Vulnerability Discovery
A security researcher discovered a vulnerability in Flock’s website that gave him an access token without needing login credentials. The researcher used the information gleaned to build a map of Flock cameras and share it on a website he named the Flock Surveillance Map, which now lists the location of 335,701 cameras. Flock has now issued a trademark infringement complaint with the goal of having the researcher close the website.
Joshua Michael used this to query ArcGIS, a third-party mapping and geospatial layer that Flock uses, to retrieve a database of Flock devices in November 2025.
Michael said that he immediately informed the company about the security flaw. He said in his email, dated Nov. 13, 2025, that all testing was strictly non-intrusive, limited to open unauthenticated endpoints, and did not involve bypassing authentication, modifying data, or invoking any billable ArcGIS or Google operations. However, the company did not reply to his message, and it took him two more attempts before a representative responded. Flock said in its response that it was internally triaging the findings, but the researcher stated the company never followed up.
Mapping Surveillance
Flock apparently fixed the vulnerability in January after Michael published his findings, but the researcher was able to exfiltrate a Flock device location database before that. This information allowed him to build the Flock Surveillance Map website, which lists 335,701 cameras, presumably updated in December 2025.
The surveillance company stated that its cloud platform has never experienced a data breach, but Michael disputes this claim. He noted that the company made its announcement after he pulled their database of devices, pointing to either a transparency failure or a detection failure with potential security implications.
Security and Privacy Concerns
This issue raises ongoing questions about the company’s cybersecurity measures. Previous incidents included hackers extracting encryption keys directly from devices to view stored clips, alongside instances of misuse where individuals were improperly monitored.
Michael also pointed out that the ubiquity of the system could allow for tracking personnel near sensitive defense and government sites, as individuals living within a 20-mile radius of these locations face a high likelihood of passing a Flock camera.
Trademark Complaint
While Flock did not comment on the reporting before publication, a cybersecurity company acting on behalf of the surveillance firm reached out with a trademark infringement complaint. The firm requested that the Flock Surveillance Map website be taken down due to unauthorized use of the trademark.
