Flock Camera Hack: What the Files Show vs. Michigan's Contract

Our Take

CISO Marketplace did the unglamorous but essential work here: lining up what was actually found inside a compromised Flock unit against the fine print of a real government contract. That comparison matters more than another breach headline. Vendors like Flock sell these deployments to city councils with glossy promises about narrow, plate-only use. When the actual file structure shows person and bicycle detection nobody disclosed, plus an unencrypted key sitting in front of thousands of video clips, you're not looking at a bug — you're looking at a gap between the sales pitch and the surveillance reality being built in your town.

This is exactly the pattern we track: capability creep that outpaces public oversight. A camera procured to catch stolen plates quietly becomes a system cataloguing how many photos exist per vehicle, what else it can classify, and how poorly the underlying data is protected once the contract ink is dry. If a security key protecting video clips is sitting unencrypted, that's not a hypothetical risk for residents — it's a live one, and it undercuts every assurance local officials gave when they approved the purchase.

If your city or county has one of these systems, don't take the contract language at face value — check what's actually running. Look up nearby cameras on our camera map, and if you want to push back at a city council meeting or file public records requests, our take-action page has the tools to get started. Credit to CISO Marketplace for digging past the press release and into the files themselves.