Flock Camera Hack: Hackers Cracked Its Encryption Key

Update, Sept. 18: A Flock spokesperson called the camera's unauthorized removal 'illegal' and said the company received no vulnerability report and has 'not enough detail to assess the claims' (via 404 Media); the stegan0gram collective says it will publish its teardown methodology so others can replicate it; the backlash keeps growing, with 50+ agencies and communities canceling, suspending or rejecting Flock contracts since the start of 2026 (IPM News, Aug. 17).

Somebody finally did what Flock Safety insisted couldn't be done. Not from a laptop in another country — from a ladder, on a roadside, in plain daylight.

A group of hackers calling themselves stegan0gram tore a Flock license-plate camera down from above a roadway, made a near-complete copy of everything stored inside it, and pulled out the one thing that was supposed to make all of this impossible: the encryption key. They handed the files to 404 Media and the transparency nonprofit Distributed Denial of Secrets, which shared them with WIRED, and the two publications spent weeks dissecting the results in a joint investigation published this week.

This is not a story about a database breach. It is something arguably more important: the first serious look inside the black box itself — the software running on one of the roughly 120,000 cameras that now watch America's streets — and it contradicts several things Flock has told the public about how its system works.

A hacker collective physically removed a Flock camera from a roadway and extracted its data, including an on-device encryption key. Illustration: TechPulse USA (original).

What the hackers actually got

According to 404 Media's reporting, the group gained access to the camera's Android operating system and examined its storage partitions. Some were unencrypted — including one labeled "vendor" and another called "media." The media partition contained an encryption key that unlocked a second section holding much of the camera's video and image material. The hackers then shared that material, and the two newsrooms independently analyzed it.

The numbers are striking. About 21 days of activity logs survived on the device. In that window, a single camera photographed roughly 50,200 vehicles and generated around 1.6 million images. On a typical day it logged about 3,300 passing vehicles, with a high of 4,454. When something moved into view, the camera fired off a rapid burst of photos — typically around 28 images per vehicle, though some cars produced more than 100 — using different exposures to capture both the license plate and the wider scene. Older logs had been overwritten or were no longer recoverable, so the camera had almost certainly been operating well beyond what the investigators could reconstruct.

Under the hood, the device runs Android on a processor comparable to a midrange smartphone, with roughly 20 Flock-built apps handling motion detection, image capture, object classification, uploads, and remote updates. One important technical detail: the camera itself does not appear to read the plate or identify a vehicle's make, model, and color. That work happens on Flock's servers, after the images are transmitted over the cellular network.

The encryption key changes the story

Flock has described its cameras as protected by on-device encryption — a claim that has been central to its security posture. The problem: the key that unlocked a large portion of the media was itself stored on the device, in a partition the hackers could reach. Once they had physical possession of the camera, the "protected by encryption" defense collapsed for a substantial share of what it held.

This is not the first time that defense has wobbled. In early 2025, security researcher Jon "GainSec" Gaines reverse-engineered a Flock license-plate reader and documented flaws that could provide root-level access. Flock acknowledged the findings but downplayed them, saying the flaws required physical access to the device and that an attacker "would still not be able to gain access to footage" because images remained on the device only briefly after transmission. The stegan0gram teardown punches a hole in that second claim: the recovered key unlocked videos and stills the company suggested would never be recoverable.

To be precise about what was and wasn't breached: the joint investigation found that much of the camera's most sensitive storage remained encrypted and inaccessible. Nobody downloaded a national database of license plates from their bedroom. But the hackers proved that physical possession of a single camera could expose data that was supposed to stay locked — and they say they plan to publish the details of how they did it, in the hope that others will copy them.

What the camera really sees: people, plates, and bumper stickers

The most consequential finding has nothing to do with encryption. The software running on the camera explicitly detects people — a capability that is typically overlooked in discussions of license-plate readers. When the system spots a person, it records where they appear in the image and how confident the detection is. To verify it, WIRED extracted the models from the camera's files and ran them against test images and footage pulled from the device. The models readily detected people, including a selfie of one of the reporters. Applied to 27,321 short video clips stored on the camera — one to two seconds each, 1024 by 768, no audio — the models found people in 11 clips, all of them motorcyclists, a small number the journalists attribute to the camera's position above a roadway pointed down at traffic.

