Over 50 critical security vulnerabilities have been found in Flock Safety’s camera systems — the same cameras that photograph 150 million vehicles daily across 80,000 deployments nationwide, including four ALPR cameras right here in Price County.
Quick Answer: Security researchers found 50+ vulnerabilities in Flock cameras, including 22 assigned CVEs. Rural communities deploying these cameras without cybersecurity staff are least equipped to respond.
Editor’s note: We’ve been investigating Flock cameras in our county for months. Here’s what we’ve found: 50+ security vulnerabilities, zero cybersecurity staff at the county level, and four cameras photographing every vehicle that passes. That’s not a recipe for safety — that’s a pretty serious blind spot.
Over 50 critical security vulnerabilities have been found in Flock Safety’s camera systems — the same cameras that photograph 150 million vehicles daily across 80,000 deployments nationwide, including four ALPR cameras right here in Price County.
Quick Answer: Security researchers found 50+ vulnerabilities in Flock cameras, including 22 assigned CVEs. Flock Falcon cameras have unlocked bootloaders and unsecured diagnostic Wi-Fi. Rural communities deploying these cameras without cybersecurity staff are least equipped to respond to risks.
Over 50 critical security vulnerabilities have been discovered in Flock Safety’s camera systems. The same cameras that photograph 150 million vehicles daily across 80,000 deployments nationwide, including four ALPR cameras in Price County, have unlocked bootloaders, outdated operating systems, and at least one model that broadcast live footage to the open internet with no password required.
TLDR: Security researchers found 50+ vulnerabilities in Flock cameras, including 22 assigned CVEs. Flock Falcon cameras have unlocked bootloaders and unsecured diagnostic Wi-Fi. Flock Condor cameras were broadcasting live surveillance footage to the open internet. Rural communities like Price County that deploy these cameras without cybersecurity staff are the least equipped to assess or respond to these risks.
What the Researchers Found
In late 2024 and throughout 2025, independent security researchers documented what SimeonOnSecurity called “the most significant security failure in law enforcement surveillance technology in American history.” The findings come from three primary sources:
GainSec’s whitepaper “Examining the Security Posture of an Anti-Crime Ecosystem” documented 51 findings, 22 assigned CVEs, and 8 pending CVE assignments. The research was published on GitHub and gainsec.com.
Benn Jordan’s investigative journalism included hands-on security testing of Flock cameras. Jordan’s video investigation, referenced in the Independent Institute’s January 2026 reporting, demonstrated that Flock’s Condor cameras were broadcasting both live and archived footage directly to the open internet. No passwords or login credentials were needed.
De-Flock’s hardware analysis, examined by IPVM, “dissected the Flock Falcon” and detailed its hardware and software components. They found significant vulnerabilities including unlocked bootloaders, debug kernels, and unsecured Wi-Fi in diagnostic mode.
The Condor Camera Broadcast
The most alarming finding involved Flock’s Condor cameras. While Flock is known primarily for ALPR cameras, the Condor is a PTZ (pan-tilt-zoom) camera with onboard artificial intelligence that can identify humans and automatically track them.
**Jordan demonstrated that several Condor cameras were broadcasting live and archived police surveillance footage to the open internet.** Anyone with the URL could watch the feed. No authentication required. The Independent Institute reported in January 2026 that “exposed security flaws allowed unrestricted access to live and archived police surveillance footage.”
The auto-focus feature on these cameras raised additional privacy questions. A camera that can identify and track humans, broadcasting to the open internet, creates a surveillance tool that anyone, not just law enforcement, can access.
The Falcon Bootloader Exploit
The Flock Falcon, the ALPR camera model deployed in Price County, has its own set of vulnerabilities. IPVM’s analysis of the De-Flock whitepaper found:
**Unlocked bootloaders** allow firmware tampering. An attacker with physical access to a camera could replace the firmware, potentially redirecting plate data to a third-party server instead of Flock’s cloud.
