vetting at all. You can steal another YC entrant’s product and still get funded.
https://deepdelver.substack.com/p/delve-fake-compliance-as-a...
many cases already public of rejected founders having their idea pushed on accepted founders with bad ideas.
TIL but not surprising.
I would recommend reading "The Nerd Reich" by Gil Duran for context on this question.
Security through obsolescence!
That's how we got Chinese APT in our phone systems that we are apparently going to do nothing about. Seriously, can be fixed, AT&T et all just won't
The oldest supported kernel is 5.10 and that loses support in December. That's wild they are using a 3.X kernel
To be fair if you could SLTS support by CIP (which is designed for things like this) you have 4.19 at least still maintained. 4.4 might still be too but I'd have to check
You'd be surprised how many things you use daily that people still backport the bare minimum to clig to 2.4.x forever
I really hope those don't have access to any networks.
good chance the linux running in your high end phone's modem runs 2.x kernel.
i dont deal with that anymorrle, but last one I saw with 2.x was the pixel 6 pro.
Just check, my 2YO phone runs kernel 6.6, not latest but i think good enough for production.
Edited: I misunderstood what you mean, you were talking about the modem subsystem, sorry.
I don't think you misunderstood, I think they're talking out their arse. Modems don't run Linux, they run RTOS operating systems. ShannonOS in the case of the Pixel 6 with a exynos modem
The pixel 6 pro runs ShannonOS an RTOS system, it's an exynos modem
Yeah I've seen plenty of kernels that start with a 2 with no forward path possible due to "we don't know how to get our driver working anymore"
>gaf770dc
missing a d(gaf)
sorry, had to get that out!
Thanks. Few saw that post: https://news.social-protocols.org/stats?id=49726577
do the articles have significantly different information/coverage to warrant two submissions?
No, they're the same article. I had only read 404's when I submitted them and I assumed they'd both be submitted regardless.
I can't read the Wired article because I'm only allowed three excerpts and 15 ads a day at Wired.com
same, but i'm not sure how that's related to my comment. workarounds or alternate articles without significant new information are typically posted within the same submission, not separate ones.
Use the Bypass Paywalls Clean extension https://gitflic.ru/project/magnolia1234/bypass-paywalls-fire...
So… all that data is literally there for any unauthorized person to walk up and take it.
It’s not even suitably encrypted on device?
Zero trust in anything Flock says.
I always assumed Flock's security posture was like most other companies. It's nice to see confirmation.
I think I should add a "X'); DROP TABLE Cameras;--" bumper sticker to my car now.
Couldn't resist: https://github.com/EvanAnderson/whimsy/blob/main/Drop_Table_...
Bobby? Bobby Tables? Is that really you?
https://xkcd.com/327/
Makes you wonder if that could actually work
has been for a long time - there's a sound engineer who developed quite a following (and is fairly involved with local movement hackerspaces) who demo'd how easy it was to hack Flock cameras nearly a year ago: https://www.youtube.com/watch?v=uB0gr7Fh6lY
the Flock response has been 'it doesn't count if a Youtuber did it' lol: https://www.youtube.com/watch?v=0ADb-qQ5hMY
My working assumption based on what I hear out of Flock is that they have a public feature set (mass license plate surveillance for LEO) and a covert feature set (even more mass surveillance, beyond license plates and privacy agreements, for intelligence communities).
The man who would choose security over freedom deserves neither.
Didn’t realize Jefferson misquoted Franklin
"The tree of liberty must be refreshed from time to time with the blood of patriots and tyrants"
The devices are entirely open for all practical purposes - but worrying about individual cameras is silly, because they have no meaningful security at all around the API's to access all the cloud data - you can buy law enforcement credentials dirt cheap in dark web marketplaces to log in and track anyone/anywhere you want and access all footage.
Yep. Clown show.
> The hackers said they were able to access the Android system on the camera, and found two partitions—sections of its hard-drive, essentially. A few of these were unencrypted, the hackers said, including one called “vendor” and another called “media.” The latter contained an encryption key that unlocked another part, which contained much of the media—think, the videos and stills—the camera took.
> In early 2025, security researcher Jon “GainSec” Gaines reverse engineered a Flock license-plate reader and documented flaws that could be used to gain root-level access. After Gaines disclosed his findings, the company acknowledged the findings but downplayed their severity, writing that the flaws required physical access to the device and that even someone who gained access to a camera “would still not be able to gain access to footage” because images remained on the device only briefly after being transmitted to the cloud.
Source: https://www.404media.co/hackers-stole-flocks-camera-software...
