A security researcher’s map appears to have identified 214,073 devices connected to Flock’s surveillance network—far more than the roughly 120,000 cameras the company has publicly acknowledged. The discrepancy may represent Flock’s private camera network, raising concerns about ownership, regulatory oversight, and the extent to which residents’ movements are being tracked. Rather than provide more information, Flock has sent the researcher a cease-and-desist letter demanding that he remove the maps, data files, and research papers.
In September, Michael described in a research paper how he discovered a Flock access token that could retrieve a device’s location without requiring a login. He notified Flock about the vulnerability while also creating a map intended to track the company’s devices.
Matt Bussell, founder of the software studio Tensorust, later analyzed the map and determined that it showed a network of 214,073 devices, rather than 120,000. The nearly 100,000-device difference likely represents Flock’s private camera network, Bussell warned, and may be operating without regulatory oversight.
“That’s more than Flock says out loud,” Bussell wrote.
Bussell told Ars that it is “concerning” that St. Lucie County has not investigated who owns the devices. Michael’s map and analysis highlight gaps in the public’s understanding of how extensively Flock may be tracking people’s movements. Flock’s statement also appears not to address residents’ concerns that their data could have been misused by unknown Flock customers.
“Flock’s lack of transparency is a recurring pattern. They seem to prioritize covering their network’s tracks over public accountability,” Bussell said. “My analysis suggests that this is a broader effort to limit visibility across operational capabilities, not just local camera placement.”
Amid mounting public criticism, Flock moved to protect the owners of the personal cameras believed to be located in St. Lucie County rather than increasing transparency. After Michael revealed the map, Flock sent him cease-and-desist letters accusing him of breaking the law by openly encouraging others to download sensitive data.
“Inadvertently exposed credentials do not facilitate access to private systems or data,” Flock said.
Flock demanded that Michael withdraw the maps, data files, and research papers. The company also asked him to identify the person who received the data. Flock claims that Michael knew the data was confidential and proprietary, and threatened to sue for statutory and punitive damages, as well as injunctive relief.
Source: arstechnica.com
