Image: Rawpixel
Flock Safety tells the public it runs more than 120,000 license-plate cameras in 49 states and logs about 20 billion vehicle images a month. Cybersecurity researcher Joshua Michael published a map of roughly 300,000 Flock-associated nodes: more than 170,000 cameras plus about 130,000 supporting devices — processors, networking gear, third-party camera links, and some 27,000 acoustic sensors. The two numbers are not the same unit. The gap still changes the picture. A camera count is a product line. A 300,000-node inventory is infrastructure.
How the Map Was Built
Michael says he found an unauthenticated access token in Flock’s systems in November 2025, notified the company, and used the token to query ArcGIS, the mapping service Flock uses. He archived a December 2025 snapshot and later checked some sites in person. Unlike crowd-sourced maps such as DeFlock, this one is built from what he describes as Flock’s own location records. Entries carry coordinates and, in some cases, labels and addresses.
One pin is tagged “FBI Pilot Camera” at the J. Edgar Hoover Building. That is a database label on Michael’s map, not an FBI confirmation of an operational program. Michael has argued a network this dense could expose travel patterns of agents, elected officials, and service members. That is his risk assessment. It is not evidence that a foreign service has queried the system.
Flock said in a January 2026 post that it has never had a data breach and that customer data was not taken. It treats earlier disclosures as vulnerabilities without exfiltration. Michael says the map came from location data sitting in Flock’s mapping stack. Whether an exposed infrastructure record is a “breach” of customer files is the fight the two sides have not settled.
The Hearing Without the Company
On September 23 the Senate Judiciary Subcommittee on Crime and Counterterrorism held “Always Watching: Flock’s Nationwide AI Surveillance Network.” Chair Josh Hawley invited Flock CEO Garrett Langley and the chiefs of Axon, Motorola Solutions, and Verkada. None appeared. Hawley said Flock has “probably heard of you.” Institute for Justice counsel Alasdair Whitney put the company’s own figures on the record: 120,000-plus cameras, 20 billion photographs a month, searches that let an officer in one state pull driving history from another with no federal statute in the way.
Witnesses who did show included Lindsey Isaacs, a Florida driver jailed 13 days after a Flock-aided vehicle match tied her to a fatal crash she says she did not cause; ACLU counsel Chad Marlow; and engineer Benn Jordan. Senators asked about retention, interagency sharing, and warrants. No Flock executive answered. Hawley left subpoenas on the table. After the hearing, pressure appeared to take Michael’s map down, including a trademark complaint whose filer is not clearly established as Flock in public reporting. A takedown demand is not a ruling on accuracy.
What the Public Still Does Not Have
Flock sells stolen-car hits and missing-person recoveries. Those uses are real. The map fight is about inventory: how many devices, of what kind, sitting where, searchable by whom, for how long. Cities and counties have already canceled or paused contracts in 2026. The Senate still does not have sworn testimony from the vendor on retention or default sharing.
A plate reader on a pole is one thing. A cloud that stitches 20 billion monthly captures to acoustic nodes and third-party feeds is another. Until the company sits for the questions Hawley asked, the public accounting is a researcher’s snapshot and a hearing the executives declined.
