Hackers Pulled 1.6 Million Images From a Flock Camera and Found Its Encryption Key

A physically removed Flock Safety camera has provided an unusually detailed look at what can remain stored inside a modern automated license-plate reader.

According to investigations published by WIRED and 404 Media, a hacker collective dismantled a Flock camera and copied much of its internal storage. Journalists examining the dataset reported roughly 1.6 million images of around 50,000 vehicles collected over 21 days, along with more than 27,000 video clips, logs and an encryption key.

The findings matter for two separate reasons.

First, they reveal how much data a single roadside device can process and retain. Second, they raise a classic security problem: encryption can provide far less protection if the cryptographic key needed to unlock the data is available on the same physically compromised device.

The incident does not mean every Flock camera can be remotely hacked. The reported researchers physically obtained the hardware. But devices mounted in public spaces have to be designed with physical compromise in mind, because roadside equipment is inherently more accessible than a server locked inside a data center.

The camera contained far more than license plates

Flock systems are best known as automated license-plate readers, or ALPRs.

The devices capture passing vehicles and send data into systems that law-enforcement agencies and other customers can search. That makes them useful for identifying stolen cars or tracking vehicles linked to investigations.

The extracted data showed that the device's sensing capability extended beyond a simple cropped plate photo.

WIRED reports that the camera captured large numbers of images around each passing vehicle and could detect people as well as cars. The dataset also included video and detailed logs that helped researchers understand how the device operates.

That does not necessarily mean every captured image is permanently stored in Flock's cloud. It does show that edge devices can temporarily or operationally contain a richer dataset than an outside observer might assume.

For privacy and security teams, that distinction matters.

Encryption is only as strong as key management

Flock has described on-device encryption as part of its security model.

Encryption is important because a stolen storage device should ideally reveal unreadable ciphertext rather than usable surveillance data.

The problem reported by researchers is that they also located an encryption key on the camera.

Cryptographic systems routinely need local keys to function, so the mere existence of key material on hardware is not surprising. The important engineering question is whether those keys are protected in a way that prevents an attacker with physical access from extracting and using them.

Secure elements, hardware-backed key storage and device-bound cryptography are all designed to make that kind of extraction harder.

If a key can be copied from ordinary storage together with encrypted files, the practical value of the encryption can be dramatically reduced.

Physical security is part of cybersecurity

Security discussions often separate cyberattacks from physical attacks, but edge computing devices blur that boundary.

A license-plate camera sits outside, often high on a pole and powered by local equipment or solar hardware. It may communicate wirelessly and operate without constant human supervision.

That creates a very different threat model from a cloud server.

An attacker may be able to steal the device, open the enclosure, clone storage, probe internal interfaces or study firmware offline. Once the hardware is in a lab, the attacker has far more time and control than a remote adversary probing an internet service.

Good edge-device security therefore assumes that some units will eventually be physically captured.

The system should minimize what one stolen device can reveal and make it possible to revoke credentials or keys associated with that unit quickly.

The data also exposes the scale of collection

The numbers are notable even apart from the encryption question.

A single camera reportedly recorded 1.6 million images in 21 days.

That illustrates the difference between a traditional camera viewed occasionally by a human and an automated sensing network. Modern surveillance systems can continuously collect, classify and index observations at a scale that would be impossible to review manually.

That capability can be valuable for legitimate investigations, but it also increases the consequences of poor access control or device compromise.

The more data a sensor collects, the more important data minimization, retention limits and strong audit controls become.

What this incident does not prove

It is important not to overstate the findings.

The researchers did not demonstrate a universal remote exploit that instantly opens every Flock camera. They physically removed a device and reverse-engineered it.

That makes the attack more demanding than sending a malicious packet over the internet.

At the same time, physical access is not a bizarre scenario for infrastructure deployed across public roads. Devices can be damaged, stolen or recovered after decommissioning.

A robust system should expect that eventually some hardware will fall into hostile hands.

The broader lesson for connected infrastructure

The Flock case is a useful reminder for every smart-city and edge-computing deployment.

Security cannot stop at encrypting traffic to the cloud. Operators also need to ask what remains on the device, where keys are stored, how long data persists, whether credentials can be revoked and what happens when the hardware itself is stolen.

As cameras, sensors and edge AI systems become more capable, those questions become more important.

The largest risk may not be one spectacular remote hack. It may be thousands of small devices quietly accumulating valuable data while being treated as if physical access were impossible.

This incident shows why that assumption deserves much more scrutiny.