Top
Best
New

Posted by chaps 18 hours ago

Flock Exposed Its AI-Powered Cameras to the Internet. We Tracked Ourselves(www.404media.co)
Archive Link: https://archive.ph/IWMKe

Also: https://www.youtube.com/watch?v=vU1-uiUlHTo – This Flock Camera Leak is like Netflix For Stalkers

570 points | 398 commentspage 3
tptacek 16 hours ago|
I would love to watch a shorter version of this video that just discussed the deltas between the status quo and Flock, rather than breathlessly reporting the implications of cameras as if they were distinctive to Flock. He'll spend 30 seconds talking about how you can see every activity and every person on the camera --- yeah, that's how cameras work. There are thousands of public IP cameras on the Internet, aimed at intersections, public streets, houses, playgrounds, schools; most of them operated that way deliberately.

There are Flock-specific bad things happening here, but you have to dig through the video to get to them, and they're not intuitive. The new Flock "Condor" cameras are apparently auto-PTZ, meaning that when they detect motion, they zoom in on it. That's new! I want to hear more about that, and less about "I had tears in my eyes watching this camera footage of a children's playground", which is something you could have done last week or last year or last decade, or about a mental health police wellness detention somewhere where all the cops were already wearing FOIA-able body cams.

If open Flock cameras gave you the Flock search bar, that would be the end of the world. And the possibility that could happen is a good reason to push back on Flock. But that's not what happened here.

fuzzylightbulb 13 hours ago||
Have you ever gone fishing? Did you catch all the fish?

Often it is more impactful to address one major/tangible player in a particular space than it would be to "boil the ocean" and ensure that we are capturing every possible player/transgressor. I agree that some of the video was overly breathless, but if that's what wakes people up to the dangers of unsecured cameras/devices then so be it.

tptacek 13 hours ago|||
Ok, you're the second person to say that, and I think my point is not clear enough. That's on me.

This response would make sense if I was saying "why focus on Flock, there are so many other ALPR cameras out there" (also true, but not relevant to my point).

But this is a video that is mostly about things that are true of all IP cameras, of the kind that we've had staring out onto public streets for decades, plural decades. People celebrated those cameras, thought they were super neat, built sites indexing them. All of them do most of the same things this video says those Flock cameras did, the tiny minority of Flock cameras you can access publicly.

hackable_sand 1 hour ago|||
Many hands make light work
jkestner 16 hours ago|||
In my experience, people respond much more strongly to naming a specific company or person. Clearer plan of action than a resigned “This tech is old news.”
tptacek 16 hours ago|||
Is the plan of action "eliminate all public IP cameras"? That's coherent, I'd get it, but that doesn't seem to be what he's saying at all. He used a Google search to find exposed Flock admin consoles (interesting! say more about that!) but he could just as easily have just searched "open IP cameras"; there's sites that do nothing but index those.
akerl_ 16 hours ago|||
If your takeaway from that comment is that ‘tptacek thinks Flock’s tech is old news and he’s resigned about it, I think you’re going to be in for a treat.
dang 12 hours ago|||
(This was originally posted to https://news.ycombinator.com/item?id=46356182 but we've since merged the threads.

The video in question is linked from the toptext above.)

phyzome 15 hours ago|||
He's pretty open in this video about how Flock is far from alone in this space, and he's just using them as an example because they're so popular and flagrantly abusive.
tptacek 14 hours ago||
In what way this is an illustration of Flock's "flagrancy"? I'm seriously asking. I'm not a Flock supporter. My point is that cameras just as sensitive as the ones he shows here are deliberately public on the Internet.
phyzome 14 hours ago|||
His other two (much longer) videos go into those details. This one is more of a quick update.

Just to give you a sense of the kind of company we're dealing with, the CEO of Flock called the guy who made a Flock camera map an "antifa terrorist". He's unhinged.

tptacek 14 hours ago||
Thanks! I know it's a big ask, but can you give me pointers (rough timestamps, whatever). A friend told me to watch this video for the distinctive Flock badness, and the time I spent on that was not rewarded.
phyzome 10 hours ago||
Sure, around 33:00 here: https://www.youtube.com/watch?v=uB0gr7Fh6lY

The other video is https://www.youtube.com/watch?v=Pp9MwZkHiMQ but I don't recall which one goes more into it.

It's also possible I'm just remembering Flock-specific stuff from other sources, and the things he shows in these videos are more general issues with security camera companies (using Flock as the example).

