Emerging Threats

Florida Uncovers Rogue Flock Surveillance Cameras

Analyst 207||Source: Schneier
Multiple surveillance cameras mounted on utility poles and buildings along a St. Lucie County street.

St. Lucie County in Florida discovered a dozen Flock cameras whose ownership it can’t identify, and that the county government had not permitted.

St. Lucie County’s unexpected find

Local officials in St. Lucie County encountered a cluster of surveillance devices—described in the source as "a dozen Flock cameras"—and concluded two concrete facts: the county government had not issued permits for their installation, and county staff could not determine who owned them. The discovery is framed in the source as a straightforward administrative and accountability problem: equipment present in public spaces without a clear, recorded owner or an authorization trail.

Unknown ownership and missing permits: immediate implications

The absence of identified ownership and permits creates several immediate, factual complications. Permits are the mechanism local governments use to approve camera siting and to attach conditions or oversight; without a permitting record, the county lacks the usual procedural controls. Without an identified owner, the county cannot serve notice, require removal, or assess whether the installations comply with any existing local ordinance. The source presents these as the plain facts driving concern in St. Lucie County.

Historical parallel: decade-old StingRay devices in Washington, DC

The source explicitly connects this episode to an earlier, decade-old situation involving StingRay cell‑phone surveillance devices in Washington, DC, in which the operators were also unknown. That parallel is raised as context inside the source itself: both episodes involve surveillance equipment appearing in public spaces without clear attribution of who deployed or operated them. The source notes that, for the StingRay case, the operators remained unidentified at the time.

Install versus compromise: the Tehran example and adversary choices

The source ventures a strategic comparison about how an adversary might choose to gain surveillance access. It reports the author's reasoning that, in the StingRay episode, the devices "were operated by foreign actors," while the Flock cameras in Florida "are more likely some local government entity that didn’t bother getting approval." The source also states an operational preference attributed to a hypothetical foreign actor: "Were I a foreign actor, I would rather hack the existing Flock network—like Israel did with Tehran’s surveillance cameras—than risk installing my own." That sentence, as presented in the source, frames a trade‑off between a covert compromise of an existing system and overtly installing new hardware that can be discovered and traced.

What this means for St. Lucie County, local governments, and foreign actors

  • St. Lucie County government: The county now faces the practical task described in the source—identifying who installed and currently owns the dozen cameras, and determining whether removal, retroactive permitting, or enforcement is appropriate given the lack of county permits.
  • Local government entities: The source raises the possibility (expressed as the author's judgment) that a local government actor might have installed cameras without following permit procedures; that possibility focuses attention on internal compliance and the need for clear chains of custody when public‑space surveillance is deployed.
  • Foreign actors: The source suggests—again as the author's conjecture—that foreign actors would prefer to compromise an existing surveillance network rather than risk installing hardware that could be discovered, citing a purported precedent in which "Israel did [hack] Tehran’s surveillance cameras" as the model for that approach.

The episode in St. Lucie County, as presented in the source, is simple in its facts yet large in its implications: a dozen unpermitted cameras, unknown ownership, and a set of strategic questions about who deploys surveillance and how. The source underlines one last, plain observation: once surveillance infrastructure becomes normalized in public spaces, "both friends and foes will take advantage of it." That is the source's stated conclusion and the factual hinge on which the local discovery turns into a broader concern about accountability, control, and the methods adversaries might choose.

https://www.schneier.com/blog/archives/2026/10/unidentified-flock-cameras-in-florida.html

Emerging ThreatsPublic SafetyFloridaLocal GovernmentFlockSurveillance CamerasUnidentified DevicesRogue SurveillanceUnpermitted EquipmentSt. Lucie County
Related Intelligence

Continue Reading

Softly lit office desk with blurred computer screens, papers, folders, and office supplies.

Frontline Education Breach Compromises Employee Data

Frontline Education recently discovered a vulnerability in a third-party software product that led to a data breach, compromising employee information. The company quickly sprang into action, investigating and remediating the issue with the help of a cybersecurity expert.

Analyst 207
Server room with rows of computer equipment and network gear in a neutral, institutional space.

Warlock Ransomware Exploits SharePoint in Global Attacks

In a lightning-fast attack, the Warlock ransomware group exploited Microsoft SharePoint vulnerabilities to infect at least 40 hosts in just two hours, disabling endpoint protection and unleashing widespread chaos. This China-linked gang has been using a chain of zero-day exploits, including ToolShell, to gain initial access to on-premises SharePoint deployments.

Analyst 207
Person sitting at desk, looking concerned at laptop screen in a office setting.

China-linked hackers impersonate US officials to target AI experts

Phishing campaigns impersonating US officials are targeting top AI policy experts, making it tough for them to know if they're being scammed. Even prominent figures like Lynne Parker have had their names used to trick others, highlighting the challenge of stopping these attacks.

Analyst 207
Laptop on a desk in a neutral Asian-style building setting.

China-Nexus Espionage Campaign Exploits Outlook, OneDrive

A sneaky espionage campaign, tracked as UAT-11587, has been exploiting Microsoft Outlook and OneDrive to secretly control its targets, with a reach that spans 16 entities across eight Asian countries. The sophisticated attack, first detected in September 2025, has been targeting academic, think-tank, and civil-society organizations, with evidence of continued activity through May 2026.

Analyst 207