Flock Camera Captured 1.6M Images in 21 Days as Leaked Code Shows It Detects People

A Flock Safety camera generated about 1.6 million images of roughly 50,200 vehicles across about 21 days of recoverable logs, according to a joint analysis of the device's data and software by WIRED and 404 Media.

The recovered software also explicitly detects people, recording where they appear in an image and how confident the system is in the detection. WIRED extracted the relevant models from the camera and found they detected a reporter in a selfie and people in 11 recovered video clips.

The material came from a Flock camera that hackers physically removed from a roadside location before making a near-complete copy of its stored data and software. The collective, which calls itself stegan0gram, shared the files with 404 Media and WIRED, which analysed them as part of a joint investigation.

One Passing Vehicle Produced Dozens of Images

The camera's software takes rapid bursts of photographs when something moves into view. A typical passing vehicle generated about 28 images, while some produced more than 100.

The camera used different exposures to capture both licence plates and wider scenes, then scanned the images, selected and cropped useful frames and sent them with other data to Flock over a cellular connection. The camera itself did not appear to read the plate or identify the vehicle's make, model or colour. That processing appeared to happen on Flock's servers.

Across the recovered logs, which covered several periods totalling about 21 days, the device photographed roughly 50,200 vehicles and generated about 1.6 million images. It logged around 3,300 vehicles on a typical day, with a peak of 4,454.

Older logs had been overwritten or were no longer recoverable, so the figures do not represent the camera's entire operating history. The 1.6 million images also do not represent 1.6 million unique people or separate encounters.

Recovered Code Explicitly Detects People

The camera ran about 20 Flock-built applications covering functions including motion detection, image capture, object classification, uploading data and remote updates.

The software explicitly detects people as well as vehicles, licence plates and bicycles. When it spots a person, it records where that person appears in the image and how confident the system is in the detection.

WIRED extracted the models from the camera's files and tested them against images and footage recovered from the device. The models detected a reporter in a selfie and were then run across 27,321 short video clips stored on the camera.

The clips were MP4 files, each about one to two seconds long, recorded at 1,024 by 768 pixels without audio. They were separate from the higher-resolution still-image bursts generated as vehicles passed.

The models detected people in 11 clips, all involving people riding motorcycles. The limited number of detections was partly a function of where the camera was mounted, above a roadway where pedestrians were unlikely to enter its field of view.

The tests also showed that the licence-plate detector could mistake other graphics for plates. In one recovered video, it cropped an American flag patch on a motorcyclist's saddlebag as though it were a licence plate.

Flock Says Camera Removal Is Illegal

Flock says its cameras do not perform facial recognition. WIRED and 404 Media found no evidence of active facial-recognition capabilities in the recovered software beyond features included by default in Android.

The recovered evidence shows person detection, but it does not establish facial recognition or the identification of pedestrians by name.

A Flock spokesperson said the unauthorised removal and tampering with a Flock camera is illegal. The company said it takes security seriously and maintains a vulnerability-disclosure process. It added that it had received no report through that channel and did not have enough information to assess the claims.

The recovered files offer a detailed look inside one Flock camera, from rapid-fire image capture to the software that selects frames, detects objects and sends data to the company's servers.