Hackers Crack Open Flock Camera, Reveal How It Watches You

TL;DR: Hackers physically obtained a Flock license-plate camera and extracted much of its software and stored data. A joint investigation by 404 Media and WIRED found the device detects far more than license plates. It identifies people, vehicles and bicycles, can take more than 100 images of one passing car and sometimes isolates bumper stickers and other graphics. One camera generated about 1.6 million images of roughly 50,200 vehicles during 21 days of recovered logs. The findings come as Flock faces growing questions about police misuse, nationwide data sharing and whether mass license-plate tracking violates the Fourth Amendment.

Flock Safety has long sold its cameras as a crime-fighting tool built around automated license-plate readers.

Hackers have now cracked one open to see what it really does.

A hacker group calling itself stegan0gram physically removed a Flock camera installed over a roadway — they “liberated” it — copied much of the data stored inside and turned the files over to 404 Media and WIRED. The two outlets jointly analyzed the files and published their findings Wednesday.

What they found looks less like a camera taking a snapshot of a license plate and more like a small roadside computer running a complex visual tracking system.

The hackers were able to access the camera's Android operating system and copy much of its storage. Some partitions were not encrypted. One contained an encryption key that allowed the group to unlock another section holding videos and still images.

That is notable because Flock says its data is encrypted on the device, during transmission and while stored. The company currently tells customers that "data stays protected the whole time."

The hackers did not break into Flock's central servers or obtain unrestricted access to its national database. Some of the camera's most sensitive storage also remained encrypted. What they did obtain, however, offered an unusual look at what happens inside a Flock camera before data reaches the company's servers.

Unsurprisingly, it‘s collecting quite a bit.

According to the analysis, the camera's software is designed to detect people, not merely vehicles and tags. It also identifies vehicles, license plates and bicycles. There was no evidence that Flock's own software was performing facial recognition.

When the camera sees motion, it rapidly takes a series of images at different exposures. A typical passing vehicle generated about 28 images. Some generated more than 100.

The recovered logs covered about 21 days of activity spread across several periods. During that time, this one camera photographed roughly 50,200 vehicles and produced about 1.6 million images. It averaged about 3,300 vehicle detections per day and reached a high of 4,454.

The recovered software and Flock's own product material show the system can acquire or derive a substantial amount of information from a passing vehicle:

• License-plate images and plate information
• Multiple images of the same vehicle as it passes
• Wider images of the vehicle and surrounding scene
• Date and time of the detection
• Location of the camera
• Vehicle color, make and model after server-side processing
• Vehicle type and other physical traits
• Direction and patterns of travel
• People detected within the camera's field of view
• Bicycles
• Bumper stickers, decals and other visible graphics
• Images that can later be searched and compared across participating camera networks

Flock says its ALPR system collects license-plate images, vehicle traits, timestamps and camera location. Its search tools allow users to filter records by such things as vehicle type, color, traits and even partial plate numbers.

The recovered — or, if you prefer, “liberated’ — software provides a much more detailed picture of how that happens.

In some cases, the camera's plate-detection system became overly enthusiastic. It mistook bumper stickers, dealership frames and other graphics for license plates and cropped them for analysis. In one case, it isolated an American flag patch on a motorcyclist's saddlebag as though it were a tag.

The camera itself appears to do much of the first-stage work — detecting motion, shooting images, finding objects and selecting useful frames. More complex tasks, such as reading the plate and identifying vehicle make, model and color, appear to take place on Flock's servers.

That distinction matters because the end product is not simply a photograph. It is a searchable record of where a particular vehicle was seen and when.

Multiply that by thousands of cameras and the privacy issue becomes much larger.

WIRED found that records from Flock cameras in Alpharetta, Georgia, were accessible to more than 2,000 agencies, ranging from police departments to colleges, airports and the federal General Services Administration's Office of Inspector General.

That type of sharing has helped turn local cameras into something approaching a national tracking network.

Questions about how that network can be abused have moved well beyond hypotheticals.

At least 10 Georgia law enforcement officers were arrested within a two-week span this summer on charges tied to alleged misuse of Flock data. The cases included officers accused of searching plates belonging to themselves, relatives, friends or other people for reasons unrelated to legitimate police work.

The Institute for Justice has documented over 200 cases in which officers allegedly used automated plate-reader databases to stalk romantic partners or for other personal reasons. These cases are maintained in a searchable database which is open to public access online. As of this writing, four cases were found in this database for Alabama.

Flock has responded by strengthening audits and cutting its default retention period for new customers to seven days. The company says searches are logged, require a public-safety reason and can be reviewed by supervisors. Flock also says customers control who can access their information and with whom it is shared.

But the basic privacy concern remains: the system first collects information about large numbers of drivers who are not suspected of committing a crime.

That concern is now reaching the courts.

The Supreme Court's recent ruling in Chatrie v. United States dealt with Google geofence data rather than license-plate cameras, but the Court held that police conducted a Fourth Amendment search when they obtained a person's location history from Google. The Court rejected the claim that the data lost constitutional protection merely because it was held by a third-party tech company.

That ruling could matter in Schmidt v. City of Norfolk, a pending challenge to Norfolk, Virginia's network of more than 176 Flock cameras.

The constitutional question is increasingly straightforward: At what point does observing cars on public streets become a government search of a person's past movements?

A single camera seeing a car drive through an intersection tells police very little.

Thousands of networked cameras recording where that car appears over days, weeks or months can reveal something quite different — trips to a church, doctor's office, political meeting, gun range, school, workplace or someone's home.

Flock rejects the mass-surveillance label. Its Trust Center says its cameras are intended for "public safety investigations" and not "tracking of individuals." The company also stresses that the system does not use facial recognition and says data access is controlled by its customers.

The hackers' discovery does not show that Flock secretly uses facial recognition. In fact, the researchers found no evidence that it does.

What it does show is just how much work occurs behind that little solar-powered box on a pole.

One ”liberated” camera produced 1.6 million images in about three weeks of logs. It detected cars, plates, bikes and people. It sometimes picked out stickers and other graphics. Its records were designed to flow into servers where vehicle details could be identified, indexed and searched.

Flock may call that a license-plate reader.

The code shows it is doing quite a bit more than reading license plates.

And that‘s what has so many people up in arms.