In november 2025, security researcher joshua michael found that flock's servers were exposing an access token available to anyone. He used it to pull a full inventory of device locations, reported it to flock, and published the data in december.
335,701 flock-associated devices. 170,000+ cameras. 130,000+ secondary hardware units. 27,000 acoustic detection systems. 49 states.
flock publicly claims roughly half that number.
Flock's response: fix the token quietly, tell customers michael was a "malicious actor," notify law enforcement, and send a cease-and-desist. their own customer email acknowledged they found no indication of unauthorized access when they closed the issue which michael says is exactly the problem. someone could have taken everything and they'd never know.
then in september, a brand-protection firm filed a trademark complaint on flock's behalf not on accuracy grounds (they never disputed the data), but arguing the site could cause "customer confusion."
the site came down.
proton stepped in, hosted the map on swiss servers, and published a statement from their head of legal: "this is an attempt to suppress information, not to prevent consumer confusion."
the map is live at
proton.me/flock-camera-map. enter your zip code. see what's watching your street.
flock cameras log 20 billion vehicle sightings a month. a washington post investigation found 50 officers accused of misusing license plate readers, 46 of those cases involved flock. the CEO, when asked how many police contracts had been suspended over abuse, declined to answer.
You weren't supposed to know how many cameras there are. now you do.