How could anyone possibly physically access a device that is just sitting out in public?
YC's finest https://www.ycombinator.com/companies/flock-safety
Its impossible, I tell ya
TDIL my homebuilt Plex media server is more strongly encrypted than a Flock Camera
so is my all-passwords.txt file on my desktop
My passwords are in an encrypted block in a text file that can be unencrypted inline in an Emacs session with a keystroke sequence that looks like a cat just chased a mouse across the keyboard, and that's before entering the decryption password. To access it, an attacker would first have to learn Emacs. Pretty sure that's a post-quantum level of security.
Nefarious I like it
They could use an LLM to lookup your HN posts and then to wrangle Emacs. Or just decrypt the text in another application - I doubt Emacs is the only platform for whatever crypto method you use. M-x rot13 ?
Oh, did I forget to mention the encryption is implemented in Emacs Lisp?
At some point, the attackers are just going to have to give up and start hitting me with a wrench. Joke's on them though - I'm an Emacs user, I like pain.
It's interesting and fun to implement this stuff; I totally agree. Emacs is amazing.
I worry people will get the wrong idea about security: The application used for decryption doesn't need to be the same as the one used for encryption, at least not for any serious attacker. That would be 'security through obscurity'. They need the encrypted text; they don't need Emacs.
More importantly, no matter who you are, that you implemented the encryption yourself (?) is a major flaw - unless you have a cryptography team that has matured the implementation over a decade or so. Nobody is good enough to do that by themself. As the saying goes, anyone can create an encryption routine that they can't break.
You do realize these are all jokes?
emacs is not a joke emacs is life
https://youtu.be/urcL86UpqZc
Maybe you do or did really believe those things - lots of people do. There's nothing wrong with it. Saying 'I was joking' is maybe true, maybe it's just using a very common tactic for covering.
Obligatory relevant xkcd: https://xkcd.com/538/
It's a forever-fresh reminder about security versus your own government, but for malicious hackers and bots: the physical trip to visit you costs more than half their infrastructure.
Encryption matters, even if I would divulge everything long before the wrench appeared.
Runs Android. Has (wireless?) internet access.
It seems that some enterprising Jolly Roger could start running a public mesh net on top of them without Flock even noticing.
It is bad.
But think the real danger in Flock is the aggregate data, tracking between camaras. So if someone hacks a single camara, they probably don't get much, unless it is pointed right at someone, which is bad. Aren't they selling these as should be pointing at traffic? If they are pointing right at people, like at playgrounds, then they are being installed illegally to begin with ?
A network connected device that can be hacked is a small step away from being the first foothold into its server. The fact that on-device security is this atrocious suggests that their server is not any better quality, which means hacking it would probably not take much effort.
A Silcon Valley startup with poor server-side security? Couldn't be!
I don't disagree.
But there is some old rule about, even the best security can fail if the device is physically accessible.
There are levels to defending against physical attacks, and Flock half-assed theirs by leaving the encryption key right on the file system, according to the reporting. Those more serious about security — like Apple — store keys in an "enclave" chip so it can't be easily extracted by an attacker doing the bare minimum
Apple did that… eventually. Early iPhones weren’t very secure. Apple only got serious after they dominated the market and reducing the theft value of iPhones became a priority.
Even the cheapest commodity encryption chips have had this capability for well over a decade now, Unlike Apple, Flock are not a hardware pioneer, not by a long shot.
The Android documentation has an example of how to use hardware keys, and a Chinese OEM (IIRC) was found using the example key provided by Android sample code - and yet that was more effort than Flock applied, since their ARM SoC support it.
i think this is actually good, because there are differences between the images they found, and security settings that the company claimed.
They had not admitted before to tracking people, but their software is clearly submitting them. They had not admitted before to looking at bumper stickers, but turns out they do.
I wonder if they could find all cars with Bernie Sanders bumper stickers within X blocks of a polling place.. I can imagine that (or similar queries) might be very useful in the wrong hands.
Is this an older model? I could see them turning off or using weak encryption on media if the hardware couldn't keep up with the amount of data they were writing.
As another commenter pointed out, any cheapo ARM core from the last 10 years could do the job Flock needs it to do, as long as it has a (very cheap and common) crypto engine strapped to it.
But, a question for you: even if it was the case that the hardware was the limitation, isn't that also an indictment of Flock? Selling something that cannot exist securely within the bounds of current technology? Or, at a minimum, bad chip selection leading to a compromised design?
I'm in the process of optimizing a bootolader for my various SoC/SBCs and even the cheapest, oldest least powerful SoC from 15 years ago can manage AES-CBC via crypto accelerator at 50 MiB/s. There's no excuse.
