Flock's roadside camera kept its own decryption key on an unencrypted partition
A hacking group took a camera down from above a roadway and found the key to its media store sitting in plaintext on the same flash, in hardware whose business case is being cheap enough to leave unattended.
The Engineer · Build desk
What happened
- The hacking group stegan0gram took a Flock camera down from above a roadway and found, on an unencrypted partition labeled media, the key that unlocked the storage holding its captured video and images.
- The camera was still holding 27,321 video clips when it came down, MP4 files at 1024 by 768 running about a second or two each.
- Flock's public FAQ says its license plate readers generally capture six to 12 images of a vehicle per session, with engineers able to adjust the setting for traffic and location.
- A Flock spokesperson told WIRED and 404 Media that removing and tampering with a camera is illegal, and the company pointed to its vulnerability disclosure policy when asked about the key.
Why it matters
- What it limits constraint Flock's end-to-end encryption claim holds only while the camera stays bolted to the pole; once the hardware is in someone else's hands, the stored evidence is readable.
- What it costs cost Anchoring the media key in hardware an attacker cannot read out adds a part and a provisioning step to every unit in a fleet whose pitch was undercutting $25,000 readers, and customers renewing contracts pay for it.
- Who has to decide decision Anyone buying unattended sensors now has a specific question for review: is the key unwrapped by a secure element, or fetched from a file on the same flash?
- Who's exposed exposure Every pole-mounted unit is a plausible target for the same procedure, and the material sitting behind that key is imagery of drivers and riders who were never suspects.
Next story · Product · Sep 17
Flock's on-camera software classifies people, bicycles and bumper stickersConfirmed3 publishers
Encryption at rest has one requirement: the key must not sit where the ciphertext sits. An unattended camera makes that awkward. The device has to come back after a power cut with nobody there to type a passphrase, so something on the board must unwrap the media key by itself. When that something is a plaintext file on a mountable partition, the attack is a mount command. The most sensitive storage on this device did stay encrypted and inaccessible [4].
Flock says images and metadata are encrypted throughout their lifecycle, starting on the device and continuing through transmission and cloud storage [25]. WIRED and 404 Media wrote that the claim can hold at the protocol level and still offer little protection when a key is recoverable from the same physical hardware, since an attacker does not need to defeat the algorithm if the deployed device supplies the key [10]. Flock has also said that flaws a security researcher noted still require physical access to exploit, and that images are only briefly retained on the device before being forwarded to the cloud [26]. The recovered clip store works out to roughly 1,300 clips for every day of the surviving log window [23].
A typical passing vehicle produced about 28 images on this camera, and some produced more than 100 [11]. That is about 2.3 times the top of the range Flock publishes [24]. The log totals sit in the same place: 1.6 million images over about 50,200 detections is roughly 32 images per detection [21], or about 76,000 images a day [22]. For those rates to describe a different pole, that pole would need this camera's settings and something close to its traffic volume. WIRED and 404 Media said the findings establish how this particular device operated, not every camera model and configuration in Flock's network [13].
The joint WIRED and 404 Media investigation, published by 404 Media on September 16th, describes an edge that is narrower than the system it feeds [3]. Plate text and vehicle color, make and model are resolved on Flock's servers; the camera detects people, vehicles, bicycles and plate-like shapes, crops them, and uploads the crops alongside the original images [7]. The detector is loose about what counts as a plate. It flagged bumper stickers and dealership frames as candidates, and in one case cropped an American flag patch on a motorcyclist's saddlebag [15]. People appeared in 11 clips, all motorcycle riders, which the reporters attributed to the camera's position above a road [8]. They found no active facial recognition beyond the capabilities Android includes by default [9].
The hardware lineage explains the constraint. Langley founded Flock Safety in 2017 with Matt Feury and Paige Todd after break-ins in his Atlanta neighborhood left police without useful evidence [16]. Todd recalled in a Georgia Tech profile that the first version was effectively an Android phone in a waterproof box [17]. Cheap components, cellular connectivity and machine learning let the company replace automatic license plate readers that could cost about $25,000 per camera [18].
Several police officers have been arrested for using Flock to stalk romantic partners, and some towns and cities have ended their contracts [20]. This recovery began with someone taking a camera off its mount, and not everyone opposed to the cameras endorses that. "I think that type of vigilantism will only crystallize the police and the state at large in their belief that this tool is necessary," Noel Pichardo, a former Pawtucket, Rhode Island police officer, told 404 Media [19].
