Amid mounting concerns about its sprawling surveillance camera network, Flock Security told the press this summer that it operates more than 120,000 cameras nationwide.
asserted
it → mount → cameras
But a new map published Wednesday by a cybersecurity researcher reveals Flock’s nationwide reach is even bigger.
asserted
reach → publish → researcher
Based on location coordinates from Flock’s own database, the map shows more than 170,000 cameras, plus more than 130,000 accompanying gadgets that play a part in the company’s expansive American surveillance network.
asserted
that → base → network
Joshua Michael’s Flock Surveillance Map highlights the locations of what he says are 300,000 Flock surveillance devices spread across the country.
asserted
he → highlight → country
His findings — which were cited in Wednesday’s Senate Subcommittee on Crime and Counterterrorism hearing on Flock — differ from existing maps of Flock’s automated license plate readers in scope and methodology.
asserted
which → cite → scope
Unlike crowd-sourced projects such as DeFlock, which are built on locations submitted by users, the Flock Surveillance Map relies on location data culled from a snapshot, archived by Michael in December 2025, of Flock’s own records.
asserted
Map → source → records
In addition to cameras, it maps supplemental devices — including 27,000 acoustic detection devices, as well as networking equipment that integrates third-party cameras — to illustrate the scale of Flock’s surveillance web.
asserted
that → map → web
“These cameras form a nationwide surveillance network that tracks where everyone drives,” Michael told The Intercept, “so foreign nations don’t need to send spies to harm our country.
asserted
nations → form → country
They can simply watch where our soldiers, federal agents, and politicians go.”
asserted
soldiers → watch → ?
The Intercept visited six random Arizona locations on Michael’s map; each location had a Flock camera present at the indicated coordinates.
asserted
camera → visit → coordinates
The Flock Surveillance Map also color-codes each Flock device according to its model — showing, for instance, whether the device is a Flock camera, known as a Falcon, or an accompanying processing unit known as a Picard.
uncertain
device → cod → Picard
(Flock did not immediately respond to a request for comment.)
asserted
Flock → respond → comment
The accompanying searchable dataset table also lists each camera’s individual name, as outlined in Flock’s database, which typically includes a street address and sometimes other identifying characteristics.
asserted
which → list → address
A camera with the name “FBI Pilot Camera,” for example, is shown to be located at the J. Edgar Hoover Building — the FBI headquarters in Washington.
asserted
camera → show → Washington
The map illustrates Flock’s national spread, but also its clustering in certain areas.
asserted
map → illustrate → areas
For example, 860 Flock devices appear to be concentrated just outside Chicago O’Hare International Airport, at the Rosemont Public Safety Department, which provides police, fire, and emergency medical services in the Chicago suburb.
asserted
which → appear → suburb
Numerous Flock cameras appear to be installed inside detention centers.
asserted
cameras → appear → centers
A camera titled “C-F-23 FOXTROT MALE HOLDING 2/SHOWERS” appears at the coordinates of the Silverdale Detention Center in Chattanooga, Tennessee.
asserted
camera → title → Chattanooga
In November 2025, Michael discovered a novel way to identify the location of Flock’s devices.
asserted
Michael → discover → devices
Trawling the company’s website, he realized that Flock’s servers were publicly leaking data in the form of an access token that could be acquired without needing to log in.
uncertain
that → trawl → token
With that token, Michael said he could query ArcGIS, a third-party geographic information system platform used by Flock, to retrieve the locations of Flock devices.
uncertain
he → say → devices
Michael told The Intercept he promptly contacted Flock and described his findings.
asserted
he → tell → findings
As Michael wrote in his initial email to Flock on November 13, 2025: “all testing was strictly non-intrusive, limited to open unauthenticated endpoints, and did not involve bypassing authentication, modifying data, or invoking any billable ArcGIS or Google operations.”
asserted
testing → write → operations
Michael said he didn’t receive a reply, so he followed up with Flock the next day, and a third time several days later.
asserted
he → say → Flock
After his third attempt to inform Flock of the discovered vulnerability, Michael received a reply from a Flock that said, “Thank you for the findings.
asserted
that → inform → findings
We are internally triaging them and will reach back out with next steps soon.”
asserted
We → triage → steps
Michael said he never heard back about it from Flock.
asserted
he → say → Flock
In December 2025, Michael downloaded the Flock device location data, and in January wrote an in-depth technical blogpost about his what he had found.
asserted
he → download → what
After Michael’s post, it appears that Flock fixed the vulnerability.
asserted
Flock → appear → vulnerability
Despite being alerted of Michael’s findings in November 2025, Flock published its own blogpost the following January saying it hadn’t had any data breaches.
asserted
it → alert → breaches
“Flock has never been hacked, and there has not been a leak of Flock information,” the company claimed.
asserted
company → hack → information
“Flock Safety’s cloud platform has never experienced a data breach.”
asserted
platform → experience → breach
The Atlanta-based startup has faced mounting criticism for its practices and transparency in recent months.
asserted
startup → base → months
An American Civil Liberties Union report found “a pattern of Flock regularly misleading or even lying about its business practices, safety record, commitment to privacy, and efforts to protect vulnerable populations.”
asserted
Flock → find → populations
Michael told The Intercept that Flock’s recent claims about its data security record don’t reflect reality.
uncertain
claims → tell → reality
Flock has publicly claimed multiple times that the company has never experienced a data breach, “and this was after I pulled their database of devices.”
asserted
I → claim → devices
“That leaves two possibilities,” he said.
asserted
he → leave → possibilities
“Either they knew and chose not to disclose it for fear of bad press, or they didn’t know I exfiltrated the data at all.
asserted
I → know → data
On Thursday, Michael was notified that Doppel, which describes itself as an “AI-native social engineering defense platfom,” filed a trademark infringement complaint regarding his site, claiming to be working on Flock’s behalf.
asserted
which → notify → behalf
Doppel says that the site is using the trademark “FLOCK SAFETY” without authorization, which “may cause customer confusion / harm.”
uncertain
which → say → harm
…and 37 more, not listed.
The Aporia
