Flock Safety Cameras Were Exposed to the Open Internet

If you haven't already seen the news, Flock Safety security cameras were exposed to the open internet for anyone to access them. If you're not familiar with Flock, they make a range of different security camera solutions marketed for police, residential communities, and businesses. They are best known for license plate reader (LPR) cameras used by law enforcement to track vehicles. They work through a cloud hosted platform called FlockOS.

Flock Cameras Exposed to the Internet

Journalists at 404 Media and YouTube creator Benn Jordan broke the news about Flock cameras being exposed to the internet for anyone to access them. It was discovered by the use of an online tool called Shodan. Shodan is basically a search engine for internet connected devices. It's sort of the Google of IoT devices, it crawls the web discovering what devices are connected.

It was discovered that these Flock cameras were accessible without any password to their administration panel. Specifically, they were able to access Flocks Condor PTZ (pan tilt zoom) cameras. These cameras are designed to move around and track people as they walk by. The journalist from 404 Media was able to watch themselves walk down a street live on their cellphone connected to the camera. They even stated in their report that they were able to download camera footage and had access to all of the administrative settings on the cameras. In their report they claim at least 60 of these cameras were accessible to places such as street corners and parks. It's estimated that Flock has around 80,000 cameras deployed all around the country.

What is Flock Safety?

Flock was founded in 2017 by Garrett Langley, Paige Todd, and Matt Feury. By 2022 they had a valuation of $3.5 billion. They claim they are in over 5,000 communities and 49 states.

Flock's biggest claim to fame is how they work with law enforcement. They are able to track license plates and have cameras that can detect gunshots. Their system can integrate with other camera systems as well, such as Axon dashcams used in police vehicles. In October 2025 they announced a partnership with Amazons Ring cameras. Individuals with Ring cameras can have the option to share their video to public safety agencies.

A major feature of Flock is how agencies can share their data with other agencies using the Flock system. They can opt in to share data with other law enforcement agencies around their state or even nationwide. This allows agencies to search each other's Flock systems and track individuals across the country.

Flock's Response

I couldn't find a direct response about this issue. They posted a LinkedIn post with how they claim to take security seriously. If someone knows of a response to this specific incident, please let me know in the comments.

** Update: I found this article from Flock which I believe is in response to this issue. It states “The issue involved a troubleshooting-only debug interface that was temporarily accessible on the internet.”

Flock says this open debug interface didn’t allow for camera control, but in 404 Medias article they state that it allowed settings to be changed in the camera. So this makes it all about as clear as mud as to what was accessible and what wasn’t.

Similar Incidents with Cloud Connected Security Camera Companies

This isn't the first time Flock has been in the news. Leaked training documents revealed that their AI assisted cameras may actually be sending data to workers overseas for analysis. This brought into question who Flock is giving access to their footage of American citizens. It's not uncommon for AI companies to use overseas workers to work on training data, but due to the nature of Flocks business, this raised concerns.

Flock isn't the only cloud connected camera system to be in the hot seat. Back in 2021, an AI video security camera manufacturer Verkada, found themselves in the news. Hackers were able to access its cloud video platform with access to over 150,000 cameras. The hackers were able to access video footage from jails, healthcare facilities, and even companies such as Tesla and Cloudflare. The hackers claimed they discovered credentials with administrator rights on the internet. According to a report by IPVM, Verkada gives many of its employee's administrator access to its system.

This isn't the first time Verkada was in the news either. Another report by IPVM outlines a work culture of discrimination and sexism at the company.

Conclusion

With the advancements in AI and cloud platforms it's hard not to want to use these kinds of systems. As someone who works in this industry, it seems to be the direction the industry is going in. More companies are offering cloud connected security cameras with built in AI features. These style of systems make installing and managing video security systems much easier for installation companies and the customers. I have even seen firsthand a law enforcement agency's Flock system they use that is integrated into various other security camera systems around the community. I have also installed Verkada equipment. It's hard for me to say people shouldn't use these systems as someone who sells them. I do however agree with the concerns of data privacy and safety. These companies need to be more transparent and forthcoming with how they handle customer data and who has access to it. Audits need to be completed by third party services to ensure that companies are upholding the standards that customers expect.

As a citizen in the community, I don't agree with Flock's business model. Giving law enforcement agencies unrestricted access to anyone's movement around the country feels like a violation of our privacy. Abuse of the system has already been documented. As these systems expand and become cheaper to deploy, claims of abuse are going to rise.