cross-posted from: https://lemmy.world/post/39883316

Cities: Eugene and Springfield, OR

cross-posted from: https://lemmy.world/post/39835035

Privacy is worth fighting for.

Full story

After residents of a Virginia town complained about AI-powered license plate reading cameras in their community, the head of the company that provided them to the local police department pushed back. His message was defiant.

“Let’s call this what it is: Flock, and the law enforcement agencies we partner with, are under coordinated attack,” Garrett Langley, chief executive of Flock Safety, wrote in an unsolicited email to Staunton Police Chief Jim Williams. “The attacks aren’t new. You’ve been dealing with this forever, and we’ve been dealing with this since our founding, from the same activist groups who want to defund the police, weaken public safety, and normalize lawlessness.”

Langley’s defiance backfired.

Last month, Staunton joined the growing list of cities that are canceling contracts with Flock, amid a growing public backlash over the surveillance technology’s expansion.

City council meetings from Washington state to Massachusetts have been filled with concerned residents, many of whom accuse their local officials of entering into contracts that allow unwarranted spying without their input or knowledge.

Williams, the longtime chief in Staunton, a town of about 25,000 in the Shenandoah Valley where Flock installed six license plate reading cameras in 2024, rejected Langley’s assertion that law enforcement is under attack.

“What we are seeing here is a group of local citizens who are raising concerns that we could be potentially surveilling private citizens, residents and visitors and using the data for nefarious purposes,” Williams wrote to Langley. “These citizens have been exercising their rights to receive answers from me, my staff, and city officials, to include our elected leaders.

“In short,” he said, “it is democracy in action.” Video spurs scrutiny

More than 80,000 Flock cameras are said to be in use throughout the U.S. Flock’s customers include an estimated 5,000 law enforcement agencies and 1,000 corporations.

Scrutiny of the company has intensified since a YouTube video revealed how live feeds from more than 60 cameras were exposed to the open internet.

The video has been viewed more than 953,000 times. Its producer, technologist Benn Jordan, told Straight Arrow News that he sent an email thanking Williams for what he saw as a rational response to Flock’s CEO.

Jordan also expressed concern over Langley’s email, which he believes may have been sent out en masse.

“I realized that Garrett Langley’s original email was unsolicited and impersonal, coming from a ‘no_reply’ address, which suggests that this kind of message is going out to large amounts of law enforcement agencies around the country,” Jordan said. “Intentionally misleading law enforcement and trying to get them to ‘join the fight’ against people critical of your company is incredibly reckless and dangerous.”

“I’ve already had police show up to my house after taking video footage of Flock Safety cameras,” Jordan continued. “How will they approach my house if they have reason to believe that I’m part of a ‘lawless coordinated attack’ on them?”

SAN reached out to Flock with specific questions about Langley’s email and the contract cancellation in Staunton. The company replied only with a link to a page on its website outlining its privacy and ethics guidelines. A clash of values

In Staunton, Williams said the Flock cameras had helped officers locate missing and wanted persons, recover stolen vehicles and identify suspects in crimes.

However, the damage from Langley’s email could not be undone. After Williams met with the city manager and city council to discuss Langley’s remarks, they decided to end the contract with Flock.

In a statement, the city said that Langley’s “narrative does not reflect” Staunton’s values.

“The Staunton Police Department reported numerous successes utilizing this technology,” the statement said. “Unfortunately, the city does not agree with the assessment as detailed by the CEO of Flock Safety.”

The city says it is currently coordinating with Flock to finalize the contract’s termination and to turn off and remove all license plate reading cameras.

‘A new era’

The situation in Staunton is similar to a growing number of others, including in Flagstaff, Arizona, which terminated its contract with Flock in December after a month of pushback from local residents. Despite efforts by police to ease concerns by outlining policy guardrails, the Flagstaff City Council ultimately voted unanimously to end the partnership.

Jan Carlile, a local resident who supported terminating the contract, said during public comment that the potential privacy ramifications were too much to bear.

“I admire and respect the efforts of our police department to try to do the very best they can to protect our safety, and until the advancement of AI and frankly the troubling efforts by our current national administration, both of those can potentially very seriously undercut our privacy as citizens,” Carlile said. “I would not likely have been concerned about the use of cameras as a tool for public safety [in the past], but we are in a new era.”

