GoKawiil
Tech News
Hackers physically removed a Flock Safety license plate reader from a roadway, extracted an encryption key from its storage, and shared the recovered files with 404 Media and WIRED. The data showed the device's software identifies not just vehicles and plates but also people, bicycles, and even small details like bumper stickers, generating over a million images in just weeks of logs.
A hacker group calling itself stegan0gram physically removed a Flock license-plate-reading camera from a roadway pole, reverse-engineered its solar-powered hardware, and copied its storage. Inside, they found unencrypted partitions containing an encryption key that unlocked a trove of 27,321 short video clips and roughly 1.6 million images capturing over 50,200 vehicles across a 21-day logging period. The findings, examined jointly by 404 Media and Wired, showed the device also occasionally detected people on motorcycles, though no active facial recognition was found.
WIRED found that Flock, whose license plate readers are used by police nationwide, has quietly stopped specifying where its cameras are manufactured in recent marketing materials, despite years of touting domestic production. A US manufacturer that once listed Flock as a client removed the reference from its website amid growing public backlash against the company's surveillance technology.
Reps. Raja Krishnamoorthi and Michael Cloud introduced the No FLOCK Act, which would cut 10 percent of a state's federal highway funding unless it restricts automated license plate readers like Flock to five specific uses, such as tracking stolen vehicles or felony suspects. The bill excludes broader applications like traffic studies or minor drug enforcement, but does not ban the technology outright or restrict sharing plate data with agencies including immigration enforcement.
A group of hackers physically removed a Flock Safety license-plate camera, copied its internal storage, and recovered an encryption key that unlocked thousands of stored vehicle images. They shared the extracted files with 404 Media and WIRED, and separately with the transparency group Distributed Denial of Secrets, along with details of how they pulled off the extraction so others could replicate it.
A public records analysis by the Electronic Frontier Foundation found that police officers across the US frequently entered nonsensical or joking justifications—such as 'LMAO,' 'lol,' 'idk,' and random keystrokes—when required to explain searches of Flock's license plate reader database. The pattern spans roughly 2023 through 2026, showing that lack of accountability in these warrantless lookups is widespread rather than isolated.
Boston Mayor Michelle Wu confirmed the city has ended its use of Flock Safety's automated license-plate reader cameras after a vendor error let outside law enforcement agencies access BPD-collected vehicle data nationwide, despite a contract requiring the sharing feature be disabled. The city's 2025 surveillance report says the breach occurred within days of launching a pilot with about 45 cameras and was corrected once discovered, but Boston has since moved on to trials with Motorola and Axon instead.
Apple Wallet and Google Wallet now let users store a state driver's license or ID digitally, with built-in options to share only limited information—such as confirming someone is over 21—instead of a full birth date, address and license number. Both companies say the data is encrypted, stored locally on the device rather than in the cloud, and requires biometric or passcode authentication before any information is shared with a verifier.
Lindsey Brooke Isaacs, 23, spent nearly two weeks jailed in Florida on eight felony charges, including three counts of vehicular homicide, after investigators tied her Dodge Durango to a fatal hit-and-run using Flock Safety's automatic license plate reader network. The case relied heavily on a single ALPR sighting placing her vehicle miles from the crash scene, despite evidence including witness accounts and vehicle residue pointing to a maroon vehicle, not matching her car's actual details.
A dark web marketplace called Nexus was found selling access to a database containing roughly 153 million U.S. and Canadian driver's licenses and 3 million travel documents, according to Krebs on Security. The breach appears linked to identity verification firm IDScan, which is now investigating, while the FBI has also opened a probe; the Nexus listing vanished from the dark web after the report but its operators have not claimed to have deleted the stolen data.
An Electronic Frontier Foundation review of Flock Safety's license plate reader logs found police officers across the U.S. entering flippant or nonsensical justifications—like 'LMAO', 'LOL', 'idk' and random keystrokes—for searches spanning thousands of cameras. One Lake County, Indiana officer searched over 19,000 cameras across 1,558 cities with the stated reason 'LMAO', while more than 6,300 searches from over 30 agencies simply listed 'TBD'.
Public records reveal that law enforcement officers across multiple agencies searched Flock Safety's nationwide license-plate camera network using vague or joke-like reasons such as 'LMAO,' 'IDK,' 'hehe,' and 'asdfg' instead of legitimate case justifications. Flock's system requires officers to enter a reason before running a search, but the logs show many entries that appear to be careless or unauthorized lookups rather than tied to actual investigations.