1.6 Million Images, 50,000 Vehicles: What Hackers Found Inside a Flock Camera

According to a joint investigation described by WIRED and 404 Media, a hacker collective called stegan0gram physically removed a Flock Safety camera, copied its storage, and recovered an encryption key stored on the device itself. That key allowed access to footage and data associated with thousands of vehicle detections. (Per Wired Story)

The recovered logs reportedly showed that a single camera:

• Recorded roughly 50,000 vehicles over about 21 days.
• Generated approximately 1.6 million images.
• Captured multiple images per vehicle, averaging about 28 images per passing vehicle.

The finding appears to challenge previous assurances that footage would not remain accessible on the device for long periods. The researchers claim they recovered weeks of logs, images, videos, software, and configuration data from the camera. At the same time, the reports note that some of the most sensitive storage areas remained encrypted and inaccessible.

From a security perspective, the most concerning allegation is not merely that data existed on the camera, but that the decryption key was allegedly stored on the device and could be extracted by someone with physical access. If accurate, that weakens the protection provided by encryption because an attacker who obtains both the encrypted data and the key can potentially recover the contents.

A particularly notable claim is that the camera software does more than detect vehicles and license plates. Analysis of the recovered software indicated that it could also detect people and bicycles, recording the location of detected individuals and assigning confidence scores.

Researchers reportedly ran the camera's own computer-vision models against 27,321 stored clips and found people detected in 11 of them, all involving motorcycle riders.

This matters because public discussions of automated license plate reader systems often focus on vehicle tracking. Evidence that the software also performs person detection may expand privacy concerns, even if that capability was intended for operational or analytic purposes.

Flock Safety stated that the camera's removal and tampering were illegal and said it lacked sufficient detail to fully assess the researchers' claims. The company pointed to its vulnerability-disclosure process rather than directly validating the reported findings.