“It allows us to move faster when researchers report findings, eliminate confusion from duplicate or conflicting vulnerability entries and give our customers a single, trusted source for security information about our products,” Chris Castaldo, chief information security officer at Flock, said in a statement.
Flock's new role as a CVE Numbering Authority
Flock, a manufacturer of automated license plate readers (ALPRs) and AI-powered cameras, has joined the global roster of more than 550 CVE Numbering Authorities (CNAs). As a CNA the company can assign CVE identifiers to vulnerabilities in its own products and publish severity assessments and mitigation details directly. Flock said the change will let it "move faster" when researchers report findings and provide customers a single source for security information.
Flock's products and the controversies that shadow them
Flock supplies surveillance systems used by law enforcement, including ALPRs and a gunshot detection system. The company’s business has attracted substantial public and legal scrutiny over privacy concerns, and multiple reports have documented police abusing the technology. Those controversies have already affected Flock’s credibility with some observers and, according to security commentators, may influence how researchers treat the company now that it can issue CVEs for its own products.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildHow the CNA model can both help and complicate vulnerability tracking
The development underscores limits in the CVE program, including debate over what qualifies as a vulnerability and who should judge impact. Experts quoted in reporting warn that vendor CNAs are “essentially grading their own homework.” Katie Moussouris, founder and CEO at Luta Security, said the proper test for Flock’s CNA status is whether its records let cities, police departments, and the public "track specific risks by product version, the nature of the vulnerability, and ideally how to mitigate or fix it."
Moussouris noted vendors can be appropriate CNAs because they know their code and can tie a record to affected versions and fixes, but added that conflicts of interest arise when a vendor “lacks the organizational and technical maturity to correctly assess the flaws and their impact.” The report also observes that vendor CNAs often write the vulnerability description and may set the severity score, opening opportunities to understate or mischaracterize issues, whether by ignorance or design.
Flock’s disclosure policy, the National Vulnerability Database, and researcher pushback
Flock published a vulnerability disclosure policy in August and recently created a security advisories page where it says it will publish newly discovered and confirmed vulnerabilities going forward. The company declined requests for further comment and referred reporters back to the blog post announcing the changes.
The disclosure policy explicitly forbids testing against live customer deployments, accessing law enforcement or investigative data, physical attacks, denial-of-service testing, and social engineering. Flock does not operate a paid bug bounty program.
Researchers have already performed technical teardowns of Flock products and continue to scrutinize the company. Zach Edwards, a security and privacy researcher, said he expects some activists and researchers to keep disclosing Flock vulnerabilities without coordinating with the company. He was skeptical of Flock’s CNA role and warned — bluntly — that based on Flock’s recent history “they will probably screw it up in some epic way that somehow unites people across the United States to demand CVE issuing reform.”
Last year, researchers reported multiple defects in Flock’s license-plate reader and gunshot detection system; Flock submitted those defects for inclusion in the National Vulnerability Database but characterized them as not material because they required physical access to the device. As Moussouris pointed out, many of Flock’s cameras sit on poles in public streets — a fact she used to question the significance of that threshold.
What this means for cities, security researchers, and the public
- Cities and police departments: Procurement and operations teams will now receive CVE identifiers issued by the product vendor itself. That may streamline patch tracking if Flock issues complete, versioned records — or it may complicate risk assessment if entries omit sufficient detail or downplay severity.
- Security researchers and activists: Some researchers are likely to coordinate disclosures with Flock; others, especially activists who have already done technical teardowns, may continue publishing independently. The company’s ban on testing deployed systems and its lack of a bounty program could push researchers toward public disclosure instead of coordinated reporting.
- The general public: People and privacy advocates concerned about surveillance and law-enforcement misuse will be watching whether Flock’s advisories provide enough transparency for communities to track how deployed devices are affected by vulnerabilities and how they are remediated.
Flock’s elevation to CNA status shifts responsibility for labeling and describing flaws closer to the vendor. Whether that leads to better, faster remediation or to underplayed risk depends, in the words of a leading researcher, on whether Flock “can be trusted to maintain accurate records.” Katie Moussouris offered a practical yardstick: the measure will be whether records give cities, police departments, and the public enough detail and accuracy to trace specific risks and mitigations. For now, Flock has authority — and a short runway to prove it will use that authority transparently.
