The camera they sold you as a license-plate reader detected 50,200 vehicles in 21 days. The code it was running did something else.

The stegan0gram collective ripped a Flock camera off a roadway pole, recovered the encryption key sitting unencrypted on a partition called “media,” and handed the files to WIRED and 404 Media on September 16 [1][2]. The logs covering 21 days show 1.6 million images, ~3,300 vehicles per day, and a midrange processor running ~20 Flock-built apps [1][4].

The vendor line for years: “automated license-plate reader, no facial recognition.” The code says otherwise: the on-board software explicitly detects people, logging where the person appears in frame and a confidence score. WIRED extracted the model from the device and ran it across 27,321 short video clips stored locally (MP4, 1-2 seconds). It detected people in 11 of the 27,321 clips — all on motorcycles, because the camera points down at the roadway [1][3].

WIRED and 404 Media found no evidence of active facial recognition beyond the default functions of Android. That is not a “clean bill of health” — the legal distinction between “person detection” and “facial recognition” does not resolve the operational problem. A detected person matched to a vehicle by movement pattern becomes person-based tracking in practice [3].

The question your next ALPR RFP should ask in writing — to the manufacturer, before signing — is whether its camera performs on-board person detection with confidence scoring, or whether processing happens only on the server. If the answer is “yes, on-board,” the next question is what your vendor does with those detections locally: discard them, retain them, index them against the plate hash, share them with its national network.

A “license-plate reader” camera that detects people on board is not a license-plate reader — it is a surveillance camera with an ALPR attached. The difference is the question your next contract should answer in writing, not in the vendor press kit.

P.D. Does your current RFP ask the vendor, in writing and before signing, whether its camera detects people on board — and what it does with those detections? If the answer is “I don’t know” or “we didn’t ask,” today is a good day to revisit the question.

📰 Sources: WIRED + 404 Media joint investigation (Sep 16, 2026) + Malwarebytes + Mashable + NewsNation corroborations.

Sources

[1] WIRED — Hackers Got Inside a Flock Camera. Its Data Shows How the System Really Works (Sep 16, 2026) — https://www.wired.com/story/hackers-flock-camera-data-shows-how-system-works/ [2] 404 Media — Hackers Stole Flock’s Camera Software (Sep 16, 2026) — https://www.404media.co/hackers-stole-flocks-camera-software-revealing-how-the-company-tracks-cars-and-people-2/ [3] Malwarebytes — Flock cameras are tracking people as well as cars (Sep 17, 2026) — https://www.malwarebytes.com/blog/privacy/2026/09/flock-cameras-are-tracking-people-as-well-as-cars [4] Mashable — Hackers dismantle Flock camera to see what makes it tick (Sep 16, 2026) — https://mashable.com/tech/hackers-dismantle-flock-camera-to-see-how-it-works [5] NewsNation — Flock camera hack exposes how it tracks vehicles and people (Sep 17, 2026) — https://www.newsnationnow.com/crime/hackers-rip-down-flock-camera-share-findings/