Security group breaches Flock camera, retrieves encryption key and massive media cache
A hacking group called stegan0gram obtained a Flock surveillance camera and discovered an encryption key stored on the device, contradicting the company's claims. The group accessed two storage partitions and unlocked a media partition containing about 1.6 million images and over 27,000 video clips captured over 21 days. The camera also showed edge AI capabilities for detecting people and vehicles.
The stegan0gram group's findings directly contradict Flock's public assurances that on-device encryption protects stored data and that images are quickly forwarded to company servers. Instead, the camera's media partition held a working encryption key, allowing access to roughly 1.6 million images and 27,321 short video clips accumulated over three weeks. The device also performed on-board detection of people, vehicles, bicycles, and plate-like shapes before transmitting cropped images to Flock's cloud infrastructure.
This breach adds to mounting criticism of Flock's surveillance network. Police officers have been arrested for misusing cameras to stalk romantic partners, and a mistyped license plate led to an armed confrontation with a car reviewer. Several municipalities have terminated contracts, while some residents have resorted to physically disabling cameras. Former officer Noel Pichardo cautioned that such sabotage could reinforce law enforcement's conviction that these tools are essential.
This incident could erode public trust in private surveillance networks, as it demonstrates that vendor claims about data security may not match reality. Communities already concerned about police overreach may view this as confirmation that camera systems retain more data than disclosed. However, the hack required physical access to the device, limiting its immediate practical threat. The broader impact may be regulatory: lawmakers could face renewed pressure to mandate independent audits of surveillance hardware and enforce stricter data retention standards.