It would be great if this stuff was (also?) published as blog posts so that it could be easily skimmed...

tptacek 9 hours ago||
Thanks! I looked, but that's a segment about someone at Flock accusing anti-Flock people of being "antifa" or terrorists. I'm about as anti-Flock as I think it's possible to be (having been instrumental in killing it my Chicagoland suburb) and I'm not not sure what to do with "someone at Flock said something dumb".

In case it helps: my thing here is, the video we were commenting on thread seems to be about all public cameras, not just AI-assisted smart cameras or even security cameras more broadly. That was my complaint.

It's not that I don't think there's a video to do about 60 open Flock admin consoles; I'm sure there is. I'm just not sure what the implications are, because that video spent all its time talking about stuff that is trivially true of all public cameras, many of which are indexed on Google already, not through Google-dork searches for open console but instead with searches like "open IP camera live streams".

(I was struck by this in part because I vividly remember when Russia invaded Ukraine flipping between dozens of different live camera streams in places like Mariupol; that's obviously not the US, but you can do very similar stuff in the US, and on a lot more than 60 random misconfigured Flock cameras).

I think there may be something to the PTZ on the new Flock cameras that makes this worse? I just think he should make a better, sharper video case against them.

Thank you for giving me a link!

ryandrake 14 hours ago|||
It's the attitude and marketing. Maybe not "flagrant" but "ambitious," "aggressive," and "expansive." I don't know the name of any other public surveillance/camera company, but I've heard about Flock, and the same is probably true of any of my neighbors who are even the least bit tech-following. They are also ambitiously funded for growth and expansion and their outward press attitude is congruent.

Other camera companies would like to see steady year-over-year growth in camera sales. Flock would like to see the world blanketed in 24/7 surveillance.

They make themselves a lightning rod as a business strategy.

tptacek 14 hours ago||
If Flock vanished off the Earth tomorrow I think we'd see exactly the same ALPR penetration. Municipalities aren't buying these things because Flock's so good at selling them; they're buying because the ALPR vendors have an extremely compelling pitch! Two of our neighboring municipalities have non-Flock ALPRs; I think you're going to see a lot of non-Flock ALPR penetration in progressive-leaning suburbs, for instance, because progressives are all het up about Flock.

(I helped get Flock cancelled in Oak Park, where I live, and before that led the passage of what I believe to be the most restrictive ALPR regs/ordinance package in the country. I'm not an ALPR booster.)

But I'm going to keep saying: my thing about this video is that he's describing mostly things that are true of all public IP cameras. There are zillions of those!

ryandrake 14 hours ago||
I think everyone in this thread can agree that surveillance cameras should be fought against, no matter whose brand is stamped on them. Flock is still a better than average target because of the attitude they project and because of name recognition.
tptacek 14 hours ago||
Wait, I don't agree with that. Why do you assume everyone in this thread agrees with that?
ryandrake 13 hours ago||
Sorry, I assumed you did, given the advocacy you mentioned you led.
tptacek 13 hours ago||
I pushed back on our Flock deployment because the particulars of its deployment meant that we were curbing more cars driven by innocent Black drivers than we were responding to any meaningful crimes, and because when we had Flock's alerts enabled, the net effect was to take our selectively-recruited, highly-trained, very expensive police force and turn them into failure-to-appear-warrant debt collectors for nearby suburbs with far worse police departments.

It was not some nerd† principled stand against "surveillance". My experience working on the public policy of this stuff is that when you take a stand against "surveillance", normal people --- and I'm in what I believe to be one of the 10 most progressive municipalities in the country, the most progressive municipality in Chicagoland --- look at you like you're a space alien.

† I am, obviously, a nerd, fwiw.

fuckflock 16 hours ago||
[dead]
SamInTheShell 17 hours ago||
It's 2025. The ISP gateway I got comes with more default security than these cameras. The barrier to entry on security is lower than it ever has been in history. Whoever let this past the QC phase is an idiot.
embedding-shape 17 hours ago||
> Whoever let this past the QC phase is an idiot.

It's all a matter of perspective. I'm sure to some executive somewhere, the person/s who approved all of this is seen as heroes, as they shaved of 0.7% or whatever from the costs of the development, and therefore made shareholders more money.

