One roadside Flock unit produced about 1.6 million images in three weeks. The software on it was built to notice people, bicycles, and bumper stickers. On-device encryption did not survive contact with the device.
Flock Safety sells cities a simple story. The box on the pole reads plates. It helps find stolen cars and missing people. The sensitive work happens behind encryption. Your Tuesday errand is not a dossier.
A collective that calls itself stegan0gram took that story apart with a ladder. They pulled a camera off a roadway mount, copied what was on it, and handed the disk image to 404 Media and Distributed Denial of Secrets. WIRED joined the analysis. The most sensitive vault on the unit stayed locked. Enough of the rest opened to make the marketing copy look thin.
An unencrypted partition labeled “media” held a key. That key unlocked a store of short clips and stills. Logs covering about 21 days showed roughly 50,200 vehicles and about 1.6 million images. A busy day cleared 4,400 cars. A typical pass generated something like 28 frames. Some vehicles triggered more than a hundred. The camera cropped what it liked and pushed a packet over cellular. Plate reading and vehicle attributes appear to finish on Flock’s servers. The pole is not a dumb sensor. It is a small computer running Android, a stack of Flock apps, and models that do more than look for a rectangle of stamped metal.
People were in the model, even when they were not the pitch
This is the part that should follow every city-council slide. The recovered software does not only look for cars and plates. It looks for people and bicycles. When it thinks it sees a person, it records where in the frame and how sure it is. WIRED ran the extracted models. They found people. They found a reporter in a selfie. Across 27,321 one-to-two-second clips from that roadside unit, people showed up in 11 files, all of them on motorcycles. No working facial-recognition package turned up in the slice researchers could open. Detection is not identification. Detection is also not “we only read plates.”
The models sometimes treated a bumper sticker or a dealer frame like a plate. In one case they isolated an American flag patch on a saddlebag. That is what computer vision does when you point it at public roads and ask it to harvest signal. It does not share the city’s theory of the product. It shares the training objective.
Flock has talked about on-device encryption as the reason a stolen or seized camera is not a privacy event. Physical possession of this unit produced a key that was sitting on the device. That is not a remote breach of Flock’s cloud. It is worse, in a quieter way. The threat model for a camera on a public pole includes a person with a wrench. If the key lives next to the footage, “encrypted at rest” is a sentence about a lock whose spare is taped to the door.
The company called the removal illegal, said it did not have enough detail to evaluate every claim, and noted the findings did not arrive through its official disclosure channel. All of that can be true at once. None of it answers whether a police contractor should store a month of a town’s driving life on a box a teenager can reach with a truck and a socket set. DDoSecrets co-founder Emma Best put the structural point in one line: mass surveillance gear is catnip for abusers, incompatible with ordinary privacy, and permanently available for physical or electronic intrusion. You can dislike the method and still need the sentence.
Missouri did not wait for the next pole
The same week, Missouri Governor Mike Kehoe signed Executive Order 26-18. The user brief called it a bill. The document on file is an order that binds state agencies and state-funded local police until the General Assembly writes a statute. That distinction matters for lawyers. It does not matter much for the person whose Civic crossed a Flock gantry on the way to work.
Kehoe said the quiet part governors usually leave to activists. Unchecked collection and indefinite storage of law-abiding people’s location data raises constitutional problems. The state should not keep a permanent record of where Missourians go, who they visit, or how they live. The order sets a floor: delete most plate and vehicle images within 30 days unless they are tied to an active criminal investigation or a life-safety emergency. Vendors may not sell, share, or commercialize Missouri-generated data. Access is limited to criminal-justice and lifesaving uses. Misuse triggers discipline, a possible criminal referral, and a report that can reach an officer’s license. And no state-funded agency may bolt AI facial recognition onto an ALPR stack to screen faces in the wild.
That last clause is the one the Flock teardown makes less abstract. The recovered code was already scoring people in the frame. A ban on “integration” of face recognition is necessary. It is not sufficient if the camera is already running a person detector and shipping crops to a server you do not control. Prohibiting the next model does not audit the current one. Cities that signed Flock contracts on the “plates only” brochure need a contractual right to inspect what the firmware actually classifies.
Thirty days is also not amnesia. A network of cameras can rebuild a week of someone’s life in an afternoon if the retention clock resets every time a new pole comes online and agencies share queries across jurisdictions. The order tries to stop commercial resale of Missouri captures. Good. The harder problem is law-enforcement sharing that never looks like a sale and still produces a map.
What “more data than disclosed” actually means
Flock is in more than 6,000 U.S. communities. The company has spent the year absorbing contract fights, misuse scandals, and a legislative weather system that finally noticed the poles. The teardown does not prove Flock built a secret face-search product on this unit. Researchers did not find that tool in the unlocked slice. Claiming they did would be sloppy.
What the files do show is a gap between the public description and the onboard software. The public description is license plates. The software is vehicles, plates, bicycles, people, confidence scores, bumper graphics, and a firehose of frames — 1.6 million from one camera in three weeks — before the interesting attributes are finished in the cloud. If your city council was told the device is a plate reader with encryption, the council was not briefed on the product that was installed.
That is a procurement failure as much as a hacker story. Police vendors get away with capability drift because the contract describes an outcome (hot-list hits) and not a processing inventory (every class the model emits, every crop that leaves the device, every key that lives in an unlocked partition). Privacy officers who would demand that inventory from a SaaS HR tool still wave through a camera network because it arrives in a public-safety wrapper.
Do not copy the break-in. Copy the questions.
Stealing a camera is a crime. Publishing a cookbook for the next crew would be a gift to the wrong reader. The useful residue is the question list cities should have asked before the first pole went up.
Where do keys live, and what happens if the housing comes off the arm? What classes does the on-device model emit today, not in the sales deck? Are person detections stored, uploaded, or discarded? How many frames per vehicle leave the curb? Who can query the server-side archive, including agencies in other states? What is the real deletion date, not the policy date? Can the vendor add a face module by firmware without a new vote?
Missouri’s order is a start on retention, purpose limitation, vendor commercialization, and face-recognition add-ons. It is a stopgap, and Kehoe said so. Legislatures that want the rule to outlive a governor have to put the same limits in statute and attach audit logs that a civilian reviewer can read. Police departments that want the tool for stolen cars can have it without keeping a rolling portrait of the commute.
The hackers said they would explain how they got in. Cities do not need that essay. They need to treat a camera on a public pole as a computer that will be stolen, cloned, and read. If the only thing that made the data “protected” was a key stored on the same disk, the protection was a press line. The 1.6 million images were the product.