Hackers stole a Flock camera and found 27,321 video clips, 1.6 million images, and an encryption key

WTF?! It seems that Flock just can't stop making headlines these days – none of them good, of course. The latest report illustrating why so many cities are dropping the license plate readers involves hackers who physically pulled a camera down from above a roadway, copied its storage, and found an encryption key sitting on the device itself. Convenient.

The group, calling itself stegan0gram, said it removed and disarmed the hardware before reverse engineering the camera and its associated solar equipment.

This required getting hold of an actual camera; the investigation didn't remotely breach Flock's cloud network. The recovered material became the subject of a joint investigation by 404 Media and Wired.

Inside the Android-based device, the hackers found unencrypted storage partitions. One contained a key that unlocked another area holding recorded media.

Much of the most sensitive storage remained encrypted and inaccessible, but the accessible footage included 27,321 MP4 files in a 1024 x 768 resolution, each lasting around one to two seconds. The clips contained no audio and were separate from the bursts of higher-resolution still images.

Separately, recovered logs spanning about 21 days across several periods showed the camera had generated roughly 1.6 million images of 50,200 vehicles.

A typical passing vehicle generated about 28 images, with some triggering more than 100. The camera selected and cropped useful frames before uploading them over a cellular connection. Reading plates and identifying vehicle characteristics appeared to happen on Flock's servers.

Concerningly, the software also detected people. Tests on the recovered clips identified people in 11 videos, all riding motorcycles.

// Related Stories

Man charged with three felonies for destroying a fake Flock camera now faces misdemeanors instead

Records show police justified Flock license plate searches with answers like "LMAO" and "idk"

Meanwhile, the plate detector occasionally mistook bumper stickers and other graphics for plates, including an American flag patch on a motorcyclist's saddlebag. The investigators found no evidence of active facial recognition.

The logs also revealed more than 27,000 errors from attempts to save full-resolution images when storage was full, alongside tens of thousands of related errors, crashes, and reboots.

Flock's curt response was to warn that unauthorized removal and tampering of its cameras were illegal. It also said it had received no report through its vulnerability disclosure process and lacked sufficient detail to assess the claims.

Flock previously said that physical access would not expose captured footage because images remained on cameras only briefly after upload, a claim these findings seem to contradict.

It's another unwelcome addition to Flock's record. From being used by police to stalk former partners to officers entering nonsense to justify database searches, cities are racing to remove the cameras. The company even reinstalled cameras in one California city after the police department canceled its contract and took them down.