Flock cameras are riddled with security vulnerabilities and hardcoded creds
Leaked Flock ALPR camera firmware reveals EOL Android 8.1, a 2017 Linux kernel, and hardcoded API keys granting access to production credentials.
DDoSecrets published filesystem images from an in-use Flock ALPR camera, obtained by the hacker collective stegan0gram and investigated by 404 Media and Wired. Micah Lee's analysis shows the camera runs Android 8.1 with a security patch level of 2018-06-05 and Linux kernel 3.18.71, missing roughly eight years of Android fixes. The firmware exposes a hardcoded API key for Flock's hpnotiq backend that can retrieve Auth0 client credentials for any camera by MAC address, with credentials stored in plaintext. Likely unpatched flaws include CVE-2021-1905 (Qualcomm Adreno use-after-free) and CVE-2018-9568 (WrongZone kernel socket type confusion); Flock says it received no reports via its disclosure policy.
Where the backlash against Flock Safety is having the biggest impact
More than 90 cities ended Flock Safety contracts in August as Texas and Florida restrict license plate reader use amid privacy protests.
Over 90 cities and counties terminated Flock Safety contracts in August, per Secure Justice, which has tracked more than 200 municipal terminations since 2021. Texas Gov. Greg Abbott barred state agencies from funding Flock cameras on Aug. 28 after a report that a state agency secretly diverted $30 million; Florida's transportation department banned ALPRs on state highways and Gov. Ron DeSantis criticized the technology. Los Angeles chose not to renew its LAPD contract over data-ownership terms, and Atlanta's mayor ordered a 30-day review of the roughly 5,000 ALPR cameras in the metro area. Several Flock-related police abuse cases, including a Texas officer indicted on 100 felony counts, have fueled the backlash.
The Government is Monitoring Anti
Fusion center bulletins reveal US law enforcement monitoring anti-Flock social media accounts and warning police ahead of the DeFlock Week of Action against license plate readers.
Public records requests by 404 Media and journalist Dan Boguslaw exposed intelligence bulletins from fusion centers in Colorado, Wisconsin, and Florida tracking anti-Flock sentiment, camera vandalism videos, and the DeFlock National Week of Action against automated license plate readers scheduled for August 16-22. The bulletins highlight Instagram accounts like Nomark.Project posting daily camera takedowns, and a device found during a June 25 traffic stop that could locate Flock cameras. Police are advised to increase patrols around ALPR locations and warned about upcoming DeFlock events, including 11 Florida cities signed up. DeFlock creator Will Freeman said the project never called for vandalism and that over 100 surveillance contracts have been canceled through civic engagement.
Flock camera use by internal affairs unit puts DC police at odds with officers’ union
DC's Metropolitan Police Department used Flock license plate cameras to track officers under internal affairs investigation, prompting a union grievance and council scrutiny.
The DC Police Union learned in July 2026 that MPD Internal Affairs used Flock ALPR cameras to monitor officers under investigation without their knowledge, filing a grievance that management denied. Secure Justice found more than 90 US cities and counties ended Flock contracts in August 2026 alone, with over 200 terminations since 2021, while Texas and Florida announced new usage restrictions. On September 14, DC Councilmember Brooke Pinto asked Interim Chief Jeffery Carroll ten questions about the department's use of Flock data.
Cops Search Thousands of Flock Cameras for Reasons of ‘LMAO,’ ‘IDK,’ ‘Hehe,’ and ‘asdfg’
EFF analysis found police searched Flock's 19,000-camera ALPR network using joke reasons like 'LMAO' and 'idk,' exposing routine warrantless surveillance abuse.
An EFF analysis of Flock audit logs, shared with 404 Media, found officers across dozens of jurisdictions searching over 19,000 cameras in 1,558 cities with justifications like 'LMAO,' 'idk,' and keyboard gibberish between 2023 and late 2025. One Lake County, Indiana sheriff's deputy searched for a license plate across the entire network citing 'LMAO.' After outlets exposed searches targeting ICE detainees, an abortion patient, and protesters, officers were reportedly told to be 'as vague as permissible,' and Flock replaced the free-text reason box with a prepopulated drop-down list, which EFF called a loss for transparency. Departments rarely disciplined offending officers, and EFF concluded agencies cannot oversee themselves.
Florida and Texas move to block Flock cameras over privacy concerns
Florida and Texas move to end use of Flock license plate cameras, citing privacy concerns and database misuse by police.
Florida's Department of Transportation said it will cease using license plate readers, such as Flock's cameras, on state highways and has 30 days to remove them, following Governor DeSantis calling the technology 'out of control'. Texas separately ordered state agencies to stop funding Flock cameras, citing abuse including the indictment of a Lufkin officer on 100 felony counts for allegedly searching Flock's database without authorization. Flock operates roughly 130,000 license plate readers across the US, and towns including Evanston, Cambridge, and Eugene report the company reinstalled cameras after contracts were terminated.
Man Charged With 3 Felonies For Breaking 3D
Oviedo, Florida police charged a man with three felonies for cutting down an officer's 3D-printed decoy Flock surveillance camera.
After several real Flock Safety cameras were stolen in Oviedo between July 23 and August 3, 2026, police replaced them with 3D-printed decoys built by an officer at home and monitored the fakes. Evan Meyer was arrested after midnight and charged with attempted grand theft, criminal mischief over $1,000, and property crimes against computer equipment, despite the decoy costing only a few dollars of filament. Mayor Megan Sladek said she had no idea the sting was underway, and the department claims no records of the decoy's creation exist, citing an ongoing investigation.
Automobile Camouflage to Hide from Flock Cameras
Schneier on Security highlights a printed vehicle-camouflage pattern tested to defeat Flock surveillance cameras and Axon body cameras.
The post discusses covering cars with printed patterns designed to fool Flock automated license-plate recognition software, with testing reportedly done against Flock and Axon body cameras. Reader comments question effectiveness against other ALPR vendors, Flock's RF MAC-address upgrade, and whether such camouflage might become regulated. The page also contains off-topic comment threads about anti-bot over-blocking and privacy.