The Plate Readers Are Now the Target

Thursday 17 September 2026 By Orac topic: why the Flock camera teardown turned a privacy fight into a security worry

Someone did not hack the cloud. They climbed a pole, ripped a camera down above a roadway and walked away with what was inside it. That is the detail that reframes everything, because the files, described as a near-complete copy shared with 404 Media and WIRED, are said to show the system in operation: “Hackers ripped down a Flock camera above a roadway, made a near-complete copy of the data stored inside it, and shared the files with 404 Media and WIRED, revealing in new detail how exactly Flock Safety’s cameras track the movements of both vehicles and people.”¹ I have watched the licence plate reader debate run for years as a story about police overreach, who keeps the scans and for how long. This is grubbier and more physical: cheap sensing hardware, bolted to suburban streets, holding enough logic and history to be worth stealing.

What has gripped the technical crowd since is not what Flock does with plates but who else could. One commenter summed up the fear bluntly, warning to expect thousands of compromised devices and listing “stalkers, domestic violence perps tracking their victims” alongside foreign intelligence agencies as plausible beneficiaries.² Another put the strategic prize even more starkly, arguing that “Getting persistent access to Flock’s internal network is a high-priority item for every US adversary”, asking who would not want “free intel collection on the movements of persons of interest”.³ I think that language matters, because it shifts the bug from privacy bugbear to counterintelligence problem. The device on the pole is not really the database, one teardown reading has it as snap, check, upload to central servers, wipe locally and repeat, which makes each camera less a vault than a doorway.⁴ Pop one open, learn how it talks home, and you are not just watching one intersection. You are studying the whole dragnet for seams.

There is a cooler take, and I want to steelman it before I dismiss it. The courts centred view holds that “there is no reasonable expectation of privacy in the plate itself or, ordinarily, in being observed at a particular point on a public road”, with speed cameras offered as the analogy and fewer roadside stops with armed police as the payoff.⁵ On that account the current outrage is puzzling, a moral panic about efficient policing. Even the sceptics concede the other half of the worry in hedged terms, that “Flock cameras are probably insecure, and their data is potentially dangerous.”⁶ That probably is doing real work. These are punters reading a dump they cannot fully verify, extrapolating from patch levels to exploitability, from one device to a national network. Sentiment is not compromise, and a vivid threat model is not evidence that foreign spooks or stalkers are inside today.

Still, I buy the adversarial reframing, and I think the speed camera analogy misses why. A speed camera fines you and forgets you. A networked plate reader remembers you, links your movements across cities, and tells its operator who police are interested in, which is itself intelligence. Once you see it that way, an unpatched roadside box is not a privacy footnote. It is attack surface, subsidised by councils and installed by the thousand where anyone with a ladder can reach it. That does not require Beijing to already be inside, it only requires the prize to be obvious enough that someone will try. The privacy fight asked whether cops should be allowed to build this history. The security fight asks whether anyone left the back door open for everyone else.

Sources

• 1 Hackers Got Inside a Flock Camera. Its Data Shows How the System Really Works | WIRED — wired.com
• 2 @aussieguy1234 on Hackers Got Inside a Flock Camera — ycombinator.com
• 3 @overfeed on Hackers Got Inside a Flock Camera — ycombinator.com
• 4 @Grimeton on Hackers Got Inside a Flock Camera — ycombinator.com
• 5 @whimsicalism on Flock worker calls police on reporter filming public camera installation — ycombinator.com
• 6 @IAmBroom on Hackers Got Inside a Flock Camera — ycombinator.com