On September 16, 2026, a joint investigative report by Wired, 404 Media, and independent security researcher Micah Lee sent shockwaves through the American municipal surveillance ecosystem. The investigation, based on raw firmware images published by transparency collective Distributed Denial of Secrets (DDoSecrets), revealed that automated license plate recognition (ALPR) vendor Flock Safety deployed thousands of public surveillance cameras riddled with catastrophic hardware vulnerabilities and hardcoded credentials.
Flock Safety has become one of the fastest-growing surveillance monopolies in the United States, operating an estimated 40,000 solar-powered ALPR cameras across municipal police departments, homeowners associations, and commercial parking centers. The system captures license plates, vehicle color, bumper stickers, and rooftop luggage configurations, indexing billions of civilian journeys monthly into a searchable nationwide cloud repository.
According to disclosure documents, a hacker collective calling itself 'stegan0gram' physically detached in-use Flock hardware from utility poles in Wauwatosa, Wisconsin, and successfully decapsulated the cameras' flash memory chips. In an interview with 404 Media, the group explained: 'Why just destroy surveillance cameras when we can reverse-engineer them and discover the secrets of those spying on us?'
Independent forensic auditing of the extracted partitions revealed systemic architectural negligence. The roadside surveillance units were running an obsolete, end-of-life build of Android 8.1 (Oreo) with Linux kernel patches dating back to 2018. Because Android 8 lacks modern memory tagging, eBPF containment, and strict seccomp filtering, physical access to the device immediately exposes underlying buses.
More alarming was the presence of hardcoded credentials baked directly into system binaries. Analysts discovered static cryptographic private keys, hardcoded administrative passwords for debug interfaces, and unauthenticated local Real-Time Streaming Protocol (RTSP) camera feeds. Furthermore, vehicle tracking telemetry transmitted over internal Quectel cellular modems communicated with cloud brokers using shared service certificates.
Security experts warned that an attacker possessing these credentials could effortlessly intercept raw vehicle footage from nearby cameras, spoof fake license plate detections to manufacture fraudulent police hotlist alerts, or pivot from roadside hardware into Flock's central cloud coordination cluster.
The revelation has galvanized privacy advocates and federal lawmakers. The Electronic Frontier Foundation (EFF) issued an urgent advisory urging city councils to immediately suspend Flock contracts, citing systemic violations of basic municipal cybersecurity standards and the severe threat of hostile surveillance exploitation.