Until there are laws in place that makes people actually responsible for creating these situations, it'll continue, as for a company, profits goes above all.

jandrese 16 hours ago|||
It probably makes close to no difference in development or production, but it does significantly cut down on the number of tech support calls from people who can't figure out how to set the password, or immediately forget the password they set. If it has no password then you can just plug it in an have it work. Sure it's totally insecure, but its also trivial to install.
embedding-shape 16 hours ago||
Generating a password that is unique to the device and print it with a sticky label on the underside of the device isn't exactly rocket-science, and ISPs somehow figured this out at least two decades ago, which was the first time I came across that myself. Surely whoever developed this IP-camera has an engineering department who've also seen something like this in the wild before?
jandrese 16 hours ago||
Yep, but if you do that you need to staff a help line with people who can say "turn the box over and look at the sticker, no the sticker with the numbers on it, it's white with black letters and says PASSWORD in a big font, no the password isn't literally PASSWORD, it's the line below that with the strange letters, yes, to type that one you need to hold the shift key and press 3..."

Remember that ISPs often have people who come to your home to hook stuff up.

embedding-shape 16 hours ago||
Yes, which costs money, which is exactly my original point. It's not because "Oh I'm so hassled because customers are dumb", it's "No, hiring people to do support would cost us money, which we don't want".

> Remember that ISPs often have people who come to your home to hook stuff up.

I can't recall a single time a technician wasn't required to come to my flat/house to install a new router. I'm based in Spain, maybe it's different elsewhere, but I think it's pretty much a requirement, you can't setup the WAN endpoint or ISP router yourself.

jandrese 16 hours ago||
Last time I moved I opted for the "self install" kit, which was fine because I'm technical and the previous owners already had the service so there was nothing that needed to be done except hooking up the pre-configured modem. Saved me $200 in truck roll fees.
embedding-shape 15 hours ago||
Interesting stuff, I've asked if I could do the installation myself every single time I've moved to a new place, and never has the ISP (three different ones) said yes. There isn't any installation fee place(probably by law?) so that isn't an issue here, just a hassle to coordinate having to meet between 12:00 and 18:00 or some super wide range of time for them to come and install it.
ewoodrich 15 hours ago||
In the US for the past 5+ years Xfinity/Comcast, Charter, and whatever CenturyLink is called these days have all heavily pushed the "self-install kit" option vs traditional tech install each time I've moved.

Worked 4/5 times (all with cable), only time it failed was because I had apparently subscribed to a DSL plan from CenturyLink without realizing and they needed to wire up the extra lines upstream for the "modern" version of DSL to work in my apartment. After insisting multiple times that the self-install kit was 100% plug-n-play at my new address despite my intense skepticism since I really needed reliable internet from Day 1 during COVID remote work.

I was seriously missing Comcast/cable by the time that 1 yr contract was up, the devil you know and all...

braingravy 16 hours ago||||
Yep. Until we start holding decision makers responsible for the consequences of their decisions, they will always choose the selfish option.
SamInTheShell 17 hours ago|||
So you're trying to justify this type of rampant negligence in tech? Do you think justifying such malfeasance makes up for fact we literally have surveillance networks that bad actors can tap to do really awful things?

Anyone that cares about their perspective has missed the point.

MSFT_Edging 16 hours ago|||
I don't think the person you're replying to is justifying it, but saying there's no laws to prevent the abuse.

Personally I think tech CEOs should be put in stocks in the town square on the regular but they're protected from any form of repercussions besides extreme cases of fraud. Even then, they're only held accountable when the money people have their money effected, not when normal people are bulldozed by the abuse.

SamInTheShell 16 hours ago||
If I was 10 years younger, I might agree that they aren't justifying it, but I have enough experience with passive speech to just not let it pass anymore.

Regarding remedy, we really need laws on this stuff yesterday. The problem is that we have to gut first amendment freedoms for some of this stuff, which wont go anywhere because there will always be too much overreach with today's representatives.

yunwal 16 hours ago||
You should probably read the comment you're replying to before replying

> Until there are laws in place that makes people actually responsible for creating these situations, it'll continue, as for a company, profits goes above all.

They obviously meant that we ought to be holding these people responsible.

SamInTheShell 15 hours ago||
> You should probably read the comment you're replying to before replying

Congrats you spotted the thing we agreed on between comments. If you fail to see the agreement through parity of the part that was echoed, idk what to tell you. Education system is failing everyone in it these days.

embedding-shape 16 hours ago||||
> So you're trying to justify this type of rampant negligence in tech?

Don't know how you reached that conclusion, I obviously isn't trying to justify anything. But maybe something I said was unclear? What exactly gave you the idea I'm trying to justify anything of this?