Cambridge, Massachusetts, initially paused the use of 16 cameras in October. But city officials canceled their contract entirely after it was revealed that Flock had installed two additional cameras without the city’s knowledge.

“Concerns about Flock were substantiated,” said city spokesperson Jeremy Warnick. “Due to this material breach of our trust and the agreement, the city terminated its contract with Flock Safety.”

In Evanston, Illinois, a similar series of events unfolded. After the city terminated its contract in late August and deactivated 19 cameras, Flock began reinstalling cameras across the city, seemingly unbeknownst to local officials and residents. The city responded in September by issuing a cease-and-desist order against Flock, which said that it would uninstall the cameras.

The controversy came around the same time that an audit by the Illinois Secretary of State found that Flock had violated state law by allowing U.S. Customs and Border Protection access to data collected by its license plate-reading cameras. Flock refuted the charge.

Washington state has also been a hotbed for backlash against Flock. The cities of Redmond and Lynwood deactivated their cameras in November while reevaluating their contracts after complaints from residents. The City Council in Mountlake Terrace unanimously canceled its contract in November, while the capital city of Olympia uninstalled 15 cameras and canceled its pilot program with Flock in December.

I am standing on the corner of Harris Road and Young Street outside of the Crossroads Business Park in Bakersfield, California, looking up at a Flock surveillance camera bolted high above a traffic signal. On my phone, I am watching myself in real time as the camera records and livestreams me—without any password or login—to the open internet. I wander into the intersection, stare at the camera and wave. On the livestream, I can see myself clearly. Hundreds of miles away, my colleagues are remotely watching me too through the exposed feed. Flock left livestreams and administrator control panels for at least 60 of its AI-enabled Condor cameras around the country exposed to the open internet, where anyone could watch them, download 30 days worth of video archive, and change settings, see log files, and run diagnostics.

Unlike many of Flock’s cameras, which are designed to capture license plates as people drive by, Flock’s Condor cameras are pan-tilt-zoom (PTZ) cameras designed to record and track people, not vehicles. Condor cameras can be set to automatically zoom in on people’s faces as they walk through a parking lot, down a public street, or play on a playground, or they can be controlled manually, according to marketing material on Flock’s website. We watched Condor cameras zoom in on a woman walking her dog on a bike path in suburban Atlanta; a camera followed a man walking through a Macy’s parking lot in Bakersfield; surveil children swinging on a swingset at a playground; and film high-res video of people sitting at a stoplight in traffic. In one case, we were able to watch a man rollerblade down Brookhaven, Georgia’s Peachtree Creek Greenway bike path. The Flock camera zoomed in on him and tracked him as he rolled past. Minutes later, he showed up on another exposed camera livestream further down the bike path. The camera’s resolution was good enough that we were able to see that, when he stopped beneath one of the cameras, he was watching rollerblading videos on his phone.

The exposure was initially discovered by YouTuber and technologist Benn Jordan and was shared with security researcher Jon “GainSec” Gaines, who recently found numerous vulnerabilities in several other models of Flock’s automated license plate reader (ALPR) cameras. They shared the details of what they found with me, and I verified many of the details seen in the exposed portals by driving to Bakersfield to walk in front of two cameras there while I watched myself on the livestream. I also pulled Flock’s contracts with cities for Condor cameras, pulled details from company presentations about the technology, and geolocated a handful of the cameras to cities and towns across the United States. Jordan also filmed himself in front of several of the cameras on the Peachtree Creek Greenway bike path. Jordan said he and Gaines discovered many of the exposed cameras with Shodan, an internet of things search engine that researchers regularly use to identify improperly secured devices.

After finding links to the feed, “immediately, we were just without any username, without any password, we were just seeing everything from playgrounds to parking lots with people, Christmas shopping and unloading their stuff into cars,” Jordan told me in an interview. “I think it was like the first time that I actually got like immediately scared … I think the one that affected me most was as playground. You could see unattended kids, and that’s something I want people to know about so they can understand how dangerous this is.” In a YouTube video about his research, Jordan said he was able to use footage pulled from the exposed feed to identify specific people using open source investigation tools in order to show how trivially an exposure like this could be abused.

