Full Report
Hackers captured a Flock camera and got a look (alternate link) at the software: While much of the automatic license plate reader’s (ALPR) most sensitive storage remained encrypted and inaccessible, the joint analysis of the recovered data shows that software running on the device explicitly detects people as well as vehicles, license plates, and bicycles. The camera can produce dozens of images of a single passing vehicle and, according to several weeks of recovered logs, generated more than a million images. Its computer-vision software also sometimes isolated bumper stickers and other graphics, including, in one case, an American flag patch on a motorcyclist’s saddlebag...
Analysis Summary
# Research: Reverse-Engineering Flock Cameras
## Metadata
- **Authors:** Reported by 404 Media / Summarized by Bruce Schneier
- **Institution:** Independent Security Researchers / Investigative Journalists
- **Publication:** Schneier on Security (Secondary), 404 Media (Primary)
- **Date:** September 21, 2026
## Abstract
This technical analysis details the findings of security researchers who physically captured a Flock Safety camera and successfully bypassed its disk encryption. The investigation reveals that the Automatic License Plate Reader (ALPR) hardware is performing high-granularity computer vision tasks beyond simple plate recognition, including the identification of pedestrians, bicycles, and distinct vehicle markings (bumper stickers/decals). The study also exposes a significant cryptographic failure: the encryption keys for the device’s sensitive partitions were stored in an unencrypted partition on the same drive.
## Research Objective
To investigate the internal software capabilities, data collection practices, and cryptographic security posture of Flock Safety’s ALPR infrastructure.
## Methodology
### Approach
- **Physical Acquisition:** Capture of a deployed Flock Safety hardware unit.
- **Reverse Engineering:** Analyzing the device's storage architecture and software stack.
- **Cryptanalysis:** Attempting to access encrypted partitions.
- **Forensic Log Analysis:** Reviewing several weeks of recovered system logs to determine the camera's operational behavior.
### Dataset/Environment
- One Flock Safety ALPR unit.
- Several weeks of system logs recovered from the device.
- Software binaries responsible for computer vision processing.
### Tools & Technologies
- **Computer Vision (CV) Analysis:** Identification of objects such as people, bicycles, and specific graphics.
- **Disk Forensics:** Tools to examine unencrypted and encrypted partitions.
- **Cryptographic Review:** Analysis of key management and storage.
## Key Findings
### Primary Results
1. **Scope Creep in Surveillance:** The software explicitly detects people and bicycles, moving the device’s function from "License Plate Reader" to "General Purpose Surveillance."
2. **Granular Visual Profiling:** The system isolates unique markings such as bumper stickers and patches (e.g., an American flag patch on a motorcyclist).
3. **High Data Volume:** A single unit generated over one million images within a few weeks, producing dozens of images for each passing vehicle.
4. **Cryptographic Failure:** Sensitive data storage was undermined by storing decryption keys in the clear on an adjacent partition.
### Supporting Evidence
- **Logs:** Review of system logs confirmed the generation of $>1,000,000$ images.
- **CV Output:** Recovered data showed bounding boxes or isolations for non-vehicular objects like bumper stickers.
### Novel Contributions
- **Disclosure of Broad Feature Detection:** First public confirmation that Flock hardware is intentionally programmed to profile human pedestrians and specific vehicle aesthetics, not just license plates.
- **Vulnerability Identification:** Exposure of a fundamental "Key Management 101" failure in high-stakes surveillance hardware.
## Technical Details
The research identifies a "broken" implementation of data-at-rest encryption. While Flock utilizes encrypted partitions to protect sensitive data and proprietary code, the device's boot process requires access to these partitions. The researchers found that the key required to unlock the sensitive storage was located in a plaintext partition accessible to anyone with physical access to the device's internal storage media. This allows for full decryption of the device’s software environment once physical possession is gained.
## Practical Implications
### For Security Practitioners
- **Physical Security is Paramount:** If a device is deployed in the public square, the software security must assume an adversary will gain physical access.
- **Key Management:** Encrypting data is useless if the key is "under the doormat" (the unencrypted partition).
### For Defenders
- **Hardware Hardening:** Future iterations of ALPR technology must utilize Secure Enclaves or Trusted Platform Modules (TPMs) to prevent key extraction.
- **Policy Alignment:** Organizations using these cameras must reconcile the "License Plate Reader" branding with the reality of pedestrian and detail-oriented tracking.
### For Researchers
- **Privacy Audit:** Further research is needed to see if this data is being used for cross-referenced biometric or "pattern of life" analysis at the server level.
## Limitations
- **Encryption Coverage:** While researchers accessed the software and logs, some "sensitive storage" remained inaccessible during the initial analysis.
- **Sample Size:** The analysis was based on a single captured unit; it is unknown if newer models have patched the key-storage vulnerability.
## Comparison to Prior Work
Previous ALPR research focused on the accuracy of plate reading and data retention policies. This research shifts the focus to the **edge computing capabilities**, revealing that the hardware is significantly more powerful and intrusive than previously advertised by manufacturers.
## Real-world Applications
- **Law Enforcement:** Provides a much broader "search" capability (e.g., searching for a car with a specific bumper sticker rather than a plate).
- **Urban Planning:** Potential (though unconsented) use for tracking pedestrian and bicycle traffic density.
## Future Work
- **Network Analysis:** Investigating how this metadata (bumper stickers, pedestrian counts) is transmitted to Flock’s centralized "TALON" network.
- **Vulnerability Assessment:** Testing if the CV software has vulnerabilities that could be exploited via "adversarial patches" on license plates or clothing.
## References
- Schneier, B. (2026). *Reverse-Engineering Flock Cameras.* Schneier on Security. `https[:]//www[.]schneier[.]com/blog/archives/2026/09/reverse-engineering-flock-cameras[.]html`
- 404 Media. (2026). *Hackers Stole Flock’s Camera Software.* `https[:]//www[.]404media[.]co/hackers-stole-flocks-camera-software-revealing-how-the-company-tracks-cars-and-people-2/`