827 points by chaps 70 days ago | 471 comments on HN
| Moderate positive
Contested
Editorial · v3.7· 2026-02-28 12:10:45 0
Summary Surveillance & Privacy Advocates
404 Media's investigative journalism exposes a critical security vulnerability in Flock's AI-powered surveillance infrastructure, demonstrating how 60+ cameras were left streaming to the open internet without authentication. The article champions privacy rights (Article 8), freedom of expression (Article 19), and freedom of peaceful assembly (Article 20) through on-the-ground verification and security researcher collaboration, addressing core UDHR protections with strong evidentiary support.
I just watched the Benn Jordan's video on this. Even if this is just configuration error on some of their cameras this is terrifying and I think they should be held accountable for this and their previous myriad of CVEs.
Flock or their defenders will lock in on the excuse that “oh these are misconfigured” or “yeah hacking is illegal, only cops should have this data”. The issue is neither of the above. The issue is the collection and collation of this footage in the first place! I don’t want hackers watching me all the time, sure, but I DEFINITELY don’t trust the state or megacorps to watch me all the time. Hackers concern me less, actually. I’m glad that Benn Jordan and others are giving this the airtime it needs, but they’re focusing the messaging on security vulnerabilities and not state surveillance. Thus Flock can go “ok we will do better about security” and the bureaucrats, average suburbanites, and law enforcement agencies will go “ok good they fixed the vulnerabilities I’m happy now”
I don't want these cameras to exist but, if they're going to, might we be better off if they are openly accessible? At the very least, that would make the power they grant more diffuse and people would be more cognizant of their existence and capabilities.
i guess that while it is alarming that these feeds were "unsecured" I'm just as concerned that they exist at all. Folks worry about it getting into the "wrong hands" but from my POV it was put up by the wrong hands.
While both are a problem I am far more concerned about the power this gives our, increasingly authoritarian, government than about individual stalkers/creeps.
I would love to watch a shorter version of this video that just discussed the deltas between the status quo and Flock, rather than breathlessly reporting the implications of cameras as if they were distinctive to Flock. He'll spend 30 seconds talking about how you can see every activity and every person on the camera --- yeah, that's how cameras work. There are thousands of public IP cameras on the Internet, aimed at intersections, public streets, houses, playgrounds, schools; most of them operated that way deliberately.
There are Flock-specific bad things happening here, but you have to dig through the video to get to them, and they're not intuitive. The new Flock "Condor" cameras are apparently auto-PTZ, meaning that when they detect motion, they zoom in on it. That's new! I want to hear more about that, and less about "I had tears in my eyes watching this camera footage of a children's playground", which is something you could have done last week or last year or last decade, or about a mental health police wellness detention somewhere where all the cops were already wearing FOIA-able body cams.
If open Flock cameras gave you the Flock search bar, that would be the end of the world. And the possibility that could happen is a good reason to push back on Flock. But that's not what happened here.
Children could go missing thanks to Flock default settings. HN would tell me to never attribute to malice ... but there may be criminal negligence.
To cover their butts I strongly suggest Flock implement a default "grading system" that will show a city in a banner at the top of their management and monitoring system that based on their camera and network configuration they get an A+ to F-. If the grade is below a C then it must be impossible to get rid of the banner and it must be blinking red. The grading system must be both free, mandatory and a part of the core management code. This assumes Flock will have the willpower to say no when a city demands removal of the flashing red banner. Instead up-sell professional services to secure their mess. I would like to see the NCC Group review their security and future grading system.
I wonder what our founders would think about tools like Flock.
From what I understand these systems are legal because there is no expectation of privacy in public. Therefore any time you go in public you cannot expect NOT to be tracked, photographed, and entered into a database (which may now outlive us).
I think the argument comes from the 1st amendment.
Weaponizing the Bill of Rights (BoR) for the government against the people does not seem to align with my understanding of why the Bill of Rights was cemented into our constitution in the first place.
