Researchers Just Found Hardcoded Passwords In Flock's Police Cameras

Our Take

Credit to the Tech News channel for digging into this one. Hardcoded passwords are about as rookie a security mistake as it gets — the kind of thing that should never survive a code review, let alone ship inside cameras that are logging every car that passes a given intersection and feeding that data to police departments and federal agencies. If the reporting holds up, it's another data point in a pattern we keep seeing with Flock: a company racing to blanket the country in cameras faster than it's willing to invest in locking down the systems holding all that location data.

This isn't just an IT headache for Flock. A hardcoded credential is a skeleton key. It means anyone who figures it out — a disgruntled employee, a bored hobbyist, a foreign actor, whoever — potentially gets a backdoor into a nationwide network of plate-reading cameras that was already operating with minimal independent oversight. We've spent years pointing out that these systems get deployed with little public debate and even less security scrutiny, and stories like this are exactly why that should worry you regardless of your politics.

We'll be watching for Flock's response and any confirmation of patches, but the bigger lesson doesn't change: infrastructure that tracks your movements should be held to a higher bar than this, not a lower one. If you want to see how many of these cameras are already watching your own neighborhood, check our map, and if you'd rather not wait around for the next vulnerability disclosure, see what you can do on our take-action page.