You can achieve 50MiB/s if that's all that you're doing. I've worked with some DSPs (TI's DaVinci line) where some operations would abort if DDR was overwhelmed.
For example, passing a frame of video (YUV) into the peripheral which can resize the overall image, would fail if the system was busy with other DMA transfers. You could attempt to resize again, but there were no guarantee that it would complete successfully. Your options are to reduce overall DDR utilization or drop frames. In an application like Flock's, dropping frames is likely something they need to avoid.
The system in question is doing similar tasks, and I don't think that what I'm suggesting is out of the question.
They can choose the SoC that would be able to fill the requirements. Eg. almost all Rockchip SoCs have NoC with configurable QoS on master ports (even the cheapest IP camera targetted SoCs that cost like 2-3$), or some other interconnect mechanism that can make it so that SDRAM controller gets tasks in some user selected priority order (eg. you deprioritize CPU in favor of camera interface and other things). This is not a new tech. It already existed when Flock was founded.
And in any case. Passing compressed video streams or pictures through HW encryption engine will not saturate 1.5+ GiB/s or whatever even the lousiest 16-bit DDR3 at 400MHz would give you, not even close. It would be like a fraction of a percent of total bandwidth.
That's why I was asking if it was an older model initially.
That would be an extremely bad trade.
Why? Does Flock really care about encryption? It checks off a box for their sales team, even if it's done poorly.
Because data should be secure. Full stop.
In a perfect world, yes, but this is a for-profit company and there's almost zero repercussion for doing it half-assed. They'd have to pay someone to implement it, and deal with the overhead and complexity.
Now they are in a position where they can sell new models with enhanced encryption and more features.
If it increases development or operating costs by $1 they won't do it unless there are consequences that could cost them more than that.
> all that data is literally there for any unauthorized person to walk up and take it.
All that data about ... license plates if you're willing to steal/damage private property. Seems like it would be a lot easier to setup your own ALPR.
You don't think that because it's called a "license plate reader," that it only captures license plates, do you?
Flock cameras capture the make, model, color, and body style of vehicles. They capture bumper stickers and other decals, as well as potentially identifying dents and scratches. They capture accessories like roof racks, bike racks, trailers, and toolboxes.
The OP story covers some of this. There's more at:
https://www.aclu.org/campaigns-initiatives/get-the-flock-out
https://www.nytimes.com/2026/08/10/us/flock-cameras-can-trac...
License plate data is bad enough (and unconstitutional in many jurisdictions, despite ubiquity).
Also, there’s way more data on there than plate data.
The article says that Flock says "their cameras don't do facial recognition" The cameras don't, but they don't say the system doesn't. They don't say facial recognition isn't a click away through another integration.
I would absolutely assume that any system that sends your image to LE is part of a facial recognition system in practice. We know now that the cameras do recognize people and intentionally transmits images of them, for later identification.
Commented something similar at the same time. I hate weasel wording like this. There is nothing that prevents this data from being used that way now or in the future.
edit: And to be clear, the cameras specifically recognize and record people for a reason. This does not appear to be a fault in the system. One reason might be off-camera facial recognition.
I’m sure the first approach has been ingesting vehicle registration data into Flock servers so that your ID photo pops up when your license is captured.
It seems the inevitable next step would be post-processed facial recognition (checked against those ready-for-the-taking ID photos) in their OS Investigator platform.
> According to our analysis, the camera’s logs recorded about 21 days of activity across several periods. During those windows, the device photographed roughly 50,200 vehicles and generated about 1.6 million images. On a typical day, it logged around 3,300 vehicles, with a high of 4,454.
Has there been any report about which state this camera was recovered in? New Hampshire has a strict 3 minute rule for non-hit plate data before the captured images and records must be deleted [1].
[1] (N.H. Rev. Stat. § 261:75-b) requires ALPR systems to delete non-hit plate data within 3 minutes
The images were deleted the moment they were uploaded. But the record in the log files persisted. The camera doesn't have enough memory to store that many data.
> The images were deleted the moment they were uploaded.
???
> VIII. Records of number plates read by each LPR shall not be recorded or transmitted anywhere and shall be purged from the system within 3 minutes of their capture [...]
But you're saying that these non-hit image captures were uploaded somewhere?
- Camera takes picture
- Camera pre-checks the picture for quality and that there's something on there that they want
- Camera uploads picture to flock servers
- Camera deletes picture locally
- Rinse and repeat
I could actually see this being done by three jobs in parallel.
