What Flock Safety Won't Tell You

Flock's Nova platform is a commercial subscription product that aggregates OSINT, public records, and license plate reader data and sells access to law enforcement agencies. Flock's own case study with Porterville PD explicitly markets "Flock Nova OSINT" as a paid product. The company's "Correcting the Record" blog post confirms Nova supplies "public records information, Open-Source Intelligence (OSINT), and License Plate Reader (LPR) data."

Flock's privacy page claims it "does not sell data," but this appears narrowly framed around customer-owned LPR data. Nova is unambiguously a paid data product aggregating intelligence from multiple sources for commercial sale. Industry analysts at Sacra estimate Flock hit $285 million in ARR at end of 2024, charging $2,400 annually per camera.

While Flock's ALPR cameras capture license plates rather than names, the Nova platform explicitly collects and surfaces extensive PII — names, home addresses, phone numbers, social media profiles, and per independent code analysis, SSNs and credit card numbers.

Leaked internal presentations showed an employee stating officers would "be able to access data and jump from LPR to person." Flock's own Q2 2025 product blog describes Nova "surfacing an address from a food delivery order" and "linking a VOIP number to a suspect's Cash App profile and photo."

Flock's privacy page states its ALPR system does not collect PII — but this is narrowly limited to the camera hardware and ignores Nova, which processes all of these data types by design.

In December 2025, at least 67 Flock Condor PTZ cameras were discovered livestreaming to the open internet with zero authentication — no password, no login, no encryption. Anyone could watch live feeds, download 30 days of archived footage, and access admin panels. A 404 Media reporter drove to Bakersfield, California and verified by walking in front of two cameras while watching himself on the livestream from his phone.

Separately, Senator Ron Wyden and Rep. Krishnamoorthi wrote to the FTC citing Hudson Rock data showing passwords for at least 35 Flock customer accounts were compromised by infostealer malware and found on Russian cybercrime forums. They called Flock's practices "negligent" and confirmed approximately 3% of Flock law enforcement customers lacked multi-factor authentication.

Independent security researcher Jon Gaines (GainSec) published a peer-reviewed white paper documenting 51 distinct security findings across Flock's product line, resulting in 22 CVE assignments in the MITRE/NVD databases (with 8 more pending). Vulnerabilities include a hardcoded Java Keystore password rated CVSS 9.8 Critical, unauthenticated admin API endpoints enabling remote code execution, disabled Secure Boot, and cleartext API keys embedded in production firmware.

Physical compromise is trivial: pressing a button sequence on the camera's back creates a wireless access point, enabling full device control. A USB "rubber ducky" device plugged into the exposed USB-C port achieves complete compromise in approximately 5 seconds. In a demonstration, Gaines planted fabricated images on a live device.

Separately, a default ArcGIS API key was found embedded in 53 JavaScript bundles across Flock's frontend, granting access to their mapping environment with roughly 1 million API credits.

In May 2025, 404 Media reported that Flock's internal discussions explicitly mentioned using hacked ParkMobile data from a 2021 breach. An employee Slack message stated: "I was pretty horrified to hear we use stolen data in our system." Flock publicly announced it would not include dark web data.

Seven months later, an independent code analysis of Nova's frontend found the feature was still built: a "DarkData" search type as a primary data source, an API endpoint called dark/getExtDarkData, a permission flag hasDarkDataAccess, and a polished UI with tabs for SSN, email, IP address, crypto wallet, credit card, and Discord/Telegram handles. API response metadata included fields for "crawl date," "leak name," and "download location" — columns typical of breach data repositories.

Caveat: The presence of frontend code does not definitively prove the feature is active in production — it could be disabled server-side. However, the specificity and polish strongly suggest this went beyond experimental code.

Flock's own audit systems failed to flag any of the following documented abuses — every case was discovered through public records requests or outside investigations, not internal auditing. EFF's analysis found the audit log system "only tracks inputs, not contextual legitimacy" and that keyword filters are "easily defeated by entering vague reasons."

Senator Wyden's October 2025 investigation revealed that ICE's investigative arm performed approximately 175 searches, CBP performed roughly 200 searches, and the Secret Service and NCIS also had access — all through a "pilot" program Flock never disclosed to its local customers. Wyden wrote: "I now believe that abuses of your product are not only likely but inevitable."

404 Media reported that CBP regularly searched 80,000+ Flock cameras nationwide. One police department said it "did not know or understand that it was sharing data with CBP." Requests were simply batch-approved like any other agency.

The scale is staggering: Bridgewater, Virginia — population 6,600 — has five Flock cameras. Over 12 months, outside agencies accessed its data 6.9 million times. Over 4,600 agencies queried the data. Roughly 9 in 10 searches came from out-of-state law enforcement.

ALPR misreads have produced documented, serious harm — including families held at gunpoint and multi-million-dollar settlements.

Flock requires all security testing be conducted under a Master Services Agreement and NDA, effectively preventing independent researchers from publicly disclosing vulnerabilities. Security researcher Jon Gaines explicitly stated he refuses to accept bounties because they are "more and more commonly tied to NDAs."

Flock threatened the creator of HaveIBeenFlocked.com — a site that simply collated public records about Flock searches — claiming it posed "an immediate threat to public safety."

Nine Denver City Council members wrote in October 2025: "We have serious concerns about Flock Group Inc.'s ethics, transparency, and credibility. The company's CEO has made multiple false statements both publicly and directly to council members."

In Sedona, Arizona, Flock told the city council on August 13, 2025 that "there's no data sharing going on." Six days later, on August 19, Flock admitted data sharing had in fact been occurring. Vice Mayor Holli Ploog stated on the record: "A company that tells us on August 13 that 'There's no data sharing going on, I swear,' and on August 19 admits that 'it's been going on,' is not a company that we can do business with."

The council voted unanimously to terminate. Mayor Jablow reversed his prior position, stating he had "since learned more about the overwhelming behind-the-scenes data sharing that was not disclosed to the council."

As of February 2026, NPR confirmed that at least 30 localities have deactivated cameras or cancelled Flock contracts. EFF counted 23 jurisdictions by December 2025. The pace is accelerating — many cancellations occurred in late 2025 and early 2026.

Primary reasons include: undisclosed federal agency access (especially ICE and CBP), privacy and mass surveillance concerns, Flock CEO Garrett Langley's rhetoric calling critics "terroristic," unauthorized camera installations, and state sanctuary law conflicts.

Verified cancellations include: Flagstaff AZ (unanimous), Sedona AZ (unanimous), South Tucson AZ (February 2026), Cambridge MA (citing Flock's "material breach of trust"), Austin TX, Hays County TX, San Marcos TX, Eugene OR, Bend OR, Mountain View CA, Santa Cruz CA, Oak Park IL, Evanston IL, Olympia WA, Redmond WA, Lynnwood WA, Staunton VA, Windsor CT, and others.

The pattern is clear: when citizens actually get a voice on this technology, they reject it.