In December 2025, the musician and YouTuber Benn Jordan found at least 70 Flock number-plate cameras exposed to the open internet, viewable through an ordinary search engine with no password at all. Some of what he could see were Condor cameras, a model built to follow people rather than cars. Flock Safety, the company behind them, says its network is protected. Jordan’s find is one of several signs that protection has gaps.
A Flock camera is an automatic number-plate reader: a small, solar- or battery-powered unit that Flock Safety mounts on a roadside pole, photographing the back of each vehicle that passes underneath. More than 100,000 of these readers now operate across the United States, and most carry the Flock name. The company gives different figures to different outlets. It told the BBC it works with more than 7,000 communities and runs roughly 100,000 cameras. It told ZDNET it has more than 12,000 customers, against outside estimates closer to 90,000 cameras. Flock does not publish an exact count of either.
Garrett Langley, Matt Feury, and Paige Todd started the company in Atlanta in 2017. It has since raised $275 million, at a $7.5 billion valuation.
more
How the camera works
Flock’s Falcon roadside cameras do not clock a car’s speed. Motion triggers the lens, which fires off between six and twelve still images of the vehicle. Software then runs automated plate recognition and machine learning over those images, logging a car’s colour and body type, its make and model, and any damage, aftermarket wheels, or bumper stickers it carries. The record also notes which direction the car was travelling. Trevor Horwitz, chief information security officer at the cybersecurity firm TrustNet, told ZDNET that the system turns those “distinguishing features” into something searchable, plate or no plate.
Everything then travels by cellular link to Flock’s cloud, where officers search it through the company’s dashboard and receive an alert if a scan matches a stolen vehicle, a missing person, or another listed record.
What one scan can’t tell you, and what a network can
Catherine Crump directs the Samuelson Law, Technology, and Public Policy Clinic at UC Berkeley. She told ZDNET that a single scan shows little more than a passer-by could see with their own eyes. A network of scans strung together, she said, “will become a comprehensive record of someone’s movements.”
That is the objection critics keep returning to. One camera on one road logs one moment. Thousands of cameras, searched as a single network, can show where a car goes every day, not just once.
How far the network reaches
A department rarely searches only its own cameras. Houston’s Metro Transit Authority owns 35 Flock units, yet has access to roughly 20,000 devices across the wider network, some as far off as Albany County, New York. The reach keeps expanding: in the Cypress-Fairbanks school district in Texas, a typical plate search covered about 270 camera networks in April 2024. A year on, that had grown to around 500. By April 2026, a fifth of the district’s searches reached more than 6,000 networks.
The same reach has served federal immigration enforcement. Flock has no direct contract with US Immigration and Customs Enforcement, but the agency has often gained access through data-sharing arrangements with local police. In Denver, the ACLU of Colorado obtained logs showing local police had run more than 1,400 searches on ICE’s behalf. The ACLU of Massachusetts has separately pointed out that an officer in Texas can search footage from a Massachusetts camera, because the network crosses state lines by design.
Where officers have crossed a line
Officers have also turned the system on people close to them. A Kentucky police officer was charged after using Flock to track his ex-girlfriend, who had a protection order against him, more than 2,000 times. Flock’s own audit tool, which flags suspicious searches and was newly mandatory, is what caught him. In Johnson County, Texas, a detective searched more than 80,000 images without a warrant while looking for a woman suspected of having had an abortion.
The cameras nobody secured
Jordan had already exposed other holes in Flock’s defences a month earlier. Engadget reports that he and a second researcher, John Gaines, found a way in with physical access to a unit. A button press and a Wi-Fi connection were enough to gain root-level control and load software of their own. Exposed USB ports on some cameras made that easier still. Flock’s public response to the researchers, Engadget reported, was to describe them as “activist groups who want to defund the police.”
The camera that hackers took apart
In September 2026, WIRED and 404 Media reported that a hacker collective calling itself stegan0gram had pulled down a Flock camera. The camera had hung above a roadway. The group copied its storage and found an encryption key kept on the device itself. That key unlocked videos of thousands of vehicle detections, though much of the most sensitive storage stayed encrypted.
The recovered logs covered about 21 days of activity across several periods. A typical passing vehicle generated about 28 images, and the camera produced more than a million images in all. Its software detects people as well as vehicles, plates, and bicycles.
More than a plate reader
Flock maintains that none of its cameras use facial recognition, and both the BBC and ZDNET confirm that is the company’s consistent line. The claim is narrower than it sounds. ZDNET reports that Flock also sells a pan-tilt-zoom camera called Condor, built to detect and follow people. The company has admitted that its “Guardian Mode” feature can be set up to do exactly that: track someone, zoom in, and record them in high resolution. The broadcaster InvestigateTV filmed a Condor camera panning to keep one of its own reporters in frame.
Facial recognition has not left Flock’s world, only Flock’s own product line. The BBC found that the Harris County Sheriff’s Office, which covers Houston, separately uses Clearview AI, a facial-recognition system built on a database of more than 70 billion images scraped largely from social media. European regulators have fined Clearview repeatedly, including a £7.5 million penalty from the UK’s Information Commissioner’s Office. Harris County’s contract for the tool runs to March 2027, and the sheriff’s office did not respond to the BBC’s questions about it.
The vandals, and the towns giving up on Flock
Not everyone waits for an audit or a court case. In Houston’s Old Braeswood neighbourhood, someone cut down four Flock cameras overnight in late July. The poles were severed, and the units and their solar panels ended up on the ground beside their own “24/7 video recording” signs. The BBC reports similar attacks in Minnesota, California, and Georgia.
Other towns have gone the legal route instead. In Saranac Lake, New York, resident protests pushed the village board to cancel its Flock contract, and the cameras came down without anyone touching a pole.
How much of this is actually about crime
Police departments credit the network with real results. Engadget reports it has helped solve at least one murder and break up a smash-and-grab robbery ring. But a review of agency data by the Electronic Frontier Foundation tells a different story. Looking at roughly 2.5 billion scans logged by 173 police agencies in 23 US states over 2016 and 2017, it found that only about 0.5% matched anything on a watch list.
That figure is what the argument over Flock is really about. The overwhelming majority of what a camera records is the ordinary movement of people nobody is looking for, which is exactly what troubles Christopher Rivera of the Texas Civil Rights Project. Cameras, he told the BBC, risk becoming tools to trace routes to work and school, and “where we worship.”
In July 2026, Representative Scott Perry said his amendment to restrict the cameras had failed in committee. He said that would not be the end of it.