Last year, Flock introduced AI features to Condor cameras that automatically zoom in on people as they walk by. In Flock’s announcement of this feature, it explained that this technology “zooms in on a suspect exiting one car, stealing an item from another, and returning to his vehicle. Every detail is captured, providing invaluable evidence for investigators.” On several of the exposed feeds, we saw Flock cameras repeatedly zooming in on and tracking random people as they walked by. The cameras can be controlled by AI or manually.
The exposure highlights the fact that Flock is not just surveilling cars—it is surveilling people, and in some cases it is doing so in an insecure way, and highlight the types of places that its Condor cameras are being deployed. Condor cameras are part of Flock’s ever-expanding quest to “prevent crime,” and are sometimes integrated with its license plate cameras, its gunshot detection microphones, and its automated camera drones. Cooper Quintin, senior staff technologist at the Electronic Frontier Foundation, told me the behavior he saw in videos we shared with him “shows that Flock's ambitions go far beyond license-plate surveillance. They want to be a nation-wide panopticon, watching everyone all the time. Flock's goal isn't to catch stolen cars, their goal is to have total surveillance of everyone all the time."

The cameras were left not just livestreaming to the internet for anyone who could find the link, but in many cases their administrative portals were left open with no login credentials required whatsoever. On this portal, some camera settings could be changed, diagnostics could be run, and text logs of what the camera was doing were being streamed, too. Thirty days of the camera’s archive was left available for anyone to watch or download from any of the cameras that we found. We were not able to geolocate every camera that was left unprotected, but we found cameras at a New York City Department of Transportation parking lot, on a street corner in suburban New Orleans, in random cul-de-sacs, in a Lowes parking lot, in the parking lot of a skatepark, at a pool, outside a parking garage, at an apartment complex, outside a church, on a bike path, and at various street intersections around the country. 404 Media did not change any settings on any cameras and only viewed footage.

“This is not the first time we have seen ALPRs exposed on the public internet, and it won't be the last. Law enforcement agencies around the country have been all too eager to adopt mass surveillance technologies, but sometimes they have put little effort into ensuring the systems are secure and the sensitive data they collect on everyday people is protected,” Quintin said. “Law enforcement should not collect information they can’t protect. Surveillance technology without adequate security measures puts everyone’s safety at risk.” It was not always clear which business or agency owned specific cameras that were left exposed, or what type of misconfiguration led to the exposure, though I was able to find a $348,000 Flock contract for Brookhaven, Georgia, which manages the Peachtree Creek Greenway, and includes 64 Condor cameras.

"This was a limited misconfiguration on a very small number of devices, and it has since been remedied," a Flock spokesperson told 404 Media. It did not answer questions about what caused the misconfiguration or how many devices ultimately were affected.

In response to Jordan and Gaines’ earlier research on vulnerabilities in other Flock cameras, Flock CEO Garrett Langley said in a LinkedIn post that “The Flock system has not been hacked. We secure customer data to the highest standard of industry requirements, including strict industry standard encryption. Flock’s cloud storage has never been compromised.” The exposure of these video feeds is not a hack of Flock’s system, but demonstrates a major misconfiguration of at least some cameras. It also highlights a major misconfiguration in its security that persisted for at least days. “When I was making my last video [about Flock ALPR vulnerabilities], it was almost like a catchphrase where I'd say like, ‘I don't see how it could get any worse.’ And then something would happen where you'd be like, wow, they pulled it off. They made it worse,” Jordan said. “And then this is like the ultimate one. Because this is completely unrelated [to my earlier research] and I don’t really know how it could be any worse to be honest.”

In a 2023 video webinar introducing the Condor platform to police, Flock executives said the cameras are meant to be paired with their ALPR cameras and are designed to feed video to FlockOS, a police panel that allows cops to hop from camera to camera in real time across a mapped-out view of their city. In Bakersfield, which has 382 Flock cameras according to a transparency report, one of the Condor cameras we saw was located next to a mall that had at least two Flock ALPR cameras stationed at the entrances to the mall parking lot. Kevin Cox, a Flock consultant who used to work for the Grand Prairie, Texas Police Department, said in the webinar that he built an “intel center” with a high “density” of Flock cameras in that city. “I am passionate about this because I’ve lived it. The background behind video [Condor] with LPR is rich with arrests,” he said. “That rich experience of seeing what happened kind of brings it alive to [judges]. So video combined with the LPR evidence of placing a vehicle at the scene or nearby is an incredibly game changing experience into the prosecutorial chain of events.” “You can look down a tremendous distance with our cameras, to the next intersection and the next intersection,” he said. “The camera will identify people, what they’re wearing, and cars up to a half a mile away. It’s that good.”

