One camera, 21 days, 1.6 million photos: hackers pulled a Flock camera off a pole and read its drive
A hacker collective ripped a license plate camera off a roadway, copied what was inside, and handed it to reporters. The logs show what one device on one street actually collects.
Somewhere above a road, a small box with a phone-grade processor was photographing every car that passed. In 21 days of recoverable logs it captured roughly 50,200 vehicles and about 1.6 million images — around 3,300 cars on a normal day, 4,454 on its busiest one. That's one camera. Flock Safety has them all over the United States.
A collective calling itself stegan0gram tore one down, made a near-complete copy of its storage, and shared the files with 404 Media and WIRED, along with the transparency nonprofit Distributed Denial of Secrets. Flock has described its cameras as protected by on-device encryption. The hackers found an unencrypted partition called "media" holding an encryption key — and that key unlocked videos of thousands of vehicle detections.
Here is the part most people get wrong about these cameras. They are usually described as license plate readers, as if a plate were all they saw. The software on the device explicitly detects people too — as well as vehicles, plates and bicycles — and when it spots a person it records where in the frame they appear and how confident it is. WIRED pulled the detection models out of the camera's own files, ran them on test material, and they readily detected people, including a selfie of a reporter.
The camera doesn't think much on its own. When something moves, it fires off a burst of photos — about 28 for a typical passing car, more than 100 in some cases — using different exposures to catch both the plate and the wider scene, then crops the useful frames and ships them to Flock over the cellular network. The reading of the plate, the colour, the make and model appears to happen on Flock's servers, not on the pole. So the pole is just the eye. The memory lives somewhere else.
And the memory is widely shared. In Alpharetta, Georgia, WIRED found records from the city's Flock cameras were accessible to more than 2,000 agencies — police departments, colleges, airports, and, inexplicably, the Office of Inspector General for the federal General Services Administration. 404 Media previously revealed local police running lookups in that national network on behalf of Immigration and Customs Enforcement, including in places that banned cooperating with immigration authorities or sending plate data out of state. In another case, a cop in Texas searched Flock cameras nationwide for a woman who self-administered an abortion.
A camera over your street is not a camera over your street. It is a search box, and more than 2,000 strangers have the keyboard.
The machine is also sloppier than the marketing suggests. Its plate detector sometimes mistook bumper stickers, dealership frames and other graphics for license plates and cropped them out as if they were plates. In one clip of a passing motorcycle, it cropped an American flag patch on the rider's saddlebag. Across 27,321 short clips stored on the device, the models found people in 11 — all motorcyclists, probably because the camera pointed down at traffic where pedestrians rarely walk. On faces, WIRED and 404 Media found no evidence of face recognition beyond what ships with Android by default, and that did not appear to be enabled or in use.
Anyone who drives past one of these on the way to work — which, in much of the US, is everyone. It also lands on people whose movements are worth hiding from the state rather than from criminals: the abortion case and the immigration lookups are the two documented examples, and neither involved the car's owner being suspected of anything. If you're in your twenties and figuring out where to live or what to train for, note the quieter part: the surveillance job market now runs on a box with a midrange smartphone processor and about 20 apps. Building it, auditing it, breaking it and arguing about it in council meetings are all growing lines of work. And if you own a motorcycle with a patch on the saddlebag, a computer has already filed that patch as a license plate.
Two threads to watch. First, the hackers say they are publishing details of how they obtained the software, hoping others copy them — so the test is whether a second camera gets dumped. Second, Flock's own position is now on the record: when security researcher Jon "GainSec" Gaines reverse engineered one of its readers in early 2025 and documented flaws allowing root-level access, the company acknowledged them but downplayed their severity, saying an attacker "would still not be able to gain access to footage." This breach recovered footage. The source names no deadline, no hearing and no regulator — and neither will we.
Some towns have already announced they are dropping Flock cameras entirely. One police department went the other way and 3D-printed a fake camera case to bait vandals. Both reactions came from the same question, and it isn't a technical one: who gets to decide what's watching your street?
Sources: WIRED, "Hackers Got Inside a Flock Camera. Its Data Shows How the System Really Works," Sep 16, 2026 (investigation in partnership with 404 Media)
Одна камера на дороге за три недели сняла 1,6 млн кадров 50 тысяч машин — и её данные доступны тысячам ведомств по всей стране, включая тех, кто искал женщину после аборта.
Written by THE TELL’s AI newsroom. how we work · corrections