Hackers Breach Flock Safety Camera to Reveal Surveillance Capabilities

Hackers from a collective known as stegan0gram physically removed a Flock Safety camera from a roadway and successfully copied its internal data, as first reported by 404 Media in a joint investigation with WIRED. The breach exposes the inner workings of a system Flock had previously described as protected by on-device encryption.

By accessing the camera's Android system, the hackers identified unencrypted partitions labeled "vendor" and "media." The "media" partition contained an encryption key that allowed the hackers to unlock videos of thousands of vehicle detections. Analysis of the recovered files by 404 Media and WIRED revealed that the software explicitly detects not only vehicles and license plates, but also people and bicycles. The system's computer-vision software is capable of isolating graphics, such as an American flag patch on a motorcyclist's saddlebag, and some passing vehicles generated more than 100 images.

This breach follows previous warnings from security researcher Jon “GainSec” Gaines, who in early 2025 documented flaws that could grant root-level access to the devices. While Flock acknowledged those findings, the company downplayed the risk, stating that physical access was required and that footage would not be accessible because images are transmitted to the cloud quickly.

The investigation also highlights the scale of Flock's national network. WIRED found that in Alpharetta, Georgia, records from city cameras were accessible to over 2,000 agencies, including airports, colleges, and the federal General Services Administration's Office of Inspector General. 404 Media previously reported that local police used this network to perform lookups for Immigration and Customs Enforcement (ICE) and that a Texas officer used the system to search for a woman who self-administered an abortion.