The facts
A cybersecurity researcher, Joshua Michael, published a map this week of what he says are about 300,000 Flock Safety devices across the United States. The Intercept reported the breakdown on Sept. 24: more than 170,000 cameras, plus more than 130,000 other gadgets, including about 27,000 acoustic detectors and gear that ties in third-party cameras. Flock told reporters this summer it operates more than 120,000 cameras. The map was cited Wednesday at a Senate Judiciary subcommittee hearing on the company.
The dots did not come from people walking around with a notebook. In November 2025 Michael found an access token leaking from Flock's site, no login required. With it he could query ArcGIS, the mapping platform Flock uses, and pull device locations. He emailed the company on Nov. 13 and said his testing stayed on open, unauthenticated endpoints. He followed up twice. A Flock reply said the findings were being triaged. He says he never heard the next step. In December he downloaded the location data. In January he wrote it up. After that post, the hole appears to have been closed.
The Intercept checked six random Arizona coordinates on the map. A Flock camera was at each one. The dataset names cameras the way Flock named them. One, "FBI Pilot Camera," sits at the coordinates of the J. Edgar Hoover Building. About 860 devices cluster at the Rosemont Public Safety Department, just outside Chicago O'Hare. Another, titled "C-F-23 FOXTROT MALE HOLDING 2/SHOWERS," sits at the coordinates of the Silverdale Detention Center in Chattanooga.
In January, after Michael's writeup, Flock published a blog post saying it had never been hacked and there had not been a leak of Flock information. Michael told the Intercept that claim came after he had already pulled the device database. His line: either they knew and did not say so, or they did not notice.
On Thursday, Michael was told that Doppel, a firm that says it works for Flock, filed a trademark complaint. The complaint says his site uses the words "FLOCK SAFETY" without permission and that this may confuse customers. Doppel asked that the site be taken down. The map already carries a pop-up that says it is not affiliated with or endorsed by Flock. This is a trademark demand, not a court order.
Our take
The company that photographs every license plate in America is upset that someone published the camera list. Not a leak of your plates. A leak of their poles.
They spent the summer telling reporters the network was 120,000 cameras. The spreadsheet they left sitting behind an unlocked token said 170,000 cameras and another 130,000 boxes, including one pointed at the showers in a county jail and one named for the FBI on the FBI's own block. A researcher mailed them the hole in November. They said they were triaging it. Then they wrote a blog post that nothing had leaked. Then, once the dots were on a public map and a Senate subcommittee had the number, a vendor showed up with a trademark form and asked for the website to die.
Customers are not confused. The pop-up says it is not Flock. The confusion Flock actually fears is a driver looking up and finding the camera the company would rather keep as a rumor. You can track the country. You just cannot be mapped doing it.
