TL;DR: Security researchers found Flock Safety surveillance cameras streaming live video to the open internet. 404 Media confirmed at least 60 exposed cameras, and researcher GainSec catalogued 67 exposed feeds and debug interfaces. No username. No password. No encryption. Anyone could watch real-time footage of playgrounds, parking lots, and public streets. They could download a month of archived footage and change device settings. 404 Media confirmed the exposure by visiting a California traffic signal and watching themselves on camera in real time. Senator Wyden is calling for an FTC investigation. Flock logins are being sold on Russian cybercrime forums.
What Researchers Found
Security researcher Benn Jordan and privacy researcher Jon "GainSec" Gaines independently discovered Flock Safety cameras exposed to the public internet in late December 2025.[1]
Jordan described what he saw:
"Immediately, we were just without any username, without any password, we were just seeing everything from playgrounds to parking lots with people, Christmas shopping and unloading their stuff into cars."
The exposed cameras weren't just pointed at empty streets. They captured:
- Children on playgrounds
- People loading purchases into their cars in parking lots
- Shoppers during Christmas season
- Public streets with passing pedestrians
Gaines found 67 instances of Flock Safety camera feeds and debug web interfaces exposed without authentication.[2]
404 Media Verified It Themselves
Jason Koebler at 404 Media visited a Flock surveillance camera mounted on a California traffic signal to confirm the exposure:[1]
"On my phone, I am watching myself in real time as the camera records and livestreams me, without any password or login, to the open internet..."
The access wasn't limited to live video. Anyone who found these feeds could:
- Watch live streams of police surveillance cameras
- Download approximately one month of archived footage
- Change device settings, view log files, and run diagnostics
The cameras are Flock's Condor models: pan-tilt-zoom cameras that can capture entire streets and zoom in on individuals.
Flock's Response
Flock Safety downplayed the exposure, saying no customer data was compromised.
In a blog post, Flock insisted they have "never been hacked, and there has not been a leak of Flock information."[3]
Researchers dispute this characterization. Jordan told 404 Media the cameras remained accessible days after Flock claimed to have fixed the issue.
The Bigger Security Problems
The exposed cameras are just one part of Flock's security failures. Senator Ron Wyden (D-OR) and Rep. Raja Krishnamoorthi (D-IL) sent a letter to FTC Chair Andrew Ferguson on November 3, 2025, detailing systemic issues:[4]
- No mandatory multi-factor authentication: Flock doesn't require law enforcement customers to use MFA
- Stolen credentials: At least 35 Flock customer accounts had passwords stolen by hackers, according to cybersecurity firm Hudson Rock
- Logins for sale: Flock login credentials appeared on Russian cybercrime forums
- Phishing-resistant MFA not supported: Flock's voluntary authentication doesn't "natively support" phishing-resistant MFA
The lawmakers wrote:
"Flock has received vast sums of taxpayer money to build a national surveillance network. But Flock's cavalier attitude towards cybersecurity needlessly exposes Americans to the threat of hackers and foreign spies tapping this data."
The Scale of Flock's Network
This isn't a small company with a few cameras. Flock Safety is the largest license plate reader vendor in America:
5,000+ Police Departments
Across 49 states, using Flock cameras for surveillance
6,000+ Communities
Neighborhoods, businesses, and HOAs also use Flock
20 Billion Scans Monthly
License plates captured and logged every month
$7.5 Billion Valuation
After raising $275 million in March 2025
When Flock's security fails, it's not a few cameras. It's a nationwide surveillance network with police access.
Cities Are Pulling the Plug
The security revelations accelerated a trend already underway. Cities across Oregon and Washington are ending Flock contracts:[5]
- Bend, OR (January 8, 2026): City council voted to turn off and remove four cameras, citing security concerns and community outcry
- Eugene, OR (December 2025): Terminated contract after a camera was reactivated without authorization
- Springfield, OR (December 2025): Ended agreement before cameras were ever activated
- Woodburn, OR: Suspended use amid sanctuary law concerns
- Skamania County, WA: Turned off cameras after public pressure
At the Bend city council meeting, residents voiced fears about mass surveillance, data security, and potential misuse for immigration enforcement. Councilor Mike Riley raised concerns about "what's going on at the federal level, and compliance with sanctuary law."
The Immigration Enforcement Connection
Senator Wyden has raised concerns beyond just cybersecurity. In October 2025, he accused Flock of misleading Oregon communities by promising to block searches related to immigration enforcement and abortion-related investigations.[4]
Wyden's oversight found that the software filters Flock described were easily bypassed.
This matters because ICE has been expanding surveillance capabilities. If Flock data can be accessed by federal immigration authorities (or if security failures expose it to anyone), the company's 20 billion monthly plate scans become a tool for tracking anyone who drives.
What You Can Do
Check Your Community
Ask your city council if they use Flock Safety. Many contracts aren't publicized. File a public records request if needed.
Attend Council Meetings
Public pressure works. Bend canceled because residents showed up. Your voice matters.
Support State Regulation
Oregon lawmakers are drafting statewide ALPR restrictions for 2027. Contact your state reps about license plate reader limits.
Vary Your Routes
If you're concerned about tracking, don't take the same route every day. ALPRs build patterns from repeated captures.
The Bottom Line
Flock Safety built America's largest vehicle surveillance network. They convinced 5,000 police departments and thousands of communities to trust them with real-time tracking of millions of vehicles. They're valued at $7.5 billion.
And they couldn't bother to put a password on their cameras.
Anyone with an internet connection could watch police surveillance feeds. Anyone could download a month of footage showing who drove where and when. Anyone could change device settings.
Flock downplayed the exposure. Lawmakers are calling for an FTC investigation. Cities are canceling contracts. Security researchers found logins for sale on Russian cybercrime forums.
This is the company that wants you to trust them with 20 billion license plate scans a month. This is the surveillance network your tax dollars are funding.
References
- 404 Media - Flock Exposed Its AI-Powered Cameras to the Internet. We Tracked Ourselves (December 2025)
- GainSec - Finding 67 Flock Safety Live PTZ Camera/LPR Feeds Exposed (January 2026)
- Flock Safety - Has Flock Been Hacked? (Company Response)
- Senator Wyden Letter to FTC Regarding Flock Safety (November 2025)
- OPB - Bend is the latest Oregon city to turn off Flock cameras (January 2026)
- 404 Media - Flock Logins Exposed, Senator Asks FTC to Investigate (November 2025)
Published: January 25, 2026