Flock seeks to have security researchers' map of Flock cameras taken down
12 hours ago
- Security researcher Joshua Michael discovered an unauthenticated vulnerability in Flock's website, allowing access to a token without login.
- The flaw enabled him to query ArcGIS and retrieve a database of 335,701 Flock camera locations, which he published on the Flock Surveillance Map website.
- Michael reported the flaw to Flock in November 2025, but the company did not respond promptly; the vulnerability was fixed in January 2026 after his findings were published.
- Flock claims no data breach occurred, but Michael argues the company either failed to disclose the incident or lacked detection capabilities, raising national security concerns.
- The camera locations include sensitive sites like military bases, intelligence agencies, and law enforcement headquarters, potentially enabling tracking of personnel.
- Flock issued a trademark infringement complaint against the surveillance map website, citing unauthorized use of the 'FLOCK SAFETY' trademark.
- Previous security issues include encryption keys stored on devices, leading to the extraction of over 27,000 clips and 1.6 million images, as well as misuse by police officers.