**Debug kernels** provide root-level access to the camera’s operating system. This is a development tool that should be disabled in production hardware but was left enabled.
**Unsecured Wi-Fi in diagnostic mode** means an attacker within Wi-Fi range could access the camera’s diagnostic interface without a password.
IPVM noted that “end users face fundamental constraints in addressing these security vulnerabilities” because the issues stem from core software architecture decisions made by Flock, including an outdated Android 8.1.0 base system. Android 8.1.0 was released in December 2017 and stopped receiving security patches in 2021.
What This Means for Rural Wisconsin
Price County has 10 surveillance devices: four Flock ALPR cameras, two unbranded ALPR cameras, and four gunshot detectors. **All of these devices connect to networks, store data in the cloud, and run software that may contain the vulnerabilities documented by GainSec and De-Flock.**
Rural communities face a double bind. they’re the least likely to have IT staff who can assess cybersecurity risks, and they’re the most likely to accept vendor assurances at face value. The Price County Sheriff’s Office is unlikely to employ a cybersecurity specialist. The county board that approved the Flock purchase included no discussion of security risks in their August 15, 2024 motion.
If Flock’s cameras can be hacked, the implications extend beyond license plate data. The Condor camera broadcast vulnerability means that in some deployments, anyone could watch live surveillance footage of the area the camera covers. For a small town like Phillips or Park Falls, that means someone could watch who comes and goes from specific locations in real time.
**The GainSec whitepaper documents vulnerabilities that could allow bad actors to access camera feeds, tamper with firmware, or compromise entire surveillance networks.** For rural communities that don’t have the resources to audit their own camera systems, this is a hidden cost of the surveillance infrastructure that was sold as a crime-fighting tool.
Flock’s Response
Flock Safety declined to comment when asked by IPVM about the De-Flock analysis. The company hasn’t publicly addressed the 50+ vulnerabilities documented by GainSec, though SimeonOnSecurity’s reporting indicates that some CVEs have been formally assigned, meaning Flock has been notified through standard vulnerability disclosure channels.
The Independent Institute noted that Flock’s products “are frequently plagued by security vulnerabilities, either due to inherent flaws or user failure to follow best practices.” The distinction matters. Some vulnerabilities are design flaws in Flock’s hardware and software. Others result from how customers configure the cameras. **Rural departments without IT expertise are more likely to misconfigure devices, leaving them exposed.**
What Price County Can Do
If Price County wants to assess the security of its Flock deployment, here are practical steps:
1. Request a security audit. The Price County Sheriff’s Office can request that Flock provide a security posture report for their specific deployment, including which CVEs affect their camera models and what patches have been applied.
2. Check camera configurations. Ensure diagnostic mode is disabled, Wi-Fi is secured, and firmware is up to date. If the Sheriff’s Office doesn’t have staff to do this, the Price County IT department or a third-party consultant should be engaged.
3. Ask about Condor cameras. Price County’s ALPR cameras are Falcon models, but it’s worth confirming whether any Condor PTZ cameras have been deployed in the area. If so, their broadcast settings should be audited immediately.
4. File a public records request. Wisconsin’s public records law allows you to ask the Sheriff’s Office for their Flock security configuration, firmware versions, and any security incidents. They may redact sensitive details, but the request itself creates a record of public concern.
The Bigger Picture
Price County installed surveillance cameras with a single board motion and no public discussion. Those cameras may have 50+ known security vulnerabilities. The company that makes them refused to comment on the findings. **The rural community that deployed them has no cybersecurity staff to assess the risk.**
When a small town buys a surveillance system, the sales pitch is about crime. The security vulnerabilities are about the system itself becoming a target. In Price County, the cameras that were supposed to watch for criminals may themselves be vulnerable to criminals.
See also: our guide to free camping in Wisconsin
See also: what makes Price County communities special
See also: our guide to Price County public records