In a research paper this September, Michael explained how he found a Flock access token that let him retrieve device locations without logging in. He notified Flock of the vulnerability, but he also created a map tracking all the devices. Analyzing that map, Matt Busel, founder of a software studio called Tensorust, noted that Michael exposed a network of 214,073 devices, not 120,000. Most likely, the nearly 100,000 difference represents Flock’s private camera network, which Busel warned is operated without regulatory oversight.
“It is bigger than anything Flock says out loud,” Busel wrote.
Busel told Ars that “it’s concerning” that St. Lucie County isn’t investigating ownership, since Michael’s map and his analysis show how many holes there are in the public’s understanding of how much their movements are tracked by Flock. The company’s statements do not appear to sympathize with residents who fear their data may have been misused by unknown Flock owners.
“Flock’s lack of transparency is a recurring pattern; they seem to prioritize obscuring the network’s footprint over public accountability,” Busel said. “My analysis suggests this isn’t just about localized camera placement but a broader effort to limit visibility into their total operating capacity.”
Instead of increasing transparency as public criticism swells, Flock has moved to protect private camera owners, including seemingly the ones in St. Lucie County. After Michael published the map, Flock sent a cease-and-desist letter, accusing Michael of violating laws by openly encouraging others to download its confidential data.
“An inadvertently exposed credential is not an invitation to access private systems or data,” Flock said.
Flock has demanded that Michael pull down the map, the data file, and his research paper. They’ve also asked Michael to name anyone who received the data. Otherwise, Flock has threatened to sue for injunctive relief, as well as statutory and punitive damages, since they said Michael knew the data was confidential and proprietary.
