Security researcher Joshua Michael discovered a vulnerability in the ArcGIS mapping layer used by Flock, allowing him to access a database of device locations in November 2025. Michael notified the company on November 13, 2025, but received no immediate action. He subsequently launched the Flock Surveillance Map website, which lists 335 701 camera locations.
Flock reportedly patched the vulnerability in January 2026. Despite the company's claims that its cloud platform has never suffered a data breach, Michael argues that the database exfiltration contradicts these statements. The researcher noted that the company recently issued a trademark infringement complaint through the cybersecurity firm Doppel, demanding the removal of his website.
Previous security issues with Flock hardware include the storage of encryption keys directly on devices, which allowed unauthorized access to over 27 000 video clips. Investigations revealed that the system captured over 1.6 million images within 21 days. Reports also highlight instances of system misuse by police officers for personal stalking and wrongful detentions.
The researcher highlighted risks regarding the tracking of personnel at 22 sensitive locations, including the Pentagon and CIA headquarters. Data suggests that individuals living within a 20-mile radius of these sites face a 57.22% to 93.94% probability of being recorded by the camera network, raising concerns about the potential for monitoring defense industry employees.
