Hear from the man who says he hacked into Flock cameras

So automatic license plate readers are deployed in almost all Maryland counties. Now a lot of people in Virginia are suing over how much data they collect. They collect a lot of data, which is why it would be really bad if someone could do this. Whether you wanted to watch this footage live in real time or look at footage from a month ago, you could just point and click your way to it like you were watching Netflix. You could even open up the live streams in VLC or cast it to a television. I am joined by Ben Jordan, the security researcher and composer responsible for a series of investigations that exposed some security flaws in Flock cameras. Thank you so much for joining me, Ben. Thanks for having me. All right. So first, real quickly for our audience, what did you get into these cameras? You describe it as like signing into Netflix. What's up with that? Yeah. The video you just showed, I just found some cameras that were streaming live to the Internet. I found them through a specialized search engine for Internet of Things devices like thermostats, IP cameras, stuff like that. And sure enough, I found the Flock interface and was like, are these actually Flock cameras? They turned out to be. And we found about 60 or 70. And I added in 404 Media and some friends to kind of help me find things and make it a little less biased to have multiple people verifying. Flock claimed that they weren't hacked, which is true because they didn't have passwords, but you could literally just log in. It was actually easier than using Netflix. You could just go to the website and see it, but they claimed it was a Verizon misconfiguration, but it was still all of that data being leaked openly on the Internet where you could view 30 days of every single camera's history. And these cameras were Condor cameras. They weren't the ALPRs, so you could actually, they followed people. There's one on a forest trail and it followed people on the trail. There's one in a Woe's parking lot and you were able to see what everybody was buying and then cross-reference their license plates to find out where some of them lived. So that was that one, and the ones previous to that were based on the hardware, where if you had access to the hardware or to where if you climbed up on a pole and pushed a button, what you could access. How has the security community reacted to this and has Flock made any changes since your videos came out? I mean, the security community was kind of floored by it, maybe not surprised. It's very difficult. I mean, Flock claims that they've never been hacked, they've never been breached. They claim to have world-class security, end-to-end encryption. We've independently found differently when reviewing their security posture. That being said, we can't actually access things on the server. Like I can't go up to a Flock camera and start poking the buttons, I can't, without going to jail essentially. And so when they do hire somebody to deal with security issues, they generally make them sign an NDA. But I've also, I've found vulnerabilities that I reported to Flock as recently as a few weeks ago, like just because at the end of the day, people's privacy is more important to me than, you know, owning the company in some sort of online debate or something. Yeah. So the view from inside a Flock camera, what data do they collect? You said they were able to, they're like PTZ cameras, pan, tilt, zoom, you were able to move them. They can detect shapes, right? Shapes of license plates and people. Yeah. Well, the Condor, the PTZ cameras, they literally follow people. They track them mechanically, right? So they, those are very different than the license plate readers. The license plate readers, they do detect people. They don't have facial recognition. They're not that high tech. My bigger worry on the technical side of the camera and stuff like that would be maybe these have a lot of false positives. Maybe they have a higher error rate than we're told, but yeah, they generally get your license plate, convert it into text, store that text, take a picture, store that picture. If they detect a person walking in front of it, they can typically detect person or dog, various objects like a dent on your car or a sticker or something like that. It saves that. And then it sends that to Flock servers by a cell phone SIM card like LTE. And then from there it hosted on a server that the police can access without a warrant for historically they could go back 30 days. Now Flock is apparently changing it to seven days. Yeah. We just had an incident nearby of a stalking incident of using that data to basically do surveillance that was outside of the job capacity of a police officer. You told Cybercrime Magazine in April that you struggle to get people to care about this type of stuff, kind of stuff. A lot of it has changed since April. Now today Axios reporting you have U.S. House candidates who are going to make automatic license plate readers an issue in the midterms. Do you think a lot more people care about this now than they did back in April? Yeah. I mean, in fact, tonight I'm leaving to go to Asheville, North Carolina, because there they have a massive city hall meeting about this. And it's kind of driving the mayoral candidacy, like, you know, it's kind of driving who's going to win that election. You're seeing that all around. It's it's good news that that people are finally paying attention to this. And I don't