One Flock Safety camera photographed about 50,200 vehicles and generated roughly 1.6 million images in just 21 days. Then hackers physically removed the roadside device, copied its internal data and recovered an encryption key that gave them access to stored footage.
The discovery offers an unusually detailed look inside one of America's largest automated licence plate networks, showing how a single roadside camera captures far more imagery than a simple licence-plate snapshot and how that data is processed through Flock's wider surveillance system.
The camera was not breached remotely. Instead, the hacker collective physically took the device from its roadside location and copied much of the information stored inside it. The files, reviewed by WIRED and 404 Media, included thousands of videos and logs that revealed how Flock's technology operates.
Researchers said they recovered an encryption key from the device that allowed them to access its stored video archive.
Hackers Found an Encryption Key Inside the Camera
Flock has long said that data stored on its cameras is protected by encryption and that physical access to a device would not allow someone to access stored footage.
The new investigation describes a different scenario. The hackers physically removed one camera, copied much of its internal storage and reverse-engineered the device. Among the recovered material was an encryption key apparently stored on the camera itself. Researchers used the key to unlock portions of its video archive.
Flock said tampering with its cameras is illegal and that it did not have enough information to assess the hackers' claims in detail.
One Camera Recorded 1.6 Million Images in 21 Days
The data revealed the volume of imagery a single roadside unit can generate.
According to WIRED and 404 Media, the camera photographed approximately 50,200 vehicles and generated about 1.6 million images over 21 days. Some vehicles generated more than 100 images.
The camera did not simply take one photograph of each passing car. When something moved into view, it captured a rapid sequence of images using different exposures to capture the licence plate and wider surroundings.
The findings also indicate that the camera does not perform all of the vehicle analysis itself. Imagery and associated information are sent to Flock's servers, where additional processing identifies characteristics such as vehicle make, model and colour.
Flock Cameras Can Detect More Than Licence Plates
The recovered software contained references to the detection and classification of people, vehicles, bicycles and licence plates. That does not mean every person passing a Flock camera is automatically identified by name.
But it does reveal the system's technical capabilities beyond simply reading a registration plate. Flock says its network includes about 120,000 cameras across 49 states. Findings from one device do not establish that every Flock camera contains the same vulnerability.
Flock Faces a Misuse Crisis
The camera compromise comes as Flock faces scrutiny over how law-enforcement customers have used its technology. The Washington Post identified dozens of cases in which officers were accused, charged or convicted of improperly using licence-plate-reader systems. CBS News reported that Flock had identified 46 cases in its coverage of the issue.
The company subsequently announced changes, including reducing the default retention period for licence-plate data from 30 days to seven days, while allowing information connected to active investigations to be preserved.
With roughly 120,000 cameras across 49 states, the physical security of each roadside device is part of the security model for a nationwide surveillance network. Flock had not provided a detailed public response to the specific encryption-key findings at the time of publication.
