Lawmakers say stolen police logins are exposing Flock surveillance cameras to hackers

Lawmakers Call for FTC Investigation Into Flock Safety Over Cybersecurity Concerns

Lawmakers are urging the Federal Trade Commission to investigate Flock Safety, a company that operates license plate-scanning cameras, for allegedly failing to implement cybersecurity protections that leave its camera network vulnerable to hackers and spies.

In a letter sent by Sen. Ron Wyden and Rep. Raja Krishnamoorthi, they call on FTC chairman Andrew Ferguson to look into why Flock does not enforce the use of multi-factor authentication (MFA), a security measure that can prevent unauthorized access by individuals with knowledge of an account holder’s password.

While Flock offers law enforcement customers the option to enable MFA, the company does not make it a requirement. This lack of security protocol could potentially allow hackers or foreign spies to access law enforcement-only areas of Flock’s website and search through the billions of photos of Americans’ license plates collected by the company’s cameras.

Flock operates a vast network of cameras and license plate readers across the U.S., providing access to over 5,000 police departments and private businesses. These cameras capture license plate data, allowing authorized users to track vehicle movements and search through the collected photos.

Wyden and Krishnamoorthi raised concerns about the security of Flock’s system after discovering evidence that some law enforcement customers’ logins had been compromised and shared online. Reports from cybersecurity company Hudson Rock and independent researcher Benn Jordan highlighted potential risks to user data.

Following inquiries from lawmakers, Flock revealed that they had enabled MFA by default for new customers starting in November 2024. However, around 3% of law enforcement customers have chosen not to activate this security feature, citing unspecified reasons.

When contacted for comment, Flock’s chief legal officer Dan Haley emphasized that the majority of law enforcement customers have implemented MFA. However, specific details about the remaining customers who have not activated MFA were not provided.

Recent incidents, such as the unauthorized use of a local police officer’s password by the U.S. Drug Enforcement Administration to access Flock’s cameras, have raised concerns about the potential misuse of the company’s technology. The Palos Heights Police Department took action to enable MFA following this breach.