Flock Safety's automated license plate readers are built to help police recover stolen cars and find wanted suspects, but a joint investigation by 404 Media and WIRED found the hardware does more than watch plates. Software running on the device explicitly detects people, vehicles, bicycles and license plates, according to the investigation, which was based on data pulled from a camera that had been physically removed from a roadway.
The researchers say they found no sign that face recognition features were actively in use. Still, the discovery shifts a public debate that has mostly centered on cars and license plates toward a system that can flag pedestrians and cyclists as well.
The camera's storage also yielded an encryption key kept on the device, and that key opened videos of thousands of vehicle detections, the investigation found. Flock had said its devices were protected by on-device encryption. Hackers reportedly took the camera off the road and copied its storage.
Separately, WIRED reported that Alpharetta, Georgia records could be reached by over 2,000 agencies, among them police departments, colleges, airports and the Office of Inspector General for the federal General Services Administration.
The Washington, D.C. police union says the department's Internal Affairs unit used Flock data to track officers who were the subject of an investigation, and that the officers did not know about it. The union says it learned of the practice in July, then filed a complaint and asked the department to stop. It argued MPD lacked adequate controls for a surveillance system of that reach. MPD defended the use as appropriate in a misconduct investigation and said the labor dispute is headed to arbitration.
The findings land alongside a run of recent warnings about links and messages that look trustworthy but are not. Malwarebytes Labs has described phishing messages that pose as USPS and as courier brands in France, Spain, Italy and the Netherlands. It has also documented fake Bitrefill checkout pages reached through lookalike domains in search results; Bitrefill sells gift cards, eSIMs and mobile top-ups payable in cryptocurrency.