I wonder what Adams or Madison would make of it. I wonder if Benjamin Franklin would be appalled.
I wonder if they'd consider every license plate reading a violation of the 4th amendment.
In Brazil there is a similar problem, but it's not as widely discussed. Here, police investigations revealed that a website sold access for less than $4 to the nation-wide surveillance system, which included live feed of public safety cameras and person search by tax identifier. It was also shown that criminal organizations used it to locate their targets. Access was through the open internet, with leaked credentials, the federal government's system requires no VPN for access.
Really valuable research. A benefit to public safety, and drawing attention to a sloppy vendor in the security space, claiming to secure the public, but instead putting the public at risk. However I'm deeply concerned for the researcher and all involved because this may be a criminal violation under the CFAA - accessing these systems without authorization, even if they don't have authentication.
Was fortunate to talk to a security lead who built the data-driven policing network for a major American city that was an early adopter. ALPR vendors like Flock either heavily augment and/or anchor the tech setups.
What was notable to me is the following, and it’s why I think a career spent on either security researching, or going to law school and suing, these vendors into the ground over 20 years would be the ultimate act of civil service:
1. It’s not just Flock cams. It’s the data eng into these networks - 18 wheeler feed cams, flock cams, retail user nest cams, traffic cams, ISP data sales
2. All in one hub, all searchable by your local PD and also the local PD across state lines who doesn’t like your abortion/marijuana/gun/whatever laws, and relying on:
3. The PD to setup and maintain proper RBAC in a nationwide surveillance network that is 100%, for sure, no doubt about it (wait how did that Texas cop track the abortion into Indiana/Illinois…?), configured for least privilege.
4. Or if the PD doesn’t want flock in town, they reinstall cameras against the ruling (Illinois iirc?) or just say “we have the feeds for the DoT cameras in/out of town and the truckers through town so might as well have control over it, PD!”
Layer the above with the current trend in the US, and 2025 model Nissan uploading stop-by-stop geolocation and telematics to cloud (then, sold into flock? Does even knowing for sure if it does or doesn’t even matter?)
Very bad line of companies. Again all is from primary sources who helped implement it over the years. If you spend enough time at cybersecurity conferences you’ll meet people with these jobs.
Flock cameras would be so easy to disable by motivated people. Dress in nondescript clothing, mask, sunglasses, and just spraypaint over the lenses. This is completely asymmetric warfare because it is trivial how long it would take for you to do this. You could hit dozens of cameras across an area overnight. Meanwhile, flock or the city, whoever maintains this stuff, needs to identify the vandalized cameras, flag them for repair, pay a technician to go out and presumably repair the unit outright. You pay cents and they are paying potentially thousands in labor and hardware costs.
And this would absolutely work at scale too. Streetlights are already being vandalized for their copper and most cities cannot afford to hire more technicians to even keep up with streetlight repair. I believe I’ve seen the backlog for streetlight repair in LA is over 10x what the current street services crew is capable of repairing in a year of constant work and growing by the day.
Municipalities and these technology companies cannot keep up against a motivated crew and can’t afford to scale either. Totally asymmetric.
What I don’t understand is how you can work at a company like Flock and look yourself in the mirror.
Seriously. You must be aware of the inherent evil, of the privacy invasive nature of your product, of how it’s being actively abused. How do you rationalize this for yourself?
Systems like this that exist to facilitate dispatching government violence will never be "good" by whatever the standards of the time is because they don't need to be. They have "at-cost" access to nearly infinite government violence they can dispatch capriciously and an unequally good relationship with any system that would hold them accountable for any misuse of their stuff.
Yes and the biggest problem with this kind of ALPRs are they bypass the due process. Most of the time police can just pull up data without any warrant and there has been instances where this was abused (I think some cops used this for stalking their exes [1]) and also the most worrying Flock seems to really okay with giving ICE unlimited access to this data [2] [3] (which I speculate for loose regulations).
