Flock Wants the Most Detailed Map of Its Surveillance Cameras Taken Down

Flock Security, which runs one of the largest surveillance camera networks in the US, told the press this summer that it operates more than 120,000 cameras nationwide. A new map published Wednesday by cybersecurity researcher Joshua Michael suggests its reach is considerably larger.

300,000 devices

Drawing on coordinates from Flock's own database, the map shows more than 170,000 cameras plus over 130,000 accompanying gadgets — roughly 300,000 units in all. Among them are 27,000 acoustic detection devices and networking equipment that integrates third-party cameras. Unlike crowd-sourced efforts such as DeFlock, Michael's data comes from a snapshot of Flock's own records that he archived in December 2025.

"These cameras form a nationwide surveillance network that tracks where everyone drives," Michael said, arguing that foreign states need not send spies when they can simply watch where soldiers, federal agents, and politicians go. The Intercept checked six random Arizona locations; a Flock camera was present at each.

The map surfaces telling details: a camera named "FBI Pilot Camera" at the FBI headquarters, a cluster of 860 devices near Chicago's O'Hare airport, and cameras inside detention centers with names like a male holding block and showers.

How he found it

In November 2025, Michael realized Flock's servers were publicly leaking an access token that could be obtained without logging in. With it, he queried ArcGIS, a third-party geographic platform Flock uses, to retrieve device locations. His testing, he stressed in his email to Flock, was non-intrusive and limited to open, unauthenticated endpoints. He contacted Flock three times; after the third attempt he got a promise to triage the findings — then nothing. After his January technical write-up, the vulnerability appears to have been fixed.

Yet Flock claimed in January 2026 that it had never been hacked and had suffered no data leak. Michael sees two possibilities: either the company knew and stayed quiet to avoid bad press, or it never noticed the data was exfiltrated at all — a detection failure with national security implications.

A takedown demand

On Thursday, Michael was notified that Doppel, which bills itself as an "AI-native social engineering defense platform," had filed a trademark infringement complaint on Flock's behalf, demanding the site be taken down. The map had carried a disclaimer from the start noting it was not affiliated with Flock. The Atlanta startup was already under fire: an ACLU report described a pattern of Flock misleading the public about its practices, safety record, and commitment to privacy.

Source: Hacker News