The detail that matters is how little it took. Security researchers say they opened up a Flock Safety camera they had bought from an online vendor by pressing the button on its front three times while running a common Android diagnostic tool. The device’s password was written into the firmware, readable on the unit itself. With it, they could upload, download or delete video.
Benn Jordan, a musician and YouTuber who works out of a cluttered lab in the Atlanta suburbs, led the effort alongside researchers Joshua Michael and Jon Gaines. They say they report every finding to Flock before posting anything. Flock’s answer, as the Guardian reported in April 2026, is that a device not connected to the internet lacks the network protections of one that is, and that the findings do not amount to a significant security issue.
Cameras on the open internet
One of Jordan’s videos, which like others has millions of views, shows him watching himself on his phone, streamed live from a camera on a pole above his head. He found that some of Flock’s Condor cameras were broadcasting their feeds to the open internet, and that some archived footage could be reached. He calls the setup “Netflix for stalkers.”
At a hearing in Dunwoody, Georgia, councilwoman Catherine Lautenbacher put the video to Flock’s public relations manager, Kerry McCormack. “He said he hacked your cameras. You said that never happened?” McCormack replied that Flock’s systems and customer data “has never been hacked,” though the company knew of one instance, which he blamed on an installation error fixed immediately.
Who can search what
Flock, based in Georgia, sells automated license plate readers and offers police something rivals mostly do not: nationwide search across a network of more than 80,000 cameras. That helps a local detective chasing a suspect out of state. It also means other agencies can reach into a town’s records of plate sightings.
404 Media revealed in May 2025 that local police around the country had repeatedly searched Flock’s database to assist federal immigration enforcement. The education news group The 74 found dozens of national searches by school police departments for the same purpose. An Atlanta police investigator ran similar searches even though the department has a no-cooperation policy with ICE.
In Dunwoody, Lautenbacher asked what would happen if a local agency tied to ICE wanted to search the city’s data. Patrick Krieg of the Dunwoody police said access is not limited to searches associated with an agency’s own case. Would such a search be possible? “Most likely.”
Flock says it does not work with ICE or any other Department of Homeland Security sub-agency, and noted in a January post that it ended pilot programs with federal agencies in August. It also says the customer owns all the data and that it never sells it. Critics are skeptical, and within the law, clients can share or sell their own data as they see fit. A recent terms-of-service change that dropped a line promising Flock does not own or sell customer data, which the company says was removed as redundant, did not help.
Cities pull the plug
Mountain View, California, switched off all its Flock cameras after an audit found federal agencies had accessed the city’s data without explicit local authorization during a brief period in 2024. “I share your anger and frustration,” Police Chief Mike Canfield wrote to residents. Santa Cruz and South Pasadena have also ended their contracts, with South Pasadena council members citing the “inadvertent” sharing of data.
California has barred sharing plate data with federal or out-of-state agencies since 2015, and Flock disabled that function for California cities in March 2025.
Dunwoody chose a middle road. Its leaders voted to defer renewal while staff work out details with Flock, but did not cancel. The city has put $360,000 into a real-time crime center and spends about half a million dollars a year on Flock’s technology and network.
Flock’s spokesperson Holly Bellin argues the company draws fire because it is open: it runs a transparency portal where the public can see what searches have been made. “It’s almost like we’re being punished for transparency,” she said. Competitors Axon and Motorola run national networks too, she noted. Neither responded to the Guardian’s requests for comment.
