Security Researcher Maps 300,000 Flock Surveillance Devices — Far More Than Company Admitted

A cybersecurity researcher named Joshua Michael has published a detailed interactive map revealing the true scale of Flock Security's nationwide surveillance network — and the numbers dwarf what the company has publicly acknowledged. While Flock told press this summer it operates roughly 120,000 cameras, Michael's map, built from location data pulled directly from Flock's own database, shows more than 170,000 cameras plus over 130,000 additional devices, for a total exceeding 300,000 surveillance units across the United States. The map was cited during a September 24, 2026 Senate Subcommittee on Crime and Counterterrorism hearing focused on Flock.

Unlike crowd-sourced mapping projects such as DeFlock, which rely on user-submitted sightings, Michael's methodology is more rigorous and more damning: he discovered in November 2025 that Flock's servers were publicly leaking an access token — obtainable without logging in — that allowed anyone to query Flock's ArcGIS geographic database and retrieve precise device locations. He archived the full dataset in December 2025. The map color-codes device types, including Flock's Falcon cameras and Picard processing units, and the accompanying searchable dataset lists each device by name. Among the entries: a camera labeled 'FBI Pilot Camera' located at the J. Edgar Hoover Building in Washington, D.C., and a unit labeled 'C-F-23 FOXTROT MALE HOLDING 2/SHOWERS' at the Silverdale Detention Center in Chattanooga, Tennessee. One Chicago suburb — Rosemont, near O'Hare International Airport — hosts 860 Flock devices alone.

Michael alerted Flock to the vulnerability in a November 13, 2025 email, stressing his approach was non-intrusive and involved only open, unauthenticated endpoints. After two follow-ups with no substantive response, he eventually received a brief acknowledgment promising next steps — which never came. He published a detailed technical blog post in January 2026; Flock appears to have quietly patched the vulnerability afterward. Yet just weeks later, Flock published its own blog post flatly denying any data breach had ever occurred, claiming its cloud platform had never been compromised. Michael says that assertion is directly contradicted by the fact that he had already downloaded their device database. He frames the contradiction as either a deliberate transparency failure or a serious detection failure with national security implications — given that the data reveals the movements of soldiers, federal agents, and politicians.

Flock's response to the public map has been legal rather than substantive. On Thursday, a firm called Doppel — which bills itself as an AI-native social engineering defense platform and claims to be acting on Flock's behalf — filed a trademark infringement complaint seeking to take Michael's site offline, arguing the name 'Flock Surveillance Map' could cause customer confusion by invoking the 'FLOCK SAFETY' trademark. Michael had already included a pop-up disclaimer on the site stating it is not affiliated with or endorsed by Flock. The move comes as an ACLU report has separately documented a pattern of Flock misleading the public about its business practices, safety record, and privacy commitments.