// TOM'S HARDWARE US — HARDWARE & GADGET
Flock seeks to have security researchers' map of Flock cameras taken down
It could also potentially be used to track key personnel heading to and from sensitive sites like military bases, intelligence agencies, and law enforcement headquarters.
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
A security researcher discovered a vulnerability in Flock’s website that gave him an access token without needing login credentials. The researcher used the information gleaned to build a map of Flock cameras and share it on a website he named the Flock Surveillance Map, which lists 335,701 cameras. Flock has now issued a trademark infringement complaint with the goal of having the researcher close the website.
According to The Intercept, Joshua Michael used this to query ArcGIS, a third-party mapping and geospatial layer that Flock uses, to retrieve a database of Flock devices in November 2025.
Michael said that he immediately informed the company about the security flaw. He said in his email, dated Nov. 13, 2025, that “all testing was strictly non-intrusive, limited to open unauthenticated endpoints, and did not involve bypassing authentication, modifying data, or invoking any billable ArcGIS or Google operations.” However, the company did not reply to his message, and it took him two more attempts before a representative responded. Flock said in its response, “Thank you for the findings. We are internally triaging them and will reach back out with next steps soon,” but the researcher said that the company still hasn’t replied to this day.
Flock apparently fixed the vulnerability in January of this year after Michael published his findings, but the researcher was able to exfiltrate a Flock device location database before that. This information has allowed him to build the Flock Surveillance Map website, which lists 335,701 cameras, presumably updated in December 2025.
The surveillance company said that it has never been hacked, that Flock information has never been leaked, and that the Flock Safety cloud platform “has never experienced a data breach,” but Michael says that this does not reflect reality. He told The Intercept that it made this announcement “after I pulled their database of devices.” “That leaves two possibilities,” said the researcher. “Either they knew and chose not to disclose it for fear of bad press, or they didn’t know I exfiltrated the data at all. The first is a transparency failure. The second is a detection failure with national security implications.”
This issue once again raises questions about the company’s cybersecurity and privacy measures. Hackers have recently discovered that the Flock cameras stored encryption keys directly on the device, which allowed them to extract more than 27,000 clips stored and find that it has taken more than 1.6 million images in a span of 21 days. There were also multiple instances of misuse, in which police officers used the system to stalk romantic partners, while a car reviewer was “ambushed” in a store parking lot and detained for an hour for a mistyped police report.
What’s more alarming was that Michael pointed out that the ubiquity of the system and the vulnerabilities he uncovered so far show that it could be used to track personnel. Soldiers and civilians working in the defense industry could potentially be observed going to and from 22 sensitive sites, including Eglin AFB, CIA Headquarters, FBI Headquarters, Joint Base Andrews, and even the Pentagon, with people living within a 20-mile radius of these sites having a 57.22% to 93.94% chance of passing a Flock camera and getting recorded in the system.
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.