The scrutiny around automated licence plate recognition has been building for years. Police departments have embraced the technology as a force multiplier, while civil liberties groups have questioned how much data gets captured, how long it is kept, and who gets to look at it. Now a new white paper has shifted the argument from policy to hardware, and the findings are considerably more uncomfortable than a debate about retention schedules. This is a story about US police equipment, and the research, the vendors and the dark web listings in it are all American.
The Gaines White Paper: A Camera Bought Secondhand, Cracked in Half a Minute
In November 2025, cybersecurity researcher Jon “GainSec” Gaines published a white paper on GitHub detailing what he found inside a Flock camera he had bought secondhand online. The findings were later explored in a YouTube video by Benn Jordan.
The headline is the effort involved. Armed with nothing more than physical access to the unit, Gaines worked through a sequence of button presses, connected to the device over a network, and used terminal commands to reach internal data and install arbitrary software. Jordan’s video puts the entire process at under 30 seconds.
That is not a sophisticated exploit chain. It is a procedure that, on the researchers’ account, requires little more than a screwdriver, a laptop and a few minutes of patience, provided someone can get their hands on the hardware. Flock cameras are mounted on poles in public places, which makes the physical access requirement less of a barrier than the company’s framing suggests.
No MFA, an Old Android and a Camera That Saves Everything
Two of the more striking findings concern authentication and firmware. According to the white paper, Flock did not require multi-factor authentication for all of its police clients. The company has said 3% of law enforcement customers declined to enable it. In the United States, an update mandating MFA across all customers arrived in August 2026, nine months after the white paper landed.
Then there is the software underneath. The hardware reportedly runs a very old version of Android that no longer receives security updates. Running unsupported firmware on a networked device that captures and stores images is the kind of decision that raises eyebrows in any security review, let alone one covering equipment deployed at scale by public bodies.
Jordan’s own testing produced a further problem. He found the camera saving pictures of him even when no licence plates were in view. That sits awkwardly with Flock’s position that cameras only save plate images and that all data and footage is always encrypted. He also reported that he did not have to “crack or decrypt a single thing” while verifying Gaines’ research.
Dorking, API Keys and Live Patrol Car Locations
The white paper did not stop at the device. Researchers used “dorking”, the practice of crafting search queries to surface inadvertently exposed material, to find API keys granting access to private data. That data included live patrol car locations, officer information and “hot list” plate records.
Live location data on patrol vehicles is a serious category of exposure. It is the sort of information that has value to people with reasons to avoid police attention, and it is difficult to argue that its leakage has no bearing on officer safety.
There is also a reported TEMPEST attack vector, described in the research, which can expose video feeds from several feet away via electromagnetic leakage. That method requires proximity and specialist equipment rather than physical contact, but it widens the threat model beyond someone who can reach the mounting bracket.
stegan0gram: A Camera Taken Down, and Software That ‘Explicitly Detects People’
A hacker collective called stegan0gram went further. According to reporting by 404 Media and Wired, the group took down an active Flock camera, copied its data and accessed an on-device encryption key.
Among the discoveries was software that “explicitly detects people”. That is a notable detail, because Flock hardware is officially billed as an automated licence plate reader. The distinction matters. A plate reader captures a plate. A system that detects people is doing something broader, and it invites questions about what else the platform is capable of and how those capabilities are described to the forces buying it.
The wider connected-camera ecosystem has been generating its own recall and software headaches lately, as our coverage of the Rivian Recalls Almost 99,000 R1T, R1S and R2 Models Over Rear-View Camera Software Fault shows. A faulty camera feed in a private vehicle is an inconvenience. An insecure camera feed operated by a police force is a different order of problem.
For Sale on the Dark Web: ‘License Plates, Background Checks, and Vehicle Tracking!’
Jordan’s video also alleges that access to the Flock system was being offered for sale. At the 3:08 mark, he points to a Russian-language semi-private community on the dark web where a translated post advertised “license plates, background checks, and vehicle tracking!”, along with “direct police accounts in key U.S. regions” and “nationwide access.”
Claims like this deserve caution. Dark web listings are frequently exaggerated, recycled or outright fraudulent, and a sales pitch is not proof of working access. But the existence of the advertisement at all is a signal about how the system is perceived by people who trade in illicit data. If there is a market, someone believes there is something to sell.
Flock’s Response and What It Means for ALPR Trust
Flock responded to the white paper in a blog post. The company said it had been in contact with Gaines and had registered the vulnerabilities appropriately.
Its central argument is one of scope. “Overall, none of the vulnerabilities detailed in the report have an impact on our customers’ ability to carry out their public safety objectives,” the company wrote, with “customers” meaning police departments. Flock added that exploitation “would not only require physical access to a device, but also require intimate knowledge of internal device hardware.”
The company maintains the Flock system has never suffered a real breach, and issued a further statement in January in the United States.
Read those two positions side by side and the gap is obvious. Flock is measuring impact against operational continuity: can a force still run its plate checks? Researchers are measuring impact against data protection: can someone get at the images, the keys and the location data? Both can be true at once. A camera that keeps working is not the same as a camera that keeps secrets.
The uncomfortable part of this story is not that a determined researcher with a bought camera found weaknesses. Security research routinely finds weaknesses, and vendors routinely patch them. The uncomfortable part is the pattern: unencrypted images saved when no plate is present, API keys exposed through ordinary search techniques, firmware running on an Android version that stopped receiving security updates, and a feature set that detects people on hardware sold as a plate reader.
Forces that have signed contracts, and the communities they police, are entitled to ask some direct questions. What version of Android is on the cameras currently mounted in our area? Is MFA mandatory for every account with access, or optional? What exactly is captured and retained, and can that be demonstrated rather than asserted? Who audits the firmware, and how often? And when a vendor says a vulnerability has “no impact”, impact on what, measured how, and by whom?
Mass surveillance hardware sits in public space, paid for with public money, and increasingly underpins ordinary policing work. The security of that hardware is not a niche technical concern. It is part of the accountability bargain, and on the evidence so far, the bargain is being described in terms that suit the vendor rather than the public.
Until vendors publish independent security audits and forces publish the terms they agreed to, the public is being asked to take a lot on trust. After a secondhand camera cracked in under 30 seconds, that trust is going to need more than a blog post to rebuild.
One Comment