17:17Machine-translated from Azerbaijani by AIRead in Azerbaijani
Flock Wants Map Showing Locations of 335,701 Cameras Taken Down
Flock wants a camera map created by exploiting a security vulnerability to be taken down. Researcher Joshua Michael obtained a digital key from the company’s website that required no login credentials. In November 2025, he used the key to query the ArcGIS mapping service operated by Flock and extracted device location data. The Flock Surveillance Map website he subsequently created shows the locations of 335,701 cameras.
Michael notified the company about the security vulnerability on November 13, 2025. The researcher says he checked only publicly accessible addresses that did not require a login. He did not attempt to bypass authentication, alter data, or initiate a paid transaction. Only after the 3rd inquiry did Flock write that it was investigating the matter internally. The vulnerability was fixed in January 2026 after the findings were published, but the researcher received no further response. Michael was able to copy the devices’ location data before the vulnerability was fixed. According to him, the map’s data was last updated, probably in December 2025. Flock says its system was never hacked and that no data was leaked. The company also emphasizes that there was no security breach of the Flock Safety cloud platform. The researcher, however, believes the company knew the data had been extracted but did not disclose it, or failed to detect the incident altogether.
The incident emerged after security problems had previously been discovered in Flock’s system. Hackers determined that the cameras stored the encryption keys protecting the data directly on the devices. They were able to extract more than 27,000 videos. The material also revealed that the system had captured more than 1.6 million images over 21 days. Cases have also been documented in which police officers used the system to track people with whom they had personal relationships. In another incident, an automotive reviewer was detained for 1 hour because of an incorrect report.
According to the researcher’s analysis, this camera network could also be used to track the movements of military personnel and defense industry employees. The map covers a total of 22 sensitive sites. These include Eglin Air Force Base and the headquarters of the Central Intelligence Agency and the Federal Bureau of Investigation. Joint Base Andrews and the Pentagon are also on the list. The probability that people living within an approximately 32 km radius of these locations would be captured by the cameras was calculated. The figure ranges from 57.22% to 93.94%. Flock has not commented on the matter. Doppel, a company that works to protect against social engineering attacks, filed a trademark complaint against the mapping site. The complaint states that the FLOCK SAFETY name was used without permission and that this could confuse customers. On that basis, it requests that the site be taken down. However, when the map is opened, a notice states that the site is not affiliated with Flock.
Michael notified the company about the security vulnerability on November 13, 2025. The researcher says he checked only publicly accessible addresses that did not require a login. He did not attempt to bypass authentication, alter data, or initiate a paid transaction. Only after the 3rd inquiry did Flock write that it was investigating the matter internally. The vulnerability was fixed in January 2026 after the findings were published, but the researcher received no further response. Michael was able to copy the devices’ location data before the vulnerability was fixed. According to him, the map’s data was last updated, probably in December 2025. Flock says its system was never hacked and that no data was leaked. The company also emphasizes that there was no security breach of the Flock Safety cloud platform. The researcher, however, believes the company knew the data had been extracted but did not disclose it, or failed to detect the incident altogether. The incident emerged after security problems had previously been discovered in Flock’s system. Hackers determined that the cameras stored the encryption keys protecting the data directly on the devices. They were able to extract more than 27,000 videos. The material also revealed that the system had captured more than 1.6 million images over 21 days. Cases have also been documented in which police officers used the system to track people with whom they had personal relationships. In another incident, an automotive reviewer was detained for 1 hour because of an incorrect report. According to the researcher’s analysis, this camera network could also be used to track the movements of military personnel and defense industry employees. The map covers a total of 22 sensitive sites. These include Eglin Air Force Base and the headquarters of the Central Intelligence Agency and the Federal Bureau of Investigation. Joint Base Andrews and the Pentagon are also on the list. The probability that people living within an approximately 32 km radius of these locations would be captured by the cameras was calculated. The figure ranges from 57.22% to 93.94%. Flock has not commented on the matter. Doppel, a company that works to protect against social engineering attacks, filed a trademark complaint against the mapping site. The complaint states that the FLOCK SAFETY name was used without permission and that this could confuse customers. On that basis, it requests that the site be taken down. However, when the map is opened, a notice states that the site is not affiliated with Flock.