If there are a lot of images found on the camera then that's probably because the upload wasn't able to keep up with the amount of data that was created or they have a buffer of a few days or there's a cronjob that deletes these files every now and then...
Unless they actually use the camera also as the storage, which would be really stupid, but sometimes people to stupid things.
It sounds like this whole thing is just in violation of New Hampshire state law.
But was this in New Hampshire? The retention policy is set by the customer.
IANAL. So that's something I cannot tell.
This does not seem to be the case. 404media's article includes extracted (redacted) images
That same NH law perhaps more importantly limits ALPR use to law enforcement officers.
That might be debatable
https://ij.org/the-ij-database-of-alpr-abuse/
The default retention policy is 7 days and the local customer (IE the police) can set it to whatever.
I wonder what can be done within 3 minutes?
A friend in China built a Flock overlay network that sends live video and audio from ~100 cameras near me to an AWS server for processing and search.
This is one of the most interesting comments on here.
Hints at unauthorized, illegal mass surveillance riding on top of authorized (but also possibly illegal) mass surveillance
Totally agree, we already know Flock is inept and lies about obvious truths. I want to know more about this.
Can you provide more details? Do you mean 100 public cameras anyone can access?
This is an interesting claim since their cameras dont seem to capture video. Just still images.
Why would you have a friend that does that
How do I make friends like this?
I’m not sure, but I bet you could find some helpful referrals here https://www.justice.gov/epstein
All these cameras do is pre-select the images that are worthy uploading. Everything else happens at Flock.
That's why they don't give anything about the camera's security.
The images are all from a public place, so no privacy expectations and what's theworst that could happen? Someone uploads their cat images or the pr0n collection?
Ai figures that one out rather quickly.
Assuming the point of these cameras is security (and not just surveillance for stalker cops), being able to upload replacement footage would subvert that entirely. This has been a feature of many spy and cops/robber movies.
The point of these cameras is to deliver as many images of good quality as possible that show something of interest like a person, a car's numberplate and so on.
I almost guarantee you, if the camera even has a SIM-Card then it's pre-configured with all the necessary information to find and join the mobile core network via APN.
It turns on, joins the core network, gets handed an ip address and additional information like a servername/ip as its reporting endpoint, establishes the connection and starts taking pictures that it then sorts out and uploads.
That's pretty much it. No login credentials, no complicated protocols, nothing. The things is identified via IMEI, Mac or some other burned in "serial" and that's all that's necessary to make it happen.
So there are no credentials that could get lost, no technology that would be worth anything, access is being controlled on the network side and the images that are being taken are from a public place with no expectation for privacy.
The core system only has to be secure enough so that it doesn't get hacked via an open bluetooth tty or something and everything else is handled by the network it belongs to. That's why DNS manipulation and similar stuff doesn't get you anywhere.
Besides that, it has to be cheap and doesn't have to adhere to any security standards whatsoever. It's a pole with a mini camera and a solar cell that can just be vandalized by the next person that shows up.
How would uploading bad footage negatively effect people trying to find license plates? It's not deleting the footage they are looking for.
>At the same time, about every two minutes, code checked that the camera was still running and logged the message, “Who’s a good boy?!
I wonder if a stingray could be used to force a software update in a flock camera. If so maybe it could brick all the flock cameras it can connect to.
Linux 3.x has a lot of CVEs filed against its Bluetooth implementation.
Does the image have bluetooth stack ? There is no reason to include bluetooth stack into the build.
Yeah, you could potentially MITM them with a rogue cell tower, I suppose. I'm curious about the researchers still having the device. They could also see all the cloud endpoints that were being accessed. Are they secure?
nice idea
Curious how/why all this negative attention is focused directly on the Flock brand (current example notwithstanding)?
Seems like if I were a competitor of Flock I'd be pretty happy right now and all this negative press is making them artificially cheap to buyout right now.
Motorola/Vigilant, Rekor, Leonardo/ELSAG, and Axon are huge companies making mint off the same thing and no once in 20 years have I seen this level of attention... not on the overarching issue of surveillance-state-ing, but of one particular company.
I can't speak for everybody, but in my case, my city has Flock cameras. It does not have Motorola, Rekor, Leonardo, or Axon.
Flock has over 80% of the US market.
You've seen this level of attention on a market leader before: on Microsoft, on Adobe, and others.
1) Flock developed a nationwide network to track innocent people, tried to get in as many places as possible, and handed law enforcement agencies carte blanche access with virtually no oversight. Their whole schtick was being the mass surveillance company, and striking fear into people's hearts, in order to prevent crime. Despite being founded in 2017, they quickly reached hundreds of thousands of cameras installed.
