Flock Safety ALPR Firmware Exposes Human Tracking Capabilities and Broad Data Sharing

What Happened

Independent security investigations, utilizing data recovered from a physically extracted Flock Safety automated license plate reader (ALPR), revealed that the device's on-device software explicitly detects pedestrians and cyclists alongside traditional vehicle and license plate data. Despite manufacturer claims of robust on-device encryption, researchers were able to bypass storage protections using a recovered encryption key to analyze thousands of detection records and embedded machine learning models.

Impact

While the analysis found no active facial recognition capabilities deployed on the examined hardware, the system's ability to consistently log human and vehicle presence enables comprehensive movement profiling. Correlating pedestrian sightings with vehicle telemetry creates granular behavioral histories. Furthermore, investigative findings show that collected data is accessible to thousands of disparate entities, including various municipal, academic, and federal oversight bodies. In Washington DC, internal union complaints revealed that the Metropolitan Police Department leveraged the network to covertly track internal personnel during internal affairs investigations.

What to Do

SecOps and municipal IT administrators must audit deployment scopes and data-sharing agreements associated with automated surveillance infrastructure.

• Review Memorandum of Understanding (MOUs) to restrict third-party agency access to ALPR and optical sensor feeds.
• Perform comprehensive data flow mapping to identify where captured optical data and metadata are stored, processed, and replicated.
• Evaluate physical security controls for roadside camera deployments to prevent hardware extraction and unauthorized firmware analysis.
• Establish strict internal oversight policies regarding the authorized use of municipal sensor data for personnel tracking.