Nothing will be done until one of the investors of the tech end up embarrassed from weaponization of the tech against themselves. These people have no clue how creepy some of their technologic betters can be. I once witnessed a coworker surveilling his own network to ensure his girlfriend wasn't cheating on him (this was a time before massive SSL adoption). The guy just got a role doing networking at my company and thankfully he wasn't there for very long after that.
> The financing was led by Andreessen Horowitz, with backing from Greenoaks Capital, Bedrock Capital. Meritech Capital, Matrix Partners, Sands Capital, Founders Fund, Kleiner Perkins, Tiger Global, and Y Combinator also participated.
In my experience, people respond much more strongly to naming a specific company or person. Clearer plan of action than a resigned “This tech is old news.”
I always found Hanlon's Razor a bit too optimistic in tone. I prefer it restated in the form of Clarke's third law:
"Sufficiently advanced stupidity is indistinguishable from malice."
I think so, but it is a loosely held opinion at this point. Fundamentally, I think it is a huge, asymmetric power grab by Flock and local police to install these systems. It only takes one officer looking up their local politician and finding them doing something that could even look like a bad deed (or to fake it in the era of AI videogen...) to enable blackmail and personal/professional gain.
If they're going to exist, it may be better for that to be spread among the public than to be left in the hands of the few.
Did you see the other post about this where the guys showed a Flock camera pointed at a playground, so any pedo can see when kids are there and not attended?
Or how it has become increasingly trivial to identify by face or license plate such that combining tools reaches "movie Interpol" levels, without any warrant or security credentials?
If Big Brother surveillance is unavoidable I don't think "everyone has access" is the solution. The best defense is actually the glut of data and the fact nobody is actively watching you picking your nose in the elevator. If everyone can utilize any camera and its history for any reason then expect fractal chaos and internet shaming.
He's pretty open in this video about how Flock is far from alone in this space, and he's just using them as an example because they're so popular and flagrantly abusive.
“Are the fires of Hell a-glowing?
Is the grisly reaper mowing?
Yes! The danger must be growing
For the rowers keep on rowing
And they're certainly not showing
Any signs that they are slowing!” - Willie Wonka
I've thought the same regarding license plate readers (and saw considerable pushback on HN) — feeling like you suggest: if they have the technology anyway, why not open it up?
I imagined a "white list" though (or whatever the new term is—"permitted list"?) so that only certain license plates are posted/tracked.
Have you ever gone fishing? Did you catch all the fish?
Often it is more impactful to address one major/tangible player in a particular space than it would be to "boil the ocean" and ensure that we are capturing every possible player/transgressor. I agree that some of the video was overly breathless, but if that's what wakes people up to the dangers of unsecured cameras/devices then so be it.
This is pretty naive. What happens when you develop and extend such a system in a way that it can track who you interact with? What about social credit scores? You might go out to a social event with a very distinguished social credit score of 820 and get knocked down to 69 just because you were in proximity to Bob and Alice, who happen to be on some blacklists for their work in cryptography.
What you're staring at is the gateway tech that brings in a dystopian society. At first stuff like this is fairly benign, but slowly over time it ramps up into truly awful outcomes.
I live in an Atlanta neighborhood where one of the founders lived. A prototype for Flock Camera was designed by three Georgia Tech grads because someone kept breaking into their car (not uncommon in our neighborhood tbh).
The trick is that the camera was pointed towards a middle school. Which means they were constantly recording kids without adult consent.
Now, years later, Atlanta is the most surveilled city in North America and one of the most in the world. Flock cameras are everywhere. There are 124 cameras for every 1,000 people. Just last week, a ex-urb police chef was arrested for using the Flock network to stalk and harass citizens.
I know a lot of people who work at Flock. I’m shocked that they do though.
He has said his goal is for a "world with no crime. Thanks to Flock." and his goal is not aspirational, visionary, but quite literal.
