Hackers Reverse-Engineer Flock Cameras, Expose Surveillance Capabilities

More than a million images, captured over several weeks, were recovered from a seized Flock automatic license plate reader, according to a joint analysis of the device’s files.

Hackers captured a Flock camera and recovered its data

Hackers obtained a Flock camera and exposed portions of the device’s software and logs. While the analysis found that some of the ALPR’s most sensitive storage remained encrypted and inaccessible, investigators were able to examine unencrypted partitions and recovered logs covering several weeks of operation. The recovered material supplied a rare look at what the device was detecting and recording in the field.

Software explicitly detects people as well as vehicles, license plates, and bicycles

The joint analysis shows that the camera’s computer-vision software was not limited to plates and cars. It “explicitly detects people as well as vehicles, license plates, and bicycles,” the recovered data indicates. That is a concrete statement about the detection classes the device was configured to surface from imagery, not a speculation about downstream use.

High image volume and surprising levels of visual detail

The device can generate dozens of images of a single passing vehicle, and the recovered logs show the camera produced more than a million images across several weeks. The computer-vision pipeline sometimes isolated small visual elements beyond broad object classes — bumper stickers and other graphics were singled out by the software. In one documented instance the analysis identified an American flag patch on a motorcyclist’s saddlebag.

Encryption failure: an unencrypted partition contained the key

Although some storage remained encrypted and inaccessible, the analysis found a critical operational failure: one of the unencrypted partitions on the device contained the key for an encrypted partition. In plain terms, the key needed to unlock encrypted storage was itself stored where it could be read without breaking encryption. The recovered report characterizes that arrangement as a severe security engineering mistake.

What this means for technologists, procurement leaders, and the public

• Technologists and security teams: The finding that an unencrypted partition contained an encryption key is a concrete configuration and implementation failure to investigate and remediate. Teams responsible for deployed ALPR devices will likely examine partitioning, key storage, and whether camera firmware or on-device software isolates sensitive keys from readable files.
• Procurement leaders and agencies buying ALPR systems: The logs show a single device can produce dozens of images per passing vehicle and more than a million images over weeks; purchasers should weigh that data volume and the device’s capability to detect people, bicycles, and small graphics when defining requirements and privacy controls.
• The public and people recorded in public: The recovered material demonstrates that an ALPR device can capture not only license plates and vehicles but also people and fine-grained graphics such as bumper stickers or a flag patch, underscoring how much visual detail such systems can surface from routine traffic monitoring.

The recovered Flock camera presents a compact case study of two linked truths: modern ALPR-equipped cameras are capable of far more than simple plate reads, and implementation mistakes can undo cryptographic protections. The device’s software explicitly labelled people, vehicles, plates, and bicycles; it collected more than a million image records in weeks; and an unencrypted partition held the key for encrypted storage. Those are the facts the joint recovery produced — concrete signals that both the functional scope and the operational hygiene of such devices matter in equal measure.

https://www.schneier.com/blog/archives/2026/09/reverse_engineering-flock-cameras.html