SamInTheShell 12 hours ago||
Nothing against you personally, just so you know. But I have to point out that anyone caring about the reason for the short coming of flock on stuff like this are just crafting soft reasons they can use to justify things later. Being up front here I care not for their reason because the entire business model is frankly disgusting and an affront to a functioning society. This is the type of tech that evolves into social credit scores and precog crime units, stoping crime before it happens.

At the end of the day your rationalization only affords comfort to those that have a vested interest in this stuff being successful and it needs to be clear to those people driving this that they’re not doing something popular or even good.

hrimfaxi 16 hours ago||||
An explanation is not a justification.
eptcyka 16 hours ago|||
Why stick your neck out, swim upstream to do a good job that will not be recognised as such?

Fix the corporate incentives and engineers will be able to do the right thing without suffering. Not everyone gets the luxury of a secure career doing morally ok things.

TheRealPomax 16 hours ago||
Counterpoint: whoever let this past the QC phase got paid very generously, and everyone involved is ignoring the laws that already exist to combat this, because law enforcement, too, gets paid generously. And the laws that forbid that aren't getting enforced because the police doesn't police the police, and dad has made it perfectly clear that flagrantly ignoring the law is fine if you're in power.
salawat 16 hours ago||
What makes you think QA/QC is paid handsomely? It's a bloody cost center mate, and you can't measure "damage prevented" consistently, or at least in a way most high-risk tolerating exec types won't immediately undermine.

t. Former QA veteran

eddyg 16 hours ago||
Yes, they should be secured so they can only be accessed by law enforcement.

But if your spouse/SO/sister/mother/girlfriend/whatever was assaulted while jogging in a park that had Flock cameras, and it allowed law enforcement to quickly identify, track, apprehend and charge the criminal, you'd absolutely be grateful for the technology. There's nothing worse than being told "we don't have any leads" when someone you care about has been attacked.

542354234235 15 hours ago||
Maybe I’m crazy, but I don’t want laws to be written to the level of my emotional individual reaction to a singular crime. I want laws to reflect the ideals and values of society, and to work at scale when balancing individual freedom, societal safety, and protection from government abuse.

“It is better, so the Fourth Amendment teaches us, that the guilty sometimes go free than the citizens be subject to easy arrest.” - Former Supreme Court Justice William O. Douglas

gs17 15 hours ago|||
They should also require a warrant at least, especially for any data sharing. With "they can only be accessed by law enforcement", we've already had plenty of police harassing their exes. If they couldn't convince a judge to let them use the camera, there's really no hope of the case going anywhere.

> There's nothing worse than being told "we don't have any leads" when someone you care about is attacked.

I'd argue worse is "we know exactly who did it and we're not going to do anything about it (but we would do something if you try to do something about it yourself)".

estimator7292 16 hours ago|||
What about when ICE uses this data to abduct and deport your spouse and family members? Will you be grateful then?
kernal 16 hours ago||
[flagged]
Cornbilly 7 hours ago||
Are you grateful for all of the legal immigrants and citizens that ICE has swept off the streets?
dexwiz 15 hours ago|||
Until your spouse/SO/sister/mother/girlfriend spurns a LEO, and then the LEO uses it to stalk and harass them. Talk to any LEO, they constantly misuse their data access to look up friends/family/neighbors to find dirt. Most of the time its relatively harmless gossip, but it can easily be used to harass people.
thedougd 14 hours ago|||
I'll make up another one to pile on. Perhaps the police would have had a visible, deterrent presence if they weren't lazily relying on cameras, and that would have prevented the assault in the first place.

Anyhow, if you read the flock database, they're overwhelmingly not using them for the purposes of public safety or random crime.

JKCalhoun 14 hours ago||
"…they're overwhelmingly not using them for the purposes of public safety or random crime."

That would seem to be very relevant information.

array_key_first 5 hours ago|||
If your argument has to start with "now, imagine your sister was raped", then it's probably just a bad argument.

Appealing to emotions, tsk tsk, but going right for the jugular? Yikes.

Also, elephant in the room: if your sister was going to be raped or beaten, it would probably be by someone in her home, in her family. Like her cop husband.

kelnos 14 hours ago|||
Ah yes, the good ol' appeal to fear. "Think of the childr--err, I mean poor defenseless woman!"