2) The US Executive branch formed concentration camps and a private army, and started using this nationwide mass surveillance network to track down any brown people with a Spanish accent to lock them up in dangerous squalid conditions and/or deport them with no trial. This is an immediate, nation-wide harm being done to millions of Americans, and this new company is enabling it.
I think I should start posting a reminder in Flock threads that Axon is a Flock competitor, is also engaged in mass surveillance, and is possibly even worse, but there’s rarely any mention of it. Journalists need to do some digging there. This shouldn’t just be a Flock story, or Flock will just get bought up or something and everyone will move on.
(The above should not be read as supporting Flock or discouraging further investigation.)
> The camera’s logs also show the camera struggling with storage. Its logs recorded more than 27,000 “no space left on device” errors while trying to save full-resolution images, along with tens of thousands of related errors, crashes, and reboots. At the same time, about every two minutes, code checked that the camera was still running and logged the message, “Who’s a good boy?!” More than 12,000 of those messages appear in the recovered logs.
Lol
"Axon is Flock but worse" will be the next big fight as police departments are pulling a fast one and saying "we got rid of Flock" by switching to Axon.
Axon is the default for the on-body camera system. The barrage of cop tv shows use them as part of their promotional relationships. Flock decided to not attack their market, in stead go for the adjacent space.
Axon (among others) has operations hubs for data fusion centers and other platforms for police like Evidence.com, so it’s an easy sell to departments.
Communities are starting to pivot to the wider issue, but a reason that this issue found purpose is that Flock is a more evocative target than “ALPRs”. I think it wouldn’t be a bad thing if “Flock” becomes the generic name.
I live near Durango, CO and this happened last week.
Bonus points: https://fccid.io/X4GS06009/Internal-Photos/Internal-Photos-8...
"Page 17" in the document shows a spicy little chip.
https://www.quectel.com/product/kg100s-amazon-sidewalk-modul...
Axon not only includes a cell modem... they're on Amazon Sidewalk, baby.
https://coverage.sidewalk.amazon/
This happened in a St. Louis suburb recently.
While Axon's system should be under the microscope too I don't think they have the nation wide cloud that Flock is doing and requires specific agreements to share data. Maybe that is getting abused to form a national database but I imagine it was designed so say a county sheriff department and local city PDs could share resources. I don't think most people are that concerned about things like that (though they should be), it is the nation wide surveillance that creeps people out. That and the stalking of course and both systems can be used for that.
Axon and Motorola also do a lot more to court state agencies who have grand plans of monitoring some highway corridor so their buddies at DEA/CPB/SMD/whatever can tip them off and their "drug task force" can make a newsworthy bust.
Flock by contrast courts local PDs who will catch a package thief or two but they really just want to have the drag net at their finger tips so that when some more equal animal's cat gets stolen they can walk back in time and figure out the short list of who could've done it.
Reminds me why a friend picked RCN over Comcast for his Internet. “They’re the more incompetent evil company.”
While highly unprofessional, the "Who's a good boy?!" status message makes me like them a tiny bit more
For those unaware, embedded devices usually have a "watchdog" timer that needs to be periodically reset ("fed"/"pet"/"kicked") when everything is operating correctly or else the device will reboot as a fail-safe.
This log message probably indicates when they're resetting the watchdog timer.
>“Who’s a good boy?!”
That a good watchdog kick message NGL.
Cisco sells IP connected high def cameras. I was happy to stop working on that project, because it was clear that the target market was public facial recognition (targeted advertisement in malls, and other useless/creepy things).
Also, a reminder that ALPR abuse predates Flock. Flock has just made it more visible. About a decade ago I personally heard a cop let it slip that he had plate-stalked someone for the crime of saying mean things about his department on Twitter. The difference today is that more departments have access to these kinds of tools.
Fixed ALPRs aren't the only privacy problem, either. Many tow trucks have roving ALPRs that feed into big databases. The notion is that it helps them repossess cars that might be garaged at home. That data, however, is for sale to third parties.
I work in a different embedded space but our keepalive heartbeat messages have a payload of <3
Man, ours is just '\0'.
https://archive.vn/NiIzH
It's surprising that an American company would forego so many common sense safety and security mechanisms just to protect their bottom line.
Title is missing "(YC S17)" after "Flock".
Correct. YC gotta wear their creations with pride.
They won’t have that sort of moment of self reflection until someone does something like use Flock infrastructure to stalk and assassinate the CEO of another YC company and then it will only be brief and fleeting before they double down on supporting this kind of egregious behaviour.