He sees false negatives as more problematic than false positives. He has admitted being inspired by Minority Report (to me it's always very telling when someone takes a cautionary tale like this and finds it "inspirational").
I wonder if such a business model could exist where they were effectively "public" and thus, access was uniformly granted to anyone willing to pay. not sure if this would be net better for society, but an interesting thought.
Central focus of article; comprehensively documents privacy violation through unauthorized real-time surveillance and archives, advocating for privacy protections.
FW Ratio: 75%
Observable Facts
The entire article documents unauthorized real-time streaming of individuals in public spaces—parking lots, streets, parks, playgrounds—without their knowledge or consent.
Researchers obtained video footage clearly identifying specific individuals, down to details like phone content visible on screen, from exposed surveillance feeds.
The article demonstrates that 30 days of archived video of personal activities and movements was accessible without any authentication barrier.
Inferences
The article presents privacy violation as the central harm, showing how unrestricted surveillance infrastructure destroys the right to privacy of person, activities, and location.
Article exemplifies freedom of expression through investigative journalism exposing wrongdoing; advocates for information access and public knowledge.
FW Ratio: 67%
Observable Facts
The article is investigative journalism by Jason Koebler (clearly identified by byline) that exercises freedom of expression to expose security vulnerabilities.
The journalist personally verified claims by driving to locations to test camera access, reviewed FOIA'd government contracts, collaborated with security researchers, and obtained video evidence.
Inferences
The article itself exemplifies freedom of expression and information-seeking in service of the public interest.
Documents surveillance of personal activities and communications; advocates strongly for privacy of movement and private activities.
FW Ratio: 67%
Observable Facts
The article documents surveillance of intimate personal activities: a woman walking her dog, individuals sitting in traffic, someone watching videos on their phone.
Live streaming and 30 days of archived video of all these personal activities was accessible without authentication to anyone with internet access.
Inferences
The article champions protection of privacy of personal communications and activities through exposure of surveillance violations.
The content champions universal human dignity and freedom by exposing violations of privacy and surveillance rights that contradict UDHR foundational principles.
FW Ratio: 67%
Observable Facts
The article documents unauthorized surveillance of hundreds of individuals across multiple U.S. locations without their knowledge or consent.
Journalists conducted independent on-the-ground verification of the security vulnerability by accessing and watching live camera feeds in real time.
Inferences
The article champions the UDHR's foundational principle that human dignity is violated by arbitrary, unconsented surveillance.
Article advocates for security of person by exposing critical security vulnerability in surveillance infrastructure.
FW Ratio: 67%
Observable Facts
The article identifies a critical security vulnerability exposing administrative control panels to open internet access without authentication.
Journalists verified they could access 30 days of archived video and camera settings without any credentials.
Inferences
The article demonstrates that proper security systems are necessary to protect the right to security of person against unauthorized surveillance access.
Article documents law enforcement surveillance infrastructure and demonstrates risks of arbitrary interference by authorities with exposed control systems.
FW Ratio: 67%
Observable Facts
The article documents that Flock's Condor cameras are designed to be controlled by law enforcement for tracking people.
The exposure revealed administrative control panels that law enforcement would use to operate surveillance systems.
Inferences
The article implicitly addresses how surveillance infrastructure deployed by authorities can enable arbitrary interference through exposed and unsecured control access.
Demonstrates surveillance threat to freedom of movement in public spaces through documentation and real-time tracking examples.
FW Ratio: 67%
Observable Facts
The article documents cameras tracking individuals across public spaces: bike paths, streets, parking lots, and parks.
Specific example: a man rollerblading was tracked on multiple cameras as he moved through a greenway, appearing on multiple exposed feeds across distance.
Inferences
The article shows how surveillance infrastructure threatens freedom of movement through continuous tracking in public spaces.
Researcher quote: 'the one that affected me most was as playground. You could see unattended kids, and that's something I want people to know about so they can understand how dangerous this is.' The emotional appeal about vulnerable children is grounded in documented surveillance capability.