WASHINGTON, D.C. — Hackers from the collective stegan0gram reverse-engineered a Flock camera, exposing its data collection practices and revealing that it captures millions of images of vehicles and classifies people, vehicles, and bicycles. Congressmen Raja Krishnamoorthi and Michael Cloud plan to introduce the No FLOCK Act legislation in response to growing scrutiny of the surveillance technology.

Analysis of the recovered data shows that software running on the Flock camera explicitly detects people, vehicles, license plates, and bicycles. The Flock camera generated more than a million images according to several weeks of recovered logs. During a 21-day period of analyzed logs, the Flock camera photographed roughly 50,200 vehicles and generated about 1.6 million images.

On a typical day, the analyzed Flock camera logged around 3,300 vehicles, with a high of 4,454. A typical passing vehicle generated about 28 images from the Flock camera, though some produced more than 100. The Flock camera device runs about 20 Flock-built apps that handle motion detection, image capture, object classification, data uploading, and remote updates.

"Why just destroy them when we can reverse engineer them and find the secrets of those spying on us?" one of the hackers, from a collective calling itself stegan0gram, said in an interview. Security researcher Jon Gaines reverse engineered a Flock license-plate reader in early 2025 and documented flaws that could be used to gain root-level access. Flock acknowledged the security findings but stated that the flaws required physical access to the device and that footage would not be accessible because images remain on the device only briefly after transmission to the cloud.

Raja Krishnamoorthi is a Democrat representing Chicago suburbs. Michael Cloud is a Republican whose Texas district includes Corpus Christi. "Our investigation into Flock exposed serious gaps in oversight, and this bipartisan bill would put clear limits in place to prevent abuse while preserving legitimate public safety uses," Krishnamoorthi said in a statement.

The No FLOCK Act directs the US Secretary of Transportation to withhold 10 percent of annual federal highway funding from states that fail to restrict the use of Flock cameras and similar automated license plate readers. Under the No FLOCK Act, states would begin losing transportation funding starting in October 2028 if they fail to comply. The No FLOCK Act permits the use of Flock cameras only for enforcing toll systems, identifying stolen vehicles, locating missing or endangered persons, tracking vehicles registered to persons with a felony warrant, or investigating vehicles involved in a felony offense.

The No FLOCK Act does not ban Flock systems altogether. The No FLOCK Act does not prohibit Flock users from sharing license plate tracking data with other government agencies, including immigration authorities. Local police performed lookups in the Flock national network on behalf of Immigration and Customs Enforcement, including in areas that banned working with immigration authorities. A police officer in Texas searched Flock cameras nationwide for a woman who self-administered an abortion.

In Alpharetta, Georgia, records from the city’s Flock cameras were accessible to more than 2,000 agencies, including police departments, colleges, airports, and the Office of Inspector General for the federal General Services Administration. As of July 2026, Flock says that it operates in over 6,000 communities across 49 US states, and performs over 20 billion scans of vehicles in the US every month. DeFlock estimates there are 100,000 Flock cameras and other ALPR devices across the US that collectively scan about 20 billion license plates each month.

An SFPD spokesperson stated that officers are only permitted to search the Flock system using a case number or computer-aided dispatch number. The San Francisco Police Department spent nearly $4 million on the Flock system, with annual renewal costs of about $1.2 million. The San Francisco Police Department reported more than 19,000 car burglaries in 2023, before Flock cameras were installed. The San Francisco Police Department reported 1,764 car burglaries so far this year after installing Flock cameras.

Zachary Schwartz is the founder of DeFlock SF. The group DeFlock SF launched a hub mapping Flock and other automated license plate reader cameras around San Francisco. Zachary Schwartz appeared before the San Francisco Police Commission to call for a comprehensive audit of how Flock cameras are being used and what data they collect. A separate 3D map counted 2,608 documented surveillance devices within 10 miles of San Francisco.

The San Jose Police Department fired an officer accused of sharing Flock data with a family member involved in a domestic violence situation. A criminal investigation was opened into the San Jose Police Department officer's alleged sharing of Flock data.

Why It Matters

The reverse-engineering of Flock hardware reveals the scale of data collection inherent in automated license plate reader networks, which process billions of scans monthly across thousands of communities. The exposure of encryption keys and internal applications demonstrates how these devices classify individuals and vehicles beyond simple license plate recognition, raising questions about data retention and access protocols.

Legislative efforts like the No FLOCK Act aim to restrict usage to specific criminal investigations while withholding federal highway funding from non-compliant states, yet the law permits data sharing with federal agencies including immigration authorities. This creates a complex regulatory landscape where local policing tools intersect with federal enforcement priorities, affecting jurisdictions that have previously attempted to limit cooperation with immigration officials.

What's New

Later reporting revealed that hackers removed a Flock camera, copied its data, and shared the files with 404 Media and WIRED. The hackers recovered an encryption key from the camera device which unlocked videos of thousands of vehicle detections. "We liberated hardware in the field, disarmed them, and proceeded with reverse engineering of the cameras and associated solar equipment," the hacker said.

The San Francisco Police Department is directly affected, as its Flock cameras were queried by out-of-state and federal agencies more than 1.6 million times in a roughly seven-month window.

How Sources Differ

Regarding San Francisco Police Department Flock costs and usage, pubt.io reports that the San Francisco Police Department is directly affected, as its Flock cameras were queried by out-of-state and federal agencies more than 1.6 million times in a roughly seven-month window.

Regarding San Francisco Police Department Flock usage and burglary stats, pubt.io reports that the San Francisco Police Department is directly affected, as its Flock cameras were queried by out-of-state and federal agencies more than 1.6 million times in a roughly seven-month window.

Regarding San Francisco Police Department Flock usage and prior burglary stats, pubt.io reports that the San Francisco Police Department is directly affected, as its Flock cameras were queried by out-of-state and federal agencies more than 1.6 million times in a roughly seven-month window.

Regarding No FLOCK Act and local mapping initiatives, No FLOCK Act legislation text states that the No FLOCK Act directs the US Secretary of Transportation to withhold 10 percent of annual federal highway funding from states that fail to restrict the use of Flock cameras and similar automated license plate readers.