think that it has much to do with like my messaging as it has to do, you know, from when I was doing these videos and trying to get people to care about it. I think it has a lot more to do with the fact that people didn't realize that the cameras were. They just didn't realize that it was a private company that was tracking a month of their behavior without a warrant, whether they committed a crime or were suspected of a crime or not. So I think people are finally waking up to that. And fortunately, it's very bipartisan to like people on the left and the right are both very angry about it. So now I want to talk about Montgomery County, Maryland. They said, we don't use flock cameras. We use automatic license plate readers that are mainly used to for amber alerts to track missing people. What do you have to say to those jurisdictions who are like, well, we've seen your flock investigations. We're not using flocks. We're using different LPRs for different reasons. Yeah. I mean, there's Axon, there's Burkata, there there's Motorola. There's a whole bunch of them. And the thing is, is when a city gets rid of flock, you can expect a line to form of other vendors that want to take taxpayer money. None of these are good. And first of all, I don't think that we need to be tracking people's license plates, but that's my opinion. And if you have a community that wants that where people agree that they want this service and they feel safer knowing who came in and out of a city or a neighborhood when a horrendous, horrific crime has been committed, that's fair enough. I don't understand why they have to go with a different vendor, why they have to lease a camera or why they have to subscribe to an external private database when you can actually there's plenty of LPRs where you can store the data and store it locally. And then if you get a warrant from a judge, then they can give you a decryption key and then that will give you access to an hour of data. And you could store that for years. But somebody needs to be suspected of a crime and a judge needs to sign off on it and say, yeah, this is this is valid. An amber alert, for example, a judge will happily sign a warrant for an amber alert. But that being said, things like Axon and Verkada, they are a little bit better than Flock because they use the National Crime Information Center. So if they want to track somebody in California from Maryland, then they have to go through that, which means that they need a warrant or an arrest warrant or subpoena, whereas Flock is just kind of if if they agree, if another police department agrees to share their data with the national network on the Flock network, then a warrant isn't involved. And it's kind of the Wild West. And then the mind goes to like, well, could you sue because you if you own your likeness and then they reproduce your likeness without your permission, is that but anyway, we've talked about the cybersecurity problems, the policy, legal problems. Let's get to do a little bit of that. Preview what you're going to say in North Carolina, because now you have House candidates going on the road and they're going to make a pitch to voters. That's probably going to be some kind of policy solution or licensing solution. What would you suggest they pitch? Oh, so in North Carolina, for example, like what I've been working on for about a year is actually a research paper into the efficacy of LPR cameras in general. And a lot of city councils are like, can we have this research? Can we have this research research faster? We have this deadline and it research doesn't really work that way. And so a lot of times I will go and explain what I found and have like an infographic and something like that. And so, yeah, it's just basically been requested before they make the vote that that I show them what I found and that I show them some of the methodology and citations behind it so they know that I'm not just an angry person saying this is bad. I actually have something behind it. But I do think that that's a good approach. And I think one thing that I've I've been saying this entire time is that this situation, along with data centers, is getting people to understand who their local city council members are, who their mayor is. A lot of people don't even know who their mayor is and they're learning who they are and they're trying they're starting to figure out if they're representing their constituents interests or not. And that's actually a really good thing, because I think that this this is one of the first years where people across the country are paying attention to their super local elections, which are the ones that affect their life the most. And, you know, if somebody wants to cut down a flat camera, I always tell them, like, well, instead thinking about that, why don't you think about replacing the person who signed the contract that threw you under the bus with that flat camera? Because that's actually easy to do on a local level. If you support their their opponent in their next election, that means a lot in a city council or a mayoral election. Right. You can't get much more local than your own street corner. All right, Ben Jordan, thank you so much for coming on the show today. That's today's DC Wrap. You can catch more on the Fox local app and at Fox 5 DC on all platforms. You can also find us on the Fox 5 Live Zone every weekday from noon until 2 p.m. I'm Guy Lambert on behalf of producer Joey Bark. Thank you for listening. We'll see you next time.