Some people are just wired that way.
I say these people should not be in charge of choosing who gets insane amounts of money and networking opportunities
They should not be in charge of anything, but being a sociopath gets you obscene amounts of money and puts you in charge of all sorts of things.
I wish this was just an anecdote rather than an axiom.
Let's just use Flock cameras to track all top-level YC people, publish everything we possibly can. Absolutely and utterly eliminate their privacy until they learn to respect ours.
Why did we not get the cool dystopia ala Gibson's Chiba City?
I remember walking over a hill into a rave in the Utah desert that we'd set up and thinking that it actually was the cyberpunk dystopia that I had been hoping for.
That kind of stuff is around but maybe not evenly distributed or legible to large demographics.
Unfortunately, so is the rest of the vicious horrorshow, equally illegible and equally uneven in distribution.
Interesting that you frame it as "hoping" for a dystopia. Like even in our wildest imaginations we can't envision a future where society works for regular folks.
I'm sympathetic to the problem that folks like Mark Fisher have laid out, in which (to paraphrase) "it is easier to imagine the end of the world than the end of capitalism", and that indeed might be one way to understand my feeling.
I take your point; it makes sense.
"Regular folks" is doing a lot of work, though.
It may very well be the case that most of the material world which props up the idea of "regular folks" never was capital-R Real and insofar as the idea is a pleasant dream it is not a sustainable one.
Proximate to me, often "regular folks" entail white folks unproblematically living their lives around the norms of US hegemonic capital interests. When I hear Pat the Bunny sing "show me utopia, I will call it a jail" I understand the feeling. I was, afterall, raised by Christians who believed in David Byrne's picture of "Heaven" as a place where "nothing ever happens".
Those are the folks who have happily elected a few people to replace the Flock cameras here with Axon. Their vision of an ordered society is a bit chilling to me, despite the fact that they understand their project as both liberal and progressive.
As I understand it, deviations from those cultural norms are already "dystopic" to the "regular folks" I know- if we somehow lost our ability to transmute sand into computing power and dead plants into motive power and had to go back to living in the cliff side then we'd no longer really be human, despite the fact that their enchanted sand and holy oil is literally destroying the ecology of the entire planet.
This situation is, of course, already a distopia for the bands of Ute and Jicarilla Apache and Dine and Hopi and others living near me. And when I look at the kinds of technological survellience built into the material structures it feels easy enough to note that we already live in a dystopia. I have heard some specific dakota folks refer this situation to as post-apocalyptic and I am inclined to agree.
If we accept that we're already in a dystopia and, further, that much of the hegemonic culture's idea of a "utopia" has already been a holocaust for several other groups of people, then hoping for a "dystopia" in that sense might seem a bit more coherent.
Damn, calling out Mark Fisher and Pat the Bunny? I think we are immersed in a lot of the same cultural and intellectual movements.
Because we got the gray box IBM version instead...
it seems like all the tech-fascists just read snowcrash and settled on that.
https://i.ibb.co/WWWYznHX/flock-future.png ;-)
See also: https://dave.autonoma.ca/blog/2019/06/06/web-of-knowledge/
Interesting to note that if you don't look like a car or a person, through "adversarial fashion" or some other visual trick, your image potentially won't leave the camera and won't reach the flock cloud for further analysis.
I wonder if they were able to find any of the Bluetooth signal-data these cameras are said to be obtaining from devices within its' vicinity. This in itself is wild, im glad they're coming down around where I am
The other day I was imagining that everyone can just own any device near them. I suppose this implies that we have the resources and access to a capable model
Tyranny of government invites terrorism from its constituents.
We have all heard the argument that when corporations intentionally make the legal option worse it drives otherwise law abiding customers to pirate the content instead because piracy provides a better service than paying the corporation for their kneecapped product.
I dont see how the same thing doesnt apply to governments.
The people tell you over and over they dont want to live under a surveilance police state. So natually the corporations and government work together to create a fascist police state and they expect the people to be good little slaves and simply sell their souls to their government.
Especially in the day of ai when they could just fake those images incredibly easily to frame someone. They dont need a patsy the next time they jfk someone they just find some sucker with a weak alibi from a list of potential suckers and then fake some cctv images and cell phone data and they can put you where ever they want to.
The only real defence is to buy your own body cam and document every moment of your life so you can have competing evidence.
At this point im surprised damaging the cameras is the only thing these activists are doing.
I wouldnt be surprised to see flock employees and corrupt politicians finding bombs under their cars. Which will likely be used to justify more cameras which will only intensify the terrorist activity.