The plate detector had its own quirks. It sometimes mistook bumper stickers, dealership frames, and other graphics for license plates and cropped them out as if they were plates. In one recovered video, the detector cut out an American flag patch on a motorcyclist's saddlebag as though it were a license plate. That matters because false positives in this system don't just sit in a log — they can surface in police searches.

One thing the investigators did not find: face recognition. Flock insists its cameras don't perform it, and 404 Media and WIRED found no evidence of face-recognition capabilities in the camera's software beyond what ships by default in Android — which did not appear to be enabled or in active use. That's a rare bright spot, and worth stating plainly.

One camera generates millions of images; Flock's roughly 120,000 cameras feed a searchable national network used by thousands of agencies. Illustration: TechPulse USA (original).

Flock's response

A Flock spokesperson told 404 Media: "The unauthorized removal and tampering of a Flock camera is illegal." Asked specifically about the encryption key found on the device, the company said it "takes security seriously and maintains a public Vulnerability Disclosure Policy for security researchers to report potential vulnerabilities directly to us. We received no report through that process, and based on the limited information provided, we do not have enough detail to assess the claims being made. If the individuals identified legitimate vulnerabilities, we encourage them to submit their technical findings through our vulnerability reporting process so our security team can review them and take any appropriate action."

Read that carefully. It is a statement about process, not a denial. The company does not dispute that the camera was removed, that its storage was copied, or that an encryption key was recovered — it says it hasn't received a formal vulnerability report and can't assess the claims from what the journalists shared.

Analysis: why one camera in a ditch should worry every town using Flock

Zoom out, because the camera is the smallest part of this story. Flock Safety's network now spans roughly 120,000 cameras across 49 states, serving thousands of law enforcement agencies and communities, scanning an estimated 20 billion license plates every month. The cameras photograph passing vehicles and beam the images to Flock's servers, where plates are read and vehicle characteristics identified — and those timestamped records become searchable not just by the agency that owns the camera, but, in many cases, by police departments across the country through Flock's national network.

That national lookup is the selling point and the scandal. In Alpharetta, Georgia, WIRED previously found that the city's Flock records were accessible to more than 2,000 agencies — police departments, colleges, airports, and even the Office of Inspector General for the federal General Services Administration. 404 Media has documented local officers running lookups in the national network on behalf of Immigration and Customs Enforcement, including in areas that banned cooperation with immigration authorities. In Texas, one officer searched Flock cameras nationwide for a woman who had self-administered an abortion. A Washington Post investigation found 46 cases in which officers were accused of using Flock cameras for unauthorized purposes, including stalking current or former romantic partners.

The backlash is measurable. More than 50 agencies or communities have canceled, suspended, or rejected a Flock contract — or deactivated their cameras — since the beginning of 2026, according to the grassroots tracker DeFlock. Across the country, people have been arrested for allegedly tampering with or sabotaging the cameras; one police department even built a fake, 3D-printed Flock camera case to bait vandals. Flock has responded by tightening rules: it now recommends agencies retain data for seven days instead of 30, requires officers to attach a criminal case number to searches, and is rolling out automatic auditing that flags suspicious search patterns. Civil liberties groups note the ACLU recently found officers entering jokes like "hehehe" as search justifications — safeguards only work if they're enforced.

Now add the encryption-key revelation to that picture. A system that asks millions of Americans to trust it with the record of everywhere they drive has now been shown to store the key to its own encryption inside the device itself. It doesn't require a nation-state or a zero-day: it requires a ladder and physical access, and the hackers who did it intend to publish a how-to so others can repeat it. For a company that has received vast sums of taxpayer money to build what lawmakers call a national surveillance network, "the key was in the camera" is a rough sentence.

