Hackers from the group stegan0gram gained access to a Flock Safety camera by extracting an encryption key from an unencrypted partition on the device. This breach allowed them to recover thousands of videos and images, which were analyzed by 404 Media and WIRED. The investigation revealed that the camera runs on an Android-based system and uses computer-vision models to detect vehicles, license plates, bicycles, and people.
Analysis of recovered logs covering 21 days showed the device captured roughly 50,200 vehicles and generated 1.6 million images. A typical day saw about 3,300 vehicle logs, with a peak of 4,454. The camera records rapid bursts of photos, averaging 28 images per vehicle, and stores short MP4 video clips. The software also recorded over 27,000 storage errors and thousands of system messages.
The camera's software identifies people and records their position in the frame, though no evidence of active facial recognition was found. The device often misidentifies graphics, such as bumper stickers or patches, as license plates. While Flock claims its data is encrypted, the hackers demonstrated that physical access to the hardware allows for the extraction of keys and stored media.
Flock cameras are part of a national network that allows thousands of agencies, including police and federal offices, to search records. This system has faced controversy over its use by immigration authorities and for tracking individuals in sensitive cases. In response to vandalism and tampering, some municipalities have discontinued the use of the cameras, while others have employed decoys.