In the webinar Cox pulled up a multiview panel of a series of cameras and took control of them, dragging, panning, and zooming on cameras and hopping between multiple cameras in real time. Cox suggested that police officers could either use Flock’s cameras to pinpoint a person at a place and time and then use it to request “cell tower dumps” from wireless companies, or could use cell GPS data to then go into the Flock system to track a person as they moved throughout a city. “If you can place that person’s cell phone and then the Condor video and Falcon LPR evidence, it would be next to impossible to beat that in court,” he said, adding that some towns may just want to have always-on, always recording video of certain intersections or town squares. “There’s endless endless uses to what we can do with these things.” On the webinar, Seth Cimino, who was a police officer at the Citrus Heights, California police department at the time but now works directly for Flock, told participants that officers in his city enjoyed using the cameras to zoom in on crimes. “There is an eagerness amongst our staff that are logged in that have their own Flock accounts to be able to monitor our ALPR and pan tilt zoom Condor cameras throughout the community, to a point where sometimes our officers are beating dispatch with the information,” he said. “If there’s an incident that occurs at a specific intersection or a short distance away where our Condor cameras can zoom in on that area, it allows for real time overwatch […] as I sit here right now with you—how cool is this? We just had a Flock alert here in the city. I mean, it just popped up on my screen!”

This was a great moment to showcase the vulnerability. Reading his own YouTube script in the live footage to prove access is wide open. Unreal!

Staunton announced this afternoon that it will end its contract with Flock Safety and remove the six automated license plate readers installed throughout the city.

While a growing number of local residents have been vocal at City Council meetings about their opposition to the cameras, it was an email from the Flock Safety CEO that appears to have been the final straw in the city’s decision about the future of the ALPR technology.

The unsolicited email, sent on Monday, Dec. 8, to Staunton Police Chief Jim Williams, said that Flock, and the law enforcement agencies they partner with, “are under coordinated attack.”

The email from CEO Garrett Langley was likely intended to give police departments ammunition to fight back against some of the persistent arguments of opponents of the APLR technology related to hackability, sharing data, security and more.

However, Staunton didn’t like the picture Langley painted of those who oppose the technology.

“The attacks aren’t new,” Langley wrote. “You’ve been dealing with this for forever, and we’ve been dealing with this since our founding, from the same activist groups who want to defund the police, weaken public safety, and normalize lawlessness. Now, they’re producing YouTube videos with misleading headlines. They’re also trying to turn a public records process into a weapon against you and against us.”

On Dec. 12, Williams replied to Langley, disagreeing with his assessment.

“As far as your assertion that we are currently under attack,” Williams wrote, “I do not believe that this is so. I have dedicated the last 41 years of my life to serving the citizens of the City of Staunton as a police officer, the last 22 as the police chief. What we are seeing here is a group of local citizens who are raising concerns that we could be potentially surveilling private citizens, residents and visitors and using the data for nefarious purposes.

“These citizens have been exercising their rights to receive answers from me, my staff, and city officials, to include our elected leaders. ln short, it is democracy in action.”

In a statement sent to media and residents this afternoon, the city said that Williams, in consultation with the City Manager and City Council, will move forward to cancel the city’s contract with Flock Safety.

“The City of Staunton wants to make it clear that the Flock Safety CEO’s narrative does not reflect the city’s values,” the statement read.

“The Staunton Police Department reported numerous successes utilizing this technology. Unfortunately, the city does not agree with the assessment as detailed by the CEO of Flock Safety. The Staunton Police Department remains fully committed to public safety through community-based policing, investigative techniques that utilize best practices, and other technology solutions.”

The city said it has already begun discussions with Flock to shut down the service.

“The City of Staunton is currently coordinating with Flock Safety to finalize the contract termination, turn off the license plate readers, and have them removed. In the near future, the city will provide an update with a more specific timeline.”

Staunton resident Aaron Barmer credited organizing for playing a big role in the city’s decision.

“I am very grateful to the many neighbors who’ve led and lit viable paths toward accomplishing today’s victory for all people who live in and visit our notable little city; and I’m grateful to the many neighbors who answered the call to bring heat and admonition to City Council and our city appointees until there was no mistaking the will of the people,” he said.

