A hacker group recently accessed a Flock Safety camera, uncovering the extensive data collection capabilities of a single automated license plate reader (ALPR). According to an article from Analytics Insight, the group, identified as stegan0gram, physically removed a camera and extracted its stored data. This information was then shared with news organizations 404 Media and WIRED through Distributed Denial of Secrets.
Review of the extracted data showed the camera captured:
- 1.6 million images
- 50,200 vehicles
- 21 days of operation
Most vehicles appeared in about 28 images, with some recorded over 100 times. This incident offers a clear picture of the volume of data these cameras collect on drivers daily. To understand more about how these systems operate, visit our /learn section.
What does this mean for drivers and their privacy?
The incident highlights the sheer volume of data a single ALPR can gather. The camera recorded vehicles, people, bicycles, and license plates. It took multiple pictures when something entered its view, then sent selected images to Flock's servers via a cellular connection. The camera itself did not analyze details like vehicle make or model; that processing happened on the company's servers.
Logs from the hacked camera also contained over 27,000 error messages indicating a lack of storage space. The system also documented crashes and restarts. The findings suggest that while these cameras are designed to collect data, their internal systems can face technical issues.
How secure are these cameras and the data they collect?
This security breach raises questions about the protections in place for data stored directly on ALPR cameras. Flock Safety stated its cameras use encryption. However, the hackers claimed to have found an encryption key on the device, which allowed them to access a large amount of media.
Flock Safety maintains that tampering with or removing its cameras without permission is illegal. The company also referred to its established process for reporting security vulnerabilities. This event suggests that security measures for connected cameras need to go beyond software, including physical access controls and securing encryption keys stored on devices.
Drivers should be aware that even with encryption, physical access to a camera could potentially expose stored information. We continue to track ALPR installations and related policy changes across the country. Check our /map to see where cameras are located near you.