The tree of liberty is long overdue for a good watering.
I disagree.
If your solution is revolution you misunderstood the problem, and you'll make it worse
We still have vestiges of democratic institutions we can use to constrain and controll the state.
The blood letting, pain and suffering you are calling for is much worse than the private power's attack on privacy, and destroys the one effective tool (what remains of your Republic) that you have to fight them
Instead of fighting to destroy your republic, struggle to protect and restore it
With that kind of protection it is guaranteed that that no Flock camera will ever be sold in Europe after december 2027... CRA et al...
I wonder what would happen if one of their customers asked for a 62443-4-2 certificate of compliance?
I feel like most of this was already known when someone here in Dallas figured out they had wifi connectivity you could connect and get access. I may not have the details exactly correct but I think someone got access then.
This is SOP for IOT devices. I am beginning to think we need to regulate this stuff, because it is ubiquitous. The device manufacturers do not have a culture of security.
There are much better ways of device enrollment; at a minimum they could require device activation that doesn't blindly use a token with no further checks.
I'm concerned about publicly accessible devices containing secrets also. These are not physically secure places to store keys, they are mounted on street lights where anyone with a ladder can get the key material out of the device.
It's like they have no threat model in place.
>> Flock insists its cameras do not perform face recognition.
Probably technically true. But since the cameras detect people that makes it easier for their backend system to do face recognition.
Really hoping some good guy hacker manages to take them all down somehow
Next headline: Flock declares Hacker News a terrorist organization.
Doh! (Switches on vpn)
And this seems designed around the assumption that the physical camera can be trusted indefinitely
Move fast and break things*
* Privacy, civic trust, society if you get a chance!
This is the end product of tech leadership taking fat rips of disruption cocaine for the last 15 years. Flock Safety got VC money so that they could build a panopticon. There is nothing surprising about the fact that they did a hack job with terrible security; the fact that their service names are various types of alcohol is beyond parody.
Oh well, at least Flock Safety's IPO will be a critical cash infusion in the pursuit of building the torture nexus so that's cool.
1984 but stupid-mode.
What could go wrong?
> This camera is missing Android security updates for the last eight years.
Right. So expect thousands of Flock cameras to be hacked soon.
Possible perps include foreign intelligence agencies (Khamenei in Iran was tracked down for his assassination using Iranian traffic cams), stalkers, domestic violence perps tracking their victims, the list goes on....
More than likely though, multiple of the above.
Flock is a scourge on democracy. Flock is YC. But looks like they did YC nearly ten years ago. Who knows what their pitch deck looked like? If they pivoted since then to their current sinister incarnation? I don’t see any evidence that YC is still actively supporting them.
Benefit of the doubt: Funding them for a community/city-owned traffic camera type thing seems like it would have been a much more reasonable proposition than funding Flock for their current use case of allowing police to stalk their ex girlfriends or mistresses.
Don't have the pitch deck directly, but do have some of the "what things looked like then" at https://www.ycdb.co/company/flock-safety
The front page then had "All the footage is yours. Your neighborhood 100% owns the data. Flock Safety will not share, sell, or access your data."
Unfortunately, flock has been excluded from wayback, so can't see other views of that page.
{insert Darth Vader: I'm altering the deal. Pray I don't alter it any further.}
(+45m edit) https://bestpitchdeck.com/flock-safety appears to be the pitch deck from 2020.
> ...
> In 2019, Flock signed their first police department deal with Jersey Village, Texas.
> The slides you see here are from Langley's pitch at a venture conference one month before closing a $47M Series C round in November 2020. The following July, Andreessen Horowitz led a $150M Series D investment in Flock as a cornerstone of their American Dynamism practice. Additional slides are included from keynote and sales presentations used in 2023.
> ...
It’s not like this stuff wasn’t known to be a problem 10 years ago. We were already in Trump’s first term, it’s not like it was part of the early post 9/11 “secure everything” push. It was WAY after that.
10 years ago is no excuse.
The NSA spying scandal happened under Obama even! IMO that was the defining moment for electronic privacy as a real political issue; before that we were very much in post-9/11 state of exception mode.
It’s not an excuse, but gives some luxury of distance. We have a lot more hindsight now on how rotten things can become, so with that hindsight it’s easy to say that companies like Flock shouldn’t exist, or shouldn’t be invested in. Ten years ago required some more leaps in foresight that some people were making, I was, but even I didn’t think it would get as evil as it has.
IDK. We’d already had plenty of spying by companies, the government, police abuse, etc.
