Flock Told the Press It Runs 120,000 Cameras. Its Own Data Says Over 170,000.

Flock Safety told reporters this summer that it operates more than 120,000 cameras nationwide. A map published September 23 by security researcher Joshua Michael, built from Flock's own location database, puts the real count at more than 170,000 cameras, plus over 130,000 supporting devices, for a total of 335,701 mapped locations.

The token nobody had to ask for

Michael's method did not involve a stolen password. He found that Flock's site was handing out an access token to any visitor, no login required, that could query ArcGIS, the mapping platform Flock uses to plot its devices. He emailed Flock on November 13, 2025, describing what he'd found and stressing that his testing was, in his words, "strictly non-intrusive, limited to open unauthenticated endpoints, and did not involve bypassing authentication, modifying data, or invoking any billable ArcGIS or Google operations."

Flock did not reply. Michael followed up the next day, then a third time days later. Only then did a representative respond: "Thank you for the findings. We are internally triaging them and will reach back out with next steps soon." He says that was the last word he heard from the company. In December 2025 he downloaded the device location data himself. Flock patched the flaw in January 2026, after Michael published a technical writeup of what he'd found.

“That leaves two possibilities. Either they knew and chose not to disclose it for fear of bad press, or they didn't know I exfiltrated the data at all. The first is a transparency failure. The second is a detection failure with national security implications.”

A no-breach claim published the same month

That same January, Flock published its own blog post stating the opposite of a breach: "Flock has never been hacked, and there has not been a leak of Flock information. Flock Safety's cloud platform has never experienced a data breach." The company had been told about the open token two months earlier and had already gone silent on the report. Michael's data pull does not fit the word hacked in its usual sense, since no password was bypassed, but an unauthenticated token that lets any visitor download a company's full device inventory is not nothing either. Flock has not disputed that the token existed or that Michael retrieved data through it.

An American Civil Liberties Union report, cited by The Intercept in its reporting on the map, found what it called a pattern of Flock "regularly misleading or even lying about its business practices, safety record, commitment to privacy, and efforts to protect vulnerable populations." Flock's camera-count gap fits that pattern without needing a new investigation to prove it. It just needed someone to count.

What checking the map actually showed

The Intercept visited six locations in Arizona pulled at random from Michael's map and found a Flock camera at each set of coordinates. The dataset also names individual devices as Flock's own system labels them. One camera, named "FBI Pilot Camera" in Flock's database, sits at the J. Edgar Hoover Building, the FBI's headquarters in Washington. Another cluster of 860 devices sits outside Chicago O'Hare International Airport, tied to the Rosemont Public Safety Department. Those are two data points out of 335,701, but they are two more than a company denial usually gets checked against.

The reply this week was a lawyer

Michael's findings were cited September 23 at a Senate Subcommittee on Crime and Counterterrorism hearing on Flock. The next day, he was notified that Doppel, describing itself as an AI-native social engineering defense platform and acting on Flock's behalf, had filed a trademark infringement complaint over his site's name, the Flock Surveillance Map. Doppel's complaint argues the name may cause "customer confusion or harm" and asks that the site come down, this despite a pop-up disclaimer Michael added stating the site is not affiliated with or endorsed by Flock.

Michael told The Intercept the stakes go past brand confusion. "These cameras form a nationwide surveillance network that tracks where everyone drives," he said, "so foreign nations don't need to send spies to harm our country. They can simply watch where our soldiers, federal agents, and politicians go." Flock has answered that argument with a legal filing over a name, not a figure for how many cameras it actually runs.