What to watch
- Whether Flock ships a firmware change that moves key material off a readable partition, and whether it says so publicly.
- Whether Flock confirms the compromised camera's image-capture settings were standard, or revises the six-to-12 figure in its FAQ.
- Whether any agency renewal starts specifying hardware-anchored key custody after the contract cancellations already reported.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence66
- Adoption45
- Hype gap+10
- Incentives62
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The hacker collective stegan0gram said it accessed the camera's Android system and found unencrypted partitions identified as "vendor" and "media"; the media partition held a key that unlocked another storage area containing much of the device's captured video and imagery.
- [2]
Hackers physically removed a Flock Safety camera from above a roadway and copied much of its internal storage.
- [3]
The hardware compromise was detailed in a joint WIRED and 404 Media investigation, with 404 Media's account published September 16th.
- [4]
WIRED and 404 Media reported that some of the camera's most sensitive storage remained encrypted and inaccessible.
- [5]
Logs covering roughly 21 days showed about 50,200 vehicle detections and 1.6 million images.
- [6]
There were 27,321 video clips saved on the device, MP4 files with a 1024 x 768 resolution lasting about a second or two.
- [7]
Reading license plates and describing vehicle characteristics such as color, make and model are done on Flock's servers; the cameras detect people, vehicles, bicycles and plate-like shapes, which they crop and send to company servers alongside the original images.
- [8]
The computer-vision models detected people in 11 clips, all involving motorcycle riders; the low count reflected the camera's position above a road, where pedestrians rarely entered its field of view.
- [9]
WIRED and 404 Media found no active facial-recognition system beyond capabilities included by default in Android.
- [10]
Flock's encryption claim can remain accurate at the protocol level while offering limited protection when a decryption key is recoverable from the same physical hardware; an attacker does not need to defeat the encryption algorithm if the deployed device supplies the key.
- [11]
A typical passing vehicle generated approximately 28 images, while some produced more than 100.
- [12]
Flock's frequently asked questions say its license plate readers generally capture six to 12 images of a vehicle per session, with engineers able to adjust the settings for traffic and location.
- [13]
The findings establish the operation of this particular device rather than every camera model and configuration in Flock's network.
- [14]
A Flock spokesperson told WIRED and 404 Media that removing and tampering with a camera is illegal; asked about the recovered key, Flock pointed to its public vulnerability disclosure policy and said security researchers should report potential flaws directly.
- [15]
The software treated some bumper stickers, dealership frames and other graphics as possible plates; in one case it cropped an American flag patch on a motorcyclist's saddlebag.
- [16]
Langley founded Flock Safety in 2017 with Matt Feury and Paige Todd after break-ins in his Atlanta neighborhood left police without useful evidence.
- [17]
The founders' first version was effectively an Android phone in a waterproof box, Todd recalled in a Georgia Tech profile.
- [18]
Cheap components, cellular connectivity and machine learning helped Flock replace automatic license plate readers that could cost about $25,000 per camera.
- [19]
"I think that type of vigilantism will only crystallize the police and the state at large in their belief that this tool is necessary," former Pawtucket, Rhode Island, police officer Noel Pichardo told 404 Media.
- [20]
Several police officers have been arrested for using Flock to stalk romantic partners, and some towns and cities have ended their contracts with the company.
- [21]
The recovered logs work out to roughly 32 images per vehicle detection.
- [22]
The camera captured about 76,000 images per day over the recovered log window.
- [23]
The clips held on the device work out to about 1,300 per day of the recovered 21-day log window.
- [24]
An average of about 28 images per vehicle is roughly 2.3 times the top of Flock's published six-to-12 range.
- [25]
Flock says images and metadata are encrypted throughout their lifecycle, beginning on the device and continuing through transmission and cloud storage.
- [26]
Flock said that physical access is still required to exploit flaws noted by a security researcher, and that images are only briefly retained on the device before they are forwarded to the cloud.
Sources
2 independent publishers whose own reporting we read for this story.
- runtimewire.comHackers pulled down a Flock camera and found the encryption key inside
1 article · September 17, 2026
- tomshardware.comHackers find encryption keys stored on stolen Flock camera despite company's denials — group extracts more than 27,000 clips, 1.6 million images captured in a span of 21 days from the device
1 article · September 17, 2026
Topics and entities
Topics
- Edge AI
- Automated License Plate Recognition
- Police Surveillance Technology
- Physical Device Security