It was all quite plain then. And the very heavy rhetoric made it very obvious which direction things would go.
>Flock is a scourge on democracy.
Yes. Blame the pickaxe seller. Do not question the miners. Do not question the investors in the mining companies. Do not question the casual voter or internet commenter who thought all this was fine.
This isn't to say that flock not a scourge, but I think a lot of people (not saying you're one of them) could stand to look in the mirror here.
Back in ye olde dark ages of <checks notes> 2017, when YC was cutting Flock a check and when "big data" was the hot buzzword people of a certain bent couldn't get enough of this kind of stuff. Everyone was jacking off nonstop to the idea that we could just hoover up everyone's data ad then "efficiently" or "proactively" dispatch enforcement resources. People talked all sorts of big talk about stuff like cross referencing people's Home Depot spend with permit requirements, identifying small businesses that don't have healthy enough financials to be fully compliant, cross referencing invoices and delivery receipts to identify overloaded trucks, and generally finding all sorts of ways to fine the crap out of people for the pettiest of petty deviance. They considered this a noble goal.
Everyone's head was too far up their asses to look at the magic crystal ball called "history" and realize that a camera on every street corner watching who's going where all the damn time would be where it goes.
so when do we get it flipped to a nationwide bird migration tracking system?
as someone pointed out: let's make that "flock" name accurate
also make it identify bird song, I am sure there are microphones on there
If I had to guess now it works it would be:
1. Take pictures
2. Send to a big server that all cops nationwide can log into whenever they want to stalk their exes
Did I miss something
The system they log into is called DAVID(Driver and Automobile Information Database) which logs activity. If an officer access that information for unlawful purposes, they can be prosecuted. You probably wont believe it, but the reason you hear about cops stalking their ex's is because they got caught doing so.
How many didn't get caught? Or did but the issue was quietly "handled" within the department.
I don't care if a small amount of cops get in trouble if the other 99% of the time they get away with it.
emphasis on "can"
It's always funny how such a "law and order" company not only lies through their teeth but also maliciously files false police reports. As in there's literally video evidence of them calling the police and telling the police things that are not happening.
It's also really annoying me that police departments around the nation are petulantly implying they were "forced" to do this because of lawlessness and silly-villain karens...also claiming, without the press even remotely challenging them, that they're disappointed because "we believe they work."
There literally isn't a single fucking shred of evidence that Flock cameras do jack shit, that isn't from a study Flock paid for, which heavily cherry-picked communities, particularly ones with very low crime rates where a Flock camera happened to be involved and the crime rate which was already low dropped by a couple crimes a year and resulted in a "200% reduction in crime."
if this data is public information, then why does it need encrypted secrecy, paywalls, or any kind of gatekeeping?
if the information does need to be protected from the public, then it must be private data and flock is an illegal system
> "We liberated hardware"
Ya know, I'm not on Flock's side here.. but be real, this is theft. You should be able to own that if you're going to do something like this.
That's also the biggest plot-hole in the first Star Wars movie. Princess Leia is supposed to be this righteous noble of the moral resistance and yet she STEALS the Death Star plans!
https://news.ycombinator.com/item?id=49422404
I don't get the impression that anyone writing about this thinks it's legal. I think the argument would be that it's justified.
Then why bother using that language? The camera doesn't need rescuing, why not just "we took".
Also, is it really justified? Did we learn anything useful here that we didn't already know? There's more effective ways to push back against Flock, townships (like my own) are having plenty of success stories without stealing anything.
You don't think maybe it's just a little bit tongue-in-cheek? Maybe a reference to how the US Military sometimes goes into foreign countries saying we'll be greeted as liberators?
“I kept trying to explain in between haymakers that we were better than this and on top of that it wasn’t likely to be ruled on favorably as far as the courts.” - Luke O’Neil https://flaminghydra.com/the-end-and-after-2/
But we own the cameras
No we don't, even if our taxes paid for them. You don't own public buildings either, that's not how it works.
But sir, we liberated them
It's ma'am, and no you stole them.
Anything becomes permissible when you believe yourself to be “on the right side of history.”
liberation is often used to refer to something that, while technically legal, the people that are subject to it did not agree to
> You should be able to own that if you're going to do something like this.
Um, are you saying the hackers should admit they broke the law? Or that Flock should righteously own the data they collect?
Either way, I d/c. Flock cameras are probably insecure, and their data is potentially dangerous.
Bad laws exist, and following them may be prudent at times, but the act of following them isn't a moral imperative.
And my privacy? The threat to democracy? Does Flock own that? Why is always the poors that need to own morality?