A roadside camera designed to quietly document passing vehicles is now at the center of a much louder fight over how much of Americans’ daily movement should be recorded and searchable. A joint investigation by WIRED and 404 Media found that hackers with a group called stegan0gram physically removed a Flock Safety camera, copied much of its internal data, and gave the files to reporters. Analysis of roughly 21 days of recovered activity showed the camera photographed about 50,200 vehicles while generating approximately 1.6 million images. A typical vehicle encounter produced about 28 images, while some generated more than 100.
The investigation also revealed that the camera’s software was built to detect more than license plates. According to the report, its computer vision software could detect vehicles, bicycles, and people. In one example, the system isolated an American flag patch on a motorcyclist’s saddlebag as though it might be a license plate. The outlets said they found no evidence that facial recognition was actively operating on the camera.
One hacker affiliated with stegan0gram explained the group’s approach to the outlets: “We liberated hardware in the field, disarmed them, and proceeded with reverse engineering of the cameras and associated solar equipment.”
“Why just destroy them when we can reverse engineer them and find the secrets of those spying on us?” they added.
The findings matter because Flock cameras do not operate as isolated traffic cameras. According to WIRED, images are transmitted to Flock’s servers, where license plates and characteristics such as vehicle make, model, and color can become searchable records. Data from Flock cameras in Alpharetta, Georgia, was accessible to more than 2,000 agencies, illustrating how a camera installed in one community can become part of a much larger investigative network.
That scale is one of the biggest concerns raised by privacy advocates. The American Civil Liberties Union said in August that Flock operates more than 120,000 automated license plate readers nationwide. The ACLU argues that repeatedly recording the time and location of vehicles can allow authorities to reconstruct patterns involving where people live, work, worship, receive medical care, or spend their time, even when those drivers are not suspected of a crime.
Flock disputes the idea that its cameras create continuous personal tracking. In its own license plate reader policy, the company says its system collects license plate images, vehicle images and characteristics, plate numbers, dates, times, and camera locations. Flock says its cameras operate in publicly visible areas and maintains that customers control access to their data.
Questions about who ultimately accesses that information have fueled additional controversy. It was previously reported that some local police agencies conducted Flock searches on behalf of Immigration and Customs Enforcement and that an officer in Texas used the nationwide network to search for a woman who had self-administered an abortion. Flock says ICE does not have direct access to its cameras or systems unless agencies controlling the data expressly authorize access.
Concerns are not limited to federal access. The Guardian reported this month that a San Jose police officer was fired after department officials said he improperly used Flock data to locate a woman who had accused the officer’s cousin of domestic abuse. Police said the officer then shared her location with his cousin. The case became a concrete example of what can happen when a system capable of locating vehicles is misused by someone with authorized access.
Accuracy creates another concern. The Institute for Justice documented at least 27 cases since 2018 involving errors connected to stationary automated license plate readers, most occurring since 2023. In one February 2026 incident in Arkansas, the organization said a Flock camera misread a plate, and an innocent couple was detained at gunpoint. Its review also documented a Florida case in which a woman was jailed for 13 days after investigators wrongly connected her vehicle to a fatal crash.
Flock acknowledges in its own policy that license plate translations can sometimes be incomplete or inaccurate and directs users to confirm computer-generated information before acting on an alert. The company says low-confidence plate reads are not sent to users and describes inaccurate readings as infrequent.
The latest hacking investigation has added cybersecurity questions to that list. Responding to the findings, a Flock spokesperson said, “The unauthorized removal and tampering of a Flock camera is illegal.”
“Flock takes security seriously and maintains a public Vulnerability Disclosure Policy for security researchers to report potential vulnerabilities directly to us,” the spokesperson said. “We received no report through that process, and based on the limited information provided, we do not have enough detail to assess the claims being made.”
Flock has also announced changes to its system. According to an August company announcement, the recommended default retention period for new law enforcement customers was reduced from 30 days to seven days. Flock also announced Evidence Mode for information connected to active investigations, additional audit requirements, mandatory case codes, and expanded monitoring designed to detect possible misuse. The ACLU argues those changes do not address its central objection to routinely collecting location information on large numbers of people who are not suspected of crimes.
The debate has now reached state governments and Congress. Florida moved this month to remove automated license plate readers from state highway rights-of-way after transportation officials cited reports of misuse, privacy concerns and the rapid expansion of the technology. Florida Gov. Ron DeSantis said he did not want the state to become a “digital AI surveillance state where everything we’re doing is being tracked at all times.”
At the federal level, Rep. Thomas Massie and Rep. Eric Burlison introduced the Flock Off Act on September 2. According to official congressional information published through GovInfo, the bill would prohibit federal funds from being used to purchase, install, maintain, operate, or upgrade covered automated license plate readers and biometric surveillance camera systems.
Trump has taken a different position.
“No, I sort of like them [Flock cameras] because of that, because of law enforcement. But some people don’t. They think it’s an infringement,” before adding, “I like them.”
Law enforcement agencies continue to argue that Flock cameras can help recover stolen vehicles, locate missing people, and generate leads in serious crimes, while critics point to the expanding network, documented misuse, inaccurate hits, and cross-jurisdictional searches as reasons stronger limits may be necessary. The hacked camera did not settle that debate, but it exposed just how much information can be created before anyone ever types a license plate into a search box.
