A hacker group calling itself stegan0gram physically removed a Flock Safety camera from above a roadway and copied its internal data.
The group shared the recovered files with 404 Media, WIRED, and the nonprofit leak archiver Distributed Denial of Secrets, known as DDoSecrets.
The data was made public and revealed in new detail how Flock Safety’s automatic license plate readers track not only vehicles but people as well.
The files showed the device captured 1.6 million images of 50,000 vehicles over just 21 days of operation, a striking volume of surveillance data.
Flock Safety has previously described its cameras as protected by on-device encryption, but the hackers were able to recover an encryption key stored directly on the device.
That key unlocked videos and image logs held in an otherwise secured partition, giving the group access to thousands of vehicle and individual detections.
The camera’s storage included unencrypted partitions labeled “vendor” and “media,” with the latter containing the key that unlocked the bulk of the material.
Recovered code showed the camera ran roughly 20 Flock-built applications handling motion detection, photography, object classification, data uploading, and remote updates.
The device’s processor was comparable to those found in midrange smartphones, according to the hackers’ technical analysis of its internal components.
The joint analysis revealed the cameras catalogued far more than license plates, logging bicycles, people, and granular details such as bumper stickers and clothing patches.
In one instance, the camera identified an American flag patch on a motorcyclist’s bag, illustrating the breadth of personal detail these systems routinely collect.
One hacker from stegan0gram made the case for reverse engineering over destruction, asking: “Why just destroy them when we can reverse engineer them and find the secrets of those spying on us?”
The group said it is also publishing details on how it obtained the software, hoping others with technical skills will replicate their approach.
Across the United States, multiple people have already been arrested for allegedly tampering with or sabotaging Flock cameras in their communities.
Some towns have responded to public backlash by announcing they will stop using Flock’s cameras altogether, reflecting growing unease with the technology.
In one notable case, a police department constructed a fake, 3D-printed Flock camera housing designed to bait and catch potential vandals in the act.
The stegan0gram findings build on earlier work by security researcher Jon “GainSec” Gaines, who reverse-engineered a Flock license plate reader in early 2025.
Gaines identified flaws in that earlier research that could have provided root-level access to the devices, raising similar concerns about the company’s security practices.
