Flock Exposed Its AI-Powered Cameras to the Internet. We Tracked Ourselves (404media.co)

I just watched the Benn Jordan's video on this. Even if this is just configuration error on some of their cameras this is terrifying and I think they should be held accountable for this and their previous myriad of CVEs.

Flock or their defenders will lock in on the excuse that “oh these are misconfigured” or “yeah hacking is illegal, only cops should have this data”. The issue is neither of the above. The issue is the collection and collation of this footage in the first place! I don’t want hackers watching me all the time, sure, but I DEFINITELY don’t trust the state or megacorps to watch me all the time. Hackers concern me less, actually. I’m glad that Benn Jordan and others are giving this the airtime it needs, but they’re focusing the messaging on security vulnerabilities and not state surveillance. Thus Flock can go “ok we will do better about security” and the bureaucrats, average suburbanites, and law enforcement agencies will go “ok good they fixed the vulnerabilities I’m happy now”

It's 2025. The ISP gateway I got comes with more default security than these cameras. The barrier to entry on security is lower than it ever has been in history. Whoever let this past the QC phase is an idiot.

Really great investigation, what's the URL of the "vibe coded" site with the access links?

I don't want these cameras to exist but, if they're going to, might we be better off if they are openly accessible? At the very least, that would make the power they grant more diffuse and people would be more cognizant of their existence and capabilities.

At what point does the top brass at Flock get arrested?

flock is the most heinous reflection of the ills of our current socioeconomic structure. absolutely nobody should be okay with mass surveillance, much less mass surveillance enabled by a private company.

remember when people first started experiencing TSA and there were massive protests at how obscene and violating it all was, then uncovering how useless they were as fake security theater

and they were going to get it all shut down

TWENTY-FIVE YEARS NOW

so good luck getting rid of flock where people don't even know it's happening

Not sure if people realize that cellphone locations, several layers in the firmware and software, can be had without warrant by anyone YEARS LATER

i guess that while it is alarming that these feeds were "unsecured" I'm just as concerned that they exist at all. Folks worry about it getting into the "wrong hands" but from my POV it was put up by the wrong hands.

While both are a problem I am far more concerned about the power this gives our, increasingly authoritarian, government than about individual stalkers/creeps.

I would love to watch a shorter version of this video that just discussed the deltas between the status quo and Flock, rather than breathlessly reporting the implications of cameras as if they were distinctive to Flock. He'll spend 30 seconds talking about how you can see every activity and every person on the camera --- yeah, that's how cameras work. There are thousands of public IP cameras on the Internet, aimed at intersections, public streets, houses, playgrounds, schools; most of them operated that way deliberately.

There are Flock-specific bad things happening here, but you have to dig through the video to get to them, and they're not intuitive. The new Flock "Condor" cameras are apparently auto-PTZ, meaning that when they detect motion, they zoom in on it. That's new! I want to hear more about that, and less about "I had tears in my eyes watching this camera footage of a children's playground", which is something you could have done last week or last year or last decade, or about a mental health police wellness detention somewhere where all the cops were already wearing FOIA-able body cams.

If open Flock cameras gave you the Flock search bar, that would be the end of the world. And the possibility that could happen is a good reason to push back on Flock. But that's not what happened here.

Children could go missing thanks to Flock default settings. HN would tell me to never attribute to malice ... but there may be criminal negligence.

To cover their butts I strongly suggest Flock implement a default "grading system" that will show a city in a banner at the top of their management and monitoring system that based on their camera and network configuration they get an A+ to F-. If the grade is below a C then it must be impossible to get rid of the banner and it must be blinking red. The grading system must be both free, mandatory and a part of the core management code. This assumes Flock will have the willpower to say no when a city demands removal of the flashing red banner. Instead up-sell professional services to secure their mess. I would like to see the NCC Group review their security and future grading system.

Oh no. Someone can view cctv data and delete it. Always blown out of proportion. The likelihood of someone a) committing a crime or otherwise b) knowing there was this specific brand of camera software being run on a camera in that area c) knowing how to access these portals

Is basically zero.

For more context here Flock Safety is a YC-backed company [1][2]

[1] https://www.ycombinator.com/companies/flock-safety

[2] https://x.com/garrytan/status/1856016868580151615

Yes, they should be secured so they can only be accessed by law enforcement.

But if your spouse/SO/sister/mother/girlfriend/whatever was assaulted while jogging in a park that had Flock cameras, and it allowed law enforcement to quickly identify, track, apprehend and charge the criminal, you'd absolutely be grateful for the technology. There's nothing worse than being told "we don't have any leads" when someone you care about has been attacked.

If the cameras are recoding public areas, isn’t it better the recorded footage stays public

It's getting pretty crazy out there. What's your recourse for this? Avoid most populated areas?

Him reading the Flock statement on a Flock camera open on the internet was just so good. I love and support Benn Jordan.

[flagged]

Related:

https://news.ycombinator.com/item?id=46356182 Benn Jordan – This Flock Camera Leak Is Like Netflix for Stalkers [video] (youtube.com)

You could kinda already do this with all kinds of security cameras. There are only so many people who are computer proficient, and that number is lower than the number of camera installers.

There have been cases of people getting into baby monitors and yelling at the baby.

But as a tech company, this is extremely irresponsible

BTW, Benn Jordan is also known as The Flashbulb, an ambient legend

Interesting, but nothing new. Shodan users have known about clueless IP camera owners that leave their cameras on the public internet for years. This is a little more interesting because it's from a well-funded startup rather than independently owned Chinese IP cameras.

Easy solution for Flock problem: get rid of visible license plates. Make them 2x1" of size and RFID-readable, give readers to police, problem solved.

Not-that-easy solution is legal ban for such surveillance.

None of these both will happen though.

You accepted TSA and PRISM, you will get used to Flock too.

Next is Flock but for people, with face recognition.

Kirlian Selections rocks

Associated Benn Jordan video post: https://www.youtube.com/watch?v=vU1-uiUlHTo