A hacker collective that ripped a Flock license-plate reader off a roadside pole and cracked it open found that the device’s software explicitly detects people, not only vehicles and license plates, according to a joint investigation published by Wired and 404 Media.
The group, which calls itself stegan0gram, copied the data inside the camera before passing it to journalists. The logs and code they extracted paint a detailed picture of how one of the country’s most widely deployed surveillance tools actually works, and where it falls short.
What the Code Inside the Camera Shows
The camera runs roughly 20 built-in apps on a processor comparable to a midrange smartphone, handling tasks from motion detection and image capture to data uploads and software updates. When something moves into view, the device takes between 28 and 100 photos at different exposures, crops what it judges to be a license plate, and sends that data to Flock’s servers over the cellular network. The plate number, vehicle make, and model are identified on Flock’s servers, not on the device itself.
Critically, the current software also “explicitly detects people” and logs where they appear in each image along with a confidence score. Wired’s review of roughly 21 days of logs found the camera photographed more than 50,000 vehicles and generated 1.6 million images, a rate of 3,300 to 4,500 vehicles per day. The analysis also turned up about 27,000 “no space left on device” errors, plus thousands of crashes and reboots. Reporters found Flock camera reverse engineering findings no evidence of facial-recognition capabilities beyond what is built into the Android operating system.
Misread Flags, Bumper Stickers, and a Self-Check Named ‘Good Boy’
The investigation revealed repeated misidentification errors. Bumper stickers, dealership frames, and decorative graphics were all logged as license plates and cropped for storage. “In one video of a passing motorcycle, the detector cropped an American flag patch on the rider’s saddlebag as if it were a plate,” Wired reported.
The device also runs an operational check every two minutes, logging the message “Who’s a good boy?!” That phrase appeared more than 12,000 times in the logs reviewed.
Flock responded to the reports by stating that “the unauthorized removal and tampering of a Flock camera is illegal.” The company added that it “takes security seriously” and maintains a public vulnerability disclosure policy, saying it received no report through that process and lacked enough detail to assess the claims. “If the individuals identified legitimate vulnerabilities, we encourage them to submit their technical findings through our vulnerability reporting process so our security team can review them and take any appropriate action,” Flock said.
What the Hackers Say, and What Comes Next
Stegan0gram explained their decision not to simply destroy the camera: “Why just destroy them when we can reverse-engineer them and find the secrets of those spying on us?” One member acknowledged the legal risk, saying, “Being investigated is a legit concern and something we are trying to avoid. I’m sure our actions have attracted some attention as it is, but we are careful and try to keep a low profile.”
The scope of Flock’s reach makes the findings consequential. According to DeFlock, more than 140,000 license-plate readers are currently operating in the United States, with Flock running 81% of them and Motorola running 5%. Whether regulators, lawmakers, or courts will scrutinize the people-detection capability surfaced by the teardown remains to be seen.