What this hack did NOT prove — an honest accounting

Hype is cheap; precision is the point of this blog. Here is what the evidence supports and what it doesn't:

Proven: A single Flock camera was physically removed, its storage copied, and an on-device encryption key recovered that unlocked a large share of its media. The device's software explicitly detects people, vehicles, plates, and bicycles. The plate detector sometimes crops non-plate graphics. Most of the most sensitive storage stayed encrypted. There is no evidence of face recognition in the camera software.

Not proven: Nobody remotely breached Flock's cloud servers or the national database. No mass leak of identifiable personal data has been demonstrated. The attack required physical possession of the hardware — you can't do this from the internet. And the full contents of every camera are not confirmed to be equally recoverable; the investigators analyzed what survived on one device.

That's the honest framing: not "Flock hacked," in the sense of millions of records exposed, but a credible, independently analyzed demonstration that Flock's on-device security model was weaker than the company said — plus a first clear window into what these cameras actually record.

What to watch next

Stegan0gram says it will publish its methodology so others can replicate the work. If that happens — and if even a fraction of copycats succeed — Flock will face a fleet-wide question: how many of its 120,000 cameras have keys sitting in unencrypted partitions, and what is the company doing about it beyond asking for vulnerability reports?

The log files themselves contain a small, grim comedy. The camera's storage struggled constantly — more than 27,000 "no space left on device" errors while trying to save full-resolution images. Every couple of minutes, a monitoring process checked that the camera was still alive and logged the message "Who's a good boy?!" — more than 12,000 of them. And when the camera rebooted, another service left a final note: "A reboot was requested! ¡Adios Amigos!"

The surveillance industry's least favorite week of the year isn't over yet. And for the thousands of towns still deciding whether these cameras belong on their streets, the encryption key is now part of the evidence.

The one-camera problem: could every Flock camera be cracked the same way?

The uncomfortable question the teardown leaves behind is the fleet-wide one. The joint investigation proved that physical possession of a single camera could expose data that was supposed to stay locked — but the investigators analyzed what survived on one device, and the full contents of every camera are not confirmed to be equally recoverable. Flock has not said whether its other roughly 120,000 cameras store their encryption keys in unencrypted partitions the same way. Until the company answers that, the stegan0gram teardown stands as a proof of concept with an unanswered follow-up: was this camera the exception, or the template?

Flock camera hack FAQ: does Flock use face recognition?

Does Flock use face recognition? No. 404 Media and WIRED found no evidence of face-recognition capabilities in the recovered camera software beyond what ships by default in Android — and that did not appear to be enabled or in active use. Plate reading and vehicle identification happen on Flock's servers, not on the device itself.

What did the camera actually detect? The on-device software explicitly detects vehicles, plates, bicycles, and people. In WIRED's test of 27,321 short video clips stored on the camera, the models found people in 11 clips — all motorcyclists, a small number the journalists attribute to the camera's position above a roadway pointed down at traffic.

Did the plate detector make mistakes? Yes. It sometimes mistook bumper stickers, dealership frames, and other graphics for license plates and cropped them out as if they were plates — in one recovered video, the detector cut out an American flag patch on a motorcyclist's saddlebag as though it were a license plate. False positives like these can surface in police searches.

Can every Flock camera be cracked the same way? That is unknown. The unencrypted partitions — including the "vendor" and "media" partitions holding the encryption key — were found on this camera, and Flock has not said whether other cameras store their keys the same way.

Sources

• 404 Media, "Hackers Stole Flock's Camera Software, Revealing How the Company Tracks Cars and People" — joint investigation with WIRED — 404media.co
• WIRED (joint investigation with 404 Media, via Distributed Denial of Secrets)
• Cybernews, "Flock camera hacked: hackers crack open spy camera secrets" — cybernews.com
• Clash Report, "Hackers Expose How Flock Mass Surveillance Works" — clashreport.com
• Le Monde, "US sees rising opposition to Flock, a network of 120,000 vehicle-identifying cameras" — lemonde.fr
• MIT Technology Review, "Flock is tightening its rules in response to a growing surveillance backlash" — technologyreview.com
• IPM News, "Flock Safety tightens safeguards as states, cities question surveillance network" — ipm.org