Flock’s Open Cameras: What Exposed Feeds Mean for “Trust Us”

In December 2025, 404 Media reported that at least 60 of Flock Safety’s automated license plate reader (ALPR) cameras were left exposed on the open internet — no login required. Anyone who found the right address could reportedly watch up to 30 days of stored footage and, in some cases, change the camera’s settings. The story is a single incident, but it points to a much bigger, permanent question: what does it actually mean when a surveillance company asks communities to “trust us with your data”?

What “exposed” means in plain English

ALPR cameras like Flock’s aren’t just taking pictures — they’re networked devices connected to cloud servers, local police networks, and sometimes each other. When a device is “exposed to the open internet,” it means the normal barriers that are supposed to keep outsiders out — passwords, private networks, access controls — either failed or were never set up correctly. In practice, that can let a stranger anywhere in the world view footage, pull vehicle history, or, in the worst cases, reconfigure how the camera operates.

This isn’t unique to Flock. Any internet-connected camera system can be misconfigured. What makes it notable here is the scale of what’s being collected: ALPR systems log the location, time, and often the exact plate of every vehicle that passes, then store it for weeks. A single exposed camera isn’t just a security bug — it’s a window into a month of a community’s movements.

Why “trust us” isn’t a security model

Companies that operate ALPR networks routinely promise that data is protected, access is logged, and only authorized users can view footage. Those promises are usually made in good faith. But promises are not the same as verified controls, and history — in ALPR programs and in tech broadly — shows that misconfigurations happen even at well-resourced companies. A camera being reachable by the public internet, even briefly, means the promise of controlled access was not being met in practice, regardless of intent.

This matters because ALPR data is different from a typical data breach. It’s not just names and emails — it’s a record of where specific vehicles were, tied to time and location, often shared across dozens of police agencies through regional or national networks. Once that kind of footage is exposed, there’s no way to know for certain who accessed it or what they did with it.

What communities can reasonably ask for

An incident like this is a good prompt for any city, county, or HOA considering or already running ALPR cameras to ask concrete questions, rather than accepting reassurances at face value:

• How is remote access to cameras and footage restricted, and who audits it?
• How long is footage stored, and who can extend or shorten that window?
• Is there a public log of security incidents, however minor?
• What happens — contractually and practically — when a misconfiguration is found?

These aren’t hostile questions. They’re the same due diligence any local government should apply before adopting infrastructure that watches every passing car. You can see how ALPR deployment looks in your own area on the map, and get a plain-English primer on how these systems work on our learn page.

The bigger, evergreen lesson

ALPR vendors will always describe their systems as secure, audited, and carefully controlled — right up until an outside researcher or journalist finds an exception. That doesn’t mean every camera is insecure or every company is careless. It means that surveillance infrastructure, like any other, should be verified rather than taken on faith, especially when it’s paid for with public funds and pointed at public streets.

If your local government is considering an ALPR contract, or already has one, transparency clauses, independent audits, and public reporting requirements are reasonable things to request — not because vendors are assumed to be acting in bad faith, but because trust in surveillance systems should be earned through evidence, not assumed by default. Our take action page has templates for public records requests and questions to bring to city council meetings, and you can find or start a local group through chapters if you want to work on this with others in your area.