No, I don't want these cameras. I don't care if they make law enforcement's job easier. They are an invasion of privacy and a part of the disgusting dragnet surveillance state.

They need to go.

A decade ago, I was attacked on a public sidewalk by three men, who roughed me up a bit and stole from me. The police were utterly unhelpful, and as far as I know, they never caught anyone. But ultimately, that didn't really matter. I was traumatized for a while, but eventually worked through it. Whether or not they were caught would not have changed any part of that process.

I get that, emotionally, we want some sort of justice when things like this happen, but I am not willing to put up with even more constant surveillance in order to feel a little bit better about a bad thing that happened to me. I would much rather criminals sometimes went free.

SunshineTheCat 14 hours ago||
Yea I've never been a fan of the whole "makes law enforcement's job easier" arguments.

As though personal rights/liberties are trumped by a cop needing to do paperwork or leave his desk.

Plus, when you follow this to its natural/extreme conclusion, the absolute easiest thing for law enforcement would be to arrest you for no reason at all.

The rationalization for this policy of course could simply be that probable cause is "inconvenient."

tediousgraffit1 15 hours ago|||
"Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety."
LeFantome 14 hours ago|||
This is true of course. You could also apply this logic to even the most extreme of fascist tendencies though.

There is freedom to and freedom from as they say in The Handmaid’s Tale.

fzeroracer 15 hours ago|||
What if your spouse/SO/whatever was wrongfully arrested because they were on a Flock camera and conveniently matched what the police were looking for? Or if they ran whatever dogshit AI algorithm over it looking for suspects?

We can make up situations all day where it can or can not be validated but the reality is that this is a defacto surveillance state. If every move you make can be monitored, you should assume that the state can and will abuse it to hurt innocent people in the name of politics or whatever.

gs17 15 hours ago||
Or if they were simply being harassed because their ex was a cop who decided to use the cameras to stalk them, where there's not even an excuse.
kgwxd 15 hours ago||
What's the point of making a statement like that? Is it like a Snapple cap thing, or do you expect people to actually give up on talking about the blatant government overreach?

And what a dumb way to frame it. "Think of the woman" is the same argument as "think of the children". Why not just say if you were attacked you'd want it to be on camera? Afraid it'll make you sound weak? Well, so does bootlicking.

GaryBluto 15 hours ago||
I'm not sure if it's better or worse to have it publicly accessible or only accessible to an elite group.
bromuk 17 hours ago||
Really great investigation, what's the URL of the "vibe coded" site with the access links?
monkaiju 16 hours ago||
i guess that while it is alarming that these feeds were "unsecured" I'm just as concerned that they exist at all. Folks worry about it getting into the "wrong hands" but from my POV it was put up by the wrong hands.

While both are a problem I am far more concerned about the power this gives our, increasingly authoritarian, government than about individual stalkers/creeps.

btbuildem 14 hours ago||
glock > flock

Is mass vandalism the final answer to this problem?

kjkjadksj 10 hours ago||
Flock cameras would be so easy to disable by motivated people. Dress in nondescript clothing, mask, sunglasses, and just spraypaint over the lenses. This is completely asymmetric warfare because it is trivial how long it would take for you to do this. You could hit dozens of cameras across an area overnight. Meanwhile, flock or the city, whoever maintains this stuff, needs to identify the vandalized cameras, flag them for repair, pay a technician to go out and presumably repair the unit outright. You pay cents and they are paying potentially thousands in labor and hardware costs.

And this would absolutely work at scale too. Streetlights are already being vandalized for their copper and most cities cannot afford to hire more technicians to even keep up with streetlight repair. I believe I’ve seen the backlog for streetlight repair in LA is over 10x what the current street services crew is capable of repairing in a year of constant work and growing by the day.

Municipalities and these technology companies cannot keep up against a motivated crew and can’t afford to scale either. Totally asymmetric.

mothballed 9 hours ago|
The initial disabling might be asymmetric but when/if you're caught you go to jail for years for something that cost the state maybe an hour tops to fix.

Therefore if only say one of a thousand gets caught, it still costs the people doing it more than the state on average (unless their life/time is worth basically nothing for years on end).

vatsachak 16 hours ago|
You could kinda already do this with all kinds of security cameras. There are only so many people who are computer proficient, and that number is lower than the number of camera installers.

There have been cases of people getting into baby monitors and yelling at the baby.

But as a tech company, this is extremely irresponsible

BTW, Benn Jordan is also known as The Flashbulb, an ambient legend

More comments...