Another vocal opponent to the Flock technology, Mark Hopp, told AFP that he is thankful that Williams decided to pull the plug on the technology. He would like the city to enact measures to ensure that “rigorous public debate” is offered before surveillance technology is considered in the future.

“I believe this is a huge step in the right direction,” Hopp said. “However, I believe that I speak for the majority of those who have been pushing for this when I say this but we would like an ordinance requiring City Council approval before any surveillance-type technologies are put in place in the City of Staunton.”

The City of Charlottesville also announced this week that its 10 cameras would be removed. The 10 cameras were installed as part of a one-year pilot program that expired in October. In June, Charlottesville disconnected from the national shared network due to concerns about data being potentially used for Immigrations and Custom Enforcement.

CAMBRIDGE, Mass. —

The city of Cambridge, Massachusetts, severed ties with Flock Safety over two of their automatic license plate readers (ALPRs) installed in late November that officials weren't aware of.

Flock is a safety technology company that provides smart cameras, ALPRs, and other services for law enforcement agencies.

In late October 2025, the city council voted to end its agreement with Flock Safety for the license plate readers. As part of that, 16 of Flock's ALPRs that were deployed in the community were deactivated and removed by the city.

According to a city spokesperson, in late November, two cameras were installed by Flock technicians without the city's awareness.

"Due to this material breach of our trust and the agreement, the City terminated its contract with Flock Safety," the spokesperson said.

The city said the two cameras have since been removed.

"The Police Department, Law Department, IT Department, and City Manager’s Office had many meetings, internally and with Flock Safety, to discuss City Council and community concerns raised with the previously approved deployment of Flock’s automatic license plate readers (ALPRs), as well as data privacy and security, and the importance of ensuring Cambridge remains a welcoming and safe city for all of our residents," a Cambridge spokesperson said. "Moving ahead, the City plans to conduct a thorough evaluation of ALPRs in Cambridge and looks forward to re-engaging with the City Council and broader community about this technology."

NewsCenter 5 has reached out to Flock Safety for comment about the Cambridge incident.

Nearly 100 law enforcement agencies across Massachusetts utilize Flock Safety technology, according to a company spokesperson.

The company said each Flock customer "fully owns and controls 100% of its date," and that customers can decide if, when, and with whom to share the information.

"Data is automatically deleted by default after 30 days unless otherwise required by local law or policy," a company spokesperson said.

Cities: Eugene and Springfield, OR

Paywall Bypass Link https://archive.is/tpflz

cross-posted from: https://sh.itjust.works/post/50900400

The legislation would enable $15 million in state surveillance funding to flow to a local nonprofit — a controversial move that could stymie accountability over the use of such surveillance technology.

This type of funding mechanism has become something of a national trend that police agencies are using to grow their access to surveillance tools: route those technologies through private entities like nonprofits that operate beyond democratic control, essentially outsourcing surveillance and policing.

Prominently, the Atlanta Police Foundation funded and built the Atlanta Public Safety Training Center, colloquially known as Cop City, for the Atlanta Police Department; the 501(c)(3) is also the official partner contracting with Flock Safety and providing the city use of the company’s notorious surveillance cameras.

In New Orleans, Project NOLA, a 501(c)(3), has built a large apparatus of more than 200 cameras through donations. News broke earlier this year that the nonprofit was conducting real time facial recognition scans and sending alerts to the New Orleans Police Department, a clear violation of city policy that went unchecked until reporting by The Washington Post revealed the arrangement.

Now, with this pending resolution, Nashville is following the lead of Atlanta, New Orleans, and other cities by leveraging a local nonprofit to build a powerful surveillance infrastructure. Nashville’s version follows the same playbook, but with a local twist that makes it particularly brazen.

A nationwide license plate recognition system tasked with reducing crime is being ousted from communities across the country — forcing local officials to reckon with mounting fears of federal surveillance during President Donald Trump’s second term.

Public safety company Flock Safety has billed its surveillance systems as a program to root out criminal activity on local streets, with its cameras already installed in more than 6,000 municipalities nationally. But as Trump’s deportation campaign brought an increased, forceful presence of federal agents to states across the country, some local officials in predominantly liberal cities and towns now argue the cameras themselves pose the bigger danger for their cities, offering federal law enforcement a back door for tracking residents’ movements.